Skip navigation

Tag Archives: esxi


It seems it becomes sort of tradition for me to apologize delay updates every time I start a new post. The truth is it does happen in recent posts. –_-b

I am currently focus on VCAP-DCA exam and so does that help me to excuse myself little bit? :p

Anyway, welcome to read my post and I will continue to update with my best effort. Today, we are going to talk about migrate ESX3.5 to vSphere with Powercli.

Environment&Goal:

Let me introduce environment first.

The old environment:

We have 7 ESX 3.5 hosts with 100 VMs running on it. It is using SAN base as datastore. 1 physical server is running vCenter 2.5 on it.

New environment:

All ESXs will upgrade to ESXi 4.1U1. vCenter will upgrade to latest version as well. It uses same SAN datastore so that’s a plus in this migration.

Migration Steps

Following is a diagram which give you some brief idea about how I do my migration. It’s little bit big picture, pls be patient when it loads.

upgrade to vsphere diagram

Using Powercli to help you

First of all, Powercli is powerful tool. But I have to mention that sometimes, it’s just much easier to use GUI interface which utilize internal cmelet and scripts to do jobs. However, there are some steps Powercli can fully utilize resource and make job quicker and efficient.

I’m going to describe the “Second week” work from above diagram with powercli power.

Preparation Stage

Powercli

Of course, you need to download powercli and install first. You can find out the powercli from vmware website. or here

if you want, you can download Vmware Update Manager Powercli snap-in as well from here.

After you install powercli, you need to run it.

You may encounter this error when you run it. Regardless 32bit or 64bit version.

powercli_001

All what you need to do is run command as following:

powercli_002

then, close the powercli and rerun it again.

Scripts:

To do those jobs, you will find following scripts coming very handy.

Upgrade-vHardware_Templates

upgrade-vhardware_vm

Those are very good scripts although they are not watch-free scripts. It means it does require some modification or you have manually interfere when it stuck at some place time by time.

What we need to do

Following steps are what we try to do in this week.

1. 20 VMs need to migrate to new vCenter.

Well, there are 20 test vms currently running on the old hosts. Since they are sharing the same datastore(both new environment and old environment), we can just shutdown and register them on new vCenter.

1.1 connect to vCenter

Connect-VIServer your_vCenter

Note: You do can connect to host but we are working on vCenter since VMs are crossing multiple hosts.

powercli_003

1.2 created a new folder so I can operate VMs at same time.

You need to make sure that folder is “blue” folder not yellow folder

In this example, I found there a blue templates folder. so I will create migration folder beneath it.

New-Folder -Name migration -Location templates

1.3 Move all test VMs to this folder

Move-VM -VM yourvmname -Destination migration

You need replace yourvmname with each VM you want to move. If VM has long name, you can use yourvmname* to get rid of rest name part.

Use following command to check all vms in the “migration” folder or not

get-vm -Location migration

1.4 Create old_vmtools folder in the new vCenter

You do same thing as above and create a new folder in the vCenter called “old_vmtools” to accept those VMs.

1.5 stop all test vms

You need stop VMs from old vcenter so you can import them into new vCenter

You will love these with powercli

get-vm -Location migration|Shutdown-VMGuest

You can use stop-vm but that will turn VM off immediately.

1.6 Import vmx into new vCenter

You can do this step with script, but it’s too much trouble. It’s easier to just manually do it on new vCenter via GUI interface. When you import them, pls make sure you import them to “old_vmtools” folder.

1.7 Install VMtools

You must install VMTOOLS before you upgrade vm hardware level.

get-vm –location old_vmtools|start-vm

Here is intersection. You either use script upgrade-vhardware_vm which will install vmtools and upgrade vm hardware or you can manually install Vmtools first. Then, you use script to upgrade Vm hardware.

For safe reason, I did the second idea.

You can just click folder name on vCenter, and choose “Virtual Machine” tab on the right side window. Use “Shift” key to select all vms, and right click to choose

powercli_004

It will upgrade all VMs vmtools automatically. Wait for 30 mins and come back.

You may notice some of VMs failed on upgrade.

You need to open those VM console and go to VM->install Vmtools on the manual. It will automatically load Vmtools installation iso on the vm cd-rom.

go to cmd and go do cd-rom and run

d:\setup /c

This will manually remove old-vmtools. Then, you will install it again.

d:\setup

1.8 upgrade vm hardware

After make sure all VMs got new vmtools, then you can safely use script to upgrade vm hardware.

All what you need to do is to download script. Change extension name from docx to ps1. Copy this script to the server where powercli runs.

In the powercli, you just need to type name of script and run.

powercli_005

This script asks you which vCenter and folder where VMs sit. Answer those questions, the script will stop VMs one by one, check vmhardware version. Upgrade version if it is old. And restart vm.

Note: sometimes, shutdown vm takes too long before script try to convert vm hardware version. so it will stuck. You need manually upgrade hardware version and manually start vm.

