6.5.1

Table Of Contents
The ESXi hosts have no direct access to the virtual volumes storage. Instead, the hosts access the virtual
volumes through an intermediate point in the data path, called the protocol endpoint. The protocol
endpoints establish a data path on demand from the virtual machines to their respective virtual volumes.
The protocol endpoints serve as a gateway for direct in-band I/O between ESXi hosts and the storage
system. ESXi can use Fibre Channel, FCoE, iSCSI, and NFS protocols for in-band communication.
The virtual volumes reside inside storage containers that logically represent a pool of physical disks on
the storage system. On the vCenter Server and ESXi side, storage containers are presented as Virtual
Volumes datastores. A single storage container can export multiple storage capability sets and provide
different levels of service to different virtual volumes.
Watch the video for information about Virtual Volumes architecture.
Virtual Volumes Part 2: Architecture
(http://link.brightcove.com/services/player/bcpid2296383276001?
bctid=ref:video_vvols_part2_architecture)
Virtual Volumes and VMware Certificate Authority
vSphere includes the VMware Certificate Authority (VMCA). By default, the VMCA creates all internal
certificates used in vSphere environment. It generates certificates for newly added ESXi hosts and
storage VASA providers that manage or represent Virtual Volumes storage systems.
Communication with the VASA provider is protected by SSL certificates. These certificates can come from
the VASA provider or from the VMCA.
n
Certificates can be directly provided by the VASA provider for long-term use. They can be either self-
generated and self-signed, or derived from an external Certificate Authority.
n
Certificates can be generated by the VMCA for use by the VASA provider.
When a host or VASA provider is registered, VMCA follows these steps automatically, without
involvement from the vSphere administrator.
1 When a VASA provider is first added to the vCenter Server storage management service (SMS), it
produces a selfsigned certificate.
2 After verifying the certificate, the SMS requests a Certificate Signing Request (CSR) from the VASA
provider.
3 After receiving and validating the CSR, the SMS presents it to the VMCA on behalf of the VASA
provider, requesting a CA signed certificate.
The VMCA can be configured to function as a standalone CA, or as a subordinate to an enterprise
CA. If you set up the VMCA as a subordinate CA, the VMCA signs the CSR with the full chain.
4 The signed certificate with the root certificate is passed to the VASA provider. The VASA provider can
authenticate all future secure connections originating from the SMS on vCenter Server and on ESXi
hosts.
vSphere Storage
VMware, Inc. 275