Deploy OVA/OVF templates using OVF Tool

Download PDF

Recently I had massive problems with deploying some VMware appliances under vSphere 6.5. Independently of the frontend (Host Client, HTML 5 Client, Web Client, C# Client) I was unable to deploy templates in a clean way at all – mostly aborts and “generic system failures” occured.

Mark Brookfield gave me the tip to use OVF Tool instead of a graphical interface. The console utility focusses at importing/exporting OVA/OVF templates between multiple VMware products and is available for Microsoft Windows, Linux und App macOS erhältlich. The tool can be downloaded for free.

Basically, it is executed like this:

$ ovftool [parameter] source target

Major parameters (some are optional) are:

Parameter Function
-n / –name Target VM name
-vf / –vmFolder Folder for storing the VM
–acceptAllEulas Automatically accept EULA
-ds / –datastore Target datastore
-dm / –diskMode Disk provisioning mode (for vSphere: thin, thick or eagerZeroedThick)
–net:NIC-name:portgroup Network binding (portgroup is mapped to NIC name)
–ipProtocol IP protocoll: IPv4, IPv6
–prop Assigning an OVA/OVF parameter (e.g. Root password)
–deploymentOption Selecting a vApp configuration (if supported by template)
–powerOn Turning on VM after provisioning


The target locator needs to have a specific schema I was not aware of at first sight. Some examples for vSphere:

Locator Description
vi://myvcenter/mydatacenter/host/mycluster Arbitrary host of a dedicated datacenter and cluster
vi://admin:admin@myvcenter/mydatacenter/host/mycluster like above, but with fixed login information
vi://myvcenter/mydatacenter/vm/myfolder/myvm Arbitrary datacenter, VM folder and name
vi://myvcenter/mydatacenter/host/myesx Arbitrary ESXi host of a datacenter
vi://myvcenter/mydatacenter/host/myesx/Resources/myresource like above, but with arbitrary resource pool


Additional examples can be found in the utility online help:

$ ovftool -h | less
$ ovftool -h locators | less
$ ovftool -h examples | less

The OVA/OVF source does not need to be stored on the local hard drive, it can also be downloaded from a web server (http://path, https://path) or FTP server (ftp://pfad).

Before deploying a template, it is a good idea to have a look at the available options. For example, this is required to get information about required network interfaces:

$ ovftool --hideEula VMware-vSAN-Witness-201704001-5310538.ova
  Name:        Management Network
  Description: Management Network will be used to drive witness vm traffic

  Name:        Witness Network
  Description: Witness Network will be used to drive witness vm traffic

In this case, valid assignments for the Management Network and Witness Network need to be made. Afterwards, check-out the available properties:

  ClassId:     vsan
  Key:         witness.root.passwd
  Label:       Root password
  Type:        password(7..)
  Description: Set password for root account.

Some are required – like the root password in this example – some are optional. Some OVA/OVF templates also offer deployment options; also called “t-shirt sizes“:

Deployment Options:
  Id:          tiny
  Label:       Tiny (10 VMs or fewer)
  Description: Configuration for Tiny vSAN Deployments with 10 VMs or fewer

               * 2 vCPUs
               * 8GB vRAM
               * 1x 12GB ESXi Boot Disk
               * 1x 15GB Magnetic Disk
               * 1x 10GB Solid-State Disk
               * Maximum of 750 Components

  Id:          normal  (default)
  Label:       Medium (up to 500 VMs)
  Description: Configuration for Medium vSAN Deployments of up to 500 VMs

               * 2 vCPUs
               * 16GB vRAM
               * 1x 12GB ESXi Boot Disk
               * 1x 350GB Magnetic Disk
               * 1x 10GB Solid-State Disk
               * Maximum of 22K Components

  Id:          large
  Label:       Large (more than 500 VMs)
  Description: Configuration for Large vSAN Deployments of more than 500 VMs

               * 2 vCPUs
               * 32GB vRAM
               * 1x 12GB ESXi Boot Disk
               * 3x 350GB Magnetic Disks
               * 1x 10GB Solid-State Disk
               * Maximum of 45K Components

This template offers three fixed configuration sizes – the requirements and use-cases are explained.

The completed commands can look like this:

$ ovftool --acceptAllEulas -ds=NFS-Backup --net:"Management Network"="DPortGroup-MGMT" --net:"Witness Network"="DPortGroup-VSAN" --prop:witness.root.passwd=... --deploymentOption=tiny VMware-vSAN-Witness-201704001-5310538.ova vi://st-vcsa03.stankowic.loc/Stankowic/host/Darmstadt/
Opening OVA source: VMware-vSAN-Witness-201704001-5310538.ova
The manifest validates
Source is signed and the certificate validates
Enter login information for target vi://st-vcsa03.stankowic.loc/
Username: administrator@vsphere.local
Password: ...
Opening VI target: vi://administrator%40vsphere.local@st-vcsa03.stankowic.loc:443/Stankowic/host/Darmstadt/
Deploying to VI: vi://administrator%40vsphere.local@st-vcsa03.stankowic.loc:443/Stankowic/host/Darmstadt/
Transfer Completed

vApp options

If you are receiving an warning such as:

- OVF property with key: 'witness.root.passwd' does not exists.

You might want to have a look at the vApp options pane in the VM configuration. There might be a missing parameter you want to fix before turning on the appliance.


Using the tool I was finally able to deploy additional vApps in my home lab – too bad, that this did not work using one of the plenty frontends. I don’t know whether the root cause for this issue is based in my lab or if it is just an generic issue (bug?). Really need to dig deeper regarding this…

Download PDF