Xtravirt — PowerCLI and VMware Horizon View

By Curtis Brown

A brief update

Following my visit to VMworld Europe in 2017 I wrote a blog post on VMware Horizon Cloud on Azure. Much has changed in a year, so it seems rather timely, given that VMworld Europe 2018 has just concluded, that I update the blog.

Where we were….

Going back a year to 2017, VMware Horizon Cloud on Azure had only just launched and at the time, it was capable of publishing full clones of Remote Desktop Session Host servers for publishing Shared Desktops and applications.  A pretty good start, all things considered, albeit slightly functionally limited compared to the VMware Hosted offering that could also offer dedicated VDI desktops.

A year on, where are we now?

Things have definitely moved on in the last year.  Not only is feature-parity between Azure and VMware Hosted offerings somewhat closer, but in one area, graphics, the Azure offering is actually superior!

Deployment

The deployment model has remained the same – you bring your own Azure subscription rather than lean on VMware for the hosting.  In this sense, it is still the case that a cost/benefit analysis needs to be undertaken

The cost of deploying Horizon VMs on Azure can be more expensive when compared to the VMware hosted offering.  To be fair, Azure is more oriented towards a server offering than desktops, so perhaps this shouldn’t be too much of a surprise.  To counterbalance this however, one must also consider connectivity in the equation.  If you already have an established Azure tenant with backhaul connectivity to on-site, then deploying VMware Hosted with its own connectivity overhead may counter the VM costs to a degree – certainly, the operational upkeep of additional environments and connectivity is a consideration.

An additional point to consider may be functionality.  From a deployment perspective, Horizon Cloud on Azure is now starting to offer dedicated and floating full desktops, not just shared.  However, at present, Instant Clones are not supported so deployment is limited to essentially persistent desktops.

Features

There is, as yet, no support for VMware App Volumes AppStacks in Horizon Cloud, so legacy deployment mechanisms will need to be considered.  As desktops are currently persistent in nature, legacy tooling such as Microsoft System Center Configuration Manager remain viable in this sense, though streaming application virtualisation tools such as VMware ThinApp and Microsoft App-V would be attractive too.

One feature that stands out over Hosted Horizon Cloud is that Azure offers enhanced graphics using Nvidia vGPU technology.  So, if you have a need for graphically intensive workloads in the Cloud, then Azure is currently the better choice.

Otherwise, with respect to connectivity protocols, management interfaces and other functionality such as the Skype for Business Virtualization Pack, the two offerings are now aligned.

What about VMware Cloud on AWS with Horizon?

VMware and Amazon Web Services have joined up to offer their VMware Cloud on AWS solution.  This allows customers to deploy a full VMware vSphere infrastructure in AWS data centers.  On top of that, it is possible to deploy VMware Horizon, so in a sense there is now a third Cloud desktop offering.

VMware consider this as an IaaS solution with desktops on, rather than a Desktop-as-a-Service offering as the customer has to look after the management tier of Horizon here, as opposed to Horizon Cloud.

The million-dollar question is - which is best? Well, there’s no easy answer to that.  Functionality wise, Horizon View has been around longer, has far greater scalability and the ability to federate multiple instances for greater resilience.  In an on-prem capacity, vGPU is supported, however this has yet to reach AWS.  The economics are more complex too given the different acquisition model involved.

There are a considerable number of use-cases where Horizon on VMware Cloud on AWS makes much more sense. For example, you have an on-prem VDI (and other services) that you wish to provide an instantaneous Cloud based DR or scaling offering, this is much more seamless and flexible than Horizon Cloud.

Closing Thoughts….

While the choice between on premises and then several cloud offerings is undoubtedly great, never has it been more apparent that an analysis prior to deciding is not just a ‘nice to have’ but a necessity.  The wrong decision can have expensive repercussions.  Such an analysis needs to consider:

• The business needs:
  

1. How does the business function currently and what are the issues to address?
   
2. How will a given solution benefit the business?
   

• Technology needs:
  

1. Compatibility with the existing environment
   
2. What connectivity do I have, and what will I need?
   
3. What resilience and security features are required?
   

• User needs:
  

1. Where are the users working?
   
2. What devices do they use and how do we manage them?
   
3. What and where are application services that users need?
   

For some customers, on-premises will remain the best approach to VDI, while others may benefit from the VMware Cloud on AWS approach offering both hybridity and flexibility and yet more may find a Desktop-as-a-Service the suitable answer.

Horizon Cloud on Azure has evolved rapidly and offers a convincing use case for customers who can gain a tangible benefit from it, but it’s not suitable in all cases.  If you need a DaaS solution and have Azure already or have graphical requirements that can’t be met in Horizon Cloud Hosted, then this might be your answer. But consider all possibilities and use cases before committing.

If you’re considering a VDI solution or digital workspace transformation, whether Cloud or On-Premises, we can help. We provide advisory, design and implementation services to create the right solution for your organisation. Contact us and we’d be happy to use our wealth of knowledge and experience to assist you.  