1.9 remove old vms from old vCenter

at old vCenter

get-vm –location migration | remove-vm

2.0 move vms to test folder

at new vCenter

get-vm –location old_vmtools|move-vm –destination test_folder

Here it is. It’s pretty easy and simple to do the job with powercli.

Please leave comments as usual. Thanks for reading.

Reference:

http://ict-freak.nl/2009/06/27/powercli-upgrading-vhardware-to-vsphere-part-1-templates/

Advertisements

As usually, I would thank you for continuing browsing my blog although I haven’t uploaded for couple of months. I was caught by my personal errands till, today, one of my friends said, “Silver, why don’t you update your blog? Even just write some nonsense into it”.

Well, personally, I don’t write any useless information in this tech blog. But I do need to update. So here it is. Hope you can enjoy it.

I will show you how to configure VMware Orchestrator. This software is coming with vSphere but it is installed silently and you need to manually configure it. Reason to use VMware Orchestrator will be 2.

A. You have very large and complex Vmware environment and you would like to dig deep and become guru.

B. You need to prepare for VCAP-DCA exam.

Regardless which reason you may have, this post will give you a hand and knock the door for you.

 

Configure VMware Orchestrator

The first thing you need to do is to check out Service “VMware vCenter Orchestrator Configuration” is running. In default, it is manual for start up.

or-001

Once you started the Orchestrator Configuration, you can just run “Configuration”

or-002

 

You should see this page coming from IE.

or-003

 

The default username and password is vmware/vmware.

You should see main interface like this.

 

General:

or-005

There is nothing you need to configure in the General class for now.

Network:

or-004

so Let’s jump on “Network”. the network configuration is for Orchestrator. So You need to put IP and DNS and keep settings. No drama on that.

Notice “SSL Certificate” page here, but we don’t configure it for now. You can choose to use CA certificate or your own certificate. In this case, we will generate Orchestrator own certificate first, then we can configure it. Please see Chapter “Server Certificate” below.

LDAP:

The purpose of LDAP is to let you use AD account to log in to Orchestrator client.

You need fill those blank with your DC servers, and LDAP path.

or-006

For the root and other group path information, you don’t need to run some scripts to get it. All what you need to do is to run AD Users and computers.

Right click the object (for example, the root of your AD) and click –> “Properties” and go to Attribute Editor and find distinguishedName as follow.

or-007

 

Same thing for the rest of page.

or-008

 

 

 

Database:

It’s pretty straight forward for configuring database. I’m using SQL database and

or-009

or-010

Once you install the database, jump on SQL server and verify it.

or-011

 

Server Certificate:

You should generate your own Server certificate here. For some reason, the certificate generate by my Domain CA doesn’t work well here. so I would suggest you do it by yourself.

or-012

Once you generate certificate, you need to export it to a file protected with password.

or-013

The next step supposes to import certificate back to “Network –>SSL configuration”. If you don’t that, you won’t get “License” right.

 

License:

This is where you gain license from vCenter and also license for plug-ins.

or-014

If you don’t import SSL certificate here, you won’t get right result. Because we need to use secure channel.

or-015

You need to import your license which you export above.

This will also setup Network configuration->SSL part as well.

or-016

please be noticed:  You may need to restart vCenter to let license work!!

Start up option:

You must make sure the status is “Running”. I was stuck at “Unknown” status for a very long time even after I restart vCenter and Orchestrator services and server. The only way to resolve it is to click those “Restart” buttons in this page. Trust me, they are here for reasons.

or-017

The rest parts are very easy to configure. I just paste picture here as guide.

Plug-in:

 

or-018

 

 

 

 

 

Mail:

or-019

SSH:

This is for connection to your hosts.

or-020

vCenter Server:

This is where you configure your vCenter.

or-021

 

once you finished the configuration, you can get into Orchestrator now via it’s own client. Run it under Vmware you shall see this interface.

or-022

 

Conclusion:

There are some tricks to setup Orchestrator. But the difficult part is actually to use it since there are lack of good examples and documents.

I would suggest VMworld Orchestrator Lab manual is a very good start. If you do want to know me to give you some examples, please leave your messages.

Thanks


So this is last part of this series. Hopefully, I don’t need to write another post.

From previous post, I discussed about how to install and configure Trend Deep Security 7.5 on vSheild. This post will talk little bit more about configuration and performance review.

In my last post, I have installed vShield Zone on host, Install DS Manager one of my VMs which is also vCenter, and push DS Virtual Appliance on to one of hosts.

Then, I changed the IP and network configuration on the DS VA and activate it with Deep Security Virtual Appliance.

Please be aware that Security Policy is playing an important role in the DS. You need to make sure all protected VMs having correct Security Policy.

Once you finished the VA, we can go back to DS manager and take a quick look.

I would like to list some common issues you may encounter.

ds-01

If anti-Malware status is not Capable, it means vEndpoint is not installed on this ESX host.

ds-02

If Anti-Malware is on, but the color is blue. It means you haven’t assigned correct policy on this VM. In default, there is no policy at all. Just right click the VM and follow the instruction.

ds-03

ds-04

You better actually create your own policy before you apply. Some default policy(like windows 2k3) doesn’t have all protection on and doesn’t allow certain protocol (e.g: RDP). The best way is to make copy of old policy and customize a new one for yourself.

