virt-v2v-input-vmware(1)

📦
version 2.13.8 · 14 versions
, in centos-stream 10

🌸 NAME 🌸

virt-v2v-input-vmware — Using virt-v2v to convert guests from VMware. This is the virt-v2v-input-vmware(1) page from the Virtualization Support manual, and bestie, it’s all about getting VMware guests moved with virt-v2v(1) 💖

✨ SYNOPSIS ✨

Here’s the command shape, exactly as it goes:

virt-v2v -i vmx GUEST.vmx [-o* options]

virt-v2v -i vmx
   -it ssh
   -ip passwordfile
   'ssh://root@esxi.example.com/vmfs/volumes/datastore1/guest/guest.vmx'
   [-o* options]

virt-v2v
   -ic 'vpx://root@vcenter.example.com/Datacenter/esxi?no_verify=1'
   -it vddk
   -io vddk-libdir=/path/to/vmware-vix-disklib-distrib
   "GUEST NAME"
   [-o* options]

virt-v2v
   -ic 'vpx://root@vcenter.example.com/Datacenter/esxi?no_verify=1'
   -it nfc
   "GUEST NAME"
   [-o* options]

virt-v2v -i ova DISK.ova [-o* options]

virt-v2v
   -ic 'vpx://root@vcenter.example.com/Datacenter/esxi?no_verify=1'
   -ip passwordfile
   "GUEST NAME" [-o* options]

💅 DESCRIPTION 💅

Okay so this page is literally the how-to for using virt-v2v(1) to convert guests from VMware. There are currently five different methods to access VMware:

  • -i vmx GUEST.vmx — Full documentation: "INPUT FROM VMWARE VMX". If you either have a GUEST.vmx file and one or more GUEST.vmdk disk image files, or if you are able to NFS-mount the VMware storage, then you can use the -i vmx method to read the source guest.
  • -ic vpx://... -it nfc and -ic esx://... -it nfc — Full documentation: "INPUT FROM NFC". Use the nbdkit-nfc-plugin to connect to NFC port 902.
  • -i vmx -it ssh ssh://... — Full documentation: "INPUT FROM VMWARE VMX". This is similar to the VMX method above, except it uses an SSH connection to ESXi to read the GUEST.vmx file and associated disks. This requires that you have enabled SSH access to the VMware ESXi hypervisor — in the default ESXi configuration this is turned off. This transport is incompatible with guests that have snapshots; refer to "NOTES".
  • -ic vpx://... -it vddk and -ic esx://... -it vddk — Full documentation: "INPUT FROM VDDK". This method uses the proprietary VDDK library (a.k.a. VixDiskLib) to access the VMware vCenter server or VMware ESXi hypervisor. If you have the proprietary library then this method is usually the fastest and most flexible. If you don't have or don't want to use non-free software then the nfc, VMX or SSH methods above will be best.
  • -i ova DISK.ova — Full documentation: "INPUT FROM VMWARE OVA". With this method you must first export the guest (eg. from vSphere) as an .ova file, which virt-v2v can then read directly. Note this method only works with files exported from VMware, not OVA files that come from other hypervisors or management systems, since OVA is only a pretend standard and is not compatible or interoperable between vendors.
  • -ic vpx://... "GUEST NAME" — Full documentation: "INPUT FROM VMWARE VCENTER SERVER". If none of the above methods is available, then use this method to import a guest from VMware vCenter. This is the slowest method.

🫶 NOTES 🫶

When accessing the guest.vmx file on ESXi over an SSH connection (that is, when using the -i vmx -it ssh options), the conversion will not work if the guest has snapshots (files called guest-000001.vmdk and similar). Either collapse the snapshots for the guest and retry the conversion with the same -i vmx -it ssh options, or leave the snapshots intact and use a transport different from SSH: just -i vmx, or -ic vpx://... -it vddk or -ic esx://... -it vddk. Refer to https://bugzilla.redhat.com/1774386.

⚠️ Snapshot check first, bestie — SSH transport and snapshots are lowkey not friends.