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He was awarded VMware vExpert 2018 and is a graduate of the VMware Advanced Architecture Course 2018.

About Xtravirt

Xtravirt are an experienced consulting firm dedicated to delivering outcomes to help customers solve their IT challenges. We design and build strategies to help customers unlock the full potential of cloud, datacentre and workspace technology.

We are the VMware Global and EMEA Professional Services partner of the year.

www.xtravirt.com

by Curtis Brown

VMware NSX® network virtualisation platform has been around for a little while now delivering an operational model for networking that forms the foundation of the Software-Defined-Data-Centre.  It’s often associated more with server virtualisation or as a component within a Cloud Automation solution and with good reason; it’s readily able to deliver a scaled, secure environment, while providing several mechanisms to deliver advanced network functionality such as firewalling, load balancing and anti-malware protection.  However, one area where its application is frequently overlooked is in the world of End User Compute – more specifically virtual desktop infrastructure.

Wouldn’t it be nice if…

Consider a full-on Horizon deployment (though, to be fair, these components could be replaced in the most part for an element of your choice) –

•  Horizon View – This will publish Virtual Desktops in Pools, with these pools assigned to Active Directory based Groups/Users.
• App Volumes – This gives you a mechanism for delivering defined stacks of applications to the Virtual Desktops.Again, you can assign using Groups or users.
• User Environment Manager – You use this to manage environmental and application settings.

 So, you have the mechanisms in place to deliver Virtual Desktops, complete with some granular application and settings delivery.  This is all pretty good, but wouldn’t it be nice if you could provide some intelligent network capabilities too?

Finetuned Firewalling.

Now take VMware NSX - this has some nice features that you can leverage in a VDI estate.

One of the key areas of concern is hardening the estate.  There’s been a pretty big play in the NSX world around using NSX to provide segmentation – both at a macro level, separating workloads into different VXLANs on virtual switches – and at the micro level using the Distributed Firewall to provide firewall rules at the Vmnic. Both strategies can be used here.

You can also separate Pools at a macro level or a micro level if you wish to, with the latter being particularly interesting.

The Distributed Firewall can provide a great deal of flexibility when defining firewall rules and can leverage several different identifiers, including vSphere entities and Active Directory objects.  Using these, you can generate a rule bases to lock down traffic quite tightly, in conjunction with the VDI solution and application delivery mechanism.  Take this example:

You can set up a standard DFW ruleset that applies to your desktops that will prevent traffic between the virtual desktops, while still providing the core services and application support for anything required for the desktop. This means you can control LDAP traffic between the desktops and Domain Controllers or PCoIP between the desktops, the Connection Servers or direct to physical endpoints if you wish.

 With App Volumes, you can define an AppStack with several applications which may well have discrete client/server network traffic requirements.  The DFW can apply rules based upon the user logged into the desktop, so you can create and apply rules specific for these client server applications and tie them to the same Active Directory object that applies the AppStack.

 The net result is that you end up with a combined ruleset applied to a desktop that is not just tied to a broad pool, but also to discrete needs for users within the pool. This provides strict granular access based upon the needs of the desktop and the application set for the user.  And let’s remember that this is applied at the desktop’s connection to the network – not at any perimeter level.

Malware Protection

NSX also provides the ability to integrate a compatible antivirus/antimalware solution into the mix. This is not, however, limited to the more publicised Guest Introspection where virus scanning is offloaded at the hypervisor level.  NSX can also integrate with both virtual and physical appliances such as Fortigate for intrusion detection, perimeter firewalling and more.

At the Infrastructure Level

As with any VDI estate, you have the upstream infrastructure to consider, several services can be provided here too.  

Using VMware NSX Edge Gateway appliances, you can provide perimeter firewalling between networks.

For Horizon View, both Connection Servers as well as Access Gateways/Security Servers require Load Balancers, as do App Volumes Managers.  The NSX Edge appliances are capable of being configured to provide load balancing services.

Perimeter firewalling using NSX Edge can also be provided, so you can have a DMZ layer for the Security Servers/Access Gateways as well.

Generally speaking, you could deploy something like this for the Horizon View management environment:

Our external traffic accesses the estate via a pair of NSX Edge Gateways, serving as firewall and load balancer for a pair of VMware User Access Gateways.  These are configured as two-legged, tunnelling into the vSwitch beneath, where you have a dedicated NSX Edge appliance load balancing the Connection servers.  This internal load balancer is also used by internal users who connect in via an L2 bridge or NSX Edge as appropriate.

 You then deploy NSX for the Desktop blocks as well, in order to provide the previously mentioned firewalling and malware protection for a secure end-to-end solution.

Closing Thoughts…

With NSX, it’s possible to turbo-charge the security for a VDI desktop environment in a manner that can be applied regardless of the choice of broker solution – the above would work just as well in a third party VDI solution such as Citrix XenApp or, perhaps more importantly, XenDesktop, not just VMware Horizon.  The ability to dynamically set and operate firewalling on egress outside of the guest Operating System means that such firewalling cannot be tampered with from within the VDI desktop, which might be useful in environments where desktops are used with untrusted users (public kiosks for example).

