Install Cisco Catalyst Center 2.3.7.9 on ESXi 8

Catalyst Center virtual appliance requirements

The Catalyst Center 2.3.7.x ESXi deployment guide specifies the appliance below.

Our recorded lab did not meet those requirements: the host had 64 GB physical DRAM plus an NVMe tier, and the VM used 32 vCPUs, 180 GB configured memory, a 48 GB memory reservation and a 40 GHz CPU reservation. The OVA resource settings were modified for that experiment. Installation and UI observations below do not establish Cisco support, production suitability or long-term stability.

How machine_profile selects vm_medium

Add node label machine_profile vm_medium

ESXi 8.0 U3 memory tiering and NVMe backing

Broadcom's ESXi 8.0 U3 memory-tiering technical preview introduces host-level memory tiering over NVMe devices. This is an optional lab experiment, not a supported substitute for Cisco's dedicated-DRAM sizing. Broadcom recommends this preview for test environments and advises against memory-latency-sensitive workloads.

Key parameters and behaviors for memory tiering in ESXi include:

• Mem.TierNvmePct: Configures NVMe tier capacity relative to physical DRAM (accepts values from 1 to 400). Read the setting on the ESXi host using esxcfg-advcfg -g /Mem/TierNvmePct.
• Host Reboot Required: Changes to tiering settings require a host reboot. Shut down or migrate virtual machines prior to modifying or applying tiering configurations.
• DRAM-Backed Reservations: VM memory reservations must still be backed by physical DRAM; NVMe tier capacity does not increase reservable RAM or substitute for Cisco's dedicated DRAM requirements.
• Snapshot Incompatibility: Broadcom documents failures of memory-inclusive VM snapshots with Software Memory Tiering enabled in vSphere 8 (msg.snapshot.take.notswMemTieringReady). According to Broadcom KB 439056, this limitation stems from missing Fast Suspend and Resume (FSR) support in vSphere 8.x, with support for FSR-based operations introduced in vSphere 9.0. This does not establish support for every snapshot option. Independently, Cisco does not support VMware snapshots as a Catalyst Center VA backup method; use the application's supported backup and restore workflow regardless of hypervisor version.

These steps assume an NVMe tier device is already configured. To enable tiering from scratch, follow the device requirements, maintenance-mode procedure and tier-partition setup in the technical guide attached to Broadcom's preview article. The device must be dedicated to tiering; do not repurpose a datastore containing data.

1. Read the current percentage on the ESXi host. Broadcom documents a default of 25 and recommends an NVMe tier no larger than physical DRAM, even though the setting accepts up to 400.
2. For a planned lab change, shut down or migrate the host's VMs and use esxcfg-advcfg -s <percentage> /Mem/TierNvmePct. Reboot the host for the new ratio to take effect.
3. Verify the host's Tier 0 (DRAM), Tier 1 (NVMe) and total memory in vSphere. Available VM capacity is lower than that total because ESXi uses some memory.
4. Assign memory to the powered-off VM through Edit Settings → Virtual Hardware → Memory. Changing the host ratio does not resize the VM or increase DRAM-backed reservation capacity.

For example, 64 GB of DRAM at 100% gives a theoretical 64 GB NVMe tier and 128 GB combined; 300% gives 192 GB and 256 GB combined; 400% gives 256 GB and 320 GB combined, before host overhead and assuming sufficient tier-device capacity. The 300% and 400% examples exceed Broadcom's recommended ratio. Our notes recorded approximately 256 GB combined, but did not verify the host's percentage; no tiering change was performed during the recorded installation.

How to install Catalyst Center (DNA Center) on ESXi 8

1Prepare the host for the appliance

2Import the OVA with dnac-esxi-launcher

./dnac-esxi-launcher -c config.json -d -u <vcenter-user> -p <password> -l <maglev-password>

{
  "host_info": {
    "ip": "192.0.2.10",
    "ssl_port": 443
  },
  "import_info": {
    "ova_path": "./catalyst-center-2.3.7.9.ova",
    "vm_name": "catalyst-center",
    "data_center": "Datacenter",
    "cluster": "Cluster",
    "resource_pool": "",
    "host_name": "esxi01.example.com",
    "datastore": "datastore1",
    "disk_provision": "thin",
    "network": {
      "enterprise_network": "VM Network"
    }
  },
  "dnac_info": {
    "enterprise": {
      "address": "192.0.2.180",
      "netmask": "255.255.255.0",
      "gateway": "192.0.2.1"
    },
    "dns_servers": [
      "192.0.2.53"
    ],
    "proxy": "",
    "ntp": [
      "time.example.com"
    ],
    "fqdn": ""
  }
}

Two errors came up during the import. Each has a simple fix:

Swipe the table sideways to see every column.