The next step is to prepare your VMs. All what you need to do is to install vShield Driver agent and DS Agent. Once you finish installation, you must reactivate your vm from DS Manager to let DS Manager to check VM status.

ds-05

If you have installed both agents and apply right policy, reactivate your vm from DS Manager. You should see something like this in the DS Manager.

ds-06

It should have all greens and Agent should running. Your VM should be protected at each level from crossing both Appliance(working with vEndpoint) and Agent.

One more thing when you try to install DS Agent, you need to copy the installation on local disk of VM and install. Otherwise, you will encounter this error.

ds-27

Virus download test

I have a protected VM which has all features turned on. Let’s see how it react when I tried to download a virus sample file from Internet.

ds-26

It actually worked!

Does Deep Security actually reduce resource consumption?

Here is the big question. The reason we spent so much time to deploy this product is the rumour that it can save the resource comparing with traditional AV solution. Let’s take a look.

I installed OfficeScan on one of test machines. I monitored the resource which has been consumed from CPU, Memory,DISK,Network for both test VM and Host as base line. I will scan a vm with officescan once. And also scan it with DS.

Protected VM CPU

Protected VM CPU with OfficeScan

ds-07

CPU: 50% of one core. It lasts 10 mins.

Protected VM CPU with DS

ds-13

ds-14

only 22% on CPU comparing with 50% on Office Scan.

Note: I ran twice on this test.

Protected VM DISK

Protected VM disk with OfficeScan

ds-08

Disk: 5000KBps for 10 mins.

Protected VM disk with DS:ds-15

It’s very interesting to see the first run disk but nothing on second. The reason is the first run has already load disk data into memory and it doesn’t require to load again at second time. It proves DS is load to memory and scan only memory theory. The DS scan finished in 4.5 mins.

Protected VM Memory

Protected VM with OfficeScan

ds-09

Memory: Consumed memory is 1.25GB, and active memory is 4GB.

Protected VM with DS

ds-25

50% of active memory in 4.5 mins. I ran twice.

Protected VM Network

Protected VM with OfficeScan

ds-10

Network: OfficeScan tried to contact OfficeScan server at beginning. Then, it went quiet.

Protected VM Network Activity with DS:

ds-16

There is almost nothing on network. It means DS is using ESX module to scan memory directly. It doesn’t go through normal network channel. Because it is using similar theory as vSwitch, I call it a protected vSwitch channel.

From what I can see via Protected VM angle, the resource has been consumed almost 50% less and use only half time to finish scan.

Because using DA actually involves to use Deep Security Virtual Appliance to scan. We need to take look about DS VA.

DS VA CPU:

ds-17

The truth behind scene is DS VA is actually scanning the data instead of protected VM. That’s why you see low utilization on VM because all what it did was to load data into memory and call vShield Endpoint driver to let DS VA to scan.

DS VA Disk:

ds-18

Almost nothing on disk VA disk activity.

DS VA Memory:

ds-19

It consume 1.5GB memory on VA. It’s understandable.

DS VA Network:

ds-20

This is very interesting. According to this chart, the network activity on DS VA is very high during scanning. It means vShield Endpoint will open port for all VMs sitting on that protected vSwitch instead of just DS VA.

ds-21

This is the vSwitch vShield Endpoint use. It’s just normal vSwith and you can add adapters if you want. It does bring my concern whether this could be potential security breach.

Here is moment of truth. Will DS actually save resource from ESX perspective?

Following is the data from Physical ESX Host:

ESX CPU utilization

ESX CPU with OfficeScan

ds-22

4% of total CPUs on ESX box.  I have nothing else was running on that host.

ESX Host CPU Performance on DS

ds-23

It does finish scan in half time but it actually use 6% of CPUs. Be aware this is not including overhead of ESX host CPU. It’s 2% of higher than OfficeScan.

ESX Disk with OfficeScan

ds-12

Disk activity on ESX host.

ESX Disk activity with DS

ds-24

It’s same disk activity but with half loading time.

There ain’t much point to check memory since everything is happening in the memory. Just one module to scan another chunk of memory in the host. That’s all.

Conclusion:

Let’s sum up with what we have learned from those data. Please be aware I’m only test single machine scan.

Resource consumption:

ESX Host

OfficeScan DS 7.5
CPU Util 4% 6%
CPU Used time 10 mins 4.5 mins
DISK Util 200CMD/s 200CMD/s
DISK Used time 10 mins 4.5 mins
Memory Same Same
Network 0 0 Nothing on pNIC

It does seem like Host CPU is consumed more resource than officeScan.

but It seems that DS VA doesn’t support multiple threads scanning at same time. If that’s the case, a host can hold about 30 VMs max. So DS Manager will schedule to scan all machines in different time.

This is the end of this Session of this year!