If you’re interested in exploring the combination of VMware NSX network virtualisation in a VDI estate, please contact Xtravirt, and we’d be happy to use our wealth of knowledge and experience to assist you.

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He is a VMware vExpert 2017.

by Nick Goldman

VMware Cloud Foundation brings the best in breed virtualisation of network, storage and compute in a pre-validated and automated package. VMware cloud is used in VMware based public cloud solutions such as; VMware cloud on AWS and IBM cloud for VMware solutions. VMware Cloud Foundation lets you spin up a private cloud environment in a much-reduced time frame and deliver a reliable hybrid cloud environment.  

VMware Cloud Foundation 3.0 was announced only a few months ago at VMworld US 2018. Version 3.0 removed the requirement to use Cisco or Arista switches. Now any switch provider that is on the VMware Hardware Compatibility List (HCL) can be used which will allow for VCF fitting into existing environments.  VMware has now also added all vSAN ready nodes which opens up far more flexibility with hardware.  

A number of management of improvements were also made also assist with enterprise deployments. These included the ability to skip upgrades of vCenter and ESXi which helps with compatibility of 3rd party solutions). Cloud Foundation 3.0 also supports multiple clusters in a workload domain to allow for larger workload domains and reduced size of failure domain and specific use cases which require small clusters (such as licensing) and stretch clusters.

Now only a few months later the next release 3.5 is announced and brings a raft of new features including support for NSX-T and PKS (Pivotal Container Service), support for composable infrastructure (initially HPE Synergy) and support for external NFS (which allows the use of existing storage for workloads).

Including NSX-T in VMware Cloud Foundation shows the direction that VMware are heading towards with much larger use cases for NSX-T.

What is VMware Cloud Foundation?

VMware’s Cloud Foundation was born out of the VMware EVO SDDC (Software Defined Data Centre) platform and is designed to make private and public clouds easy to deploy, manage and secure. It also allows cloud providers such as IBM and VMware Cloud on AWS, as well as private data centres, to quickly deploy and scale out a cloud platform.  

“VMware’s Cloud Foundation allows cloud providers to quickly deploy and scale out a cloud platform” 

VMware Cloud Foundation is a Hyper Converged Infrastructure platform that that delivers software defined compute, storage and networking services (NSX) to allow agile delivery of virtual servers or containers. The solution is made up of vSphere, VSAN and NSX overlaid with a management solution (the SDDC manager) which is used for both setup and day 2 operations such as patching and monitoring. 

Cloud Foundation version 3.5 has just been released and includes the latest releases of all VMware products including vSphere 6.7U1, vSAN 6.7U1, NSX-V6.4.3, NSX-T 2.3 and optionally vRealize Automation 7.5. and vRealize Operation 7.0, vRealize Log Insight 4.7

Delivery Model

VMware Cloud Foundation is available in three delivery models: 

• Through a public cloud provider such as VMware Cloud on AWS or through one of the VMware Cloud Provider Program providers such as IBM or Rackspace   
  
• As an engineered solution such as Dell EMC’s VxRack solution which comes preconfigured and installed (however customers have informed me this at present introduces a delay while the configuration is certified 
  
• Deploying on any vSAN ready nodes from any vendors including Dell EMC, Cisco, Fujitsu, HPE, Hitachi and Quanta 
  

Cloud Foundation can speed up the delivery of an SDDC solution by having a pre-validated and tested solution using VMware best practices. This can reduce the complexities and lead times associated with traditional datacentre infrastructures. VMware on AWS will be the proving ground for many new features on VMware Cloud Foundation and as the suite is all based in software VMware will be able to rapidly add features.  

“Cloud Foundation can speed up the delivery of an SDDC solution” 

The management of Cloud Foundation is via the VMware SDDC Manager. From within here you can do the initial bring up which just requires a few details such as time, network settings and DNS and NTP servers. The SDDC manager will bring up the entire stack including switch configuration, host configuration and a management cluster (a four-node cluster containing a dedicated vCenter, NSX manager and vSAN). Once the bring up procedure has been completed, you are then able to deploy workload domains which are policy driven based on the performance and availability requirements. The workloads can either be virtual server infrastructure or virtual desktop infrastructure where the SDDC manager will automatically deploy a fully functional VMware view environment.

Is VMware Cloud foundation right for my company?

Whether Cloud Foundation is right for your organisation for not depends on what your commitment to other hardware solutions such as a SAN or blade enclosures are. In these cases, it may not be best to change your entire infrastructure to start using Cloud Foundation, but if you have end of life hardware or you are looking at putting in NSX to virtualise your organisation’s networking then it could help to reduce the time to get the new platform up and running. In addition, with the lifecycle management included it will reduce some of the burden associated with keeping your cloud platform up to date.