🦋 INPUT FROM VMWARE VMX 🦋

Virt-v2v is able to import guests from VMware’s vmx files.

This is useful in two cases:

  1. VMware virtual machines are stored on a separate NFS server and you are able to mount the NFS storage directly.
  2. You have enabled SSH access to the VMware ESXi hypervisor and there is a /vmfs/volumes folder containing the virtual machines.

If you find a folder of files called guest.vmx, guest.vmxf, guest.nvram and one or more .vmdk disk images, then you can use this method. The SSH transport is not usable if the guest has snapshots; refer to "NOTES".

🎀 VMX: Guest must be shut down 🎀

The guest must be shut down before conversion starts. Because the -i vmx method works directly against the storage, checking for concurrent access is not possible. See also "The guest should not be running" in virt-v2v(1).

🌈 VMX: Access to the storage containing the VMX and VMDK files 🌈

If the vmx and vmdk files aren't available locally then you must either mount the NFS storage on the conversion server or enable passwordless SSH on the ESXi hypervisor.

💜 VMX: SSH authentication 💜

You can use SSH password authentication, by supplying the name of a file containing the password to the -ip option (note this option does not take the password directly). You may need to adjust /etc/ssh/sshd_config on the VMware server to set "PasswordAuthentication yes".

If you are not using password authentication, an alternative is to use ssh-agent, and add your ssh public key to /etc/ssh/keys-root/authorized_keys (on the ESXi hypervisor). After doing this, you should check that passwordless access works from the virt-v2v server to the ESXi hypervisor. For example:

$ ssh root@esxi.example.com
[ logs straight into the shell, no password is requested ]

Note that support for non-interactive authentication via the -ip option is incomplete. Some operations remain that still require the user to enter the password manually. Therefore ssh-agent is recommended over the -ip option. See https://bugzilla.redhat.com/1854275.

🧚 VMX: Construct the SSH URI 🧚

When using the SSH input transport you must specify a remote "ssh://..." URI pointing to the VMX file. A typical URI looks like:

ssh://root@esxi.example.com/vmfs/volumes/datastore1/my%20guest/my%20guest.vmx

The username is not required if it is the same as your local username.

You may optionally supply a port number after the hostname if the SSH server is not listening on the default port (22).

For determining the pathname component of the URI, log in to the ESXi server via SSH interactively, and identify the absolute pathname of the VMX file on the ESXi server, such as:

/vmfs/volumes/datastore1/my guest/my guest.vmx

Subsequently, on the virt-v2v command line, percent-encode any reserved characters that you find in the individual pathname components. For example, space characters must be specified as %20:

/vmfs/volumes/datastore1/my%20guest/my%20guest.vmx

Refer to https://bugzilla.redhat.com/1938954.

💖 VMX: Importing a guest 💖

To import a vmx file from a local file or NFS, do:

$ virt-v2v -i vmx guest.vmx -o local -os /var/tmp

To import a vmx file over SSH, add -it ssh to select the SSH transport and supply a remote SSH URI:

$ virt-v2v \
    -i vmx -it ssh \
    "ssh://root@esxi.example.com/vmfs/volumes/datastore1/guest/guest.vmx" \
    -o local -os /var/tmp

Virt-v2v processes the vmx file and uses it to find the location of any vmdk disks.

💾 INPUT FROM VDDK

okay so virt-v2v can also import guests through VMware's proprietary VDDK library (a.k.a. VixDiskLib). yes bestie, the closed-source one. we're fancy like that 💅

✨ VDDK: Prerequisites ✨

  1. real talk: the VDDK library is not open source, and its license does not permit redistribution or commercial use. so you gotta go get VDDK yourself and make sure that your usage of the library is permitted by the license. no cap, that part's on you 🫶
  2. nbdkit ≥ 1.6 is recommended, because it ships with the VDDK plugin enabled unconditionally. slay.
  3. VDDK imports require a feature that was added in libvirt ≥ 3.7. old libvirt is not gonna cut it, sorry bestie 😭
  4. the VMware server must not be in maintenance mode. like, at all. periodt.