I wish everyone has a wonderful Christmas and Happy New Year!!

 

 


As you guys may notice, I have spent some hours on vSphere vShield product recently. I have came cross a design flaw issue I would like to discuss with you.

First all, let me briefly describe my test environment.

I have two physical HP boxes and a EMC SAN as my test box. In this case, I have built a vCenter as VM sitting on one of ESX host. Therefore, I can even make snapshot if I want to. However, this has been generate some issues for vShield product.

Symptoms:

In terms of testing installing and configuring vShield product. I normally install vShield on one host and move some test VMs to new host to see how VMs respond. Then, I will vMotion vCenter VM to new host and install vShield on the second host since some of vShield components requires reboot host. I have done that couple of times. Eventually, it happened.

shissue-03

I initialled vMotion from a host which has zone, firewall, vApp to a host which doesn’t have those settings. vCenter got frozen.

I was waiting for couple of minutes but I was still not able to connect to vCenter. Not even pingable.

so I jump on new host with directly vClient and I found vCenter is up running in the new host. But it’s not pingable. Other VMs sitting in the same vSwitch are not having issues at all. I vMotioned vCenter before I install vShield without any issues. Why I can’t connect to vCenter VM this time?

Cause:

The reason is simple. It’s caused by vShield Zone and other components. Let’s take a look to see what happens when I vMotion a normal VM to a host installed with vShield.

shissue-01

 

The normal procedure should be:

  1. Query
  2. Migrate a new VM into new host.

 

However, as you can see from the picture, it actually reconfigured the VM afterwards.

Notice:

And  if you monitor vMotion ping status, the ping drop during vMotion from 1 time out become 10 times out depends on how you configure vShield.

shissue-02

 

so what exactly this reconfiguration step do?

The answer is that virtual machine vmx file has been reconfigured with vShield information. The more important thing is this step is done by vCenter!!

With a host installed with vShield products(like Zone), any VMs vMotion into that host will automatically configured with vZone. If vZone information is not configured, the VM will not able to communicate with other VM even if VMs in the same vSwitch because it’s caused at vNic leve.

Just imagine what happened if you try to vMotion a vCenter? No one is going to modify vCenter VM since it’s temporary disconnect from network!!

Solution:

I think this is a design flaw since use VM as vCenter is an option provided by VMware.

What I did was to use putty to connect to ESX host and manually modify vmx file of vCenter VM.

This is what old vmx looks like. This host has all vShield parts.

shissue-05

We need to remove filter0.name and param1 and add vEndpoint to match whatever new host got. The result is following.

shissue-04

After modification, the vCenter is able to start and connect to network.

Conclusion:

vShield is still a new product. VMware needs to resolve issues when vCenter in VM mode and let host , instead of vCenter, to reconfigure vmx files everytime a new VM vmotion into host or register a new VM.

Plus, the reconfiguration takes too long to finish. For important time sensitive machine, 10 time out may not be acceptable.


In my previous post, I described about vShield Endpoint. In this post, I will talk about the only real product which is actually using and design with this concept. Trend Micro Deep Security 7.5.

Before I started to roll out details, I would like to thank Trend Micro Australia’s help to give me support when I stuck. Thanks guys.

trenddp_08

What can Trend Micro Deep Security 7.5 do?

First time I saw this product is on the Vmware seminar. When Trend Micro representative standing on the stage and demonstrate how Deep Security can use only 20% of resource to scan in the virtualization environment.  That was mind blowing because imaging VDI and VMs are calling for schedule scan at same time. How much pressure it will cost to ESX Host? This product is only working with vSphere 4.1. It’s using vShield Endpoint and must use vShield point to do it’s job.   Well, at least, that’s what Trend Micro claimed. So is this true? Please continue to read.

Note: DS 7.5 is actually merely designed for VM environment. It means it’s not a complete solution at this stage. If you want to protect your physical boxes or workstation, you better still use OfficeScan product.

Deep Security provides comprehensive protection, including:

  • Anti-Malware (detect&clean virus)
  • Intrusion Detection and Prevention (IDS/IPS) and Firewall (malicious attack pattern protection)
  • Web Application Protection (malicious attack pattern protection)
  • Application Control (malicious attack pattern protection)
  • Integrity Monitoring (Registry & file modification trace)
  • Log Inspection (inspect logs and event on vm)

The interesting about DS 7.5 and vShield Endpoint is that none of this product can provide complete solution for end users. Each of them play a certain roles in the system. So the result is actually combination of both software.

Let’s take a look with clear table.

trenddp_09

Note:

My suggestion for installing is to install both vShield Endpoint Agent and DS Agent on your VMs. That’s the only way you can protect your VMs.