If your organisation has previously struggled with setting up new technology or it has taken an excessively long amount of time to deploy and expand, then VMware Cloud Foundation could be the right solution for your organisation. VMware will allow you to transfer existing unused licenses for individual components to Cloud Foundation.

VMware Cloud Foundation has similarities to other solutions such as Nutanix, which provide a simplified management for their hyper converged platform. However, the inclusion of technology such as NSX in the platform is more advanced than some of VMware’s competitors.

“Cloud Foundation takes VMware’s best of breed technology and wraps a management layer around them”.  

Version 3.5 also offers the latest versions of VMware products which was part of VMware’s commitment to reduce the time between when products were released individually and when they are available as part of VMware cloud foundation.

Closing thoughts

VMware Cloud Foundation has become a very comprehensive solution for organisations looking to deploy there SDDC in a reliable and standardised fashion whilst reducing timescales for design and deployment. It takes VMware’s best of breed technologies and wraps a management layer around them. As companies look to move towards a buy rather than build strategy with their infrastructure then VMware Cloud Foundation is on point to be a tried and tested solution. VMware are starting to open up options of hardware in this release which will make Cloud Foundation to suitable for many more organisations who are looking to upgrade or deploy a new SDDC or to put them on the path to the hybrid cloud journey via NSX hybrid connect. 

If you are interested in VMware cloud services and solutions and want to know how they can benefit your organisation Xtravirt can help. We provide advisory, design and implementation services to create the right solution for your organisation. Contact us and we’ll be happy to use our wealth of knowledge and experience to assist you. 

About the Author

Nick Goldman is a Senior Consultant within the Xtravirt consulting team. He is an experienced infrastructure consultant with experience in both technical architecture and hands-on implementation. His areas of expertise include virtualisation solutions based on the VMware stack and Microsoft based infrastructure solutions.

About Xtravirt

Xtravirt are an experienced consulting firm dedicated to delivering outcomes to help customers solve their IT challenges. We design and build strategies to help customers unlock the full potential of cloud, datacentre and workspace technology.

We are the VMware Global and EMEA Professional Services partner of the year.

www.xtravirt.com

by Curtis Brown

As those of you who have the joy of supporting end-users will know (and this old techie has worn that badge of honour!), any tool that can make getting to grips with an issue easier is always welcome, particularly if it means getting your hands on the user’s desktop to see the problem in action.

So it’s welcome news that the latest release of VMware Horizon® 7.2 brings into play a fully integrated helpdesk tool, specifically for supporting VMware Horizon desktop sessions. It provides session information, as well as several remote operational abilities such as resetting sessions, remote control, logging off users etc.

Setting up Helpdesk

You don’t need to do anything fancy to install it as it’s a part of the Connection Server installation, however there are several recommended additional steps to get best use from it.

You will need to configure the Events database – this provides session information to the HelpDesk console, so it’s pretty important. To track logon events properly, a further command should be run on each Connection Server:

vdmadmin -I -timingProfiler -enable

Oh, and ensure that the VMware Horizon Agent installed in the desktop templates is also a 7.2 release – otherwise you’ll miss desktop side session information.

Getting into the Help Desk Tool

There are two ways of accessing the Helpdesk tool.  In either case, a user will require Admin access to Horizon – Inventory Admins should be sufficient for most operations.

The first option is to log into the Admin console for horizon (HTTPS://(ConnectionServer URL)/admin). Once logged in, there is a new Help Desk button in the top bar of the console – click on this to access the helpdesk tool – the credentials pass through, all Single Sign-On style!

Alternatively, you can access the console directly (via HTTPS://(ConnectionServer URL)/helpdesk) and then log on with the right credentials.

Doing Help Desk stuff.

So, once you’re all set up and logged in, you can use the tool to do all sorts of heroic Help Desk stuff. The front page offers a search function.

Punch in the name of the user, for example, “Curtis” and it’ll pull in the Active Directory credentials of the user – if the Active Directory E-mail and phone number fields are filled in, these are also displayed.

If you click on the user, you’ll get a new page with a summary of running sessions and entitlements.

Under ‘Sessions’, you’ll see the highlights of all running sessions - the green ones are connected sessions.  It’s even Cloud Pod aware – the L status refers to a session in the local Pod, and the G status refers to a session in the global Cloud Pod environment. If you then click on the Computer name, you can drill down further.

If the Agent is 7.2+, you get detailed session info, including CPU performance, memory usage and more.  Further, you can do some active tasks on the session.

You can send messages to the specific session or offer Remote Assistance.  The latter plugs into Microsoft’s Remote Assistance functionality, so this will need to be enabled and configured in the VM.

On VDI sessions (not RDS Published Desktops or Application Sessions), you can issue a restart command to the desktop – this will reboot the VM.  You can also disconnect or log off users.  The Reset function differs from Restart in that the latter is a graceful shutdown and restart – Reset should only be used if the VM has hung.

Closing Thoughts….

