Reference Architecture

11 April 2019
vRealize Automation 7.6
Reference Architecture

You can find the most up-to-date technical documentation on the VMware website at:
https://docs.vmware.com/
If you have comments about this documentation, submit your feedback to
[email protected]

VMware, Inc.
3401 Hillview Ave.
Palo Alto, CA 94304
www.vmware.com

Copyright © 2017–2019 VMware, Inc. All rights reserved. Copyright and trademark information.

VMware, Inc. 2
 Contents

vRealize Automation Reference Architecture Guide 4

1 Initial Deployment and Configuration Recommendations 5

2 vRealize Automation Deployment 6

3 vRealize Business for Cloud Deployment Considerations 9

4 vRealize Automation Scalability 10

Configure Manager Service for High Data Volume 12
Distributed Execution Manager Performance Analysis and Tuning 13

5 vRealize Business for Cloud Scalability 14

6 vRealize Automation High Availability Configuration Considerations 15

7 vRealize Business for Cloud High Availability Considerations 18

8 vRealize Automation Hardware Specifications and Capacity Maximums 19

9 vRealize Automation Small Deployment Requirements 22

10 vRealize Automation Medium Deployment Requirements 28

11 vRealize Automation Large Deployment Requirements 34

12 vRealize Automation Multi-Data Center Data Deployments 40

VMware, Inc. 3
vRealize Automation Reference
Architecture Guide

The vRealize Automation Reference Architecture Guide describes the structure and configuration of
typical vRealize Automation deployments. In addition, it provides information about high availability,
scalability, and deployment profiles.

Intended Audience
This information is intended for anyone who wants to configure and manage vRealize Automation. The
information is written for experienced Windows or Linux system users and administrators who are familiar
with virtual machine technology and datacenter operations.

VMware, Inc. 4
Initial Deployment and
Configuration
Recommendations 1
Deploy and configure all VMware vRealize Automation components in accordance with VMware
recommendations.

Keep your vRealize Automation, vRealize Business for Cloud, and vRealize Orchestrator in the same
time zone with their clocks synchronized.

Install vRealize Automation, vRealize Business for Cloud, and vRealize Orchestrator on the same
management cluster. Provision machines to a cluster that is separate from the management cluster so
that user workload and server workload can be isolated.

Deploy Proxy Agents in the same data center as the Endpoint with which they communicate. VMware
does not recommended placing DEM Workers in Remote Data Centers unless there is an express
workflow skill based use case that requires it. All components except the Proxy Agents and DEM Workers
must be deployed in the same Data Center or Data Centers within a Metro Area Network. Latency must
be less than 5 milliseconds, and bandwidth must not be less than 1 GB/s between the Data Centers in the
Metro Area Network.

For more information including a support statement, see the VMware Knowledge Base article Installing
the VMware vRealize Automation on a distributed multi-site instance available at VMware Knowledge
Base Article 2134842.

VMware, Inc. 5
vRealize Automation
Deployment 2
Use the VMware resource recommendations as a starting point for vRealize Automation deployment
planning.

After initial testing and deployment to production, continue to monitor performance and allocate additional
resources if necessary, as described in Chapter 4 vRealize Automation Scalability.

Authentication
When configuring vRealize Automation, you can use the default Directories Management connector for
user authentication, or you can specify a pre-existing SAML based identity provider to support a single-
sign on experience.

If two-factor authentication is required vRealize Automation supports integration with RSASecurID. When
this integration point is configured, users are prompted for their user ID and passcode.

Load Balancer Considerations

Use the Least Response Time or round-robin method to balance traffic to the vRealize Automation
appliances and infrastructure Web servers. Enable session affinity or the sticky session feature to direct
subsequent requests from each unique session to the same Web server in the load balancer pool.

You can use a load balancer to manage failover for the Manager Service, but do not use a load-balancing
algorithm, because only one Manager Service is active at a time. Also, do not use session affinity when
managing failover with a load balancer.

Use ports 443 and 8444 when load balancing the vRealize Automation Appliance. For the Infrastructure
Website and Infrastructure Manager Service, only port 443 should be load balanced.

Although you can use other load balancers, NSX, F5 BIG-IP hardware, and F5 BIG-IP Virtual Edition are
tested and are recommended for use.

See the vRealize Automation documentation for detailed information on configuring load balancers.

VMware, Inc. 6
Reference Architecture

Database Deployment
vRealize Automation automatically clusters the appliance database in 7.0 and later releases. All new 7.0
and later deployments must use the embedded appliance database. vRealize Automation instances
which are upgrading to 7.1 or later must merge their external databases into the appliance database. See
the vRealize Automation product documentation for more information on the upgrade process.

For production deployments of the Infrastructure components, use a dedicated database server to host
the Microsoft SQL Server (MSSQL) databases. vRealize Automation requires machines that
communicate with the database server to be configured to use Microsoft Distributed Transaction
Coordinator (MSDTC). By default, MSDTC requires port 135 and ports 1024 through 65535.

For more information about changing the default MSDTC ports, see the Microsoft Knowledge Base article
Configuring Microsoft Distributed Transaction Coordinator (DTC) to work through a firewall available at
Microsoft Knowledge Base Article 250367.

The IaaS Manager Service host must be able to resolve the NETBIOS name of the IaaS SQL Server
database host. If it cannot resolve the NETBIOS name, add the SQL Server NETBIOS name to the
Manager Service machine /etc/hosts file and restart the Manager Service.

vRealize Automation supports SQL AlwaysON groups only with Microsoft SQL Server 2016. When
installing SQL Server 2016, the database must be created in 100 mode. If you use an older version of
Microsoft SQL Server, use a Failover Cluster instance with shared disks. For more information on
configuring SQL AlwaysOn groups with MSDTC, see https://msdn.microsoft.com/en-
us/library/ms366279.aspx.

Data Collection Configuration

The default data collection settings provide a good starting point for most implementations. After
deploying to production, continue to monitor the performance of data collection to determine whether you
must make any adjustments.

Proxy Agents
For maximum performance, deploy agents in the same data center as the endpoint to which they are
associated. You can install additional agents to increase system throughput and concurrency. Distributed
deployments can have multiple agent servers that are distributed around the globe.