Components of Deep Security 7.5

Deep Security consists of the following set of components that work together to provide protection:

Deep Security Manager, the centralized management component which administrators use to configure security policy and deploy protection to enforcement components: Deep Security Virtual Appliance and Deep Security Agent. (You need to install it on one of windows server)

Deep Security Virtual Appliance is a security virtual machine built for VMware vSphere environments, that provides Anti-Malware, IDS/IPS, Firewall , Web Application Protection and Application Control protection. (It will be pushed from DS manager to each ESX)

Deep Security Agent is a security agent deployed directly on a computer which can provide IDS/IPS, Firewall, Web Application Protection, Application Control, Integrity Monitoring and Log Inspection protection. (It need to be installed on the protected VMs)

As matter of fact, you need to download following files from Trend Micro website. Don’t forget to download filter-driver which will be pushed from DS Manager to each ESX host.

trenddp_10

Architecture of Deep Security 7.5

Let’s take a look.

trenddp_02

There should be only have one DS manager unless you want to have redundancy.

ESX Host must be installed with vShield Endpoint.

Each ESX has it’s own Virtual appliance.

Each VM should have both vShield Endpoint and DS Agent installed.

How does Deep Security 7.5 work?

trenddp_16

For malware and virus check:

DS is using vShield Endpoint to monitor protected VM memory. The vSheild Endpoint Agent (or AKA vShield Endpoint thin driver) will open a special channel to allow DS virtual appliance to scan it’s memory via special vSwitch which is running on ESX kernel driver layer.

Since VMware needs to make sure the isolation of VMs traffic and memory, hard disk and no other application should breach this protection, vShield Endpoint is a back door opened by VMware to let third party to scan VM content legally and logically.

For registry keys and logs and other components of VM, we have to relay on DS Agent because vShield Endpoint can allow do so much. That’s why the solution must combine both vShield Endpint and DS agent.

Install Deep Security 7.5

I did encounter some interesting errors during the installation.

But let’s sort out the steps of installation first.

  1. Install Endpoint on your VMware ESXs.
  2. hostInstall DS manager on one of your windows box.
  3. Push Virtual Appliance, filter driver to each ESX host. It will add a appliance into vShield protected vSwitch. Filter driver will be loaded in the ESX kernel.
  4. Install DS agent, vShield Point Agent on VMs you want to protect.

Install Endpoint on your VMware ESXs.

Please click here to see how to do it.

Install DS manager on one of your windows box

Those are easy step. I believe any admin can do his job well.

Let’s me skip some easy parts.

trenddp_11

skip,skip

trenddp_12

Once you finish installation of DS Manager. You need to configure the DS Manager.

trenddp_13 trenddp_14

trenddp_15

This is really tricky part. What are those IP for?

The answer is those IP must not be occupied and it must be in the same subnet as rest of your vShield components are.

Check out this diagram and find out your own vShield  subnet.

On your ESX host(which has Endpoint installed already), you should find this.

trenddp_17

so what’s your vSheild Subnet?

The rest is easy part. skip,skip

trenddp_18

trenddp_19

Basic Configure DS Manager

By now, you have already connect to vCenter and vShield Manager. You suppose to see something like that.

trenddp_20

Notice nothing is actually managed and ready. That’s because you need to “Prepare ESX”.

Notice:

Before you “Prepare ESX”, you need to make sure vShield Endpoint has already installed and you have already download all DS components.

trenddp_21

trenddp_22

If you didn’t setup your vShield subnet correct, you will run into this error.

trenddp_23

In my case, I just need to right click vCenter->Properties-> Network Configuration

trenddp_24

please be aware you need to put your ESX into maintenance mode and restart it in terms of pushing DS virtual appliance and filter driver.

trenddp_25

You need to import your downloaded files into DS Manager. If you didn’t import before, you will have chance to import again or download.

trenddp_26

As usually, I skip some steps.

trenddp_27

trenddp_28

Here is another tricky. Because my ESX has different default IP as DS default. so once the DS Manager deploy the virtual appliance to ESX, the appliance only has default DHCP IP which is wrong in my case also the virtual network is also wrong. I encounter this problem.

trenddp_29

All what you need to do is to jump on ESX and virtual appliance console to change IP of that appliance. The default username and password is dsva.

trenddp_30

trenddp_31

Once you changed the IP, reboot this VM. Go back to DS Manager and double click dsva object to activate it.

trenddp_32

Make sure the security profile is loaded. That’s very important!!

trenddp_33

System will automatically offer you some VMs to protect. You can choose “no” at this stage. Why? because you haven’t installed vShield Endpoint agent and DS agent on your VMs yet.

trenddp_34

By now, the installation steps have finished here.

In my next post, I will talk about how to configure Trend Micro Deep Security 7.5 and performance result comparing with OfficeScan and virus testing.

Let me show you a picture what a DS manager look like when a VM is fully protected to finish this post.

trenddp_36

Reference:

Trend Micro Deep security installation guide

Trend Micro Deep security User guide


First of all, I would like to apologize for updating my blog late since I was called away last week and not able to do too much.

I’m going to talk about vShield Edge and vApp. First of all, let’s review why we need vShield Edge. The last post can be found here.

