Xtravirt — AirWatch – Mobile Management

by Curtis Brown

VMware NSX® network virtualisation platform has been around for a little while now delivering an operational model for networking that forms the foundation of the Software-Defined-Data-Centre.  It’s often associated more with server virtualisation or as a component within a Cloud Automation solution and with good reason; it’s readily able to deliver a scaled, secure environment, while providing several mechanisms to deliver advanced network functionality such as firewalling, load balancing and anti-malware protection.  However, one area where its application is frequently overlooked is in the world of End User Compute – more specifically virtual desktop infrastructure.

Wouldn’t it be nice if…

Consider a full-on Horizon deployment (though, to be fair, these components could be replaced in the most part for an element of your choice) –

•  Horizon View – This will publish Virtual Desktops in Pools, with these pools assigned to Active Directory based Groups/Users.
• App Volumes – This gives you a mechanism for delivering defined stacks of applications to the Virtual Desktops.Again, you can assign using Groups or users.
• User Environment Manager – You use this to manage environmental and application settings.

 So, you have the mechanisms in place to deliver Virtual Desktops, complete with some granular application and settings delivery.  This is all pretty good, but wouldn’t it be nice if you could provide some intelligent network capabilities too?

Finetuned Firewalling.

Now take VMware NSX - this has some nice features that you can leverage in a VDI estate.

One of the key areas of concern is hardening the estate.  There’s been a pretty big play in the NSX world around using NSX to provide segmentation – both at a macro level, separating workloads into different VXLANs on virtual switches – and at the micro level using the Distributed Firewall to provide firewall rules at the Vmnic. Both strategies can be used here.

You can also separate Pools at a macro level or a micro level if you wish to, with the latter being particularly interesting.

The Distributed Firewall can provide a great deal of flexibility when defining firewall rules and can leverage several different identifiers, including vSphere entities and Active Directory objects.  Using these, you can generate a rule bases to lock down traffic quite tightly, in conjunction with the VDI solution and application delivery mechanism.  Take this example:

You can set up a standard DFW ruleset that applies to your desktops that will prevent traffic between the virtual desktops, while still providing the core services and application support for anything required for the desktop. This means you can control LDAP traffic between the desktops and Domain Controllers or PCoIP between the desktops, the Connection Servers or direct to physical endpoints if you wish.

 With App Volumes, you can define an AppStack with several applications which may well have discrete client/server network traffic requirements.  The DFW can apply rules based upon the user logged into the desktop, so you can create and apply rules specific for these client server applications and tie them to the same Active Directory object that applies the AppStack.

 The net result is that you end up with a combined ruleset applied to a desktop that is not just tied to a broad pool, but also to discrete needs for users within the pool. This provides strict granular access based upon the needs of the desktop and the application set for the user.  And let’s remember that this is applied at the desktop’s connection to the network – not at any perimeter level.

Malware Protection

NSX also provides the ability to integrate a compatible antivirus/antimalware solution into the mix. This is not, however, limited to the more publicised Guest Introspection where virus scanning is offloaded at the hypervisor level.  NSX can also integrate with both virtual and physical appliances such as Fortigate for intrusion detection, perimeter firewalling and more.

At the Infrastructure Level

As with any VDI estate, you have the upstream infrastructure to consider, several services can be provided here too.  

Using VMware NSX Edge Gateway appliances, you can provide perimeter firewalling between networks.

For Horizon View, both Connection Servers as well as Access Gateways/Security Servers require Load Balancers, as do App Volumes Managers.  The NSX Edge appliances are capable of being configured to provide load balancing services.

Perimeter firewalling using NSX Edge can also be provided, so you can have a DMZ layer for the Security Servers/Access Gateways as well.

Generally speaking, you could deploy something like this for the Horizon View management environment:

Our external traffic accesses the estate via a pair of NSX Edge Gateways, serving as firewall and load balancer for a pair of VMware User Access Gateways.  These are configured as two-legged, tunnelling into the vSwitch beneath, where you have a dedicated NSX Edge appliance load balancing the Connection servers.  This internal load balancer is also used by internal users who connect in via an L2 bridge or NSX Edge as appropriate.

 You then deploy NSX for the Desktop blocks as well, in order to provide the previously mentioned firewalling and malware protection for a secure end-to-end solution.

Closing Thoughts…

With NSX, it’s possible to turbo-charge the security for a VDI desktop environment in a manner that can be applied regardless of the choice of broker solution – the above would work just as well in a third party VDI solution such as Citrix XenApp or, perhaps more importantly, XenDesktop, not just VMware Horizon.  The ability to dynamically set and operate firewalling on egress outside of the guest Operating System means that such firewalling cannot be tampered with from within the VDI desktop, which might be useful in environments where desktops are used with untrusted users (public kiosks for example).

If you’re interested in exploring the combination of VMware NSX network virtualisation in a VDI estate, please contact Xtravirt, and we’d be happy to use our wealth of knowledge and experience to assist you.

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He is a VMware vExpert 2017.

By Curtis Brown

Introduction

As a highly respected, award winning VMware partner, Xtravirt has had the opportunity to send consultants on VMware’s Advanced Architecture Course at their headquarters in Palo Alto.  The first two consultants attended earlier this year, and I got my opportunity in September 2018.

This article (a somewhat non-technical one) describes the purpose of the course and my experience attending it.

What is the Advanced Architecture Course?

VMware have always been a technology company.  As the product portfolio has grown outwards far beyond the original hypervisor product, VMware have realised that while the technology is perfectly good, what is more important is the purpose to which the technology is applied.

Often, solutions get purchased (or for that matter, sold) based purely on the technology and its capabilities.  This rather misses the more important point of ‘what benefit will this solution be to the business and why should we use it?’  As such, in the worst cases, such acquisitions can end up as ‘shelf-ware’ – acquired, tested but ultimately deemed of little value and not used.  This is harmful to the customer and, significantly, harmful to how VMware is perceived by the customer.

The Advanced Architecture Course is a product of VMware’s desire to change the emphasis to being business needs driven.  The course aims to take experienced consultants and architects and provide them with a business needs oriented approach to discovering requirements and proposing solutions to meet those requirements.  A key part of this involves educating consultants on how to present to C level executives – all of which is quite a departure from the comfort zone for technically focused consultants.

My Adventures in Palo Alto

I’ll gloss over the journey out there (which was quite an adventure in itself – avoiding Hurricane Florence, almost missing a connection and losing a suitcase…) and focus on the course itself.

The course was a nine-day affair and to pass the course as a whole, we had to accrue a score of greater than 70% on all the objectives.  This included points for the pre-course online study (on matters ranging from ITIL and TOGAF through to VMware Workspace ONE), points for passing the end of day tests on content and the final presentation – which I’ll describe later.