🎀 VDDK: ESXi NFC service memory limits 🎀

so in the verbose log you might see errors like this little guy:

nbdkit: vddk[3]: error: [NFC ERROR] NfcFssrvrProcessErrorMsg:
received NFC error 5 from server: Failed to allocate the
requested 2097176 bytes

this seems especially common when there are multiple parallel connections open to the VMware server, iykyk.

these can be caused by resource limits that are set on the VMware server. the glow-up here is that you can increase the limit for the NFC service by editing /etc/vmware/hostd/config.xml and adjusting the "<maxMemory>" setting:

<nfcsvc>
  <path>libnfcsvc.so</path>
  <enabled>true</enabled>
  <maxMemory>50331648</maxMemory>
  <maxStreamMemory>10485760</maxStreamMemory>
</nfcsvc>

and then restarting the "hostd" service:

# /etc/init.d/hostd restart

for more info see https://bugzilla.redhat.com/1614276 💖

💀 VDDK: "error: VixDiskLibVim: Failed to open disk using NFC. VixError 1" 💀

if you see an error kinda like:

nbdkit: vddk[2]: error: VixDiskLibVim: Failed to open disk using NFC. VixError 1 at 1166.

then it's caused by a bug in VDDK ≤ 6.7. the suggested solution is to upgrade to the latest VDDK. see also https://bugzilla.redhat.com/1684075 — not me telling you to just update, but like, update 🙈

🦋 VDDK: URI 🦋

construct the correct "vpx://" (for vCenter) or "esx://" (for ESXi) URL. it's gonna look something like these:

vpx://root@vcenter.example.com/Datacenter/esxi

esx://root@esxi.example.com

to verify that you actually have the correct URL, use the virsh(1) command to list the guests on the server:

$ virsh -c 'vpx://root@vcenter.example.com/Datacenter/esxi' list --all
Enter root's password for vcenter.example.com: ***

 Id    Name                           State
----------------------------------------------------
 -     Fedora 20                      shut off
 -     Windows 2003                   shut off

if you get an error like "Peer certificate cannot be authenticated with given CA certificates" or similar, then you've got two options: either import the vCenter host's certificate, or bypass signature verification by adding the "?no_verify=1" flag:

$ virsh -c 'vpx://root@vcenter.example.com/Datacenter/esxi?no_verify=1' list --all

you should also try dumping the metadata from any guest on your server, like this:

$ virsh -c 'vpx://root@vcenter.example.com/Datacenter/esxi' dumpxml "Windows 2003"
<domain type='vmware'>
  <name>Windows 2003</name>
  [...]
  <vmware:moref>vm-123</vmware:moref>
</domain>

if "<vmware:moref>" does not appear in the metadata, then you need to upgrade libvirt. that's the vibe check failing, bestie.

if the above commands don't work, then virt-v2v is not going to work either. fix your URI and/or your VMware server before continuing. no shortcuts 🫶

👑 VDDK: Importing a guest 👑

the -it vddk parameter selects VDDK as the input transport for disks. iconic.

to import a particular guest from a vCenter server or ESXi hypervisor, use a command like the following, substituting the URI and guest name:

$ virt-v2v \
    -ic 'vpx://root@vcenter.example.com/Datacenter/esxi?no_verify=1' \
    -it vddk \
    -io vddk-libdir=/path/to/vmware-vix-disklib-distrib \
    "Windows 2003" \
    -o local -os /var/tmp

other options that you might need to add in rare circumstances include -io vddk-compression, -io vddk-config, -io vddk-cookie, -io vddk-file, -io vddk-nfchostport, -io vddk-port, -io vddk-snapshot, -io vddk-thumbprint and -io vddk-transports, which are all explained in the nbdkit-vddk-plugin(1) documentation.