When agents are installed in the same data center as their associated endpoint, you can see an increase
in data collection performance of 200 percent, on average. The collection time measured includes only
the time spent transferring data between the proxy agent and the manager service. It does not include the
time it takes for the manager service to process the data.

For example, you currently deploy the product to a data center in Palo Alto and you have vSphere
endpoints in Palo Alto, Boston, and London. In this configuration, the vSphere proxy agents are deployed
in Palo Alto, Boston, and London for their respective endpoints. If instead, agents are deployed only in
Palo Alto, you might see a 200 percent increase in data collection time for Boston and London.

VMware, Inc. 7
Reference Architecture

Distributed Execution Manager Configuration

In general, locate distributed execution managers (DEMs) as close as possible to the model manager
host. The DEM Orchestrator must have strong network connectivity to the model manager at all times. By
default, the installer places DEM Orchestrators alongside the Manager Service. Create two DEM
Orchestrator instances, one for failover, and two DEM Worker instances in your primary data center.

If a DEM Worker instance must run a location-specific workflow, install the instance in that location.

Assign skills to the relevant workflows and DEMs so that those workflows are always run by DEMs in the
correct location. For information about assigning skills to workflows and DEMs by using the
vRealize Automation designer console, see the vRealize Automation Extensibility documentation.

For the best performance, install DEMs and agents on separate machines. For additional information
about installing vRealize Automation agents, see the vRealize Automation Installing vRealize Automation
documentation.

vRealize Orchestrator
Use the embedded vRealize Orchestrator instance for all new deployments. If necessary, legacy
deployments can continue to use an external vRealize Orchestrator. See
https://kb.vmware.com/selfservice/microsites/search.do?
language=en_US&cmd=displayKC&externalId=2147109 for the procedure to increase the memory
allocated to the embedded vRealize Orchestrator instance.

For best product performance, review and implement configuration guidelines described in the vRealize
Orchestrator Coding Design Guide prior to importing vRealize Orchestrator content into production
deployments.

VMware, Inc. 8
vRealize Business for Cloud
Deployment Considerations 3
Deploy vRealize Business for Cloud, formerly known as vRealize Business Standard Edition, in
accordance with VMware guidelines.

Load Balancer Considerations

Load balancing is not supported for data collection connections. For more information, see Chapter 4
vRealize Automation Scalability. In the vRealize Business for Cloud appliance for user interface and API
client connections, you can use the vRealize Automation load balancer.

VMware, Inc. 9
vRealize Automation Scalability 4
Consider all applicable scalability factors when configuring your vRealize Automation system.

Users
The vRealize Automation appliance is configured for syncing less than 100,000 users. If your system
contains more users, you may need to add memory to vRealize Automation Directories Management. For
detailed information on adding memory to Directories Management, see "Add Memory to Directories
Management" in Configuring vRealize Automation.

Concurrent Provision Settings

VMware has evaluated and tuned default settings in vRealize Automation 7.5. The following defaults
apply to both fresh installations and upgrades to vRealize Automation 7.5.

Default Setting Details

Shortened the Manager Service polling frequency from 10 n RepositoryWorkflowTimerCallbackMilliseconds = 2000

seconds to 2 seconds in ManagerService.exe.config. n MachineRequestTimerCallbackMilliseconds = 2000
n MachineWorkflowCreationTimerCallbackMilliseconds =
2000

Count of objects obtained per polling interval has been n VirtualMachineObserverQueryCount = 100
exposed as a configuration setting and increased from 10 to
100.

Increased vSphere proxy agent polling interval and maximum n workitemTimeInterval = 00:00:05
number of work items. n workitemRetrievalCount = 100
n activeQueueSize = 100

By default, vRealize Automation processes only eight concurrent provisions per endpoint. For information
about increasing this limit, see Configuring vRealize Automation.

Distributed Execution Manager - Workers

VMware recommends that all deployments start with at least two DEM-Workers. In 6.x each DEM-Worker
could process 15 workflows concurrently. This was increased to 30 for vRealize Automation 7.0 and later.

VMware, Inc. 10
Reference Architecture

If machines are being customized through Workflow Stubs, you should have 1 DEM-Worker per 20
Machines that will be provisioned concurrently. For example, a system supporting 100 concurrent
provisions should have a minimum of 5 DEM-Workers.

For more information on DEM-Workers and scalability see Distributed Execution Manager Performance
Analysis and Tuning

Data Collection Scalability

Data collection completion time depends on the compute resource capacity, the number of machines on
the compute resource or endpoint, the current system, and network load, among other variables. The
performance scales at a different rate for different types of data collection.

Each type of data collection has a default interval that you can override or modify. Infrastructure
administrators can manually initiate data collection for infrastructure source endpoints. Fabric
administrators can manually initiate data collection for compute resources. The following values are the
default intervals for data collection.

Table 4‑1. Data Collection Default Intervals

Data Collection Type Default Interval

Inventory Every 24 hours (daily)

State Every 15 minutes

Performance Every 24 hours (daily)

Performance Analysis and Tuning

As the number of resources collecting data increases, data collection completion times might become
longer than the interval between data collection intervals, particularly for state data collection. To
determine whether data collection for a compute resource or endpoint is completing in time or is being
queued, see the Data Collection page. The Last Completed field value might show In queue or In
progress instead of a timestamp when data collection last finished. If this problem occurs, you can
increase the interval between data collections to decrease the data collection frequency.

Alternatively, you can increase the concurrent data collection limit per agent. By default,
vRealize Automation limits concurrent data collection activities to two per agent and queues requests that
exceed this limit. This limitation allows data collection activities to finish quickly without affecting overall
performance. You can raise the limit to take advantage of concurrent data collection, but you must weigh
this option against overall performance degradation.

If you increase the configured vRealize Automation per-agent limit, you might want to increase one or
more of these execution timeout intervals. For more information about how to configure data collection
concurrency and timeout intervals, see the vRealize Automation System Administration documentation.
Manager Service data collection is CPU-intensive. Increasing the processing power of the Manager
Service host can decrease the time required for overall data collection.