It all started early on a sunny California Monday morning (at 7am!).  The first day focussed on VMware’s model for developing a business’ journey from basic virtualisation through to hybrid cloud and microservices as well as their model describing application of Digital Workspace technologies to business.  The approach consciously avoids specific products – so, for example, for Digital workspace, it describes the journey from traditional identity management through multi-factor authentication to single-sign-on.

Day 2 focused on the importance of requirements gathering, but broadening from just the traditional technical viewpoint outwards to business requirements – ‘we need to increase business revenue by… ’.  The importance of adapting the operating processes as well as IT were emphasised on Day 3.  A key message was that technology is only a part of the solution, without adapting to accommodate new abilities, those new abilities will still be hog-tied by legacy approaches to new needs.

We then had a particularly interesting day being taught presentation techniques, covering presenting to large audiences, conflict resolution and useful tips and tricks.

From here on out, the focus was on new technology, but with a business as a driver slant.  It’s not possible to replay much of the course content here for non-disclosure reasons, though, again, the idea was to broaden the knowledge of consultants.  As such, the breadth of technical areas covered was vast.  It included Cloud and DevOps, through network virtualisation and End User Compute to emerging solutions such as serverless computing, app containerization and Kubernetes.

The final day, although the briefest was the most challenging.  At the beginning of the course, the attendees were broken down into groups and given a case study.  From this, the groups had to work out a requirements matrix and put together a 20-minute final presentation (plus 10 minutes of questions) covering requirements, conceptual and logical design for a global solution encompassing both Software Defined Data Centre and End User Compute technologies.  This led to many long days putting in additional hours throughout the two weeks as well as some weekend work.  The presentation was to be given to a panel consisting of senior VMware staff (senior vice presidents and the likes) serving as the C-level execs of this fictional corporation.  This contributed most of the points on the course – so a pass here was important.

Fortunately, I was surrounded by thirty-seven of the smartest consultants and architects from all four corners of the world.  It was a real pleasure to work with these guys and I have to say that, despite the difficulty of the course, I wasn’t too surprised that we all passed.

Closing Thoughts

It was without doubt a tough course, intended to take the attendees out of their comfort zone to both broaden skills while also attempting to equip them for dealing with a bigger picture than just technology.  For me, it certainly has taught me a great deal, disproving the line “you can’t teach an old dog new tricks”.

Certainly, I consider myself fortunate to be working in a company that provides the opportunity to attend courses such as this.  It’s an investment for the company, of course, but one that ultimately benefits the customer.

(The day trip up to San Francisco was rather nice too, I can recommend the calamari and chips at Pier 39…).

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He was awarded VMware vExpert 2018 and is a graduate of the VMware Advanced Architecture Course 2018.

About Xtravirt

Xtravirt are an experienced consulting firm dedicated to delivering outcomes to help customers solve their IT challenges. We design and build strategies to help customers unlock the full potential of cloud, datacentre and workspace technology.

We are the VMware Global and EMEA Professional Services partner of the year.

www.xtravirt.com

By Curtis Brown

Introduction

In the wonderful world of VMware based virtualisation, there has been a concerted effort in recent years to not just virtualise the compute side of matters but expand out into networking (with VMware NSX) and the provisioning of storage (VMware vSAN). This all results in a single VMware Hyper-converged infrastructure offering.

An important factor within this is security.  VMware vSphere itself has considerable security with its small footprint, hardened hypervisor and the move towards a hardened Linux based appliance as the preferred option for the VMware vCenter management server.  VMware NSX can be argued to be a security product in and off itself – providing not only edge firewalling capabilities but per-VM based firewalling with the Distributed Firewall and support for agentless malware protection solutions with the Guest Introspection framework.

But what of VM storage? SAN solutions can offer security measures, subject to the SAN vendor, but how does this apply in a VMware vSAN environment?

There are two options available:

• VM Encryption
  
• VMware vSAN Encryption
  

Each has some pros and cons – so let’s take a look.

VM Encryption

 Fundamentally, this is the encryption of virtual machines themselves.  There are third party (and, for that matter, in-guest) encryption offerings, but we’ll focus on the built-in VM encryption capability that was released in VMware vSphere 6.5.

It’s pretty straightforward to set up, requiring only two things – the deployment of an encryption Key Management Server (compatible ones are listed here and in the Interoperability guide) and a VMware vSphere Storage Policy.  After that, apply the policy to a given VM and – hey Presto!

So, what’s the catch? The encryption works on all IO operations for the VM itself at the top level – as it’s written to the Virtual Disk. This means that all IO operations in transit are encrypted as well as at rest on the physical disk.

From a security standpoint, this is very secure, and as it’s on a per-VM basis, it’s granular – you don’t need to encrypt everything (though you could argue that this is a management overhead).  However, the downside in a vSAN environment is that the encryption occurs before de-duplication, so no space saving is possible.

There are further caveats with VM encryption to be aware of:

• The VM Snapshot ‘Capture the virtual machine memory’ function is not compatible.
  
• vSphere Fault Tolerance does not work with VM encryption.
  
• Suspending (and resuming) encrypted VMs is not supported.
  

In addition, not all vSphere integrated backup solutions can support VM level encryption.

vSAN Encryption

 VMware vSAN Encryption uses the same Key Management Server, but this time the VMware vSAN storage is itself encrypted.  It’s applied at the cluster level, so anything stored in the vSAN cluster is encrypted – no management overhead as such, but no granularity.

All data travel is in an unencrypted state – it is encrypted when the data hits the caching tier, decrypted when it is de-staged from the cache for de-duplication and writing to the data tier.  This means that data-deduplication can be applied in combination with encryption, however the down-side is that encryption is therefore limited to data at rest (i.e. written to disk) as opposed to end-to-end as would be the case for VM encryption.

As encryption is at the storage tier, it is essentially invisible to VM operations – so vSphere operations such as Fault Tolerance and snapshots are fully supported and most vSAN aware backup solutions aren’t impacted.

Comparing the options

 To compare these two options:

Closing Thoughts

 Both mechanisms have their use cases.  VM encryption is the more secure when you consider that it is capable of full end-to-end encryption.  It also benefits from being able to support traditional SAN datastores as well as vSAN. However, some VMware vSphere functionality is impaired when compared to vSAN and there is more of a management overhead.  In a modern all-flash estate, IO drops caused by encryption are negligible in both cases, so performance should not be a concern.

VM Encryption is worth considering, though it does add a layer of complexity to an estate. If the deployment of a robust KMS (Key Management Server) solution is a must, then there is configuration of the solution itself.

If you’re considering implementing or upgrading a VMware vSphere environment and data security is a concern, please contact Xtravirt, and we’d be happy to use our wealth of knowledge and experience to assist you.