So, a welcome set of useful capabilities has been added to this point release – and one that focusses on supportability rather than the usual performance or user-centric capabilities.

If you’re in need of assistance with a troublesome Horizon solution or perhaps want some support upgrading or implementing a new one, please contact Xtravirt, and we’d be happy to use our wealth of knowledge and experience to assist you.

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He is a VMware vExpert 2017.

By Curtis Brown

The somewhat anticipated release of VMware vSphere 6.7 Update 1 is now with us.  So, the burning question now is “Can I upgrade?”.  The answer is not quite as simple as a yes or no as this is always a mine field, particularly where interoperability is concerned.  My intention with this article is to save you some of the leg work with respect to investigating product interoperability.

However please note, this article doesn’t dig into hardware compatibility, or compatibility with third party products, simply because of the vast array of possible scenarios.

Compatibility with Horizon View 7

The most common starting point is VMware Horizon 7 itself.   By checking the VMware product Interoperability Matrix, we can see that the minimum release of VMware Horizon that is validated with VMware vSphere 6.7 Update 1 is the latest release, 7.6.

VMware Horizon 7.6 - COMPATIBLE

VMware App Volumes

VMware App Volumes 2.14 and the more recent patch release are both listed as a valid configuration.  This would also be the recommended release for use with VMware Horizon 7.6, although it has quite a generous level of backward compatibility.

One observation of note is that the poorly adopted cul-de-sac release 3.0 product has not been validated against 6.7, but as this was explicitly incompatible with 6.5, so this is not particularly surprising.

VMware App Volumes 2.14.2 - COMPATIBLE

VMware vRealize Operations for Horizon

With respect to VMware vRealize Operations support in general, release 6.6.1 or later is required.  This is driven by vSphere rather than Horizon which can work with older vROps releases.

For a VMware Horizon environment running on VMware vSphere 6.7 Update 1, the VMware vRealize Operations for Horizon plugin needs to be on 6.6.0 to support VMware Horizon 7.6 to retain compatibility through to VMware vSphere.

However, care should be taken with the compatibility between the Horizon plugin and vRealize Operations itself.  As the Horizon component only supports Horizon 7.6 directly on release 6.6.0 of the plugin, the interoperability matrix dictates that VMware vRealize Operations should be running on release 6.7.

VMware vRealize Operations Manager 6.7 - COMPATIBLE
VMware vRealize Operations for Horizon 6.6 - COMPATIBLE

Of course, for features, guest operating system compatibility, the latest version is recommended.

VMware User Environment Manager 9.5 - COMPATIBLE

VMware NSX for vSphere

Although not every VMware Horizon deployment uses VMware NSX, it’s included to flag a possible concern. With respect to straight VMware vSphere interoperability, VMware NSX for vSphere 6.4.2 and 6.4.3 both support for vSphere 6.7 Update 1.  However, the supported Horizon release (7.6) has yet to be validated with NSX 6.4.2 or 6.4.3.  This is  unlikely to cause an issue, and validation is likely to be only a matter of time, though it may be enough to cause a pause for thought.

VMware NSX for vSphere 6.4.3 - SUBJECT TO CONFIRMATION BY VMware REGARDING HORIZON 7.6

Upgrading Desktop Templates

With respect to upgrading templates, the back-end components should be upgraded prior to the agents within the image.  As such, upgrading this rather depends on how many change windows are being used to upgrade the above components.  In all cases, VMware have limited support for backward compatibility for agents, so there is flexibility here.  The VM templates have the following components/dependencies:

• VMware App Volumes Agent – used for registering the VM and the logged in user to App Volumes manager.
  
• VMware UEM Agent – used for managing the user persona via UEM.
  
• VMware vRealize Operations for Horizon Agent – although a version is integrated as part of the VMware Horizon Agent, for full functionality in line with the release of vRealize Operations for Horizon, the dedicated agent is recommended.
  
• VMware Horizon Agent – this is used to provide components for managing deployment, assignment and the remote desktop protocol to the desktop.  It is recommended that this is installed after VMware Tools has been upgraded.
  
• VMware Tools – required for interaction with vSphere, as well as providing optimised device drivers for the guest OS.
  
• The VM virtual hardware version – this is defined by the VMware ESXi release. Upgrading should only be carried out once VMware Tools are upgraded but can be beneficial for performance reasons.
  

Where hardware GPUs are deployed, there are further considerations.  For example, if the templates are deployed using a vDGA (Dedicated Graphics) or Nvidia vGPU configuration, further investigation into supported Nvidia drivers should be carried out.

What to upgrade first?

Where to start upgrading will be driven from your starting point, so it’s well worth looking at compatibility of the release that you’re starting at with the relevant components.

Upgrading VMware vRealize Operations and the Horizon plugin is likely to be the best starting point as this supports all the monitored components backwards for a number of releases. In addition, it is the least disruptive activity for users.

After this, updating App Volumes Managers would be the next step.