What is vEdge?

vShield Edge is deployed as a virtual appliance to provide firewall,VPN, Web(HTTP only) load balancer, NAT, and DHCP services. Eliminate the need for VLANs by creating a barrier between the virtual machines protected by vShield Edge and the external network for port group isolation. Satisfy your network security within virtualized environments:

  • Consolidate edge security hardware: Provision edge security services, including firewall and VPN, using existing vSphere resources, eliminating the need for hardware-based solutions.
  • Ensure performance and availability of web services: Efficiently manage inbound web traffic across virtual machine clusters with web load balancing capabilities.
  • Accelerate IT compliance: Get increased visibility and control over security at the network edge, with the logging and auditing controls you need to demonstrate compliance with internal policies and external regulatory requirements.

Why do we need vEdge?

VMware is trying to design cloud system which can be used by ISP to host multiple Enterprise clouds on one datacenter.

vshield-edge01

VMware needs a cheap and efficient way to manage internal network to make sure the data between different clouds can be isolated from different network level but also be connected with well control. vEdge is used to allow you to isolate different cloud with NAT, load balance, DHCP and VPN.

Here is a good example for NAT using. There are two Test environment coexists in the same network because NAT function vEdge provides.

vshield-edge02

With vEdge, you can separate your Network tenancy into different connections without security breach or other threat.

vshield-edge03

Install vEdge

Installing vEdge is required to install license first. It’s the same location as you will do for others.

vshield-edge04

The next step is to choose which vSwitch (vSS or vDS) you want to deploy vEdge. Not like Zone which can be installed on vNic level, vEdge can be only setup on PortGroup.

vshield-edge05

All what you need to do is to choose a portgroup and click Edge menu on the right hand and provide information for vEdge VM and click to install.

vshield-edge06

Since vShield zone is base on Network crossing host, only one VM will be created and deployed by vShield Manager.  vSheild-Edge-DvPorgGroup can be migrated to other Host without any issues.

vshield-edge07

There is option when you install vEdge on Portgroup. It’s called Port Group Isolation.

You can prepare and install a port group isolation on vDS. It is an option for vEdge and it only works for vDS based vShield Edge. The port group Isolation creates a barrier between the protected VM and external network. Only NAT nuels or VLAN tags are configured.

At same time, a new vShield-PGI-dvSwitch will be created to handle traffic control. Each port group isolation will create a new VM.

Configuring vEdge

Everyone configures it differently. Please check out screen shots.

vshield-edge08

Firewall

vshield-edge09

NAT

vshield-edge10

DHCP

vshield-edge11

VPN

vshield-edge12

Load Balancer

Load Balancer is only for HTTP protocol at this stage. It’s designed for front web servers.

vshield-edge13

Few things to be aware:

  • At this day, vEdge can handdle 40,000 concurrent sessions.
  • You can make rules in the different layer, but new rules don’t apply to established sessions unless you manually apply it.
  • You can always create security groups as logical unit to manage your rules.
  • There is no package capture functions in vShield.
  • vEdge license can be included in Vmware View premium version.
  • vZone license can be included in vSphere Advanced.
  • vApp license can be included in vCloud director.

We will talk about vApp in next post.


 

Here is a details you may find handy in the future. As we all use Microsoft products, MS always release their Demo with vhd format. I always thought it would pretty easy and straight forward to convert vhd to vmdk. But it turns out it’s not exactly smooth like it sounds. so I write this article to help everyone who may have same issue.

Let’s check out the basic requirement.

Sharepoint 2010 Demo.

You need to download 28 winrar compressed files from Microsoft website. It will occupy 17GB space.

Extra those 17GB files, you will get two folders.  2010-7a (44GB,vhd) and 2010-7b (14GB,vhd) file.

These vhd are using thin mode. The full size of vhd is 133GB each.

Goal:

Run Sharepoint Demo in the Test or Dev Environment.

Hyper-V Solution:

You can install Windows 2008 R2 on a real physical server and add on Hyper-v feature.  However, if you don’t have Hyper-V, you may encounter following.

Hyper-V in Vmware Env  issues:

1.MS doesn’t allow you to enable Hyper-v feature on a VM. There is no other way to install Hyper-V on VM.

2. Virtual PC can’t run this Demo either. As matter of fact, MS recommend only use Hyper-V R2 to run it.

 

Vmware Solutions:

If you environment is complete VMWare, we need to figure out a solution to run DEMO in the Vmware vSphere Test or Dev env. But we also don’t want to waste all unnecessary space during the procedure. So for all converting, vhd or vmdk must be stay in thin disk mode.

 

Using Vmware Convert:

Vmware Convert is an excellent tool. However it doesn’t support vhd file directly. It requires thirdparty software to do preparation. Vmware Converter has 5 ways to import other machines into Vmware.

  1. Power-On Machine(As long as they are windows server and 2003 up. Physical or VM, using MS VSS.)
  2. VMware Infrastructure virtual Machine (convert a vm from Vmware ESX itself)
  3. Vmware Workstation or other Vmware virtual machine (must be a vm, not just a single disk. For vm server as well.)
  4. Backup image or third-party virtual machine (Support virtual PC, Symantec Recovery Imange, Acronis etc, must be a vm, not a single disk).
  5. Hyper-V server (It will deploy convert agent on Hyper-v, doesn’t require reboot).