VMware, Inc. 11
Reference Architecture

Data collection for Amazon Elastic Compute Cloud (Amazon Web Services), in particular, can be CPU
intensive, especially if your system collects data on multiple regions concurrently and if data was not
previously collected on those regions. This type of data collection can cause an overall degradation in
Web site performance. Decrease the frequency of Amazon Web Services inventory data collection if it is
having a noticeable effect on performance.

Workflow Processing Scalability

The average workflow processing time, from when the DEM Orchestrator starts preprocessing the
workflow to when the workflow finishes executing, increases with the number of concurrent workflows.
Workflow volume is a function of the amount of vRealize Automation activity, including machine requests
and some data collection activities.

This chapter includes the following topics:

n Configure Manager Service for High Data Volume

n Distributed Execution Manager Performance Analysis and Tuning

Configure Manager Service for High Data Volume

If you expect to use a VMware vSphere cluster that contains a large number of objects, for example, 3000
or more virtual machines, modify the manager service config file with larger values. If you do not modify
this setting, large inventory data collections might fail.

Modify the default value of the ProxyAgentServiceBinding and maxStringContentLength settings in

the ManagerService.exe.config file.

Procedure

1 Open the ManagerService.exe.config file in a text editor.

Typically, this file resides at C:\Program Files (x86)\VMware\vCAC\Server.

2 Locate the binding name and readerQuotas lines in the file.

<binding name=”ProxyAgentServiceBinding” maxReceivedMessageSize=”13107200”>

<readerQuotas maxStringContentLength=”13107200” />

Note Do not confuse these two lines with the similar lines that contain the following string: binding
name = "ProvisionServiceBinding".

3 Replace the number values assigned to the maxReceivedMessageSize and

maxStringContentLength attributes with a larger value.

The optimal size depends on how many more objects you expect your VMware vSphere cluster to
contain in the future. For example, you can increase these numbers by a factor of 10 for testing.

4 Save your changes and close the file.

5 Restart the vRealize Automation manager service.

VMware, Inc. 12
Reference Architecture

Distributed Execution Manager Performance Analysis and

Tuning
You can view the total number of in progress or pending workflows at any time on the Distributed
Execution Status page, and you can use the Workflow History page to determine how long it takes to run
a given workflow.

If you have a large number of pending workflows, or if workflows are taking longer than expected to finish,
add more Distributed Execution Manager (DEM) Worker instances to pick up the workflows. Each DEM
Worker instance can process 30 concurrent workflows. Excess workflows are queued for execution.

You can adjust workflow schedules to minimize the number of workflows that start simultaneously. For
example, rather than scheduling all hourly workflows to run at the beginning of the hour, you can stagger
their run times so that they do not compete for DEM resources. For more information about workflows,
see the vRealize Automation Extensibility documentation.

Some workflows, particularly certain custom workflows, can be CPU intensive. If the CPU load on the
DEM Worker machines is high, consider increasing the processing power of the DEM machine or adding
more DEM machines to your environment.

VMware, Inc. 13
vRealize Business for Cloud
Scalability 5
Configure your vRealize Business for Cloud installation for scalability in accordance with VMware
guidelines.

vRealize Business for Cloud can scale up to 20,000 virtual machines across ten VMware vCenter Server
instances. The first synchronization of the inventory data collection takes approximately three hours to
synchronize 20,000 virtual machines across three VMware vCenter Server instances. Synchronization of
statistics from VMware vCenter Server takes approximately one hour for 20,000 virtual machines. By
default, the cost calculation job runs every day and takes approximately two hours for each run for 20,000
virtual machines.

Note In vRealize Business for Cloud 1.0, the default virtual appliance configuration can support up to
20,000 virtual machines. Increasing the limits of the virtual appliance beyond its default configuration
does not increase the number of virtual machines that it can support.

VMware, Inc. 14
vRealize Automation High
Availability Configuration
Considerations 6
If you require maximum system robustness, configure your vRealize Automation system for high
availability in accordance with VMware guidelines.

vRealize Automation Appliance

The vRealize Automation appliance supports active-active high availability for all components except the
appliance database. Starting with the 7.3 release, database failover is automatic if three nodes are
deployed and synchronous replication is configured between two nodes. When vRealize Automation
appliance detects database failure, it promotes a suitable database server to be the master. You can
monitor and manage the appliance database on the vRealize Automation appliance management
interface Cluster tab.

To enable high availability for these appliances, place them under a load balancer. For more information,
see Installing vRealize Automation. Beginning with the 7.0 release, the appliance database, and
vRealize Orchestrator are automatically clustered and available for use.

vRealize Automation Directories Management

Each vRealize Automation appliance includes a connector that supports user authentication, although
only one connector is typically configured to perform directory synchronization. It does not matter which
connector you choose to serve as the sync connector. To support Directories Management high
availability, you must configure a second connector that corresponds to your second vRealize Automation
appliance, which connects to your Identity Provider and points to the same Active Directory. With this
configuration, if one appliance fails, the other takes over management of user authentication.

In a high availability environment, all nodes must serve the same set of Active Directories, users,
authentication methods, etc. The most direct method to accomplish this is to promote the Identity Provider
to the cluster by setting the load balancer host as the Identity Provider host. With this configuration, all
authentication requests are directed to the load balancer, which forwards the request to either connector
as appropriate.

For more information about configuring Directories Management for high availability, see Configuring
vRealize Automation.

VMware, Inc. 15
Reference Architecture

Infrastructure Web Server

The Infrastructure Web server components all support active-active high availability. To enable high
availability for these components, place them under a load balancer.

Infrastructure Manager Service

The manager service component supports active-passive high availability. To enable high availability for
this component, place two manager services under a load balancer. In vRealize Automation 7.3 and
newer, failover is automatic.

If the active manager service fails, stop the Windows service, if it is not already stopped under the load
balancer. Enable the passive manager service and restart the Windows service under the load balancer.
See the Installing vRealize Automation documentation.

Agents
Agents support active-active high availability. For information about configuring agents for high availability,
see the vRealize Automation configuration documentation. Check the target service for high availability.