Upgrading VMware Horizon follows the order it has always followed – VMware Composer, followed by Connection Servers and Security Servers.  The recommendation, however, would be to take the time to retire any Security Servers and replace them with VMware Unified Access Gateway appliances instead.

Where deployed, VMware NSX would be next on the list..

After this, the vCenter upgrade followed by the VMware ESXi hosts should take place.  In the case of the latter, as mentioned previously, pay close attention where hardware GPUs are deployed as this may need upgraded drivers and software in-line with the vSphere release.  If vSAN is deployed, this would take place as the closing step of upgrading all the ESXi hosts in the cluster, ensuring that there is enough space to carry out such an upgrade.

With respect to the desktop templates, upgrading of components can be staged, but the supporting services must be in place first.

Closing Thoughts

Although there are a fair few items to consider, so long as the components are upgraded with consideration to each other and in the proper order, it’s possible to uplift the entire stack to support VMware vSphere 6.7 Update 1.  The only caveat is the lack of interoperability testing  between releases of VMware Horizon 7.6 and NSX 6.4, though it should be remembered that there is no direct connection between the two products and VMware have yet to actually publish test results for this combination.

If you are looking to get the best from VMware infrastructure and understand your upgrade and compatibility options, please contact us, and we’d be happy to use our wealth of knowledge and experience to assist you.

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He was awarded VMware vExpert 2018 and is a graduate of the VMware Advanced Architecture Course 2018.

About Xtravirt

Xtravirt are an experienced consulting firm dedicated to delivering outcomes to help customers solve their IT challenges. We design and build strategies to help customers unlock the full potential of cloud, datacentre and workspace technology.

We are the VMware Global and EMEA Professional Services partner of the year.

www.xtravirt.com

by Curtis Brown

VMware App Volumes are installed with a self-signed certificate, as is common with most products that install with components using certificates, however, this is obviously not the preferred option.  But fear not-help is at hand!

Let’s assume you’ve deployed a VMware Horizon View estate properly and you’ve deployed this with a Microsoft CA signed cert – so you already have a Web Server template cloned out and good to go.

Preparing Certificates & Keys

The first step in preparing certificates and keys is to grant the App Volumes Manager server the rights to read/write and enrol with the certificate template – a bit like this:

Then, as with a View Connection server, you can import the certificate into the computer store on the App Volumes Manager server.  This is carried out using the Certificates console, making sure the Subject Name is set to the value you want (the name of the server or the load balancer name – Subject Alternates might be nice too).

You then export this as a PFX file, making sure you export the private key and note the password.  You can drop that in a folder – let’s call it c:\temp\appvol.pfx.

The next bit is breaking this PFX into a certificate and a key file.  You need openssl to do this (tip – VMware tools has a copy).

First, let’s break out the Key file.

openssl pkcs12 -in c:\temp\appvol.pfx -nocerts -out c:\temp\appvol1.key

You’ll need the password for the PFX.  (If you don’t have this, go have a coffee and try again.)  You’ll then be prompted for another password – this time one to protect the key file.  This can be a good thing; however, you can unprotect the key using:

** openssl rsa -in c:\temp\appvol1.key -out c:\temp\appvol.key**

This is useful for AppVol’s NGINX web server as you either protect the key and put the password in clear text in the nginx.conf (see the next step) or just unprotect the key and not worry.  I tend to do the latter.

Next, you need to export the certificate.

openssl pkcs12 -in c:\temp\appvol.pfx -nokeys -out c:\temp\appvol.crt

This gives us a .key and a .crt file.

Let’s drop these in C:\Program Files(x86)\CloudVolumes\Manager\nginx\conf

Replacing the certificates

In the same path that we’ve dropped our files, you’ll find nginx.conf.

You need to edit this. Using Notepad will be fine but take a backup of the file first.

Look for the ssl_certificate entries and replace the filenames with the new files.

Restart your App Volumes Manager Service (or bounce the box if you must).

Connect with the web browser to test:

You now have App Volumes with a trusted certificate and SSL Encryption is good to go!

Closing Thoughts…

In all seriousness, in these days of hackers and generally bad stuff, we need to make sure that we take appropriate measures to harden an estate.  Using signed certificates prevents numerous attack approaches and is certainly worth the effort.

If you are developing an end user compute solution and need assistance designing and deploying the solution in a secure manner, please contact us and we’d be happy to use our wealth of knowledge and experience to assist you.

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He is a VMware vExpert 2017.

by Curtis Brown

AirWatch®, for some time now a VMware® product, has been one of the most successful Enterprise Mobile Management solutions on the market (enough to justify VMware spending over $1bn to acquire them!).

Although its origins are predominantly based upon cloud based management of mobile phones, the product has spread its wings considerably in recent times. 

Deploying AirWatch

 Although it originated as a cloud based offering, and this is still very much the pushed approach, there are in fact several ways that an AirWatch solution can be deployed.

The most obvious one is the original cloud flavour.

