Xtravirt — Moving on from Citrix XenApp 6.5

by Nick Goldman

VMware Cloud Foundation brings the best in breed virtualisation of network, storage and compute in a pre-validated and automated package. VMware cloud is used in VMware based public cloud solutions such as; VMware cloud on AWS and IBM cloud for VMware solutions. VMware Cloud Foundation lets you spin up a private cloud environment in a much-reduced time frame and deliver a reliable hybrid cloud environment.  

VMware Cloud Foundation 3.0 was announced only a few months ago at VMworld US 2018. Version 3.0 removed the requirement to use Cisco or Arista switches. Now any switch provider that is on the VMware Hardware Compatibility List (HCL) can be used which will allow for VCF fitting into existing environments.  VMware has now also added all vSAN ready nodes which opens up far more flexibility with hardware.  

A number of management of improvements were also made also assist with enterprise deployments. These included the ability to skip upgrades of vCenter and ESXi which helps with compatibility of 3rd party solutions). Cloud Foundation 3.0 also supports multiple clusters in a workload domain to allow for larger workload domains and reduced size of failure domain and specific use cases which require small clusters (such as licensing) and stretch clusters.

Now only a few months later the next release 3.5 is announced and brings a raft of new features including support for NSX-T and PKS (Pivotal Container Service), support for composable infrastructure (initially HPE Synergy) and support for external NFS (which allows the use of existing storage for workloads).

Including NSX-T in VMware Cloud Foundation shows the direction that VMware are heading towards with much larger use cases for NSX-T.

What is VMware Cloud Foundation?

VMware’s Cloud Foundation was born out of the VMware EVO SDDC (Software Defined Data Centre) platform and is designed to make private and public clouds easy to deploy, manage and secure. It also allows cloud providers such as IBM and VMware Cloud on AWS, as well as private data centres, to quickly deploy and scale out a cloud platform.  

“VMware’s Cloud Foundation allows cloud providers to quickly deploy and scale out a cloud platform” 

VMware Cloud Foundation is a Hyper Converged Infrastructure platform that that delivers software defined compute, storage and networking services (NSX) to allow agile delivery of virtual servers or containers. The solution is made up of vSphere, VSAN and NSX overlaid with a management solution (the SDDC manager) which is used for both setup and day 2 operations such as patching and monitoring. 

Cloud Foundation version 3.5 has just been released and includes the latest releases of all VMware products including vSphere 6.7U1, vSAN 6.7U1, NSX-V6.4.3, NSX-T 2.3 and optionally vRealize Automation 7.5. and vRealize Operation 7.0, vRealize Log Insight 4.7

Delivery Model

VMware Cloud Foundation is available in three delivery models: 

• Through a public cloud provider such as VMware Cloud on AWS or through one of the VMware Cloud Provider Program providers such as IBM or Rackspace   
  
• As an engineered solution such as Dell EMC’s VxRack solution which comes preconfigured and installed (however customers have informed me this at present introduces a delay while the configuration is certified 
  
• Deploying on any vSAN ready nodes from any vendors including Dell EMC, Cisco, Fujitsu, HPE, Hitachi and Quanta 
  

Cloud Foundation can speed up the delivery of an SDDC solution by having a pre-validated and tested solution using VMware best practices. This can reduce the complexities and lead times associated with traditional datacentre infrastructures. VMware on AWS will be the proving ground for many new features on VMware Cloud Foundation and as the suite is all based in software VMware will be able to rapidly add features.  

“Cloud Foundation can speed up the delivery of an SDDC solution” 

The management of Cloud Foundation is via the VMware SDDC Manager. From within here you can do the initial bring up which just requires a few details such as time, network settings and DNS and NTP servers. The SDDC manager will bring up the entire stack including switch configuration, host configuration and a management cluster (a four-node cluster containing a dedicated vCenter, NSX manager and vSAN). Once the bring up procedure has been completed, you are then able to deploy workload domains which are policy driven based on the performance and availability requirements. The workloads can either be virtual server infrastructure or virtual desktop infrastructure where the SDDC manager will automatically deploy a fully functional VMware view environment.

Is VMware Cloud foundation right for my company?

Whether Cloud Foundation is right for your organisation for not depends on what your commitment to other hardware solutions such as a SAN or blade enclosures are. In these cases, it may not be best to change your entire infrastructure to start using Cloud Foundation, but if you have end of life hardware or you are looking at putting in NSX to virtualise your organisation’s networking then it could help to reduce the time to get the new platform up and running. In addition, with the lifecycle management included it will reduce some of the burden associated with keeping your cloud platform up to date.

If your organisation has previously struggled with setting up new technology or it has taken an excessively long amount of time to deploy and expand, then VMware Cloud Foundation could be the right solution for your organisation. VMware will allow you to transfer existing unused licenses for individual components to Cloud Foundation.

VMware Cloud Foundation has similarities to other solutions such as Nutanix, which provide a simplified management for their hyper converged platform. However, the inclusion of technology such as NSX in the platform is more advanced than some of VMware’s competitors.

“Cloud Foundation takes VMware’s best of breed technology and wraps a management layer around them”.  

Version 3.5 also offers the latest versions of VMware products which was part of VMware’s commitment to reduce the time between when products were released individually and when they are available as part of VMware cloud foundation.

Closing thoughts

VMware Cloud Foundation has become a very comprehensive solution for organisations looking to deploy there SDDC in a reliable and standardised fashion whilst reducing timescales for design and deployment. It takes VMware’s best of breed technologies and wraps a management layer around them. As companies look to move towards a buy rather than build strategy with their infrastructure then VMware Cloud Foundation is on point to be a tried and tested solution. VMware are starting to open up options of hardware in this release which will make Cloud Foundation to suitable for many more organisations who are looking to upgrade or deploy a new SDDC or to put them on the path to the hybrid cloud journey via NSX hybrid connect. 