Distributed Execution Manager Worker

A Distributed Execution Manager (DEM) running under the Worker role supports active-active high
availability. If a DEM Worker instance fails, the DEM Orchestrator detects the failure and cancels
workflows that the DEM Worker instance is running. When the DEM Worker instance comes back online,
it detects that the DEM Orchestrator has canceled the workflows of the instance and stops running them.
To prevent workflows from being canceled prematurely, leave a DEM Worker instance offline for several
minutes before you cancel its workflows.

Distributed Execution Manager Orchestrator

DEMs running under the Orchestrator role support active-active high availability. When a DEM
Orchestrator starts, it searches for another running DEM Orchestrator.

n If it finds no DEM Orchestrator instances running, it starts running as the primary DEM Orchestrator.

n If it does find another running DEM Orchestrator, it monitors the other primary DEM Orchestrator to
detect an outage.

n If it detects an outage, it takes over as the primary instance.

When the previous primary instance comes online again, it detects that another DEM Orchestrator has
taken over its role as primary and monitors for failure of the primary Orchestrator instance.

VMware, Inc. 16
Reference Architecture

MSSQL Database Server for Infrastructure Components

vRealize Automation supports SQL AlwaysON groups only with Microsoft SQL Server 2016. When
installing SQL Server 2016, the database must be created in 100 mode. If you use an older version of
Microsoft SQL Server, use a Failover Cluster instance with shared disks. For more information on
configuring SQL AlwaysOn groups with MSDTC, see Microsoft article https://msdn.microsoft.com/en-
us/library/ms366279.aspx.

vRealize Orchestrator
An embedded highly-available instance of vRealize Orchestrator is supplied as part of the
vRealize Automation appliance.

VMware, Inc. 17
vRealize Business for Cloud
High Availability Considerations 7
Use the VMware vSphere HA feature for the vRealize Business for Cloud Edition appliance.

To configure the VMware vSphere HA feature on the VMware ESXi host, see the vCenter Server and
Host Management documentation.

VMware, Inc. 18
vRealize Automation Hardware
Specifications and Capacity
Maximums 8
Install appropriate components for your configuration and capacity needs on each vRealize Automation
server profile in your environment.

Required Hardware Recommended Hardware

Server Role Components Specifications Specifications

vRealize Automation vRealize Automation CPU: 4 vCPU Same as required hardware

Appliance Services, RAM: 18 GB (See Chapter 4 specifications.
vRealize Orchestrator, vRealize Automation
vRealize Automation Scalability for more
Appliance Database information.)
Disk: 140 GB
Network: 1 GB/s

Infrastructure Core Server Web site, Manager Service, CPU: 4 vCPU Same as required hardware
DEM Orchestrator, DEM RAM: 8 GB specifications.
Worker, Proxy Agent Disk: 40 GB
Network: 1 GB/s

Infrastructure Web Server Web site CPU: 2 vCPU CPU: 2 vCPU

RAM: 8 GB RAM: 8 GB
Disk: 40 GB Disk: 40 GB
Network: 1 GB/s Network: 1 GB/s

Infrastructure Manager Server Manager Service, DEM CPU: 2 vCPU CPU: 2 vCPU*
Orchestrator RAM: 8 GB RAM: 8 GB
Disk: 40 GB Disk: 40 GB
Network: 1 GB/s Network: 1 GB/s
* 4 vCPU if performing more
than 100 concurrent
provisions.

Infrastructure Web/Manager Infrastructure Web/Manager CPU: 2 vCPU CPU: 2 vCPU

Server Server RAM: 8 GB RAM: 8 GB
Disk: 40 GB Disk: 40 GB
Network: 1 GB/s Network: 1 GB/s

VMware, Inc. 19
Reference Architecture

Required Hardware Recommended Hardware

Server Role Components Specifications Specifications

Infrastructure DEM Server (One or more) DEM Workers CPU: 2 vCPU CPU: 2 vCPU*
RAM: 8 GB RAM: 8 GB
Disk: 40 GB Disk: 40 GB
Network: 1 GB/s Per DEM Network: 1 GB/s Per DEM
Worker Worker
* 4vCPU if performing more
than 100 concurrent
provisions.

Infrastructure Agent Server (One or more) Proxy Agent CPU: 2 vCPU CPU: 2 vCPU
RAM: 8 GB RAM: 8 GB
Disk: 40 GB Disk: 40 GB
Network: 1 GB/s Network: 1 GB/s

MSSQL Database Server Infrastructure Database CPU: 2 vCPU CPU: 8 vCPU

RAM: 8 GB RAM: 16 GB
Disk: 40 GB Disk: 80 GB
Network: 1 GB/s Network: 1 GB/s

vRealize Business for Cloud vRealize Business for Cloud CPU: 2 vCPU Same as required hardware
Appliance Appliance services RAM: 4 GB specifications.
vRealize Business for Cloud Disk: 50 GB
Database Server
Network: 1 GB/s

vRealize Automation Recommended Capacity Maximums

The following resource capacity maximum values apply to the vRealize Automation large deployment
profile.

Table 8‑1. vRealize Automation Resource Capacity Maximums

Parameter Maximum Value

Tenant 100

vSphere Endpoints 45*

* Maximum of 25 vCenter agents per
server.

Compute Resources 200

Managed Machines 75,000

Peak Concurrent Request

Constant 100

Bursts 250

Business Groups 5,000 With 10 unique users per business

group and with no user being a member
of more than 50 business groups.

VMware, Inc. 20
Reference Architecture

Table 8‑1. vRealize Automation Resource Capacity Maximums (Continued)

Parameter Maximum Value

Reservations 14,000 With 3 reservations per business

group.

Blueprints

CBP only 6,000

CBP + XaaS 8,000

Catalog Items

Across Tenants 4,000

In a Single Tenant 6,000

User/Group Sync with Default 18 GB

Memory

Number of Users 95,000

Number of Groups 20,000 Each group contains 4 users

including one level of nesting.

User/Group with Memory Increased to

30 GB

Number of Users 100,000

Number of Groups 750 Each group contains 4,000 users

and each user is in 30 groups.