Here, the solution is entirely hosted in the cloud.  Applications and data services are directly accessed from the estate, leveraging as the customer desires (VPN, direct access to the application in the DMZ etc.) This has zero footprint in the estate and works well where services onto the internet are already established.

The next approach, referred to as Integrated Cloud, provides a hybrid approach; a VMware AirWatch Cloud Connector is deployed within the estate.

This server provides both integration with cloud (for notifications and management), an on-premise presence for administration, as well as providing AirWatch Tunnel.  This is a secure gateway for AirWatch managed devices to access corporate resources directly – a ‘VPN-less’ VPN.

The final approach is an on-premise solution.  This leverages one or more AirWatch servers, carrying out all the AirWatch functionality on premise, including the tunnelling capability above.  For small deployments, a single DMZ based server is used. In a larger deployment, with multiple servers, the DMZ server provides AirWatch Secure Email Gateway and AirWatch Tunnel, while AirWatch Servers on the corporate network carry out the remaining provisioning services.

Further, the solution can be fully integrated with VMware Identity Manager Advanced Edition to extend the app catalogue capabilities to include single-sign-on access to web applications, Citrix® and VMware Horizon.  VMware Identity Manager Advanced is included as part of the AirWatch Suite blue and yellow licensing tiers. 

What Devices?

 VMware AirWatch coverage of devices is impressive.  From a mobile phone/tablet perspective, Android, iOS, BlackBerry and Windows Mobile are all supported.  In addition, there is also support for Rugged devices, such as scanning handsets used in warehouses etc.  Typically, these run Android, Windows Mobile or Windows CE.

Perhaps most interesting of all is the support for laptops (and essentially desktops) running Windows 10 or MacOS.  This functionality is quite powerful.  For example, not only can it provide configuration management and asset tracking, as you’d expect with an MDM solution, but it can also provide software distribution (in the case of Windows 10, this includes Win32 and Universal Apps), remote assistance (screen sharing) and endpoint protection such as configuring encryption and malware prevention measures. 

AirWatch Features

 There are a few standout features beyond the ability to manage devices and application publishing in a secure manner.

AirWatch Browser

– This provides a secure web browsing capability.  It can be centrally controlled, allowing white/blacklisting of sites, cookie handling control and restricting copy/print functionality.  On top of this, it provides a built in SSO capability and can leverage an AirWatch App Tunnel to access intranet sites without a third-party VPN.

AirWatch Content Locker

– This is a clever data management solution allowing devices (including browsers) to access corporate data in a secure, rights-managed environment.  It can integrate with cloud provisions (Box, Office 365, Google Drive) and on-premises solutions such as SharePoint and WebDAV and traditional File Servers as well.  In the case of On-Premise, these leverage AirWatch Tunnel for secure access.

**AirWatch Video **

– This is a secure video distribution solution, a corporate YouTube to some extent. 

Closing Thoughts

 VMware AirWatch provides a big play towards VMware’s any device, anywhere mantra.  Whether used in combination with VMware Horizon or other solutions, this provides not only management and control of corporate devices, but also the means to deliver applications and services in a secure manner to practically any compute device.

 About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He is a VMware vExpert 2017.

by Curtis Brown

Although VMware tends to put a focus on the more glamorous side of Enterprise computing – Cloud this, Containers that, Hypervisor here, Automation the other…. – there is a side that in the past has been almost a cottage industry in comparison, VMware’s Type 2 desktop hypervisor products. But at this year’s VMworld they weren’t forgotten and got a session all of their own.

Developing Products

VMware Workstation (for Windows and Linux) and VMware Fusion (for Mac) have been around for some time – the latter is celebrating its 10^th anniversary, while the former was released back in 1999.

The unified approach to the underlying VMware Platform means that the underlying Hypervisor service, VM hardware, VMware Tools and console, are common across the VMware product range. As a base, this then diverges to the different product teams for the Workstation/Fusion and ESXi vSphere layers.

This is significant, as this article will go on to discuss.

Welcome to the Next Generation

The big-ticket item for this session was the presentation of the new VMware Fusion release (version 10), and VMware Workstation release 14.  Both releases are important for several reasons, not least because it’s the first major version release since 2015.

So, what’s new?

The big one, common to both is VM version 14.  This is noteworthy for several reasons.  Firstly, there is support for VMs running the new Microsoft Windows 10 Fall Creators Update, Ubuntu 17.04 and Fedora 26.  In the case of the former, Virtual Machines can be configured to support Microsoft VBS (Virtualization Based Security), i.e. Credential Guard, which is a significant development. VBS requires UEFI bios on a VM configured for Secure Boot and enabled for in-guest (nested) Virtualisation – VBS uses Microsoft Hyper-V components.  We also have virtual NVMe disk support for improved storage performance on VMs too.

Further, with respect to VBS, it was mentioned that a future point release will support this on the host desktop PC, essentially allowing Hyper-V to run alongside Workstation.   Time will tell whether this comes to pass.

Remember the comment about the common underpinnings between the different VMware products being significant?  Ask yourself this – what does VM version 14 mean for the next vSphere release?