 

In our case, we need to use method 3,4 or 5 to do the job.

Method 3 requires a Vm workstation or VM server version of VM. We can use Starwind to do this job.

Starwind:

Starwind free tool V2V convert can convert VHD to VMDK and vice verse.

It can has following options. First 3 options are what we concern.

 

Vmware growable image and VMware pre-allocated image are VMware workstation version VMDK. First option is to use thin disk mode.If you choose this one, you have to download a VM workstation or VM Server to create a VM.

Vmware ESX Server image is what we want. But it has biggest issue. There is only thick mode for this option. In our case, you have to convert 43GB VHD(thin mode) to 131GB VMDK (ESX but thick mode). You can upload this big fat file to your storage space but it will cause lots disk consumption and time.

 

Then, you can use VMware converter to import it into ESX.

Method 4 is the one I recommend here.

All what you need to do is to download Virtual PC 2007 SP1 which can be installed on the Windows 2008 R2. You can simply run it easily and ignore the warning it gives you since you don’t need actually to run vm.

You just need to create a Mcirosoft Virtual PC VM. Then, you can use VMware convert to import it into ESX.

 

Method 5 is a little distance to go.

You need to install a Hyper-v on bare physical hardware and create a VM and import the vhd disk. Then, you can use VMware convert to import it into ESX.

 

Conclusion:

Convert VHD to Vmware method.

Install Virtual PC 2007 sp1-> Create a vm->using vhd->save vmc file->load VM Converter->use method 3->import into vSphere

Install Starwind->Convert VHD to ESX Server VM->save full size VMDK file ->Upload full size VMDK file->Create VM in vSphere->using VMDK disk (full size)

Install Starwind->Convert VHD to VM workstation vmdk(thin)->save thin vmdk file->install VM workstation or VM Server->Create vm->load vmdk->create vmx file->load VMConvert->import into vSphere with thin mode

Or you can use Winimage to replace Starwind

Reference:

Download virtual pc 2007 sp1

http://www.microsoft.com/downloads/en/details.aspx?FamilyId=28C97D22-6EB8-4A09-A7F7-F6C7A1F000B5&displaylang=en

http://www.sharepointdevwiki.com/pages/viewpage.action?pageId=23429169


vSphere 4.1 has been released for a while. But It’s difficult to find an post dedicate for the difference between ESXTOP 4.1 to it’s previous version. This post will include difference and some explanation. Please feel free to leave any comments.

I have few posts regarding in ESXTOP so let’s see what’s new in version 4.1.

Note: All ESXTOP I refer in this top will apply to resxtop in the vSphere CLI or vMA as well.

What’s New in ESXTOP

First of all, Vmware finally claims ESXTOP can be used to monitor NFS protocol, which is a good news for users who have NAS. The limitation of 2TB for maximum datastorage starts to block VMFS in it’s own way. More and more company started to use NAS to act as central data center. We used to use vscsistate to check out performance of NFS, now ESXTOP finally supported it too.

CPU Power monitor

In this new version of ESXTOP, you will be able to monitor how much watts your CPU consumes.

I can quote some explanations from Vmware doc. But I am not able to explain why my idle session has %14 %LAT_C and %799 for %DMD.

Memory compression monitor

This is one of new feature vSphere 4.1 brought to us. The ESXTOP does support it.

If you want to learn more about Memory compression, please click here

New Disk renamed monitor

If you have read my previous post, you would know Vmware started to use new name convention in the v4.1. If you haven’t read it, please click here.

Since we have used new name for UUID, vml, and identify name for device. Thing changed in disk monitor. ESXTOP has Storage Adapter Panel (press d), Storage Device Panel (press u) and VM storage panel (press v) to read information like latency and I/O information. In the newer version of ESXTOP, some of meters have been removed and replaced.

Network Multicast/broadcast monitor

Just see the diagram and you will understand the change.

Interrupt panel Monitor

It’s still there. Except name has been changed to COUNT_x.

All rights. To summer this post, there are some new changes in almost all the areas. But no new panel appears and esxtop still can be used in batch and replay model as usual.

Please let me know what you think. Have fun.

Reference:

https://geeksilver.wordpress.com/2010/08/09/vmware-vsphere-4-1-vs-esx-3-x-storage-identifier-understanding/

http://www.vmware.com/files/pdf/techpaper/VMW-Whats-New-vSphere41-Performance.pdf

https://geeksilver.wordpress.com/2010/08/04/vmware-vsphere-4-1-memory-compression-understanding/


I have spent some time on collecting information for VCAP. I have downloaded the blueprint but it turns out I have too much stuff I need to catch up. so I am thinking why not sharing some of my collection while I’m searching? Here is the first post and please write to me if you have your own way to prepare VCAP.