VMware, Inc. 21
vRealize Automation Small
Deployment Requirements 9
A vRealize Automation small deployment comprises systems of 10,000 managed machines or fewer and
includes the appropriate virtual machines, load balancers, and port configurations. The small deployment
serves as a starting point for a vRealize Automation deployment that enables you to scale in a supported
manner to a medium or large deployment.

When deploying vRealize Automation, use the Enterprise deployment process to provide a separate
infrastructure Web site and Manager Service address.

Support
A small deployment can support the following items.

n 10,000 managed machines

n 500 catalog items

n 10 concurrent machine provisions

Requirements
A small deployment must be configured with the appropriate components.

n vRealize Automation appliance: vrava-1.ra.local

n Infrastructure Core server: inf-1.ra.local.

n MSSQL Database Server: mssql.ra.local

n vRealize Business for Cloud appliance: vrb.ra.local

DNS Entries
DNS Entry Points To

vrava.ra.local vrava-1.ra.local

web.ra.local inf.ra.local

manager.ra.local inf.ra.local

VMware, Inc. 22
Reference Architecture

Certificates
The host names used in this table are examples only.

Server Role CN or SAN

vRealize Automation appliance SAN contains vra.va.sqa.local and vra.va-1.sqa.local

Infrastructure Core Server SAN contains web.ra.local, managers.ra.local and inf-1.ra.local

vRealize Business for Cloud Server CN = vrb.ra.local

Ports
Users require access to certain ports. All ports listed are default ports.

Server Role Port

vRealize Automation appliance 443, 8444. Port 8444 is required for the Virtual Machine
Remote Console. Port 8283 is required for access to the
vRealize Orchestrator Control Center.

Administrators require access to certain ports, in addition to the ports that users require.

Server Role Port

vRealize Automation appliance 5480, 8443. Port 8443 is used for advanced identity
management configuration.
VMware Identity Manager to Active Directory: 389, 636, 3268,
3269
VMware Identity Manager to Domain Controller: 88, 464, 135

vRealize Business for Cloud 5480

VMware, Inc. 23
Reference Architecture

Service/System
Server Role Inbound Ports Outbound Ports

vRealize Automation appliance HTTPS: 443 LDAP: 389

Adapter Configuration: LDAPS:636
8443 VMware ESXi: 902
Remote Console Proxy: Infrastructure Core
8444 requires access to
SSH: 22 vSphere endpoint port 443
to obtain a ticket for
vRealize Automation
VMware Remote Console.
appliance management
The vRealize Automation
interface: 5480
appliance requires access
to ESXi host port 902 to
proxy traffic to the
consumer.
Infrastructure Core Server:
443
Kerberos Authentication:
88
Computer Object
Password renewal: 464

Infrastructure Core server HTTPS: 443 vRealize Automation

MSDTC: 135, 1024 - virtual appliance: 443,
65535. For information 5480
about how to narrow this vSphere Endpoint: 443
range, see the Database Infrastructure Core
Deployment section of requires access to
Chapter 2 vRealize vSphere Endpoint Port
Automation Deployment. 443 to obtain a ticket for
VMware Remote Console.
The vRealize Automation
appliance requires access
to ESXi host port 902 to
proxy traffic to the
consumer.
MSSQL: 135, 1433, 1024
- 65535
MSDTC: 135, 1024 -
65535. For information
about how to narrow this
range, see the Database
Deployment section of
Chapter 2 vRealize
Automation Deployment.

VMware, Inc. 24
Reference Architecture

Service/System
Server Role Inbound Ports Outbound Ports

MSSQL database server MSSQL: 1433 Infrastructure Core Server:

MSDTC: 135, 1024 - 135, 1024 to 65535. For
65535. For information information about how to
about how to narrow this narrow this range, see the
range, see the Database Database Deployment
Deployment section of section of Chapter 2
Chapter 2 vRealize vRealize Automation
Automation Deployment. Deployment.
MSDTC: 135, 1024 -
65535. For information
about how to narrow this
range, see the Database
Deployment section of
Chapter 2 vRealize
Automation Deployment.

vRealize Business for Cloud appliance HTTPS: 443 vRealize Automation

SSH: 22 virtual appliance:443

vRealize Automation Infrastructure Core:443

appliance management
interface: 5480

Global Catalog Global Catalog: 3268,

3269

VMware, Inc. 25
Reference Architecture

Minimum Footprints
Figure 9‑1. Minimum footprint for small configuration of vRealize Automation
Not Shown:
Users All Infrastructure systems
require access to Port 5480
of all vRealize Appliances for
443,8444, 8283 Log Collection (vRA >
Cluster >Collect Logs on
Virtual Appliance:5480) to function.
vRA Virtual Appliance DNS Entry
vrava.ra.local For Virtual Machine Remote
Console, vRealize Appliance
requires access to VMware
ESXi Port 902, and Infrastructure
vRA Virtual Appliance Core Server requires access
vrava-1.ra.local to vSphere Endpoint Port 443.

Infrastructure Web Infrastructure Web

DNS Entry DNS Entry
web.ra.local manager.ra.local

Infrastructure Core
lnf-1.ra.local

*135
1433
*1024 – 65535

Fabric

SQL Database
Server
Small-
mssql.ra.local

*Please see Database Deployment section for information on how to narrow this range
In addition, bi-directional communication is required.

VMware, Inc. 26
Reference Architecture

Figure 9‑2. Minimum footprint for small configuration of vRealize Business for Cloud

Infrastructure Web vRa Virtual

DNS Entry Appliance DNS Entry
web.ra.local vrava.ra.local

443 443

vRealize Business Standard Virtual Appliance

vrb.ra.local

443 443 443

vCenter Amazon
vCloud
Operations Web vCenter
Director
Manager Services

VMware, Inc. 27
vRealize Automation Medium
Deployment Requirements 10
A vRealize Automation medium deployment comprises systems of 30,000 managed machines or fewer
and includes the appropriate virtual machines, load balancers, and port configurations.

Support
A medium deployment can support the following items.

n 30,000 managed machines

n 1000 catalog items

n 50 machine provisions

Requirements
A medium deployment must meet the appropriate system configuration requirements.