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with strengths in VDI, storage integration, backup and Disaster Recovery design/implementation. He is a VMware vExpert 2018.

by Nick Goldman

VMware Cloud Foundation brings the best in breed virtualisation of network, storage and compute in a pre-validated and automated package. VMware cloud is used in VMware based public cloud solutions such as; VMware cloud on AWS and IBM cloud for VMware solutions. VMware Cloud Foundation lets you spin up a private cloud environment in a much-reduced time frame and deliver a reliable hybrid cloud environment.  

VMware Cloud Foundation 3.0 was announced only a few months ago at VMworld US 2018. Version 3.0 removed the requirement to use Cisco or Arista switches. Now any switch provider that is on the VMware Hardware Compatibility List (HCL) can be used which will allow for VCF fitting into existing environments.  VMware has now also added all vSAN ready nodes which opens up far more flexibility with hardware.  

A number of management of improvements were also made also assist with enterprise deployments. These included the ability to skip upgrades of vCenter and ESXi which helps with compatibility of 3rd party solutions). Cloud Foundation 3.0 also supports multiple clusters in a workload domain to allow for larger workload domains and reduced size of failure domain and specific use cases which require small clusters (such as licensing) and stretch clusters.

Now only a few months later the next release 3.5 is announced and brings a raft of new features including support for NSX-T and PKS (Pivotal Container Service), support for composable infrastructure (initially HPE Synergy) and support for external NFS (which allows the use of existing storage for workloads).

Including NSX-T in VMware Cloud Foundation shows the direction that VMware are heading towards with much larger use cases for NSX-T.

What is VMware Cloud Foundation?

VMware’s Cloud Foundation was born out of the VMware EVO SDDC (Software Defined Data Centre) platform and is designed to make private and public clouds easy to deploy, manage and secure. It also allows cloud providers such as IBM and VMware Cloud on AWS, as well as private data centres, to quickly deploy and scale out a cloud platform.  

“VMware’s Cloud Foundation allows cloud providers to quickly deploy and scale out a cloud platform” 

VMware Cloud Foundation is a Hyper Converged Infrastructure platform that that delivers software defined compute, storage and networking services (NSX) to allow agile delivery of virtual servers or containers. The solution is made up of vSphere, VSAN and NSX overlaid with a management solution (the SDDC manager) which is used for both setup and day 2 operations such as patching and monitoring. 

Cloud Foundation version 3.5 has just been released and includes the latest releases of all VMware products including vSphere 6.7U1, vSAN 6.7U1, NSX-V6.4.3, NSX-T 2.3 and optionally vRealize Automation 7.5. and vRealize Operation 7.0, vRealize Log Insight 4.7

Delivery Model

VMware Cloud Foundation is available in three delivery models: 

• Through a public cloud provider such as VMware Cloud on AWS or through one of the VMware Cloud Provider Program providers such as IBM or Rackspace   
  
• As an engineered solution such as Dell EMC’s VxRack solution which comes preconfigured and installed (however customers have informed me this at present introduces a delay while the configuration is certified 
  
• Deploying on any vSAN ready nodes from any vendors including Dell EMC, Cisco, Fujitsu, HPE, Hitachi and Quanta 
  

Cloud Foundation can speed up the delivery of an SDDC solution by having a pre-validated and tested solution using VMware best practices. This can reduce the complexities and lead times associated with traditional datacentre infrastructures. VMware on AWS will be the proving ground for many new features on VMware Cloud Foundation and as the suite is all based in software VMware will be able to rapidly add features.  

“Cloud Foundation can speed up the delivery of an SDDC solution” 

The management of Cloud Foundation is via the VMware SDDC Manager. From within here you can do the initial bring up which just requires a few details such as time, network settings and DNS and NTP servers. The SDDC manager will bring up the entire stack including switch configuration, host configuration and a management cluster (a four-node cluster containing a dedicated vCenter, NSX manager and vSAN). Once the bring up procedure has been completed, you are then able to deploy workload domains which are policy driven based on the performance and availability requirements. The workloads can either be virtual server infrastructure or virtual desktop infrastructure where the SDDC manager will automatically deploy a fully functional VMware view environment.

Is VMware Cloud foundation right for my company?

Whether Cloud Foundation is right for your organisation for not depends on what your commitment to other hardware solutions such as a SAN or blade enclosures are. In these cases, it may not be best to change your entire infrastructure to start using Cloud Foundation, but if you have end of life hardware or you are looking at putting in NSX to virtualise your organisation’s networking then it could help to reduce the time to get the new platform up and running. In addition, with the lifecycle management included it will reduce some of the burden associated with keeping your cloud platform up to date.

If your organisation has previously struggled with setting up new technology or it has taken an excessively long amount of time to deploy and expand, then VMware Cloud Foundation could be the right solution for your organisation. VMware will allow you to transfer existing unused licenses for individual components to Cloud Foundation.

VMware Cloud Foundation has similarities to other solutions such as Nutanix, which provide a simplified management for their hyper converged platform. However, the inclusion of technology such as NSX in the platform is more advanced than some of VMware’s competitors.

“Cloud Foundation takes VMware’s best of breed technology and wraps a management layer around them”.  

Version 3.5 also offers the latest versions of VMware products which was part of VMware’s commitment to reduce the time between when products were released individually and when they are available as part of VMware cloud foundation.

Closing thoughts

VMware Cloud Foundation has become a very comprehensive solution for organisations looking to deploy there SDDC in a reliable and standardised fashion whilst reducing timescales for design and deployment. It takes VMware’s best of breed technologies and wraps a management layer around them. As companies look to move towards a buy rather than build strategy with their infrastructure then VMware Cloud Foundation is on point to be a tried and tested solution. VMware are starting to open up options of hardware in this release which will make Cloud Foundation to suitable for many more organisations who are looking to upgrade or deploy a new SDDC or to put them on the path to the hybrid cloud journey via NSX hybrid connect. 

If you are interested in VMware cloud services and solutions and want to know how they can benefit your organisation Xtravirt can help. We provide advisory, design and implementation services to create the right solution for your organisation. Contact us and we’ll be happy to use our wealth of knowledge and experience to assist you. 

About the Author

Nick Goldman is a Senior Consultant within the Xtravirt consulting team. He is an experienced infrastructure consultant with experience in both technical architecture and hands-on implementation. His areas of expertise include virtualisation solutions based on the VMware stack and Microsoft based infrastructure solutions.

About Xtravirt

Xtravirt are an experienced consulting firm dedicated to delivering outcomes to help customers solve their IT challenges. We design and build strategies to help customers unlock the full potential of cloud, datacentre and workspace technology.