If you are interested in VMware cloud services and solutions and want to know how they can benefit your organisation Xtravirt can help. We provide advisory, design and implementation services to create the right solution for your organisation. Contact us and we’ll be happy to use our wealth of knowledge and experience to assist you. 

About the Author

Nick Goldman is a Senior Consultant within the Xtravirt consulting team. He is an experienced infrastructure consultant with experience in both technical architecture and hands-on implementation. His areas of expertise include virtualisation solutions based on the VMware stack and Microsoft based infrastructure solutions.

About Xtravirt

Xtravirt are an experienced consulting firm dedicated to delivering outcomes to help customers solve their IT challenges. We design and build strategies to help customers unlock the full potential of cloud, datacentre and workspace technology.

We are the VMware Global and EMEA Professional Services partner of the year.

www.xtravirt.com

By Michal Grzeszczak

OLD WORLD

The landscape of modern IT is constantly evolving and an aggressive shift towards the software defined data centre is arising. Nowadays, virtualisation of storage and networking is becoming as, or even more important than the virtualisation of compute. In this rapidly transforming realm, traditional networking and security can’t keep up with location-agnostic and application-centric workloads and even if they could, there are now simply better ways to solve the problems occurring in traditionally managed data centres. Security, agility, automation and visibility are the key areas where there is a need for new tooling. During a recent customer engagement, we faced all of these issues and to mitigate them, VMware NSX® and VMware vRealize® Network Insight™ (vRNI) were deployed in the environment.  

BACKGROUND

The customer’s main business objective is to provide IT services to a number of hospitals. Security regulations in the health care world (the likes of HIPPA) can be difficult to comply with, especially with traditional security methods such as using perimeter firewalls for east-west traffic control. The customer had an old data centre that contained both virtual and physical workloads, 200+ undocumented applications, Cisco 6500s core switches and Cisco ASA firewalls. As they were facing multiple challenges with this setup, the decision was made to engage Xtravirt to migrate to a new NSX based data centre.

CHALLENGES

The main challenge the customer had in their previous environment was application traffic visibility, namely the 200+ applications without proper documentation outlining necessary ports to be open in the firewall. The communication between the networking team and application team wasn’t as smooth as one could hope for either which created unnecessary holes in the overall security posture of the company’s IT department. Multiple DMZs from the Cisco ASA firewall did not scale well and the rule sprawl was becoming a problem. The security team was working reactively instead of pro-actively - a known issue with the traditional approach. All of these issues led to the environment becoming unmanageable.

To sum up the challenges:

• Lack of visibility of the East-West traffic - resulting in poor understanding of the application flows and complicating the security policy, therefore becoming difficult to manage.
  

• Communication breakdown between IT teams - back and forth email exchange proves time consuming and slows down the deployments or changes, identifying a need for a tool to provide a “source of truth” of what is actually happening in the environment. 
  

• Hair-Pinning to the perimeter firewalls and routers - sending traffic for inspection to the physical firewalls and routing to the core switches, even if the workloads reside on the same host. That is a waste of bandwidth. Also, latency sensitive applications might be affected. 
  

 GOALS

The customer decided to build a new data centre with NSX for micro-segmentation and vRNI for visibility and security planning. The next step was to migrate the applications from the old environment to a new one, then monitor traffic flows of the applications to create an adequate security policy.

 Goals communicated before the engagement:

• Use vRNI to monitor applications and services that are running in the current data centre to get a clear picture of the network flows before the migration of the applications to the new data centre. 
  
• Use vRNI to plan security policies for the environment based on the observed flows as opposed to the (lacking) documentation from the application team. 
  
• Design a security policy using NSX, based on the vRNI outcome. 
  
• Monitor the entire network, both virtual and physical workloads to get the full picture of what is happening in the environment. Then design an alert system using vRNI that will help with monitoring and troubleshooting. 

D-DAY

After adding Virtual Distributed Switches as Data Sources in the vRNI we watched traffic flows of the applications. With a few clicks, we were able to see all the traffic - ports, protocols, IP addresses - to and from any selected application. To define an application in the vRNI we simply specify the workloads that are relevant. Then the visual graph shows all necessary information as well as recommended firewall rules. We could export interesting data in the CSV file format readable in Excel and use that as a base for Security Rules creation. It is recommended to collect the flows of the application for some time, like a day or two, as not all the ports of the applications are used in the given moment. It could be a good idea to send a request to the DevOps team to sweep through all the functionality of the application, just to make sure all the traffic needed to be allowed in the firewall is actually there in the output graph of vRNI. By default, vRNI collects data every 5 minutes. 

Next steps involved creating a Security Policy using a distributed firewall - kernel based East-West firewall used for micro-segmentation. The decision was made to use Security Tags for all of the virtual workloads and IPsets for external ones. 

• The Security Tags allow for dynamic assignment of VMs. For example - you could create a Security Tag called “Web” and configure a Security Policy that will automatically add VMs with the name that contains “Web” to a specific Security Group. This is a useful feature as workloads quite often change IP addresses and location. We are simply shifting from network-based security to an object-based one that allows for agile and location-agnostic applications. 
  
• IPsets are sets of IP Addresses, subnets or a group of subnets that specify the scope of affected workloads for a given Security Group. In the customer’s environment, the zero-trust model was implemented which means that only necessary traffic is allowed on the Distributed Firewall and everything else is dropped. This type of design ensures maximum security. 

Next, the vRNI notification system was used for monitoring the new Data Centre. There are two types of notifications:

• System notifications, which are pre-defined. The list of notifications contains 100 of the most commonly appearing issues customers face during a deployment. For example, this could be a loss of network connection of the NSX Edge routers.  
  
• User notifications are defined by user and are very simple to set up. One can simply use a search bar to search for a specific query, for example, Change in the Application “App1” - and create a notification alert with the click of a mouse. Both System and User notifications are customisable. You can specify the severity of the alerts and tags to make searching for the problem easier and quicker, and contact recipients by email to notify a specific person or a team about an issue.  