Virtual Appliances
n vRealize Automation appliance 1: vrava-1.ra.local

n vRealize Automation appliance 2: vrava-2.ra.local

n vRealize Automation appliance 3: vrava-3.ra.local

n vRealize Business for Cloud appliance: vrb.ra.local

Windows Server Virtual Machines

n Infrastructure Web/Manager Server 1 (Active Web or DEM-O, Active Manager): inf-1.ra.local

n Infrastructure Web/Manager Server 2 (Active Web or DEM-O, Passive Manager): inf-2.ra.local

n Infrastructure DEM Server 1: dem-1.ra.local

n Infrastructure DEM Server 2: dem-2.ra.local

n Infrastructure Agent Server 1: agent-1.ra.local

n Infrastructure Agent Server 2: agent-2.ra.local

Database Servers
n MSSQL Failover Cluster Instance: mssql.ra.local

VMware, Inc. 28
Reference Architecture

Load Balancers

n vRealize Automation appliance load balancer: med-vrava.ra.local

n Infrastructure Web load balancer: med-web.ra.local

n Infrastructure Manager Service load balancer: med-manager.ra.local

Certificates
The host names that appear in this table are examples only.

Server Role CN or SAN

vRealize Automation appliance SAN contains the following host names:

n vrava.ra.local
n vrava-1.ra.local
n vrava-2.ra.local

Infrastructure Web or Manager server SAN contains the following host names:
n web.ra.local
n manager.ra.local
n inf-1.ra.local
n inf-2.ra.local

vRealize Business for Cloud appliance CN = vrb.ra.local

Ports
Users require access to certain ports. All ports listed are default ports.

Server Role Port

vRealize Automation appliance load balancer 443, 8444. Port 8444 is required for the Virtual Machine
Remote Console.

Administrators require access to certain ports, in addition to the ports that users require.

Server Role Port

vRealize Automation appliance management interface 5480, 8443. Port 8443 is for advanced identity management
configuration.
VMware Identity Manager to Active Directory: 389, 636, 3268,
3269
VMware Identity Manager to Domain Controller: 88, 464, 135

vRealize Appliance Orchestrator Control Center 8283

vRealize Business for Cloud Server 5480

The following table shows inter-application communication.

VMware, Inc. 29
Reference Architecture

Outbound Ports for Service or

Server Role Inbound Ports System

vRealize Automation appliance HTTPS: LDAP:389

Adapter Configuration: LDAPS: 636
8443 vRealize Automationappliance (All
Remote Console other): 5432, 4369, 25672, 5671, 5672,
Proxy: 8444 9300, 40002, 40003
Postgres: 5432 vRealize Automation Infrastructure Web
RabbitMQ: 4369, load balancer: 443
25672, 5671, 5672 VMware ESXi: 902. Infrastructure Web
ElasticSearch: 9300, or Manager requires access to vSphere
40002, 40003 Endpoint port 443 to obtain a ticket for
Virtual Machine Remote Console. The
Stomp: 61613
vRealize Automation appliance requires
SSH: 22
access to ESXi host port 902 to proxy
console data to the user.
Kerberos Authentication: 88
Computer Object Password renewal:
464

Infrastructure Web/Manager Server HTTPS: 443 vRealize Automation appliance load

MSDTC: 135, balancer: 443
1024-65535. For vRealize Automation Infrastructure Web
information about how load balancer: 443
to narrow this range, vRealize Automation appliance: 5480.
see the Database vSphere Endpoint: 443. Infrastructure
Deployment section of Web or Manager requires access to
Chapter 2 vRealize vSphere Endpoint port 443 to obtain a
Automation ticket for Virtual Machine Remote
Deployment. Console. The vRealize Automation
appliance requires access to ESXi host
port 902 to proxy console data to the
user.
MSSQL: 135, 1433, 1024 to 65535. For
information about how to narrow this
range, see the Database Deployment
section of Chapter 2 vRealize
Automation Deployment.

Infrastructure DEM Server NA vRealize Automation appliance load

balancer: 443
vRealize Automation Infrastructure Web
load balancer: 443
vRealize Automation Infrastructure
Manager load balancer: 443
vRealize Automation appliance: 5480.

Infrastructure Agent Server NA vRealize Automation Infrastructure Web

load balancer: 443
vRealize Automation Infrastructure
Manager load balancer: 443
vRealize Automation appliance: 5480.

VMware, Inc. 30
Reference Architecture

Outbound Ports for Service or

Server Role Inbound Ports System

MSSQL Database Server MSSQL: 1433 Infrastructure Web/Manager Server:

MSDTC: 135, 1024 - 135, 1024 - 65535. For information
65535. For information about how to narrow this range, see the
about how to narrow Database Deployment section of
this range, see the Chapter 2 vRealize Automation
Database Deployment Deployment.
section of Chapter 2
vRealize Automation
Deployment.

vRealize Business for Cloud Server HTTPS: 443 vRealize Automation appliance load
SSH: 22 balancer: 443

vRealize Automation vRealize Automation Infrastructure Web

appliance management load balancer: 443
interface: 5480

Global Catalog Global Catalog: 3268, 3269

Load balancers require access through the following ports.

Load Balancer Ports Balanced

vRealize Automation appliance load balancer 443, 8444

vRealize Automation Infrastructure Web load balancer 443

vRealize Automation Infrastructure Manager Service load 443

balancer

VMware, Inc. 31
Reference Architecture

Graphics
Figure 10‑1. Minimum footprint for vRealize Automation medium configuration

Not Shown:
Users All Infrastructure systems
require access to Port 5480
443,8444, 8283
of all vRealize Appliances for
Log Collection (vRA >
Cluster >Collect Logs on
Virtual Appliance:5480) to function.
vRA Virtual Appliance Load Balancer (Port 443, 8444, 8283)
vrava.ra.local For Virtual Machine Remote
Console, vRealize Appliance
443, 8283, 8444 requires access to VMware
443 ESXi Port 902, and Infrastructure
Core Server requires access
vRA Virtual Appliance 1 vRA Virtual Appliance 2 to vSphere Endpoint Port 443.
vrava-1.ra.local vrava-2.ra.local