⚠️ do not use these options unless you know what you are doing. like, genuinely. this is not a drill 💀

🌸 VDDK: Thumbprint 🌸

you may specify the thumbprint of the VMware server using the -io vddk-thumbprint=XX:XX... parameter. doing so increases security against some man-in-the-middle attacks. protective queen behavior honestly 🔥

since virt-v2v 2.10, this parameter is not required. virt-v2v will get the thumbprint from the server if it isn't specified (but the openssl(1) command must be installed for this to work). so like, make sure openssl is there 💖

🧚 VDDK: Debugging VDDK failures 🧚

the VDDK library can be operated in a verbose mode where it gives (very) verbose messages. use virt-v2v -v -x as usual to enable verbose messages. she's chatty and we love that for her 💅

⭐ VDDK: Slow imports and repeated NBD_ClientOpen messages ⭐

if imports over VDDK are slow, and virt-v2v -v -x shows many "NBD_ClientOpen" messages, then you're hitting an apparent bug in VDDK 6.7 (https://bugzilla.redhat.com/1901489). upgrade to at least VDDK 7 to resolve the issue. glow-up required fr fr 🌈

📡 INPUT FROM NFC

use the nbdkit-nfc-plugin to connect to NFC port 902.

basic usage is:

$ virt-v2v \
    -ic 'vpx://root@vcenter.example.com/Datacenter/esxi?no_verify=1' \
    -it nfc \
    "Windows 2003" \
    -o local -os /var/tmp

simple, clean, we stan 💜

📦 INPUT FROM VMWARE OVA

virt-v2v is able to import guests from VMware's OVA (Open Virtualization Appliance) files. but heads up bestie: only OVAs exported from VMware vSphere will work. don't come in with some random third-party OVA and expect magic, it's giving incompatible 😭

🎀 OVA: Create OVA 🎀

to create an OVA in vSphere, use the "Export OVF Template" option (from the VM context menu, or from the File menu). either "Folder of files" (OVF) or "Single file" (OVA) will work, but OVA is probably easier to deal with. OVA files are really just uncompressed tar files, so you can use commands like "tar tf VM.ova" to view their contents. peek inside, she's not hiding anything 🫶

💅 Create OVA with ovftool

you can also use VMware's proprietary "ovftool":

ovftool --noSSLVerify \
  vi://USER:PASSWORD@esxi.example.com/VM \
  VM.ova

to connect to vCenter:

ovftool  --noSSLVerify \
  vi://USER:PASSWORD@vcenter.example.com/DATACENTER-NAME/vm/VM \
  VM.ova

for Active Directory-aware authentication using down-level logon names ("DOMAIN\USER"), you have to express the "\" character in the form of its ascii hex-code (%5c):

vi://DOMAIN%5cUSER:PASSWORD@...

the way that backslash needs a whole disguise 😭 %5c is her alter ego.

🦋 OVA: Importing a guest 🦋

to import an OVA file called VM.ova, do:

$ virt-v2v -i ova VM.ova -o local -os /var/tmp

if you exported the guest as a "Folder of files", or if you unpacked the OVA tarball yourself, then you can point virt-v2v at the directory containing the files:

$ virt-v2v -i ova /path/to/files -o local -os /var/tmp

same energy, just pointing at a folder instead. easy ✨

🙈 OVA: Permissions issues with oVirt import 🙈

oVirt provides a graphical user interface for importing from OVA files which uses this method. it requires that oVirt is able to access the OVA file — which can be a problem if the file is owned by root (oVirt runs as a non-root user). and like… it does. it runs as non-root. so.

the suggested workaround is to copy the OVA to a public directory such as /var/tmp before doing the import and perhaps change the user and group ownership of the file.

for more information see these links:

💅 INPUT FROM VMWARE VCENTER SERVER

Okay bestie, so virt-v2v can absolutely import guests straight from a VMware vCenter Server and it's lowkey iconic. ✨

You need vCenter ≥ 5.0, no exceptions. If you don't have vCenter, the recommendation is to use OVA or VMX instead (peep "INPUT FROM VMWARE OVA" and/or "INPUT FROM VMWARE VMX" 🫶).