We are the VMware Global and EMEA Professional Services partner of the year.

www.xtravirt.com

By Michal Grzeszczak, Senior Consultant, Xtravirt

As a Senior Consultant at Xtravirt, I recently spent time with a customer, a major European airline, to plan and oversee the deployment of VMware NSX^®.

In the aviation industry, a data breach could have catastrophic repercussions.  Concerned about data security, the customer chose VMware NSX for its security capabilities.  This is because NSX allows for micro-segmentation, a practice through which workloads are individually cordoned off to prevent any East-West movement in the event of a breach.  In contrast to most IT networks, where one firewall protects the entire perimeter, a breach in a micro-segmented network can only impact a small subset of data.

With the objective to increase environment security and control East-West traffic, the project was managed in five key phases:

Phase 1 – Discovery and Planning

Xtravirt kicked off the project with a 2-day planning workshop with key technical staff and subject matter experts.  In this phase we confirm and capture the full scope of requirements and ensure we fully understand the current environment.  This process reveals any prerequisites, potential roadblocks and validates the use case.

In this instance, the customer has two data centres, one vCenter Server (version 6.5) and uses vRealize Network Insight (vRNI) to monitor their environment.

During the initial discovery phase, it became apparent that vRealize Network Insight (vRNI) could be used to better understand East-West traffic and to map the customer’s applications to the security policy that could be provided by NSX Distributed Firewall (NSX DFW).

Both solutions, vRNI and NSX DFW, are quite unique in the market and help solve many typical problems associated with securing workloads in modern data centres. In this instance, they helped to:

- gain a better understanding of the flows of the applications, how they communicate with the outside world as well as within the application itself

- secure East-West traffic and avoid reliance on the perimeter firewall to segment those workloads.

Phase 2 – Installation and configuration of vRNI

The installation and configuration of vRNI onto the customer’s environment involved adding the “Data Sources” to the vRNI, where the data (flows) would be collected. There are many data sources supported by vRNI, including for example - vCenter, NSX-V, NSX-T, as well as third party devices like Cisco, AWS and Arista.   A list of supported solutions can be found here: https://docs.vmware.com/en/VMware-vRealize-Network-Insight/3.6/com.vmware.vrni.install.doc/GUID-4BA21C7A-18FD-4411-BFAC-CADEF0050D76.html

After adding the necessary sources, vRNI collected all the flows for a 30-day monitoring period.  Other VMware solutions such as Application Rule Manager, allow for a maximum of 7-days monitoring and provide a great option for small applications. However, vRNI’s 30-day monitoring period is especially useful when applications in the environment are particularly active during specific times, like a payroll application.

Phase 3 – Defining workloads

The next step was to define which workloads were part of which application.  In this particular case, we had 4 main requirements:

- micro-segmentation of Application “A” which consisted of 3 tiers. Each tier needed to talk to other tiers only on needed ports, thus securing flows within the application.

- micro-segmentation of Application “B” which consisted of 3 sub-applications.  The goal here was to secure traffic between sub-applications and not within each sub-application.

- mapping of the shared services (active directory, monitoring etc.) that are necessary for the applications to function properly.

- mapping of the users that need access to those applications.

As the users and shared services communicate with all applications in the environment, we started with the first two requirements.

It is very easy to create a logical application in vRNI. You simply add workloads to the tiers that make each application. In the case of Application “A”, the action was to create three tiers, each with corresponding workloads. In the case of application “B”, even when dealing with multiple applications, the process was the same as the requirement was to secure Inter-Application flows. We simply added workloads from each sub-application to the corresponding Tier in vRNI.

Phase 4 – Security planning

The next step was to go to the “Plan Security” section of vRNI and select our new logical application. That presented us with a “pizza” view of the tiers of the application, in both application cases. We then selected each tier of the pizza/application and extracted incoming and outgoing flows to a .csv file. This part of the application mapping can be done directly in vRNI.  However, due to the complexity of the applications, we needed to view these flows in an Excel sheet.

The most time-consuming part of the implementation at this point had been to map flows from vRNI to the design document section for security rules / security groups / IPSets in NSX DFW. Use of filtering options in Excel and colour coding the types of traffic allowed us to have a clear visual representation of the flows in the environment. We divided the flows into Shared Services, Inter-Application communication between applications that we were mapping, Intra-Application communication between workloads that we were mapping as well as user access.

Phase 5 – Application Mapping

Establishing communication between mapped applications and unmapped applications is the final stage. Under the scope of the engagement our role was to map 2 out of 70 applications. Our role as consultants was to ensure knowledge transfer and develop a repeatable process so the customer could complete their own application mapping.

Once the whole environment is mapped, then Security Groups / IPSets in DFW can be created for all applications.  Specific rules will be put in place to cover necessary flows between applications.

During the process of application mapping we were able to get necessary information about Shared Services and Users. The former was mapped into a separate NSX DFW section on top of all the other sections to be checked by DFW first (rules in NSX DFW are checked top to bottom). These sections will need to be constantly updated as more applications will be mapped and will require additional ports to be open to communicate with Shared Services. The latter was divided into floors, buildings and countries with corresponding IPSets to provide more controlled access. Those IPSets were added to two Security Groups - “Super Users” and “General Users” and were added to each application’s section to allow for management traffic.

Conclusion

By scoping out the project with the customer from the offset and having a clear and concise goal in place we were able to decide on the right tools for the job and move forward with minimal stumbling blocks. vRNI gave us a clearer picture of the road ahead and defined the East – West traffic that needed to be segmented and controlled to ensure that any potential data breaches could be stopped fast and with minimal leakage.

vRNI and NSX DFW created the perfect combination for a creating a market leading security solution and better still working to a planned and repeatable process made the whole operation smooth from beginning to end.

Find out more

If you would like to learn more about how Xtravirt can help you improve the security of your IT environment, contact us and we’d be happy to use our wealth of knowledge and experience to assist you.

Xtravirt (www.xtravirt.com) are the VMware Global Services Partner of the Year and have achieved the VMware Master Services Competency for Network Virtualization – a testament to our expertise in delivering NSX environments.  

About the author

Michal Grzeszczak joined the Xtravirt consulting team in September 2017. He has an in-depth understanding of NSX along with experience in software-defined networking, virtualization and data centre support.

By Michal Grzeszczak

OLD WORLD

The landscape of modern IT is constantly evolving and an aggressive shift towards the software defined data centre is arising. Nowadays, virtualisation of storage and networking is becoming as, or even more important than the virtualisation of compute. In this rapidly transforming realm, traditional networking and security can’t keep up with location-agnostic and application-centric workloads and even if they could, there are now simply better ways to solve the problems occurring in traditionally managed data centres. Security, agility, automation and visibility are the key areas where there is a need for new tooling. During a recent customer engagement, we faced all of these issues and to mitigate them, VMware NSX® and VMware vRealize® Network Insight™ (vRNI) were deployed in the environment.  