RESULTS

Quite simply, they are spectacular. In my opinion, none of the solutions available on the market could solve the customer challenges like NSX and vRNI. All the goals were met and challenges mitigated. The customer now has a new health care compliant and scalable data centre with full visibility of both physical and virtual traffic. The customer also has a solution that is centrally managed and application-centric with an agile security policy, plus a customised notification system for monitoring and troubleshooting. 

ONE STEP AHEAD

VMware appears to be reading the future pretty well; by being flexible and adjusting to the market needs, this virtualisation pioneer managed to create a one stop shop for every IT requirement. With the acquisitions of Nicira and Arkin respectively, VMware expanded their catalogue with two extremely powerful and market changing solutions - NSX and vRNI. The first providing micro-segmentation, logical switching/routing and load balancing to name a few, and the second allowing for full visibility of physical/virtual networks and assisting in security planning. The fact that these two work together and give so many unique features is a game changer in the industry. Adding to the mix products like vSAN for storage virtualisation and vRA for automation, makes it even more interesting - all in software, all managed from your browser, location-agnostic and application-centric. This is a software defined revolution and it is happening right now. Join it and stay ahead of the game. 

Xtravirt is a leading VMware NSX specialist and has the ultimate combination of deep experience and agility to design and deliver your IT transformation. If software-defined networking is on your roadmap then contact us today.

To find out more visit: https://xtravirt.com/nsx/

About the author

Michal Grzeszczak joined the Xtravirt consulting team in September 2017. He has an in-depth understanding of NSX along with experience in software-defined networking, virtualization and data centre support.

by Curtis Brown

VMware NSX® network virtualisation platform has been around for a little while now delivering an operational model for networking that forms the foundation of the Software-Defined-Data-Centre.  It’s often associated more with server virtualisation or as a component within a Cloud Automation solution and with good reason; it’s readily able to deliver a scaled, secure environment, while providing several mechanisms to deliver advanced network functionality such as firewalling, load balancing and anti-malware protection.  However, one area where its application is frequently overlooked is in the world of End User Compute – more specifically virtual desktop infrastructure.

Wouldn’t it be nice if…

Consider a full-on Horizon deployment (though, to be fair, these components could be replaced in the most part for an element of your choice) –

•  Horizon View – This will publish Virtual Desktops in Pools, with these pools assigned to Active Directory based Groups/Users.
• App Volumes – This gives you a mechanism for delivering defined stacks of applications to the Virtual Desktops.Again, you can assign using Groups or users.
• User Environment Manager – You use this to manage environmental and application settings.

 So, you have the mechanisms in place to deliver Virtual Desktops, complete with some granular application and settings delivery.  This is all pretty good, but wouldn’t it be nice if you could provide some intelligent network capabilities too?

Finetuned Firewalling.

Now take VMware NSX - this has some nice features that you can leverage in a VDI estate.

One of the key areas of concern is hardening the estate.  There’s been a pretty big play in the NSX world around using NSX to provide segmentation – both at a macro level, separating workloads into different VXLANs on virtual switches – and at the micro level using the Distributed Firewall to provide firewall rules at the Vmnic. Both strategies can be used here.

You can also separate Pools at a macro level or a micro level if you wish to, with the latter being particularly interesting.

The Distributed Firewall can provide a great deal of flexibility when defining firewall rules and can leverage several different identifiers, including vSphere entities and Active Directory objects.  Using these, you can generate a rule bases to lock down traffic quite tightly, in conjunction with the VDI solution and application delivery mechanism.  Take this example:

You can set up a standard DFW ruleset that applies to your desktops that will prevent traffic between the virtual desktops, while still providing the core services and application support for anything required for the desktop. This means you can control LDAP traffic between the desktops and Domain Controllers or PCoIP between the desktops, the Connection Servers or direct to physical endpoints if you wish.

 With App Volumes, you can define an AppStack with several applications which may well have discrete client/server network traffic requirements.  The DFW can apply rules based upon the user logged into the desktop, so you can create and apply rules specific for these client server applications and tie them to the same Active Directory object that applies the AppStack.

 The net result is that you end up with a combined ruleset applied to a desktop that is not just tied to a broad pool, but also to discrete needs for users within the pool. This provides strict granular access based upon the needs of the desktop and the application set for the user.  And let’s remember that this is applied at the desktop’s connection to the network – not at any perimeter level.

Malware Protection

NSX also provides the ability to integrate a compatible antivirus/antimalware solution into the mix. This is not, however, limited to the more publicised Guest Introspection where virus scanning is offloaded at the hypervisor level.  NSX can also integrate with both virtual and physical appliances such as Fortigate for intrusion detection, perimeter firewalling and more.

At the Infrastructure Level

As with any VDI estate, you have the upstream infrastructure to consider, several services can be provided here too.  

Using VMware NSX Edge Gateway appliances, you can provide perimeter firewalling between networks.

For Horizon View, both Connection Servers as well as Access Gateways/Security Servers require Load Balancers, as do App Volumes Managers.  The NSX Edge appliances are capable of being configured to provide load balancing services.

Perimeter firewalling using NSX Edge can also be provided, so you can have a DMZ layer for the Security Servers/Access Gateways as well.

Generally speaking, you could deploy something like this for the Horizon View management environment:

Our external traffic accesses the estate via a pair of NSX Edge Gateways, serving as firewall and load balancer for a pair of VMware User Access Gateways.  These are configured as two-legged, tunnelling into the vSwitch beneath, where you have a dedicated NSX Edge appliance load balancing the Connection servers.  This internal load balancer is also used by internal users who connect in via an L2 bridge or NSX Edge as appropriate.

 You then deploy NSX for the Desktop blocks as well, in order to provide the previously mentioned firewalling and malware protection for a secure end-to-end solution.

Closing Thoughts…

With NSX, it’s possible to turbo-charge the security for a VDI desktop environment in a manner that can be applied regardless of the choice of broker solution – the above would work just as well in a third party VDI solution such as Citrix XenApp or, perhaps more importantly, XenDesktop, not just VMware Horizon.  The ability to dynamically set and operate firewalling on egress outside of the guest Operating System means that such firewalling cannot be tampered with from within the VDI desktop, which might be useful in environments where desktops are used with untrusted users (public kiosks for example).