Ports Required for

Appliances to
Replicate/ 443
Communicate vRA Virtual Appliance 3
4369, 5432, vrava-3.ra.local
5671, 5672,
9300, 25672, 443 443
443
4002, 40003
Infrastructure Web Infrastructure Manager
Load Balancer Load Balancer (Port 443) 443
(Port 443) manager.ra.local
443

443 443 443

443

Infrastructure Web / Infrastructure Web /

Manager Server Manager Server
inf-1.ra.local inf-2.ra.local

Infrastructure Infrastructure Infrastructure

Agent Server 1 Agent Server 2 DEM Server 1
agent-1.ra.local agent-2.ra.local dem-1.ra.local
**Varies
Fabric
443

Infrastructure
vCenter DEM Server 2
Endpoint dem-2.ra.local

**Endpoint communication ports

*135 vary by endpoint design and configuration
1433
*1024 – 65535
Clustered
MSSQL
Database
mssql.ra.local

*Please see Database Deployment section for information on how to narrow this range

In addition, bi-directional communication is required.

VMware, Inc. 32
Reference Architecture

Figure 10‑2. Minimum footprint for vRealize Business for Cloud medium deployment

vRA IaaS Web vRA Virtual Appliance

Load Balancer Load Balancer
web.ra.local vrava.ra.local

443 443

vRealize Business Standard Virtual Appliance

vrb.ra.local

443 443 443

vCenter Amazon
vCloud
Operations Web vCenter
Director
Manager Services

VMware, Inc. 33
vRealize Automation Large
Deployment Requirements 11
A vRealize Automation large deployment comprises systems of 75,000 managed machines or fewer and
includes the appropriate virtual machines, load balancers, and port configurations.

Support
A large deployment can support the following items.

n 75,000 managed machines

n 2500 catalog items

n 100 concurrent machine provisions

Requirements
A large deployment must meet the appropriate system configuration requirements.

Virtual Appliances
n vRealize Automation appliance 1: vrava-1.ra.local

n vRealize Automation appliance 2: vrava-2.ra.local

n vRealize Automation appliance 2: vrava-3.ra.local

n vRealize Business for Cloud appliance: vrb.ra.local

Windows Server Virtual Machines

n Infrastructure Web Server 1: web-1.ra.local

n Infrastructure Web Server 2: web-2.ra.local

n Infrastructure Manager Server 1: manager-1.ra.local

n Infrastructure Manager Server 2: manager-2.ra.local

n Infrastructure DEM Server 1: dem-1.ra.local

n Infrastructure DEM Server 2: dem-2.ra.local

n Infrastructure Agent Server 1: agent-1.ra.local

n Infrastructure Agent Server 2: agent-2.ra.local

VMware, Inc. 34
Reference Architecture

n Clustered MSSQL Database: mssql.ra.local

Load Balancers

n vRealize Automation appliance load balancer: vrava.ra.local

n Infrastructure Web load balancer: web.ra.local

n Infrastructure manager service load balancer: manager.ra.local

Certificates
The host names used in this table are examples only.

Server Role CN or SAN

vRealize Automation appliance SAN contains the following host names:

n vrava.ra.local
n vrava-1.ra.local
n vrava-2.ra.local

Infrastructure Web server SAN contains the following host names:

n web.ra.local
n web-1.ra.local
n web-2.ra.local

Infrastructure manager server SAN contains the following host names:

n manager.ra.local
n manager-1.ra.local
n manager-2.ra.local

vRealize Business for Cloud appliance CN = vrb.ra.local

Ports
Users require access to certain ports. All ports listed are default ports.

Server Role Port

vRealize Automation appliance load balancer 443, 8444,8283 Port 8444 is required for the
VMware Remote Console Port 8382 is required for
vRealize Orchestrator Control Center.

Administrators require access to certain ports, in addition to the ports that users require.

Server Role Port

vRealize Automation appliance 5480, 8283, 8443. Port 8443 is used for advanced identity
management configuration.
VMware Identity Manager to Active Directory: 389, 636, 3268,
3269
VMware Identity Manager to Domain Controller: 88, 464, 135

vRealize Business for Cloud server 5480

VMware, Inc. 35
Reference Architecture

The system must support the appropriate inter-application communication.

Outbound Ports for Service or

Server Role Inbound Ports System

vRealize Automation

vRealize Automation appliance HTTPS: 443 LDAP: 389

Adapter configuration: 8443 LDAPS: 636
Remote console proxy: 8444 vRealize Automation appliance:
Postgres: 5432 5432, 4369, 25672, 5671,5672,
9300, 40002, 40003.
Rabbit MQ: 4369, 25672, 5671,
5672 vRealize Automation infrastructure
Web load balancer: 443
ElasticSearch: 9300, 40002,
40003 VMware ESXi: 902. Infrastructure
Web requires access to vSphere
Stomp: 61613
endpoint port 443 to obtain a ticket
SSH: 22
for VMware Remote Console. The
Control-Center: 8283 vRealize Automation appliance
requires access to ESXi host Port
902 to proxy console data to the
user.
Kerberos Authentication: 88
Computer Object Password renewal:
464

Infrastructure Web server HTTPS: 443 vRealize Automation appliance load

MSDTC: 443, 1024-65535. For balancer: 443
information about how to vRealize Automation appliance
narrow this range, see the virtual appliance: 5480.
database deployment section vSphere endpoint: 443. Infrastructure
of Chapter 2 vRealize Web requires access to vSphere
Automation Deployment. endpoint port 443 to obtain a ticket
for VMware Remote Console. The
vRealize Automation appliance
requires access to ESXi host port
902 to proxy console data to the
user.
MSSQL: 135, 1433, 1024 to 65535.
For information about how to narrow
this range, see the database
deployment section of Chapter 2
vRealize Automation Deployment.

Infrastructure manager server HTTPS: 443 vRealize Automation appliance load

MSDTC: 135,1024-65535. For balancer: 443
information about how to vRealize Automation Infrastructure
narrow this range, see the Web Load Balancer: 443
database deployment section vRealize Automation appliance: 443,
of Chapter 2 vRealize 5480
Automation Deployment. MSSQL: 135, 1433, 1024 to 65535.
For information about how to narrow
this range, see the database
deployment section of Chapter 2
vRealize Automation Deployment.