Ok. Today topic is understanding storage identifier in vSphere 4.1. I’m not quit sure whether you have noticed the storage identifier in ESX 3.5 is a mess. It’s different from the name you give it via the SAN and it’s all different on each host. vSphere 4.1 has dramatically changed the chaos with new name and new rules. Let’s take detail look.

Please be aware that all ESX 3.x examples and discussion in this post referes to ESX (not ESXi). All ESX 4.x refers to ESXi 4.1 only since we won’t use ESX anymore in vSphere 4.1. Also, ESX 3.X will see different storage device (but same type) vs ESX 4.x.Please look the keywords not exactly label.

There are 4 different ways ESX use to label storage.

ESX 3.X

  • vmhba<Adapter>:<Target>:<LUN> or vmhba<Adapter>:<Target>:<LUN>:<Partition>
  • vml.<VML> or vml.<VML>:<Partition>
  • /dev/sd<Device Letter> or /dev/sd<Device Letter><Partition>
  • <UUID>

There are 6 different ways ESX use to label storage.

ESX 4.X

  • naa.<NAA> or  naa.<NAA>:<Partition>
  • eui.<EUI> or eui.<EUI>:<Partition>
  • mpx.vmhba<Adapter>:C<Channel>:T<Target>:L<LUN> ormpx.vmhba<Adapter>:C<Channel>:T<Target>:L<LUN>:<Partition>
  • vml.<VML> or vml.<VML>:<Partition>
  • vmhba<Adapter>:C<Channel>:T<Target>:L<LUN>
  • /dev/sd<Device Letter> or /dev/sd<Device Letter><Partition> (ESX only, not for ESXi)

Let’s take a look what ESX 3.x storage properties tell us about device name.

Vmware use vmhbax:y:z to identify a storage device. How about ESX 4.x?

Here it is. New identifier for ESX 4.x.

naa.<NAA> or eui.<EUI> to replace vmhba
vmhba was very confused in the ESX 3.X version. It could be considered as path name or device name. In the ESX 4.X, vmhba is exclusively to identify a path to LUN.

NAA stands for Network Addressing Authority identifier. EUI stands for Extended Unique Identifier. The number is guaranteed to be unique to that LUN. The NAA or EUI identifier is the preferred method of identifying LUNs and the number is generated by the storage device. Since the NAA or EUI is unique to the LUN, if the LUN is presented the same way across all ESX hosts, the NAA or EUI identifier remains the same.

mpx.vmhba<Adapter>:C<Channel>:T<Target>:L<LUN> ormpx.vmhba<Adapter>:C<Channel>:T<Target>:L<LUN>:<Partition>

Some devices do not provide the NAA number described above.  In these circumstances, an MPX Identifier is generated by ESX to represent the LUN or disk. The identifier takes the form similar to that of the canonical name of previous versions of ESX with the mpx. prefix.  This identifier can be used in the exact same way as the NAA Identifier described above but it’s for local disks identity. In other word, this is used for local device only.

vml.<VML> or vml.<VML>:<Partition>

The VML Identifier can be used interchangeably with the NAA Identifier and the MPX Identifier. Appending:<Partition> works in the same way described above. This identifier is generally used for operations with utilities such as vmkfstools.
The vml path hosts the LUN ID, GUID and partition number information and this is also stored in the volumes VMFS header. Vml construct is used by kernel to define paths to see SCSI LUN.

/dev/sd<Device Letter> or /dev/sd<Device Letter><Partition>

This naming convention is not VMware specific. It’s decided by Red Hat Linux and you won’t see that in the ESXi 4.1 since it’s replaced by mpx. This convention is used exclusively by the service console and open source utilities which come with the service console. The <Device Letter> represents the LUN or Disk and is assigned by the service console during boot. The optional <Partition> represents the partition on the LUN or disk.  These naming conventions may vary from ESX host to ESX host, and may change if storage hardware replaced.  This identifier is generally used for operations with utilities such as fdisk and dd.

Note: VMware ESXi does not have a service console; disks are refered to by the VML Identifier.

<UUID>

The <UUID> is a unique number assigned to a VMFS volume upon the creation of the volume. It may be included in syntax where you need to specify the full path of specific files on a datastore.  The UUID is generated on the initial ESX host that created the VMFS volume based on the UUID creation standards. It’s possible to have same UUID although it’s very rare.

I’m going to show you a series of command and you will see the difference between ESX 3.x and ESX 4.x.

Please leave comments if you want. Thanks

This slideshow requires JavaScript.

Reference:

UUID: http://blog.laspina.ca/ubiquitous/tag/vml

ESX storage: http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1014953

UUID is not unique:

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1006250


As you all may know ESXi is not long a free product for Vmware. The original free product is renamed to vSphere Hypervisor. So what’s the difference between these two?

Well, at this stage, there are no difference between these two products besides license. The installation is the same version of ESXi.

The installation file is the same size. No difference during the installation. It means you can demote any ESXi 4.1 to Hypervisor with Hypervisor license. All what  you need to do is to use vSphere client connect to that Host and apply Hypervisor license.

Let’s see what’s difference after applying license.

I guess we all clear here?