BACKGROUND

The customer’s main business objective is to provide IT services to a number of hospitals. Security regulations in the health care world (the likes of HIPPA) can be difficult to comply with, especially with traditional security methods such as using perimeter firewalls for east-west traffic control. The customer had an old data centre that contained both virtual and physical workloads, 200+ undocumented applications, Cisco 6500s core switches and Cisco ASA firewalls. As they were facing multiple challenges with this setup, the decision was made to engage Xtravirt to migrate to a new NSX based data centre.

CHALLENGES

The main challenge the customer had in their previous environment was application traffic visibility, namely the 200+ applications without proper documentation outlining necessary ports to be open in the firewall. The communication between the networking team and application team wasn’t as smooth as one could hope for either which created unnecessary holes in the overall security posture of the company’s IT department. Multiple DMZs from the Cisco ASA firewall did not scale well and the rule sprawl was becoming a problem. The security team was working reactively instead of pro-actively - a known issue with the traditional approach. All of these issues led to the environment becoming unmanageable.

To sum up the challenges:

• Lack of visibility of the East-West traffic - resulting in poor understanding of the application flows and complicating the security policy, therefore becoming difficult to manage.
  

• Communication breakdown between IT teams - back and forth email exchange proves time consuming and slows down the deployments or changes, identifying a need for a tool to provide a “source of truth” of what is actually happening in the environment. 
  

• Hair-Pinning to the perimeter firewalls and routers - sending traffic for inspection to the physical firewalls and routing to the core switches, even if the workloads reside on the same host. That is a waste of bandwidth. Also, latency sensitive applications might be affected. 
  

 GOALS

The customer decided to build a new data centre with NSX for micro-segmentation and vRNI for visibility and security planning. The next step was to migrate the applications from the old environment to a new one, then monitor traffic flows of the applications to create an adequate security policy.

 Goals communicated before the engagement:

• Use vRNI to monitor applications and services that are running in the current data centre to get a clear picture of the network flows before the migration of the applications to the new data centre. 
  
• Use vRNI to plan security policies for the environment based on the observed flows as opposed to the (lacking) documentation from the application team. 
  
• Design a security policy using NSX, based on the vRNI outcome. 
  
• Monitor the entire network, both virtual and physical workloads to get the full picture of what is happening in the environment. Then design an alert system using vRNI that will help with monitoring and troubleshooting. 

D-DAY

After adding Virtual Distributed Switches as Data Sources in the vRNI we watched traffic flows of the applications. With a few clicks, we were able to see all the traffic - ports, protocols, IP addresses - to and from any selected application. To define an application in the vRNI we simply specify the workloads that are relevant. Then the visual graph shows all necessary information as well as recommended firewall rules. We could export interesting data in the CSV file format readable in Excel and use that as a base for Security Rules creation. It is recommended to collect the flows of the application for some time, like a day or two, as not all the ports of the applications are used in the given moment. It could be a good idea to send a request to the DevOps team to sweep through all the functionality of the application, just to make sure all the traffic needed to be allowed in the firewall is actually there in the output graph of vRNI. By default, vRNI collects data every 5 minutes. 

Next steps involved creating a Security Policy using a distributed firewall - kernel based East-West firewall used for micro-segmentation. The decision was made to use Security Tags for all of the virtual workloads and IPsets for external ones. 

• The Security Tags allow for dynamic assignment of VMs. For example - you could create a Security Tag called “Web” and configure a Security Policy that will automatically add VMs with the name that contains “Web” to a specific Security Group. This is a useful feature as workloads quite often change IP addresses and location. We are simply shifting from network-based security to an object-based one that allows for agile and location-agnostic applications. 
  
• IPsets are sets of IP Addresses, subnets or a group of subnets that specify the scope of affected workloads for a given Security Group. In the customer’s environment, the zero-trust model was implemented which means that only necessary traffic is allowed on the Distributed Firewall and everything else is dropped. This type of design ensures maximum security. 

Next, the vRNI notification system was used for monitoring the new Data Centre. There are two types of notifications:

• System notifications, which are pre-defined. The list of notifications contains 100 of the most commonly appearing issues customers face during a deployment. For example, this could be a loss of network connection of the NSX Edge routers.  
  
• User notifications are defined by user and are very simple to set up. One can simply use a search bar to search for a specific query, for example, Change in the Application “App1” - and create a notification alert with the click of a mouse. Both System and User notifications are customisable. You can specify the severity of the alerts and tags to make searching for the problem easier and quicker, and contact recipients by email to notify a specific person or a team about an issue.  

RESULTS

Quite simply, they are spectacular. In my opinion, none of the solutions available on the market could solve the customer challenges like NSX and vRNI. All the goals were met and challenges mitigated. The customer now has a new health care compliant and scalable data centre with full visibility of both physical and virtual traffic. The customer also has a solution that is centrally managed and application-centric with an agile security policy, plus a customised notification system for monitoring and troubleshooting. 

ONE STEP AHEAD

VMware appears to be reading the future pretty well; by being flexible and adjusting to the market needs, this virtualisation pioneer managed to create a one stop shop for every IT requirement. With the acquisitions of Nicira and Arkin respectively, VMware expanded their catalogue with two extremely powerful and market changing solutions - NSX and vRNI. The first providing micro-segmentation, logical switching/routing and load balancing to name a few, and the second allowing for full visibility of physical/virtual networks and assisting in security planning. The fact that these two work together and give so many unique features is a game changer in the industry. Adding to the mix products like vSAN for storage virtualisation and vRA for automation, makes it even more interesting - all in software, all managed from your browser, location-agnostic and application-centric. This is a software defined revolution and it is happening right now. Join it and stay ahead of the game. 

Xtravirt is a leading VMware NSX specialist and has the ultimate combination of deep experience and agility to design and deliver your IT transformation. If software-defined networking is on your roadmap then contact us today.

To find out more visit: https://xtravirt.com/nsx/

About the author

Michal Grzeszczak joined the Xtravirt consulting team in September 2017. He has an in-depth understanding of NSX along with experience in software-defined networking, virtualization and data centre support.

by Curtis Brown

September came with the arrival of the 10^th VMworld Europe, VMware’s primary European Technical Conference. A few of us Xtravirt consultants were fortunate enough to attend and turn into roving reporters for a few days. The conference focuses on VMware® products and partner solutions, which rather implies all things virtual, however, it does include some hardware aspects as well.

Focussing on the compute side, there were a couple of nuggets that may have interesting repercussions when considering hardware purchases in the near future.

AMD is Back!