VMware, Inc. 36
Reference Architecture

Outbound Ports for Service or

Server Role Inbound Ports System

Infrastructure DEM server NA vRealize Automation appliance load

balancer: 443
vRealize Automation infrastructure
Web load Balancer: 443
vRealize Automation infrastructure
manager load balancer: 443
vRealize Orchestrator load balancer:
8281
vRealize Automation appliance:
5480.

Infrastructure agent server NA vRealize Automation infrastructure

Web load balancer: 443
vRealize Automation infrastructure
manager load balancer: 443
vRealize Automation appliance:
5480.

MSSQL database server MSSQL: 1433 Infrastructure Web server: 135,

MSDTC: 135, 1024-65535. For 1024-65535. For information about
information about how to how to narrow this range, see the
narrow this range, see the database deployment section of
database deployment section Chapter 2 vRealize Automation
of Chapter 2 vRealize Deployment.
Automation Deployment. Infrastructure manager server: 135,
1024-65535. For information about
how to narrow this range, see the
database deployment section of
Chapter 2 vRealize Automation
Deployment.

vRealize Business for Cloud server HTTPS: 443 vRealize Automation appliance load
SSH: 22 balancer: 443

vRealize Automation appliance vRealize Automation infrastructure

management interface: 5480 Web load balancer: 443

Global Catalog Global Catalog: 3268, 3269

Load balancers require access through the following ports.

Load Balancer Ports Balanced

vRealize Automation appliance load balancer 443, 8444

vRealize Automation infrastructure Web load balancer 443

vRealize Automation manager server load balancer 443

VMware, Inc. 37
Reference Architecture

Graphics
Figure 11‑1. Minimum footprint for vRealize Automation large configuration

NOT SHOWN
Users All Infrastructure systems require
access to Port 5480 of all vRealize
Appliances for Log Collection
443,8444, 8283 (vRA > Cluster > Collect Logs
on Virtual Appliance:5480)
to function.
vRA Virtual Appliance Load Balancer (Port 443, 8444, 8283) For Virtual Machine Remote Console,
vrava.ra.local vRealize Appliance requires access
to VMware ESXi Port 902, and
443, 8283, 8444 Infrastructure Core Server requires
443 access to vSphere Endpoint Port 443.

Virtual Appliances must be able to

vRA Virtual Appliance 1 vRA Virtual Appliance 2 access the Active Directories which
vrava-1.ra.local vrava-2.ra.local are configured as Directories
for Authentication
Ports Required for
Appliances to
Replicate/
Communicate vRA Virtual Appliance 3
4369, 5432, vrava-3.ra.local
5671, 5672,
9300, 25672, 443
4002, 40003
vRA Infrastructure Web Load Balancer [Port 443]
web.ra.local

443
vRA Infrastructure vRA Infrastructure
Web Server 1 Web Server 2 443
web-1.ra.local web-2.ra.local 443

vRA Infrastructure Manager Load Balancer [Port 443]

manager.ra.local 443

443 443

vRA Infrastructure vRA Infrastructure

Manager Service 1 Manager Service 2
manager-1.ra.local manager-2.ra.local

vRA Infrastructure 443 vRA Infrastructure vRA Infrastructure

Proxy Agent 1 Proxy Agent 2 DEM Server 1
agent-1.ra.local agent-2.ra.local dem-1.ra.local
**Varies
Fabric
443

vRA Infrastructure
DEM Server 2
vCenter dem-2.ra.local

**Endpoint communication ports

*135 vary by endpoint design and configuration
1433
*1024 – 65535
Clustered
MSSQL
Database
mssql.ra.local

*Please see Database Deployment section for information on how to narrow this range
VMware, Inc. 38
In addition, bi-directional communication is required.
Reference Architecture

Figure 11‑2. Minimum footprint for vRealize Business for Cloud large configuration

vRA Infrastructure vRA Virtual Appliance

Web Load Balancer Load Balancer
web.ra.local vrava.ra.local

443 443

vRealize Business Standard Virtual Appliance

vrb.ra.local

443 443 443

vCenter Amazon
vCloud
Operations Web vCenter
Director
Manager Services

VMware, Inc. 39
vRealize Automation Multi-Data
Center Data Deployments 12
vRealize Automation supports managing resources in remote data centers.

To manage vSphere, HyperV, or Xen resources in remote data centers, deploy the proxy agent on a
virtual machine in the remote data center.

Note The diagram below shows a vSphere deployment. Other endpoints require no additional
configuration.

Because vRealize Orchestrator workflows will potentially communicate over a WAN, observe best
practices as stated in the vRealize Orchestrator Coding Design Guide.

Table 12‑1. Required Ports for WAN Communication

Role Inbound Ports Service/System Outbound Ports

vRealize Automation appliance - N/A vSphere endpoint: 443

including embedded ESXi Hosts: 902
vRealize Orchestrator

vRealize Automation Infrastructure Load vRealize Automation Infrastructure Proxy N/A

Balancer Agent: 443

vRealize Automation Infrastructure Web N/A vSphere endpoint: 443

Server

vRealize Automation Infrastructure vRealize Automation Infrastructure Proxy N/A

Manager Load Balancer Agent: 443

vRealize Automation Infrastructure DEM- N/A Endpoint: **varies

worker Servers

* If DEM-workers are installed on the Manager Service machine or another server, these ports must be
open between that machine and the target endpoint.

** The port required to a communicate with an external endpoint varies depending on the endpoint. By
default for vSphere, this is port 443.

VMware, Inc. 40
Reference Architecture

Figure 12‑1. vRealize Automation Multi-Site Configuration

Primary Data Center Remote Data Center

443

vRA Virtual vSphere

Appliances Endpoint

443

vRA Infrastructure ESXi

902
Web Load Balancer Host

443 443

vRA Infrastructure vRA Infrastructure

Web Server Proxy Agent

vRA Infrastructure *DEM-Based

443
Manager Load Balancer Endpoints

vRA Infrastructure
DEM-Worker Servers 443

Varies

VMware, Inc. 41