If you’re interested in exploring the combination of VMware NSX network virtualisation in a VDI estate, please contact Xtravirt, and we’d be happy to use our wealth of knowledge and experience to assist you.

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He is a VMware vExpert 2017.

By Curtis Brown

Introduction

In the wonderful world of VMware based virtualisation, there has been a concerted effort in recent years to not just virtualise the compute side of matters but expand out into networking (with VMware NSX) and the provisioning of storage (VMware vSAN). This all results in a single VMware Hyper-converged infrastructure offering.

An important factor within this is security.  VMware vSphere itself has considerable security with its small footprint, hardened hypervisor and the move towards a hardened Linux based appliance as the preferred option for the VMware vCenter management server.  VMware NSX can be argued to be a security product in and off itself – providing not only edge firewalling capabilities but per-VM based firewalling with the Distributed Firewall and support for agentless malware protection solutions with the Guest Introspection framework.

But what of VM storage? SAN solutions can offer security measures, subject to the SAN vendor, but how does this apply in a VMware vSAN environment?

There are two options available:

• VM Encryption
  
• VMware vSAN Encryption
  

Each has some pros and cons – so let’s take a look.

VM Encryption

 Fundamentally, this is the encryption of virtual machines themselves.  There are third party (and, for that matter, in-guest) encryption offerings, but we’ll focus on the built-in VM encryption capability that was released in VMware vSphere 6.5.

It’s pretty straightforward to set up, requiring only two things – the deployment of an encryption Key Management Server (compatible ones are listed here and in the Interoperability guide) and a VMware vSphere Storage Policy.  After that, apply the policy to a given VM and – hey Presto!

So, what’s the catch? The encryption works on all IO operations for the VM itself at the top level – as it’s written to the Virtual Disk. This means that all IO operations in transit are encrypted as well as at rest on the physical disk.

From a security standpoint, this is very secure, and as it’s on a per-VM basis, it’s granular – you don’t need to encrypt everything (though you could argue that this is a management overhead).  However, the downside in a vSAN environment is that the encryption occurs before de-duplication, so no space saving is possible.

There are further caveats with VM encryption to be aware of:

• The VM Snapshot ‘Capture the virtual machine memory’ function is not compatible.
  
• vSphere Fault Tolerance does not work with VM encryption.
  
• Suspending (and resuming) encrypted VMs is not supported.
  

In addition, not all vSphere integrated backup solutions can support VM level encryption.

vSAN Encryption

 VMware vSAN Encryption uses the same Key Management Server, but this time the VMware vSAN storage is itself encrypted.  It’s applied at the cluster level, so anything stored in the vSAN cluster is encrypted – no management overhead as such, but no granularity.

All data travel is in an unencrypted state – it is encrypted when the data hits the caching tier, decrypted when it is de-staged from the cache for de-duplication and writing to the data tier.  This means that data-deduplication can be applied in combination with encryption, however the down-side is that encryption is therefore limited to data at rest (i.e. written to disk) as opposed to end-to-end as would be the case for VM encryption.

As encryption is at the storage tier, it is essentially invisible to VM operations – so vSphere operations such as Fault Tolerance and snapshots are fully supported and most vSAN aware backup solutions aren’t impacted.

Comparing the options

 To compare these two options:

Closing Thoughts

 Both mechanisms have their use cases.  VM encryption is the more secure when you consider that it is capable of full end-to-end encryption.  It also benefits from being able to support traditional SAN datastores as well as vSAN. However, some VMware vSphere functionality is impaired when compared to vSAN and there is more of a management overhead.  In a modern all-flash estate, IO drops caused by encryption are negligible in both cases, so performance should not be a concern.

VM Encryption is worth considering, though it does add a layer of complexity to an estate. If the deployment of a robust KMS (Key Management Server) solution is a must, then there is configuration of the solution itself.

If you’re considering implementing or upgrading a VMware vSphere environment and data security is a concern, please contact Xtravirt, and we’d be happy to use our wealth of knowledge and experience to assist you.

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with strengths in VDI, storage integration, backup and Disaster Recovery design/implementation. He is a VMware vExpert 2018.

by Dan Card

Current IT

Some of the top trends for 2015 in enterprise IT are focussing on cloud, security and mobility. Since Microsoft’s ‘mobile first, cloud first’ strategy announcement, followed later by VMware’s recent ‘one cloud, any application’ theme you will be hard pressed not to hear these topics being discussed. However, before we look at 2015 let’s take a look at what organisations used to do.

Back in the day

In the pre-cloud era I used to use the phrase “well managed IT”. Shocking to hear, but before cloud, orchestration and everything-as-a-service, in some organisations we operated the following models:

• Self-service request fulfilment
  • A combination of automated and manual tasks depending upon the service
• Any device, anywhere, anytime and secure
  • To provide a little more technical detail we used VPN’s, file/disk encryption, web publishing (usually an ISA reverse proxy), two-factor authentication, server-based computing (terminal services and Citrix metaframe/presentation server).
• User-centric computing
  • Role and policy based configuration combined with roaming profiles, login scripts and intelli-mirror technologies, we designed user experiences that followed you. If you logged into our remote desktop solution the experience also followed you (customised to cater for lower bandwidth by providing a slightly reduced feature set)
  • Applications that followed you. Using Microsoft systems management server we could target applications at groups, advertising the application ensuring you could use your application wherever you went. Fancy stuff!
  • Self-service recovery. If your machine had a software failure that was not catastrophic we could re-image your device over the wire, or, as was our standard solution, utilise a local source. We would even run tools to try and keep your documents safe during this process. The only downside was that you had to be on the corporate network.
  • Orchestration and automation. Before fancy orchestration engines and workflow tools were invented using open standards we had to settle for using our trusty notepad. We did however build scripts using standard languages, protocols data structures (xml), draw our workflows on paper (Visio) and build task based engines, using databases, files, registry and xml datasets as reference and tracking tools (we even updated configuration and user data into other systems)
  • Automation. Xtravirt’s co-founder and CIO Paul Davey and I used to try to automate everything, and this is also where Xtravirt’s SONAR cloud-based analytics service emerged from. To this day I still believe in automation, so much so I wrote a quick script to read my firewall log out to me (useful? maybe less so than previous work but it kept the brain working). Even though we architected and designed the solutions, we also built the management systems and images etc. To this end we worked a lot with the operational teams to provide automated tools and processes to make the support team’s life easier.
• Configuration management
  • We used a number of methods and systems, including systems management server and many bespoke scripts to maintain asset and configuration information. Again we built release management tools & processes to ensure we were in control (as much as possible) of the activities and were able to accurately report on the configuration and asset baselines of the estate.

