How to enable Virtual Guest Tagging(VGT) in ESXi 6.5

Why are you trying to use VMware Converter for this? If you have shared storage and the necessary licenses, you should be able to do a VMotion between hosts. Alternatively, if these are two standalone ESXi servers, then you can shut down the guest on the 4.0 box, use scp to copy the files to the vmfs on the new server, re-add to inventory there and then start it up.

Note: to do the above, you'll need to enable ssh (a.k.a. remote tech support mode) on both hosts. This used to be unsupported by VMware, but is now (thankfully) a fully-supported option.

so c33s, i've got a answer for you after researching this topic myself :-)

i'll state 4 steps for ESXi 4 (should work on 5 as well). on ESXi 5 VMware included a packet filter (you should find many on this topic on google).

let's get started: first you need SSH access to your ESXi. here are the 4 steps to improve the situation on a root server a bit:

1) remove ESXi welcome screen: a request to https://your-esxi/ shows a page telling you how to get started with ESXi. Nobody needs to now this exept you. So read it and after that rename the file:

mv /usr/lib/vmware/hostd/docroot/index.html /usr/lib/vmware/hostd/docroot/index.html.bak

2) allow only auth_key login on ssh generate an SSH auth_key for your admin machine (i call it "YOUR-SSH-RSA" further in text). check your setup by running this code on your ESXi

mkdir /.ssh
chmod 0600 -R /.ssh
echo "YOUR-SSH-RSA" >> /.ssh/authorized_keys

Check if logging in works. If so, you can put these lines into rc.local using

vi /etc/rc.local

This is needed because ESXi forgets about this after a reboot. To disable password login do the following:

vi /etc/inetd.conf

Add parameter -s to following lines:

ssh stream tcp nowait root /sbin/dropbearmulti dropbear ++min=0,swap,group=shell -i -K60
ssh stream tcp6 nowait root /sbin/dropbearmulti dropbear ++min=0,swap,group=shell -i -K60

Should look like this afterwards:

ssh stream tcp nowait root /sbin/dropbearmulti dropbear ++min=0,swap,group=shell -s -i -K60
ssh stream tcp6 nowait root /sbin/dropbearmulti dropbear ++min=0,swap,group=shell -s -i -K60

reboot (or atleast restarting inetd) is needed to take effect.

3) Change SSH default port

vi /etc/services

search for

ssh             22/tcp                         # SSH Remote Login Protocol
ssh             22/udp                         # SSH Remote Login Protocol

change the port 22 to what ever you like. look out for conflicts with other ports!

reboot (or atleast restarting inetd) is needed to take effect.

4) Change routing Because ESXi 4 has no packet filter we need to change the routing so it doesn't know how to talk to everyone. this is a bit dangerous, because wrong routing could lead to an ESXi-Management only reachable from local console! You need a static IP or known Network from which you want to administer your ESXi. We add a route to this and delete the default route afterwards.

esxcfg-route -a x.x.x.x/sub y.y.y.y

where "x.x.x.x" is your network or ip. "sub" the subnet mask. and "y.y.y.y" your gateway.

for example we have a ESXi with default gateway 12.34.56.78 and want to add only a single ip 98.76.54.21 the command is

esxcfg-route -a 98.76.54.21/32 12.34.56.78

check if your route is correctly set:

esxcfg-route -l

if so, delete your default route

esxcfg-route -d default y.y.y.y

When all was done correct, you should still reach your ESXi. If not you have to log in localy and change everything back.