Patch ESXi to a Specific Version with the Command-line

This post describes how to patch an ESXi host to a specific version with the command-line. It is highly recommended to use the vSphere Update Manager (VUM) for patch management, but there are some cases where you need an alternative. It's probably noting you would do in production, but you might need a specific version to reproduce problems or to comply with policies.

In this example, I am going to patch a standalone ESXi 5.5 host with internet access to build number 2068190. The host is currently running ESXi 5.5.0 Build 2302651. (It's a downgrade)

1. Determine the Image Profile for build 2068190. You can identify the Image Profile for all Versions at my ESXi Image Profiles Page. I use the standard profile (with VMware Tools) so the name of the required Image Profile is ESXi-5.5.0-20140902001-standard
2. If your Host is part of a Cluster place it in maintenance mode
3. Connect to the ESXi host with SSH
4. Allow outgoing http connections

   # esxcli network firewall ruleset set -e true -r httpClient

5. Update ESXi to the selected Image Profile. The default behavior is to install packages with newer versions only. If you want to downgrade to an older version to set the allow-downgrades option.

   esxcli software profile update -d https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml -p ESXi-5.5.0-20140902001-standard --allow-downgrades

6. Reboot the System
7. Block outgoing http connections

   # esxcli network firewall ruleset set -e false -r httpClient

If your policy requires to run all ESXi hosts at the same version (VUM with fixed baselines is best practice here), this is how you figure out which version of ESXi you are running:

Determining ESXi Version with the vSphere Client
The build number is displayed above the tabs

Determining ESXi Version with the vSphere Web-Client
The build number is displayed in the Summary tab

Determining ESXi Version from the command line
The vmware -v command displays the ESXi build number