I could probably go on forever about different areas we used to work on, however the main theme here is that we’ve been doing this over the past 10 years.

Moving into the mobile and cloud era

So fast forward to the present. We are talking cloud, enterprise mobility, software-defined everything. No longer are we making bespoke solutions in notepad, and we no longer have a host of tools to orchestrate automate and provide self-service everything, all out of the box.

While it’s true our technology capabilities have improved, what used to require some special magic now ships as a standard capability with the products. The reality is, to achieve a well-managed mobile and cloud-based model there is still a ton of effort that is required.

So can we provide access to our systems and data on any device, anytime, anywhere and in a secure manner? Well the answer is yes; we could before and we still can today. The main advances I see are we can spend more time on providing business solutions and less time writing bespoke engines cobbled together from a set of scripts.

Remember the IT landscape is still incredibly complicated with billions of transactions occurring, weaving this web together into a well-managed, efficient, cost effective and business valued service still requires more than just opening the box.

If need help along your virtualisation journey and moving into the mobile and cloud era, Xtravirt can deliver the right strategy and architecture for your business, so contact us today.

by Sam McGeown

VMware have put a lot of development into their latest release of vRealize Automation 7.3 and it certainly feels like a bigger release than a ‘.1’ version –  as is evident in the “What’s New” section of the  release notes.

 As part of a push to make it easier to manage and operate a vRA-based cloud platform, VMware have made some great improvements – the main features that stand out for me are:

•  Automated failover for the PostgreSQL database, and IaaS Manager Service – something that many customers have been asking for and now finally have, is a fully “HA” distributed platform.

• A new API for installation, upgrade and migration of the platform itself. This means scripted installs, upgrades and migrations are now simple and can be orchestrated.

• Parameterised blueprints – this allows out-of-the-box support for one of the most frequently asked for blueprint options – t-shirt sizes. In addition, the new Component Profiles will simplify the number of blueprints required and reduce catalogue management.

• Integration with vRealize Operations 6.6 (vROps); allowing intelligent placement of workloads based on analytics data and a Workload Placement Policy.

• Enhanced integration with IPAM – an extended IPAM framework allowing deeper integration with Infoblox initially, but expect other IPAM providers to start providing plugins.

• Enhanced integration with ServiceNow – a new plugin version will deepen the integration with ServiceNow as a CMDB and governance engine, with support for things like day 2 operations.

 There have been huge improvements and developments with the NSX integration, with all the native functionality now using the REST API rather than the vRealize Orchestrator (vRO) Plugin – this is great news and will simplify operations and troubleshooting. The plugin is still available for custom integrations if required.

 The main highlights for me are:

• Deeper integration with NSX Load Balancers – which allows customised load balancer configuration per-blueprint (algorithms, persistence, health monitors, port, etc.)  as well as day 2 reconfiguration of the load balancer. This is a fantastic improvement!

• NSX Security Group and Tag integration – much better integration with the UI and the ability to add and remove Security Groups and Tags as a day 2 operation

• NSX Edge Sizing and HA – Edge Gateways can be customised on a per blueprint basis to size correctly or in HA mode for resilient services like load balancing, NAT and firewall.

 vRA 7.3 should also have a greater appeal to those who have developer environments, with its deeper integration with Puppet, Docker, vSphere Integrated Containers and Docker volumes.

• Puppet as a “1^st class citizen” – this is part of a wider move to get configuration management tools integrated with the platform, but it’s starting with Puppet. This means drag and drop configuration management in the blueprint designer, and day 2 configuration management for deployed applications.

• Container management has been improved with support for vSphere Integrated Containers, alongside the traditional Docker hosts, and support for Docker volumes.

 And for those who are already running vRA, there are a couple of bug-bears that have been relieved, such as:

• A force destroy option to get rid of those “stuck” deployments. These would previously require a CloudClient command line clean up, or a database edit under the watchful eye of GSS.

• Improved integration with Storage Policies – anyone who has used the SPBM plugin will know that it’s been a little … clunky. A new plugin, shipped with the latest version of vRO, will make it easier to leverage vSAN and VVOL based storage.

• Role based access for vRO – given the huge power within the SDDC that vRO has, it’s great to see this finally being implemented.

 That’s a vast number of really significant improvements for a single point release and in this blog I’ve only drawn out the ones that I know customers will love. This release is without a doubt, a massive step forward in the maturity of VMware’s Cloud Management Platform.

 If you are considering a move to a Cloud Management platform and need assistance in deciding on the right solution for you and your organisation, please contact us and we’d be happy to use our wealth of knowledge and experience to assist you.

By Curtis Brown

A brief update

Following my visit to VMworld Europe in 2017 I wrote a blog post on VMware Horizon Cloud on Azure. Much has changed in a year, so it seems rather timely, given that VMworld Europe 2018 has just concluded, that I update the blog.

Where we were….

Going back a year to 2017, VMware Horizon Cloud on Azure had only just launched and at the time, it was capable of publishing full clones of Remote Desktop Session Host servers for publishing Shared Desktops and applications.  A pretty good start, all things considered, albeit slightly functionally limited compared to the VMware Hosted offering that could also offer dedicated VDI desktops.