AMD have been in the processor game for a long time, primarily in the desktop side and more so for home users than corporate.  In the server side, they made waves in the x86 server industry with their Opteron line – high numbers of physical cores for competitive prices.  However, for some time, the product line has been lacking development, with the last major core release being around 5 years ago, (The Piledriver architecture).

Following the release of the AMD Ryzen range of desktop processors, based on the new Zen microarchitecture, AMD have now released the EPYC range as replacement for the Opteron.

So, what does this mean in the virtual world?  AMD are now back with a product that is competitive to the Intel Xeon range, bringing with it some pretty clever features.

In terms of specifications, the EPYC ranges from 8 to 32 cores with a boosted performance of up to 3.2GHz.  More importantly, the EPYC now provides Hyperthreading (something new to AMD) so that 32 cores can push 64 threads per socket.  Speaking of sockets, the EPYC range currently offers only 1-2 socket support.

In terms of Hypervisor support, VMware added support for the Zen microarchitecture with VMware vSphere® 6.5 Update 1 – so relatively recently.  However, there is a feature that’s provided in the AMD chipset that is currently only supported in KVM – real-time encryption of VM memory.

For the loss of around 1% performance, a VM running under KVM can be encrypted right through to the in-use allocated RAM by the memory controller using AMDs ‘Secure Run’ feature. Each VM has a unique encryption key, and the data is encrypted and decrypted as it passes through the memory silicon.  So even in the event of the hypervisor being accessed by a hacker, the VM’s allocated memory is securely encrypted.  When asked, the AMD representative mentioned that discussions about implementing the capability in vSphere were under way.

While the first partner with AMD on EPYC is Supermicro, Dell and HPE are both releasing products using this chipset.  So, competition in the Server CPU market is firing up again.

Nvidia GRiD

Nvidia are continuing to develop their GRiD solution for enhanced graphics in VDI.  The Maxwell Core M6, M10 and M60 are now supplemented by the new P6 and P40 Pascal based GPUs.  The Pascal has much higher benchmark performance that the older Maxwell, though both have certain use cases.  The table below compares the current devices:

Note that the Maxwell still supports a 512MB profile which is suitable for enhancing the standard office experience while the Pascal doesn’t.  This means the M10 is still the go-to model for numbers of instances (64), making graphically enhanced desktops possible for many users on a host. However, for power users, the Pascals have the edge.

With a single GPU, we can scale to 24 users on a Pascal, or one with a monster 24GB vRAM profile! There are also more slot sizes available on the P40, making the solution more flexible.  For Blade based estates, the MXM packaged Teslas are improving, with the Pascal based P6 packing 16GB video RAM permitting sixteen 1GB sessions while running at 10W less power than the older M6.

A big item, demonstrated at VMworld, was the new ability to vMotion VMs running with Nvidia GRiD. Although this capability has yet to be released, it means that DRS load balancing in GRiD clusters is now possible.

The somewhat criticised management software is also much improved, supporting clustering and offering greater security too.

With the improvements in hardware and the flexibility in configuration, Nvidia GRiD shows the signs of a maturing technology and an attractive one where graphics are important in VDI.

Nvidia also offer these cards, as well as additional models specifically for CUDA based mathematical calculation work.

Closing Thoughts…

The release of these products shows that the market for hardware horsepower is far from waning. Greater power leads to higher density, permitting greater efficiency in delivering workloads.

VMworld is not just a place to look at the latest virtualisation solutions, but to also a place to see what hardware can be used to host it.

If you’re interested in exploring the latest virtualisation solutions but not sure where to start, please contact Xtravirt, and we’d be happy to use our wealth of knowledge and experience to assist you.

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He is a VMware vExpert 2017.

by Curtis Brown

As those of you who have the joy of supporting end-users will know (and this old techie has worn that badge of honour!), any tool that can make getting to grips with an issue easier is always welcome, particularly if it means getting your hands on the user’s desktop to see the problem in action.

So it’s welcome news that the latest release of VMware Horizon® 7.2 brings into play a fully integrated helpdesk tool, specifically for supporting VMware Horizon desktop sessions. It provides session information, as well as several remote operational abilities such as resetting sessions, remote control, logging off users etc.

Setting up Helpdesk

You don’t need to do anything fancy to install it as it’s a part of the Connection Server installation, however there are several recommended additional steps to get best use from it.

You will need to configure the Events database – this provides session information to the HelpDesk console, so it’s pretty important. To track logon events properly, a further command should be run on each Connection Server:

vdmadmin -I -timingProfiler -enable

Oh, and ensure that the VMware Horizon Agent installed in the desktop templates is also a 7.2 release – otherwise you’ll miss desktop side session information.

Getting into the Help Desk Tool

There are two ways of accessing the Helpdesk tool.  In either case, a user will require Admin access to Horizon – Inventory Admins should be sufficient for most operations.

The first option is to log into the Admin console for horizon (HTTPS://(ConnectionServer URL)/admin). Once logged in, there is a new Help Desk button in the top bar of the console – click on this to access the helpdesk tool – the credentials pass through, all Single Sign-On style!

Alternatively, you can access the console directly (via HTTPS://(ConnectionServer URL)/helpdesk) and then log on with the right credentials.

Doing Help Desk stuff.

So, once you’re all set up and logged in, you can use the tool to do all sorts of heroic Help Desk stuff. The front page offers a search function.

Punch in the name of the user, for example, “Curtis” and it’ll pull in the Active Directory credentials of the user – if the Active Directory E-mail and phone number fields are filled in, these are also displayed.

If you click on the user, you’ll get a new page with a summary of running sessions and entitlements.

Under ‘Sessions’, you’ll see the highlights of all running sessions - the green ones are connected sessions.  It’s even Cloud Pod aware – the L status refers to a session in the local Pod, and the G status refers to a session in the global Cloud Pod environment. If you then click on the Computer name, you can drill down further.

If the Agent is 7.2+, you get detailed session info, including CPU performance, memory usage and more.  Further, you can do some active tasks on the session.

You can send messages to the specific session or offer Remote Assistance.  The latter plugs into Microsoft’s Remote Assistance functionality, so this will need to be enabled and configured in the VM.

On VDI sessions (not RDS Published Desktops or Application Sessions), you can issue a restart command to the desktop – this will reboot the VM.  You can also disconnect or log off users.  The Reset function differs from Restart in that the latter is a graceful shutdown and restart – Reset should only be used if the VM has hung.

Closing Thoughts….

So, a welcome set of useful capabilities has been added to this point release – and one that focusses on supportability rather than the usual performance or user-centric capabilities.

If you’re in need of assistance with a troublesome Horizon solution or perhaps want some support upgrading or implementing a new one, please contact Xtravirt, and we’d be happy to use our wealth of knowledge and experience to assist you.

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He is a VMware vExpert 2017.