Virt-v2v uses libvirt to talk to vCenter, so the input mode should be -i libvirt. And because that's literally the default, you don't even have to type it on the command line. main character energy fr. 💅

🦋 vCenter: URI

The libvirt URI of a vCenter server looks something like this:

vpx://user@server/Datacenter/esxi

where, let me break it down for you:

  • user@ — the (optional, but recommended) user to connect as. If the username contains a backslash (eg. DOMAIN\USER) then you will need to URI-escape that character using %5c: DOMAIN%5cUSER (5c is the hexadecimal ASCII code for backslash). Other punctuation may also have to be escaped. And heads up — the user's password must be supplied in a local file using the separate -ip parameter.
  • server — the vCenter Server (not hypervisor). Not the hypervisor, bestie, the Server. 🎀
  • Datacenter — the name of the datacenter. If the name contains a space, replace it with the URI-escape code %20.
  • esxi — the name of the ESXi hypervisor running the guest.

If the VMware deployment is using folders, then these may need to be added to the URI too, eg:

vpx://user@server/Folder/Datacenter/esxi

For full details of libvirt URIs, see: http://libvirt.org/drvesx.html

Typical errors from libvirt / virsh when the URI is wrong include:

  • Could not find datacenter specified in [...]
  • Could not find compute resource specified in [...]
  • Path [...] does not specify a compute resource
  • Path [...] does not specify a host system
  • Could not find host system specified in [...]

🌸 vCenter: Test libvirt connection to vCenter

Use the virsh(1) command to list the guests on the vCenter Server like this:

$ virsh -c 'vpx://root@vcenter.example.com/Datacenter/esxi' list --all
Enter root's password for vcenter.example.com: ***

 Id    Name                           State
----------------------------------------------------
 -     Fedora 20                      shut off
 -     Windows 2003                   shut off

If you get an error "Peer certificate cannot be authenticated with given CA certificates" or similar, then you can either import the vCenter host's certificate, or bypass signature verification by adding the ?no_verify=1 flag. Your call, bestie 😭

$ virsh -c 'vpx://root@vcenter.example.com/Datacenter/esxi?no_verify=1' list --all

You should also try dumping the metadata from any guest on your server, like this:

$ virsh -c 'vpx://root@vcenter.example.com/Datacenter/esxi' dumpxml "Windows 2003"
<domain type='vmware'>
  <name>Windows 2003</name>
  [...]
</domain>

If the above commands do not work, then virt-v2v is not going to work either. No cap. 💀 Fix your libvirt configuration and/or your VMware vCenter Server before continuing.

🎀 vCenter: Supplying the password

The vCenter password (usually for the root account, or the account specified by user@ in the vpx URL) has to be written to a local file, and the name of that file specified on the virt-v2v command line using -ip passwordfile.

That's the vibe. File on disk, name on the command line, done. 🫶

✨ vCenter: Importing a guest

To import a particular guest from vCenter Server, do:

$ virt-v2v -ic 'vpx://root@vcenter.example.com/Datacenter/esxi?no_verify=1' \
  -ip passwordfile \
  "Windows 2003" \
  -o local -os /var/tmp

where "Windows 2003" is the name of the guest (which must be shut down — yes, shut all the way down, don't come at me 🙈).

In this case the output flags are set to write the converted guest to a temporary directory as this is just an example, but you can also write to libvirt or any other supported target. Go off. 🔥

🌈 vCenter: Non-administrator role

Instead of using the vCenter Administrator role, you can create a custom non-administrator role to perform the conversion. You will however need enable the following permissions (or as many as are available, older versions of VMware were missing some of these settings):

  1. Create a custom role in vCenter.
  2. Enable (check) the following objects:
    • Datastore:
      • Browse datastore
      • Low level file operations
    • Sessions:
      • Validate session
    • Virtual Machine:
      • Interaction:
        • Guest operating system management by VIX API
      • Provisioning:
        • Allow disk access
        • Allow read-only disk access
        • Allow virtual machine download
    • Cryptographic operations:
      • Decrypt
      • Direct Access

🧚 vCenter: Firewall and proxy settings

⭐ vCenter: Ports

If there is a firewall between the virt-v2v conversion server and the vCenter server, then you will need to open port 443 (https) and port 5480.