A year on, where are we now?

Things have definitely moved on in the last year.  Not only is feature-parity between Azure and VMware Hosted offerings somewhat closer, but in one area, graphics, the Azure offering is actually superior!

Deployment

The deployment model has remained the same – you bring your own Azure subscription rather than lean on VMware for the hosting.  In this sense, it is still the case that a cost/benefit analysis needs to be undertaken

The cost of deploying Horizon VMs on Azure can be more expensive when compared to the VMware hosted offering.  To be fair, Azure is more oriented towards a server offering than desktops, so perhaps this shouldn’t be too much of a surprise.  To counterbalance this however, one must also consider connectivity in the equation.  If you already have an established Azure tenant with backhaul connectivity to on-site, then deploying VMware Hosted with its own connectivity overhead may counter the VM costs to a degree – certainly, the operational upkeep of additional environments and connectivity is a consideration.

An additional point to consider may be functionality.  From a deployment perspective, Horizon Cloud on Azure is now starting to offer dedicated and floating full desktops, not just shared.  However, at present, Instant Clones are not supported so deployment is limited to essentially persistent desktops.

Features

There is, as yet, no support for VMware App Volumes AppStacks in Horizon Cloud, so legacy deployment mechanisms will need to be considered.  As desktops are currently persistent in nature, legacy tooling such as Microsoft System Center Configuration Manager remain viable in this sense, though streaming application virtualisation tools such as VMware ThinApp and Microsoft App-V would be attractive too.

One feature that stands out over Hosted Horizon Cloud is that Azure offers enhanced graphics using Nvidia vGPU technology.  So, if you have a need for graphically intensive workloads in the Cloud, then Azure is currently the better choice.

Otherwise, with respect to connectivity protocols, management interfaces and other functionality such as the Skype for Business Virtualization Pack, the two offerings are now aligned.

What about VMware Cloud on AWS with Horizon?

VMware and Amazon Web Services have joined up to offer their VMware Cloud on AWS solution.  This allows customers to deploy a full VMware vSphere infrastructure in AWS data centers.  On top of that, it is possible to deploy VMware Horizon, so in a sense there is now a third Cloud desktop offering.

VMware consider this as an IaaS solution with desktops on, rather than a Desktop-as-a-Service offering as the customer has to look after the management tier of Horizon here, as opposed to Horizon Cloud.

The million-dollar question is - which is best? Well, there’s no easy answer to that.  Functionality wise, Horizon View has been around longer, has far greater scalability and the ability to federate multiple instances for greater resilience.  In an on-prem capacity, vGPU is supported, however this has yet to reach AWS.  The economics are more complex too given the different acquisition model involved.

There are a considerable number of use-cases where Horizon on VMware Cloud on AWS makes much more sense. For example, you have an on-prem VDI (and other services) that you wish to provide an instantaneous Cloud based DR or scaling offering, this is much more seamless and flexible than Horizon Cloud.

Closing Thoughts….

While the choice between on premises and then several cloud offerings is undoubtedly great, never has it been more apparent that an analysis prior to deciding is not just a ‘nice to have’ but a necessity.  The wrong decision can have expensive repercussions.  Such an analysis needs to consider:

• The business needs:
  

1. How does the business function currently and what are the issues to address?
   
2. How will a given solution benefit the business?
   

• Technology needs:
  

1. Compatibility with the existing environment
   
2. What connectivity do I have, and what will I need?
   
3. What resilience and security features are required?
   

• User needs:
  

1. Where are the users working?
   
2. What devices do they use and how do we manage them?
   
3. What and where are application services that users need?
   

For some customers, on-premises will remain the best approach to VDI, while others may benefit from the VMware Cloud on AWS approach offering both hybridity and flexibility and yet more may find a Desktop-as-a-Service the suitable answer.

Horizon Cloud on Azure has evolved rapidly and offers a convincing use case for customers who can gain a tangible benefit from it, but it’s not suitable in all cases.  If you need a DaaS solution and have Azure already or have graphical requirements that can’t be met in Horizon Cloud Hosted, then this might be your answer. But consider all possibilities and use cases before committing.

If you’re considering a VDI solution or digital workspace transformation, whether Cloud or On-Premises, we can help. We provide advisory, design and implementation services to create the right solution for your organisation. Contact us and we’d be happy to use our wealth of knowledge and experience to assist you.  

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He was awarded VMware vExpert 2018 and is a graduate of the VMware Advanced Architecture Course 2018.

About Xtravirt

Xtravirt are an experienced consulting firm dedicated to delivering outcomes to help customers solve their IT challenges. We design and build strategies to help customers unlock the full potential of cloud, datacentre and workspace technology.

We are the VMware Global and EMEA Professional Services partner of the year.

www.xtravirt.com

by Curtis Brown

AirWatch®, for some time now a VMware® product, has been one of the most successful Enterprise Mobile Management solutions on the market (enough to justify VMware spending over $1bn to acquire them!).

Although its origins are predominantly based upon cloud based management of mobile phones, the product has spread its wings considerably in recent times. 

Deploying AirWatch

 Although it originated as a cloud based offering, and this is still very much the pushed approach, there are in fact several ways that an AirWatch solution can be deployed.

The most obvious one is the original cloud flavour.

Here, the solution is entirely hosted in the cloud.  Applications and data services are directly accessed from the estate, leveraging as the customer desires (VPN, direct access to the application in the DMZ etc.) This has zero footprint in the estate and works well where services onto the internet are already established.

The next approach, referred to as Integrated Cloud, provides a hybrid approach; a VMware AirWatch Cloud Connector is deployed within the estate.

This server provides both integration with cloud (for notifications and management), an on-premise presence for administration, as well as providing AirWatch Tunnel.  This is a secure gateway for AirWatch managed devices to access corporate resources directly – a ‘VPN-less’ VPN.