By Curtis Brown

The somewhat anticipated release of VMware vSphere 6.7 Update 1 is now with us.  So, the burning question now is “Can I upgrade?”.  The answer is not quite as simple as a yes or no as this is always a mine field, particularly where interoperability is concerned.  My intention with this article is to save you some of the leg work with respect to investigating product interoperability.

However please note, this article doesn’t dig into hardware compatibility, or compatibility with third party products, simply because of the vast array of possible scenarios.

Compatibility with Horizon View 7

The most common starting point is VMware Horizon 7 itself.   By checking the VMware product Interoperability Matrix, we can see that the minimum release of VMware Horizon that is validated with VMware vSphere 6.7 Update 1 is the latest release, 7.6.

VMware Horizon 7.6 - COMPATIBLE

VMware App Volumes

VMware App Volumes 2.14 and the more recent patch release are both listed as a valid configuration.  This would also be the recommended release for use with VMware Horizon 7.6, although it has quite a generous level of backward compatibility.

One observation of note is that the poorly adopted cul-de-sac release 3.0 product has not been validated against 6.7, but as this was explicitly incompatible with 6.5, so this is not particularly surprising.

VMware App Volumes 2.14.2 - COMPATIBLE

VMware vRealize Operations for Horizon

With respect to VMware vRealize Operations support in general, release 6.6.1 or later is required.  This is driven by vSphere rather than Horizon which can work with older vROps releases.

For a VMware Horizon environment running on VMware vSphere 6.7 Update 1, the VMware vRealize Operations for Horizon plugin needs to be on 6.6.0 to support VMware Horizon 7.6 to retain compatibility through to VMware vSphere.

However, care should be taken with the compatibility between the Horizon plugin and vRealize Operations itself.  As the Horizon component only supports Horizon 7.6 directly on release 6.6.0 of the plugin, the interoperability matrix dictates that VMware vRealize Operations should be running on release 6.7.

VMware vRealize Operations Manager 6.7 - COMPATIBLE
VMware vRealize Operations for Horizon 6.6 - COMPATIBLE

Of course, for features, guest operating system compatibility, the latest version is recommended.

VMware User Environment Manager 9.5 - COMPATIBLE

VMware NSX for vSphere

Although not every VMware Horizon deployment uses VMware NSX, it’s included to flag a possible concern. With respect to straight VMware vSphere interoperability, VMware NSX for vSphere 6.4.2 and 6.4.3 both support for vSphere 6.7 Update 1.  However, the supported Horizon release (7.6) has yet to be validated with NSX 6.4.2 or 6.4.3.  This is  unlikely to cause an issue, and validation is likely to be only a matter of time, though it may be enough to cause a pause for thought.

VMware NSX for vSphere 6.4.3 - SUBJECT TO CONFIRMATION BY VMware REGARDING HORIZON 7.6

Upgrading Desktop Templates

With respect to upgrading templates, the back-end components should be upgraded prior to the agents within the image.  As such, upgrading this rather depends on how many change windows are being used to upgrade the above components.  In all cases, VMware have limited support for backward compatibility for agents, so there is flexibility here.  The VM templates have the following components/dependencies:

• VMware App Volumes Agent – used for registering the VM and the logged in user to App Volumes manager.
  
• VMware UEM Agent – used for managing the user persona via UEM.
  
• VMware vRealize Operations for Horizon Agent – although a version is integrated as part of the VMware Horizon Agent, for full functionality in line with the release of vRealize Operations for Horizon, the dedicated agent is recommended.
  
• VMware Horizon Agent – this is used to provide components for managing deployment, assignment and the remote desktop protocol to the desktop.  It is recommended that this is installed after VMware Tools has been upgraded.
  
• VMware Tools – required for interaction with vSphere, as well as providing optimised device drivers for the guest OS.
  
• The VM virtual hardware version – this is defined by the VMware ESXi release. Upgrading should only be carried out once VMware Tools are upgraded but can be beneficial for performance reasons.
  

Where hardware GPUs are deployed, there are further considerations.  For example, if the templates are deployed using a vDGA (Dedicated Graphics) or Nvidia vGPU configuration, further investigation into supported Nvidia drivers should be carried out.

What to upgrade first?

Where to start upgrading will be driven from your starting point, so it’s well worth looking at compatibility of the release that you’re starting at with the relevant components.

Upgrading VMware vRealize Operations and the Horizon plugin is likely to be the best starting point as this supports all the monitored components backwards for a number of releases. In addition, it is the least disruptive activity for users.

After this, updating App Volumes Managers would be the next step.

Upgrading VMware Horizon follows the order it has always followed – VMware Composer, followed by Connection Servers and Security Servers.  The recommendation, however, would be to take the time to retire any Security Servers and replace them with VMware Unified Access Gateway appliances instead.

Where deployed, VMware NSX would be next on the list..

After this, the vCenter upgrade followed by the VMware ESXi hosts should take place.  In the case of the latter, as mentioned previously, pay close attention where hardware GPUs are deployed as this may need upgraded drivers and software in-line with the vSphere release.  If vSAN is deployed, this would take place as the closing step of upgrading all the ESXi hosts in the cluster, ensuring that there is enough space to carry out such an upgrade.

With respect to the desktop templates, upgrading of components can be staged, but the supporting services must be in place first.

Closing Thoughts

Although there are a fair few items to consider, so long as the components are upgraded with consideration to each other and in the proper order, it’s possible to uplift the entire stack to support VMware vSphere 6.7 Update 1.  The only caveat is the lack of interoperability testing  between releases of VMware Horizon 7.6 and NSX 6.4, though it should be remembered that there is no direct connection between the two products and VMware have yet to actually publish test results for this combination.

If you are looking to get the best from VMware infrastructure and understand your upgrade and compatibility options, please contact us, and we’d be happy to use our wealth of knowledge and experience to assist you.

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He was awarded VMware vExpert 2018 and is a graduate of the VMware Advanced Architecture Course 2018.

About Xtravirt

Xtravirt are an experienced consulting firm dedicated to delivering outcomes to help customers solve their IT challenges. We design and build strategies to help customers unlock the full potential of cloud, datacentre and workspace technology.

We are the VMware Global and EMEA Professional Services partner of the year.

www.xtravirt.com

by Michal Grzeszczak

My name is Michal Grzeszczak and I am a senior consultant at Xtravirt (www.xtravirt.com), an independent cloud consulting business and VMware Master Services Competent Partner.  In this blog, I’d like to share with you my experience of L2 bridging with VMware® NSX-T Data Center and help you to understand some of the differences between NSX-T and NSX-V, as well as cover some NSX use cases.  