The 33 GB OVA import took about an hour. The launcher has no option to skip power-on, and it warned that Storage I/O Control was off on the datastore.

3Consider disabling ESXi memory ballooning

The launcher powers the VM on straight after the import. About three minutes into that boot we shut the guest down through VMware Tools, before starting the appliance configuration, and added one advanced parameter under VM Options, Advanced, Configuration Parameters: sched.mem.maxmemctl = 0. It caps the balloon driver at zero for this VM only. Ballooning reduces the memory available to the guest, and with no guest swap that can put pressure on the appliance's Java and Elasticsearch backends. Whether to do this depends on your host: Broadcom treats it case by case. In this deployment the install that followed completed.

Open full size

4Configure Catalyst Center with Advanced Install

After we interrupted the boot, the launcher's automatic initialisation did not run and the appliance came up on DHCP at the configuration wizard on port 9004. The simple Install workflow reported that the management interface was already configured:

Open full size

Advanced Install showed the launcher's values pre-filled. For a single node we used one enterprise interface plus the intracluster link, left the cluster VIPs and FQDN empty, kept the default container (169.254.32.0/20) and cluster (169.254.48.0/20) subnets, set DNS and NTP, and left FIPS off. Make sure the container and cluster subnets do not overlap anything on your network, and that DNS and NTP actually answer. Subnetting explained covers how to check for overlap.

Open full size

Open full size

5Monitor the uber-dnac release wait

Our timeline, in UTC on 27 October:

1. 00:08:58

   Start Configuration in the Advanced Install wizard

2. 00:16:48

   Pre-Install: networking applied through netplan

3. 00:17:55

   Cleanup and initramfs rebuild, a “Still Working” notice, then a reboot

4. 00:20:22

   Post-reboot Kubernetes setup (the UI bar says 93% while the API says Post-Install 5%)

5. 00:28:36

   Add node label machine_profile vm_medium

6. 00:29:11

   Install release uber-dnac, then the long release wait

7. 01:57:16

   Release wait ends: Calico policy, node-add event, post-install checks

8. 01:57:55

   Install-Completed: “Post-Install: Configuration completed successfully”

The uber-dnac release wait took 1 hour 28 minutes of a 1 hour 49 minute install, and no ABORT or failure line appeared in the log. The progress bar can lag the backend, so watch the VM console and the installer endpoints; Install-Completed alone does not confirm that uber-dnac is DEPLOYED. The bootstrap service also exposes read-only progress and log endpoints you can poll from a workstation (not a documented public API):

curl -ks https://<appliance-ip>:9004/api/mks/v1/webinstall/install/progress
curl -ks https://<appliance-ip>:9004/api/mks/v1/webinstall/install/logs

Open full size

Open full size

Open full size

Memory during the install

ESXi “consumed host memory” for the appliance VM during the uber-dnac release wait, with other VMs powered off; ESXi itself was still running.

Validate the deployment with maglevreleases

In this deployment, the first login with the temporary credential required a new SUPER-ADMIN user and replaced the temporary account. Quick Start followed: Cisco.com authentication (Skip is available) and the EULA, which states that telemetry is sent to Cisco. Until you close Quick Start, deep links redirect back to /firstTimeSetup.

Then check that each of these works:

• Software Management loads and shows release 2.3.7.9-75335 with no failure banner.
• System 360 shows Node Status and Services Status Healthy, with all 118 services Up, including grouping-service and spf-service-manager-service.
• Inventory opens immediately with no “gather all the device data” wait.
• System Health draws the topology for the enterprise address.