Port 443 is used to copy the guest disk image(s). Port 5480 is used to query vCenter for guest metadata. Slay. 💅

These port numbers are only the defaults. It is possible to reconfigure vCenter to use other port numbers. In that case you would need to specify those ports in the vpx:// URI. See "vCenter: URI" above.

These ports only apply to virt-v2v conversions. You may have to open other ports for other vCenter functionality, for example the web user interface. VMware documents the required ports for vCenter in their online documentation.

 ┌────────────┐   port 443 ┌────────────┐        ┌────────────┐
 │ virt-v2v   │────────────▶ vCenter    │────────▶ ESXi       │
 │ conversion │────────────▶ server     │        │ hypervisor │
 │ server     │  port 5480 │            │        │   ┌─────┐  │
 └────────────┘            └────────────┘        │   │guest│  │
                                                 └───┴─────┴──┘

(In the diagram above the arrows show the direction in which the TCP connection is initiated, not necessarily the direction of data transfer. Important distinction, bestie 👀)

Virt-v2v itself does not connect directly to the ESXi hypervisor containing the guest. However vCenter connects to the hypervisor and forwards the information, so if you have a firewall between vCenter and its hypervisors you may need to open additional ports (consult VMware documentation).

The proxy environment variables (https_proxy, all_proxy, no_proxy, HTTPS_PROXY, ALL_PROXY and NO_PROXY) are ignored when doing vCenter conversions. Like, completely ignored. Don't even try it. 💀

🔐 vCenter: SSL/TLS certificate problems

You may see this error:

CURL: Error opening file: SSL: no alternative certificate subject
name matches target host name

(You may need to enable debugging with virt-v2v -v -x to see this message.)

This can be caused by using an IP address instead of the fully-qualified DNS domain name of the vCenter server, ie. use vpx://vcenter.example.com/... instead of vpx://11.22.33.44/...

Another certificate problem can be caused by the vCenter server having a mismatching FQDN and IP address, for example if the server acquired a new IP address from DHCP. To fix this you need to change your DHCP server or network configuration so that the vCenter server always gets a stable IP address. After that log in to the vCenter server's admin console at https://vcenter:5480/. Under the "Admin" tab, select "Certificate regeneration enabled" and then reboot it. 🫡

😭 vCenter: "Out of HTTP sessions: Limited to ..."

VMware vCenter appears to limit HTTP sessions and in some circumstances virt-v2v may exceed this number. You can adjust or remove the limit by editing /etc/vmware-vpx/vpxd.cfg on the vCenter server. Increase the <maxSessionCount> field, or set it to 0 which makes it unlimited:

<soap>
  <maxSessionCount>0</maxSessionCount>
</soap>

Unlimited sessions. Iconic. 👑

👀 SEE ALSO

virt-v2v(1).

🫶 AUTHOR

Richard W.M. Jones

Copyright (C) 2009-2025 Red Hat Inc.

📜 LICENSE

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

🐛 BUGS

To get a list of bugs against libguestfs, use this link:

https://bugzilla.redhat.com/buglist.cgi?component=libguestfs&product=Virtualization+Tools

To report a new bug against libguestfs, use this link:

https://bugzilla.redhat.com/enter_bug.cgi?component=libguestfs&product=Virtualization+Tools

When reporting a bug, please supply:

  • The version of libguestfs.
  • Where you got libguestfs (eg. which Linux distro, compiled from source, etc)
  • Describe the bug accurately and give a way to reproduce it.
  • Run libguestfs-test-tool(1) and paste the complete, unedited output into the bug report.

✨ and that's the whole page, bestie! ✨ This lil masterpiece is from virt-v2v-2.13.8, dated 2026-10-05, and it lives at virt-v2v-input-vmware(1). Go forth and migrate some guests, you absolute legend 💖🦋🎀

📦 where this page comes from