Customer background:

The customer is one of the leading organisations in the betting and gambling industry and have been using NSX-V for some time now. When it came to their new greenfield environment, they decided to deploy NSX-T 2.4 Data Center. This decision was largely based on the fact that NSX-T Data Center provides bridging firewalls natively for L2 software bridging, which was their main requirement. Also, given that NSX-T will be the de facto network and security virtualisation platform offered by VMware going forward, by specifying it for this environment the customer is able to future proof the deployment. 

Future upgrades are also accounted for as upgrading from NSX-T 2.4 to future NSX-T releases is simpler than performing upgrades from a previous version of V or T.

NSX-T 2.4 was a major update and brought many changes to the architecture of the product, the main ones being:

• The NSX Manager and NSX Controllers were merged into one appliance deployed in a Cluster of 3 Nodes therefore minimising the footprint of the solution and operational complexity. 
• The other major change was the introduction of the new Simplified UI which “requires just the bare minimum of user input, offering strong default values with prescriptive guidance for ease of use. This means fewer clicks and page hops are required to complete configuration tasks.”

NOTE: In NSX 2.4 two UIs are presented - one is the new Simplified UI, the other one is Advanced. The latter is taken from NSX-T 2.3. The future plan is to remove the Advanced UI and provide all of the functionality via the Simplified UI.

 What are the key benefits of choosing NSX-T over NSX-V?

 There are many benefits of NSX-T over NSX-V, to name a few:

• NSX-T doesn’t require vCenter, however it can be added to NSX-T as a Compute Manager and allows for up to 16 Compute Managers per NSX 2.4 solution . There is no longer a 1:1 requirement like there was with NSX-V. 
• KVM Hypervisor support
• Bare Metal Edges provide sub-second failover 
• Data Plane Development Kit (DPDK) Optimising Forwarding - DPDK is a set of data plane libraries and network interface controller drivers for fast packet processing
• New, more flexible Overlay technology - Geneve replaces     VXLAN  https://docs.vmware.com/en/VMware-Validated-Design/4.3/com.vmware.vvd.sddc-nsxt-design.doc/GUID-CF3C47CA-9BEB-4213-8F08-1494261BF3EC.html 
• Bi-directional Forwarding Detection support
• BGP (Border Gateway Protocol) expanded functionality with features like Route Maps
• Much clearer User Interface (UI)

What were the specific use cases for this case customer and the design considerations?

USE CASE 1 - NSX-T Edge L2 Bridging - Integration of physical, non-virtualised database servers that require L2 connectivity to the virtualised environment. 

Design considerations:

• In NSX-T 2.4 two options are possible to bridge L2 workloads - using ESXi Bridge Clusters or Edge Bridge Profiles. The latter is recommended to use as the former will be deprecated in future. 
• Ideally the use of dedicated Bare Metal Edges, however this is not a requirement. 
• The possibility to deploy Edge Bridges in collapsed vSphere Clusters >     Management + Edge or Compute + Edge
• Consider having active and standby Edge Nodes on different hosts to avoid throughput drop, because VLAN traffic needs to be forwarded to both Edge Nodes in promiscuous mode.
• Overlay traffic can be tagged on a Distributed Port Group or Uplink Profile, but please avoid double tagging. 
• VLAN traffic should not be tagged on the Uplink Profile.
• Distributed Port Group for VLAN traffic connecting to the Edge Node should be in a Trunk Mode. The reason for this is due to the fact that Edge doing Bridging adds 802.1Q tag when transposing Overlay traffic to VLAN. 
• Consider having the same MTU value across your environment - if you can, choose MTU of 9000 for better performance. 
• Several Bridge Profiles can be configured, and a given Edge can belong to several Bridge Profiles. By creating two separate Bridge Profiles, alternating active and backup Edge in the configuration, the user can easily make sure that two Edge nodes simultaneously bridge traffic between Overlay and VLAN

Constraints:

• Edge Cluster with minimum 2 Edge Nodes in Active/Standby mode is needed.
• Standby uplinks are not supported on the Edge Node.
• Source Based Load Based Teaming is not supported on the Edge Node.
• The port group on the VSS/VDS sending and receiving traffic on the VLAN side should be in promiscuous mode, allowing MAC Address changes and Forge Transmits.

Deployment:

• Follow the deployment guide here - https://youtu.be/IwpujflzJhY 
• Or here https://docs.vmware.com/en/VMware-NSX-T-Data-Center/2.3/com.vmware.nsxt.admin.doc/GUID-7B21DF3D-C9DB-4C10-A32F-B16642266538.html 

Validation:

• Log in to the Edge Node with your credentials.
• Type “nsxcli”.
• “Get l2bridge-ports-config” will show the Bridge Port State (Active Edge will have Forwarding, Standby will have Stopped), VLAN ID configured and Bridge UUID which can be copied and used to do a packet capture on the Edge Node.
• To do the packet capture type “start capture interface “copied Bridge UUID” and hit enter, ping from VM to Physical Server to see the flows. 

USE CASE 2 - NSX bridging firewall - Secure communication between physical database servers and Overlay workloads.

• The configuration of the bridging firewall can be done currently only on the Advanced UI.
• Security rules are configured per Logical Switch aka Segment in Simplified UI. 
• NSX-T grouping objects like NSGroups can be used to provide abstraction from the IP based approach.

USE CASE 3 - vRealize Network Insight - Monitoring tool that can provide visibility into both Physical and Virtual environments. 

• NSX-T 2.4 is fully supported with the latest vRealize Network Insight version 4.1.
• Make sure you are allowing ports for communication between vRNI and other devices after the deployment. For example, ESXi Hosts to vRNI Collector on UDP 2055. The full list of ports needed can be found here - https://docs.vmware.com/en/VMware-vRealize-Network-Insight/3.9/com.vmware.vrni.install.doc/GUID-FDDA5F2F-7C3B-472A-A17D-39582FBD5996.html 
• There is a new website that provides in-depth information about new features in vRNI, definitely worth visiting - https://vrealize.vmware.com/t/vmware-network-management/  

What were the outcomes?

Overall, this deployment was a complete success as we were able to satisfy all of the requirements that the customer had. All the production physical databases were able to communicate on the same L2 segments, virtualised and connected to NSX-T segments workloads. On top of that, communication between those workloads was secured by NSX-T Bridging Firewall. vRealize Network Insight was used to provide visibility into the environment. Its ability to quickly troubleshoot network and firewall related issues in both virtual and physical realms allows admins to take a breath in the never-ending battle of making the networks stable.

I hope you enjoyed my blog, if you’d like to talk to Xtravirt about your business’s networking and security requirements, then please send an email to info@xtravirt.com

Some Useful links:

You can read more about the NSX-T 2.4 release here: https://blogs.vmware.com/networkvirtualization/2019/02/introducing-nsx-t-2-4-a-landmark-release-in-the-history-of-nsx.html/