Open full size

Open full size

Open full size

Open full size

ssh -p 2222 maglev@<appliance-ip>
kubectl get maglevreleases -A          # uber-dnac must be DEPLOYED, not ABORTED
kubectl get maglevservicereleases -A   # nothing at INSTALL_REQUESTED or FAILED

Where the memory goes

Catalyst Center API calls and sample responses

curl -ks https://<appliance-ip>:9004/api/mks/v1/webinstall/install/progress

state            Post-Install          (while waiting for uber-dnac)
state            Install-Completed     (at the end)
percent_complete 100
active step      (empty once complete)

curl -ks https://<appliance-ip>:9004/api/mks/v1/webinstall/install/logs

{
  "response": [
    "2026-10-27 01:57:42,599 | Found post install hook /mnt/install-artifacts/maglevsystemseed-post_install.yaml",
    "2026-10-27 01:57:42,602 | extra_var file: /tmp/cli_extra_vars.json extra_var dest file //tmp/cli_extra_vars.json",
    "2026-10-27 01:57:42,603 | extra_vars in file: {\"cert_expiry_limit\" : 100, \"cert_validity_period\" : 3650, \"ipv6\" : true, \"disk_encryption\" : true, \"telemetry\" : false, ...}",
    "2026-10-27 01:57:43,626 | Gathering Facts"
  ],
  "version": "2.0.0"

{
  "response": [
    "2026-10-27 01:57:42,599 | Found post install hook /mnt/install-artifacts/maglevsystemseed-post_install.yaml",
    "2026-10-27 01:57:42,602 | extra_var file: /tmp/cli_extra_vars.json extra_var dest file //tmp/cli_extra_vars.json",
    "2026-10-27 01:57:42,603 | extra_vars in file: {\"cert_expiry_limit\" : 100, \"cert_validity_period\" : 3650, \"ipv6\" : true, \"disk_encryption\" : true, \"telemetry\" : false, ...}",
    "2026-10-27 01:57:43,626 | Gathering Facts"
  ],
  "version": "2.0.0"
}

curl -ks -X POST https://<appliance-ip>/dna/system/api/v1/auth/token \
  -u '<admin-user>:<password>' \
  -H 'Content-Type: application/json' -d '{}'

{
  "Token": "eyJhbGciOiJSUzI1NiIs... (redacted)"
}

curl -ks https://<appliance-ip>/dna/intent/api/v1/network-device \
  -H "X-Auth-Token: $TOKEN"

{
  "response": [
    {
      "hostname": "c8000v-1",
      "softwareType": "IOS-XE",
      "softwareVersion": "17.16.1a",
      "reachabilityStatus": "Reachable",
      "collectionStatus": "Managed",

{
  "response": [
    {
      "hostname": "c8000v-1",
      "softwareType": "IOS-XE",
      "softwareVersion": "17.16.1a",
      "reachabilityStatus": "Reachable",
      "collectionStatus": "Managed",
      "managementIpAddress": "<device-ip>",
      "id": "<device-uuid>"
    }
  ],
  "version": "1.0"
}

curl -ks -X PUT \
  https://<appliance-ip>/dna/intent/api/v1/network-device/<device-uuid>/management-address \
  -H "X-Auth-Token: $TOKEN" -H 'Content-Type: application/json' \
  -d '{"newIP": "192.0.2.216"}'

{
  "response": {
    "taskId": "<task-uuid>",
    "url": "/api/v1/task/<task-uuid>"
  },
  "version": "1.0"
}

curl -ks https://<appliance-ip>/api/kairos/v1/proxy/status \
  -H "X-Auth-Token: $TOKEN"

HTTP 200
{ "isOnboarded": false, ... }   (no customer ID)

Adding a first device

An empty controller is not much of a lab. In our testing on 2.3.7.9 we tried two virtual devices:

Swipe the table sideways to see every column.

The C8000V worked in this test; check Cisco's device compatibility matrix for your exact controller and device releases. Give it a privilege 15 user for the controller, an enable secret, an SNMPv2c read-only community and netconf-yang.

Catalyst Center install stuck: errors and fixes

Errors you may meet, what causes them and how to fix them.

Catalyst Center ESXi installation FAQ