The final approach is an on-premise solution.  This leverages one or more AirWatch servers, carrying out all the AirWatch functionality on premise, including the tunnelling capability above.  For small deployments, a single DMZ based server is used. In a larger deployment, with multiple servers, the DMZ server provides AirWatch Secure Email Gateway and AirWatch Tunnel, while AirWatch Servers on the corporate network carry out the remaining provisioning services.

Further, the solution can be fully integrated with VMware Identity Manager Advanced Edition to extend the app catalogue capabilities to include single-sign-on access to web applications, Citrix® and VMware Horizon.  VMware Identity Manager Advanced is included as part of the AirWatch Suite blue and yellow licensing tiers. 

What Devices?

 VMware AirWatch coverage of devices is impressive.  From a mobile phone/tablet perspective, Android, iOS, BlackBerry and Windows Mobile are all supported.  In addition, there is also support for Rugged devices, such as scanning handsets used in warehouses etc.  Typically, these run Android, Windows Mobile or Windows CE.

Perhaps most interesting of all is the support for laptops (and essentially desktops) running Windows 10 or MacOS.  This functionality is quite powerful.  For example, not only can it provide configuration management and asset tracking, as you’d expect with an MDM solution, but it can also provide software distribution (in the case of Windows 10, this includes Win32 and Universal Apps), remote assistance (screen sharing) and endpoint protection such as configuring encryption and malware prevention measures. 

AirWatch Features

 There are a few standout features beyond the ability to manage devices and application publishing in a secure manner.

AirWatch Browser

– This provides a secure web browsing capability.  It can be centrally controlled, allowing white/blacklisting of sites, cookie handling control and restricting copy/print functionality.  On top of this, it provides a built in SSO capability and can leverage an AirWatch App Tunnel to access intranet sites without a third-party VPN.

AirWatch Content Locker

– This is a clever data management solution allowing devices (including browsers) to access corporate data in a secure, rights-managed environment.  It can integrate with cloud provisions (Box, Office 365, Google Drive) and on-premises solutions such as SharePoint and WebDAV and traditional File Servers as well.  In the case of On-Premise, these leverage AirWatch Tunnel for secure access.

**AirWatch Video **

– This is a secure video distribution solution, a corporate YouTube to some extent. 

Closing Thoughts

 VMware AirWatch provides a big play towards VMware’s any device, anywhere mantra.  Whether used in combination with VMware Horizon or other solutions, this provides not only management and control of corporate devices, but also the means to deliver applications and services in a secure manner to practically any compute device.

 About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He is a VMware vExpert 2017.

by Dan Card

Looking into the crystal ball

For starter’s I don’t have a crystal ball (if I did I would probably have won the lottery and be on an island somewhere hot), so predicting the future isn’t that easy. We can however at least give it a go.

Evolution of Computing

Over the past 40 years or so we have moved from centralised mainframe computing onto client/server applications and there began the stacking of beige servers in every server room. We then realised we could consolidate, and swapped out the numerous beige servers for fewer but larger shiny silver rack mount servers running virtual machines. Once we had virtualised as much as possible the next logical step was to then consume these offerings as a service. This is what we currently describe as Cloud computing.

Whilst evolution has provided the ability to allow us to consume serviced offerings today, the stark reality is we are currently somewhere between the adoption curves of virtualisation and cloud.The question on many people’s minds is what does life look like for IT post-cloud? For this prediction I’m going to assume that cloud has been adopted by the masses as opposed to the world moving into an era of cyber warfare where secrecy is paramount and the idea of using multi-tenant services is off the cards. For this prediction, the IT department now has the role of a cloud broker.

Internal IT organisation gap analysis

The following matrix outlines typical existing IT departmental capability, with a view that in the post cloud era requirement in a particular organisation capability will increase, reduce or remain the same:

So the GAP analysis produced is very high level and incredibly speculative, I have however begun to consider the likelihood and impact of changes to the technology landscape; who knows maybe at some point we will have answers to questions such as:

• Will my level 1 headcount need to increase and level 2/3 be offset to vendors and cloud providers?
• Will we rely on a far greater maturity of supplier management?
• Will IT security internally become outsourced to cloud providers?
• With the increase in 3rd party services and solutions increase the requirement for strong central governance?
• How will cyber warfare affect the corporate IT landscape?
• Will cloud be overtaken by a far greater disruptive force?

What’s your view on the post cloud era? Will it go full circle and bring IT back in house? Will we exist in a hybrid world, or will we become consumers of service?
Anyway this is just a glimpse of the types of conversation the team at Xtravirt have when they aren’t out solving current customer issues.

We are always here to help you with your virtualisation challenges so if you have a requirement, please contact us and we’ll be happy to assist.

by Michal Grzeszczak

My name is Michal Grzeszczak and I am a senior consultant at Xtravirt (www.xtravirt.com), an independent cloud consulting business and VMware Master Services Competent Partner.  In this blog, I’d like to share with you my experience of L2 bridging with VMware® NSX-T Data Center and help you to understand some of the differences between NSX-T and NSX-V, as well as cover some NSX use cases.  

Customer background:

The customer is one of the leading organisations in the betting and gambling industry and have been using NSX-V for some time now. When it came to their new greenfield environment, they decided to deploy NSX-T 2.4 Data Center. This decision was largely based on the fact that NSX-T Data Center provides bridging firewalls natively for L2 software bridging, which was their main requirement. Also, given that NSX-T will be the de facto network and security virtualisation platform offered by VMware going forward, by specifying it for this environment the customer is able to future proof the deployment. 

Future upgrades are also accounted for as upgrading from NSX-T 2.4 to future NSX-T releases is simpler than performing upgrades from a previous version of V or T.

NSX-T 2.4 was a major update and brought many changes to the architecture of the product, the main ones being:

• The NSX Manager and NSX Controllers were merged into one appliance deployed in a Cluster of 3 Nodes therefore minimising the footprint of the solution and operational complexity. 
• The other major change was the introduction of the new Simplified UI which “requires just the bare minimum of user input, offering strong default values with prescriptive guidance for ease of use. This means fewer clicks and page hops are required to complete configuration tasks.”

