Async patching in VMware Cloud Foundation (VCF) allows administrators to apply critical updates to components like vCenter Server, NSX Manager, and ESXi outside of the standard VCF release cycle. This guide walks through the process of applying these patches using the Async Patch Tool in an online environment.
✅ Prerequisites
Before starting, ensure:
- Your SDDC Manager appliance has internet access (direct or via proxy).
- You’re using VMware Cloud Foundation 4.2.1 or later.
- You have the latest version of the Async Patch Tool.
- Any older versions of the tool are removed: Shellrm -r /home/vcf/asyncPatchTool
rm -r /home/vcf/asyncPatchTool
🔧 Step-by-Step Process
1. Download the Async Patch Tool
- Log in to the Broadcom Support Portal.
- Navigate to My Downloads > VMware Cloud Foundation > Drivers & Tools.
- Download the latest
vcf-async-patch-tool-<version>.tar.gz.
2. Prepare the SDDC Manager Appliance
- SSH into the appliance using the
vcfuser. - Create the tool directory:
mkdir /home/vcf/asyncPatchTool
- Copy and extract the tool:
tar -xvf vcf-async-patch-tool-<version>.tar.gz
- Set permissions:
chmod -R 755 asyncPatchTool chown -R vcf:vcf asyncPatchTool
3. Configure Access to VMware Depot
- Update tool properties for authenticated access (see KB 390122).
- Use TCP keepalive in your SSH client to avoid timeouts.
4. List Available Async Patches
Navigate to the tool’s binary directory and run:
/home/vcf/asyncPatchTool/bin. ./vcf-async-patch-tool --listAsyncPatch --dubroadcom_support_email
Optional filters:
--sku(e.g., VCF or VCF_ON_VXRAIL)--productType(e.g., ESX_HOST, NSX, VCENTER)--proxyServerfor proxy configurations
5. Enable the Async Patch
Download the input spec (see KB 344935), then run:
./vcf-async-patch-tool -i /path/to/inputspec --du <your_email> --sddcSSOUser <SSO_user> --sddcSSHUser vcf --it ONLINE
For VxRail:
./vcf-async-patch-tool -i /path/to/inputspec --du <your_email> --pdu <dell_emc_email> --sddcSSOUser <SSO_user> --sddcSSHUser vcf --it ONLINE
You’ll be prompted to:
- Confirm tool version
- Join CEIP (Customer Experience Improvement Program)
- Enter passwords for
vcf,root, and SSO accounts
6. Apply the Patch via SDDC Manager UI
- Log into the UI.
- Apply the patch to all workload domains.
- For ESXi upgrades:
- Use custom ISO (baseline clusters)
- Use Lifecycle Manager images (image-based clusters)
7. Deactivate the Patch (Post-Deployment)
Run:
./vcf-async-patch-tool --disableAllPatches --sddcSSOUser <SSO_user> --sddcSSHUser vcf
8. Important Notes
- Starting with VCF 5.2, new workload domains inherit patched versions of vCenter and NSX Manager.
- For earlier versions, reapply patches manually to new domains.
- New hosts added to patched domains must match the async patch version of ESXi.