NOTE: In NSX 2.4 two UIs are presented - one is the new Simplified UI, the other one is Advanced. The latter is taken from NSX-T 2.3. The future plan is to remove the Advanced UI and provide all of the functionality via the Simplified UI.

 What are the key benefits of choosing NSX-T over NSX-V?

 There are many benefits of NSX-T over NSX-V, to name a few:

• NSX-T doesn’t require vCenter, however it can be added to NSX-T as a Compute Manager and allows for up to 16 Compute Managers per NSX 2.4 solution . There is no longer a 1:1 requirement like there was with NSX-V. 
• KVM Hypervisor support
• Bare Metal Edges provide sub-second failover 
• Data Plane Development Kit (DPDK) Optimising Forwarding - DPDK is a set of data plane libraries and network interface controller drivers for fast packet processing
• New, more flexible Overlay technology - Geneve replaces     VXLAN  https://docs.vmware.com/en/VMware-Validated-Design/4.3/com.vmware.vvd.sddc-nsxt-design.doc/GUID-CF3C47CA-9BEB-4213-8F08-1494261BF3EC.html 
• Bi-directional Forwarding Detection support
• BGP (Border Gateway Protocol) expanded functionality with features like Route Maps
• Much clearer User Interface (UI)

What were the specific use cases for this case customer and the design considerations?

USE CASE 1 - NSX-T Edge L2 Bridging - Integration of physical, non-virtualised database servers that require L2 connectivity to the virtualised environment. 

Design considerations:

• In NSX-T 2.4 two options are possible to bridge L2 workloads - using ESXi Bridge Clusters or Edge Bridge Profiles. The latter is recommended to use as the former will be deprecated in future. 
• Ideally the use of dedicated Bare Metal Edges, however this is not a requirement. 
• The possibility to deploy Edge Bridges in collapsed vSphere Clusters >     Management + Edge or Compute + Edge
• Consider having active and standby Edge Nodes on different hosts to avoid throughput drop, because VLAN traffic needs to be forwarded to both Edge Nodes in promiscuous mode.
• Overlay traffic can be tagged on a Distributed Port Group or Uplink Profile, but please avoid double tagging. 
• VLAN traffic should not be tagged on the Uplink Profile.
• Distributed Port Group for VLAN traffic connecting to the Edge Node should be in a Trunk Mode. The reason for this is due to the fact that Edge doing Bridging adds 802.1Q tag when transposing Overlay traffic to VLAN. 
• Consider having the same MTU value across your environment - if you can, choose MTU of 9000 for better performance. 
• Several Bridge Profiles can be configured, and a given Edge can belong to several Bridge Profiles. By creating two separate Bridge Profiles, alternating active and backup Edge in the configuration, the user can easily make sure that two Edge nodes simultaneously bridge traffic between Overlay and VLAN

Constraints:

• Edge Cluster with minimum 2 Edge Nodes in Active/Standby mode is needed.
• Standby uplinks are not supported on the Edge Node.
• Source Based Load Based Teaming is not supported on the Edge Node.
• The port group on the VSS/VDS sending and receiving traffic on the VLAN side should be in promiscuous mode, allowing MAC Address changes and Forge Transmits.

Deployment:

• Follow the deployment guide here - https://youtu.be/IwpujflzJhY 
• Or here https://docs.vmware.com/en/VMware-NSX-T-Data-Center/2.3/com.vmware.nsxt.admin.doc/GUID-7B21DF3D-C9DB-4C10-A32F-B16642266538.html 

Validation:

• Log in to the Edge Node with your credentials.
• Type “nsxcli”.
• “Get l2bridge-ports-config” will show the Bridge Port State (Active Edge will have Forwarding, Standby will have Stopped), VLAN ID configured and Bridge UUID which can be copied and used to do a packet capture on the Edge Node.
• To do the packet capture type “start capture interface “copied Bridge UUID” and hit enter, ping from VM to Physical Server to see the flows. 

USE CASE 2 - NSX bridging firewall - Secure communication between physical database servers and Overlay workloads.

• The configuration of the bridging firewall can be done currently only on the Advanced UI.
• Security rules are configured per Logical Switch aka Segment in Simplified UI. 
• NSX-T grouping objects like NSGroups can be used to provide abstraction from the IP based approach.

USE CASE 3 - vRealize Network Insight - Monitoring tool that can provide visibility into both Physical and Virtual environments. 

• NSX-T 2.4 is fully supported with the latest vRealize Network Insight version 4.1.
• Make sure you are allowing ports for communication between vRNI and other devices after the deployment. For example, ESXi Hosts to vRNI Collector on UDP 2055. The full list of ports needed can be found here - https://docs.vmware.com/en/VMware-vRealize-Network-Insight/3.9/com.vmware.vrni.install.doc/GUID-FDDA5F2F-7C3B-472A-A17D-39582FBD5996.html 
• There is a new website that provides in-depth information about new features in vRNI, definitely worth visiting - https://vrealize.vmware.com/t/vmware-network-management/  

What were the outcomes?

Overall, this deployment was a complete success as we were able to satisfy all of the requirements that the customer had. All the production physical databases were able to communicate on the same L2 segments, virtualised and connected to NSX-T segments workloads. On top of that, communication between those workloads was secured by NSX-T Bridging Firewall. vRealize Network Insight was used to provide visibility into the environment. Its ability to quickly troubleshoot network and firewall related issues in both virtual and physical realms allows admins to take a breath in the never-ending battle of making the networks stable.

I hope you enjoyed my blog, if you’d like to talk to Xtravirt about your business’s networking and security requirements, then please send an email to info@xtravirt.com

Some Useful links:

You can read more about the NSX-T 2.4 release here: https://blogs.vmware.com/networkvirtualization/2019/02/introducing-nsx-t-2-4-a-landmark-release-in-the-history-of-nsx.html/