Both products gain full support for importing OVA packages. This allows, for example, the configuration of an appliance via the GUI, as would be the case in VMware vSphere. This means that the vCenter Appliance can be deployed in a fully supported manner in the GUI.

There are also improvements in Virtual Networking such as Workstation Pro and Fusion Pro Virtual Networking, which now includes a Latency emulator for network stress testing.  Both products also provide enhancements in their ability to control a VMware vSphere estate.

For VMware Fusion users, there’s an API framework with 20 VM controls for scripting.  Furthermore, the graphics engine now supports MacOS Metal rendering engine, which provides a marked improvement over OpenGL, though the latter is available as a fall-back mode.  For those MacBook users with the fancy new Touch Bar – this is now supported in VMware Fusion.

VMware Workstation Player has taken on a particularly key role in more recent times as a delivery mechanism for corporate desktop VM builds to BYOD or offsite locations, often using VMware Horizon FLEX.  To that end, VMware have put some effort in improving the User Interface design.   Workstation Pro continues to be the tool for developers using Windows/Linux desktops – the Network testing capabilities being a prime example of that.

Closing Thoughts…

Far from being a product left to whither on the vine, VMware have breathed new life into these popular products.  They remain at the leading edge with respect to local capabilities while continuing to serve a wide array of use cases from developers to business users to home users.

If you’re interested in exploring the latest virtualisation solutions but not sure where to start, please contact Xtravirt, and we’d be happy to use our wealth of knowledge and experience to assist you.

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He is a VMware vExpert 2017.

by Curtis Brown

Introduction

VMware vSAN™ is the storage component for VMware®’s Hyper-Converged Infrastructure offering. It can be deployed (albeit with its own licensing), as a part of a VMware vSphere® cluster.  The release of vSAN is generally tied to a specific release of VMware vSphere, so the 6.5 Update 1 release includes 6.6.1.

Testing VMware vSphere in a lab can be desirable for many reasons, for example training or development. However, it can be quite hardware intensive, and adding in vSAN makes matters more complicated.  To properly test vSAN, we need multiple nodes and good networking (10Gb for all-flash). However, it’s possible to use VMware Workstation (or VMware Fusion® for you Apple fans) to test this in a nested environment, where a set of virtual machines running VMware vSphere are hosted on one physical system.

One of the key features in VMware Workstation 14 (and Fusion

is the addition of Virtual Machine Hardware version 14. This is significant for this exercise, as one the features of this version is the ability to add virtual NVMe drives to Virtual Machines. This is also useful as we don’t need to mess about with the host VM or guest vSphere configuration to spoof the software into thinking it has SSDs.

What’s the Shopping list?

Well, you’re going to need a machine with a decent CPU (an Intel i7 or similar) and 32GB RAM with some fast disk (SSD).  It’s worth remembering that you’re going to be standing up quite a bit if you squeeze this in one machine. From my experience, you will need:

• 6GB RAM
  
• 2 vCPU
  
• 15GB disk (for vSphere ESXi binaries)
  
• 2 NICs
  
• For vSAN, I added a 5GB NVMe as my Cache layer and a pair of 20GB NVMe as my data tier
  

Using this toolkit, I can build out my own vSphere cluster.  In addition to this, I also use a Distributed Switch with a Management port group and a VM port group (more for tidiness than anything else).  Each host needs a VMKernel for Management (adding vMotion to this also works for efficiency) and I added a separate one purely for vSAN.

Enabling vSAN

This is pretty simple – browse through the vSphere Web Client to the Cluster, go to the Configure tab, select vSAN>General and hit Configure. This will then launch a wizard that takes you through the process of enabling vSAN.  

Feature wise, to keep the load down I didn’t enable de-duplication & compression or encryption.  So long as vSAN is enabled on a VMKernel port on each host, the network validation should be fine.

The disk claiming is spot on.  As you can see, the NVMe disks are recognised correctly as flash disks and selected for the relevant tiers based on size.

This will complete the configuration and you’ll have a vSAN:

Fixing Some Warnings…

There will be a few amber warnings that require attention.

For the simpler warnings, you’ll want to enable the Performance Service as well as update the vSAN HCL Database. If you’re not connected to the internet you can download and apply this manually using ‘update from file’.  The file can be downloaded from https://partnerweb.vmware.com/service/vsan/all.json

The remaining Amber warnings are trickier.  The first warning that you will encounter will be that the hardware isn’t on the vSAN HCL. (This shouldn’t be much of a surprise given we’re running this in Workstation.)

The second will be the vSAN Build Recommendation Engine Health component. This requires an internet connection and that the service is logged into my.vmware.com with credentials.  For a disposable lab, this is unlikely to be desirable.

These warnings can be silenced via the Ruby vCenter Console (RVC. via either SSH or the console, log on as root and access the Shell. Then log onto RVC using vCenter credentials directed at the vCenter FQDN…)

Mark a shortcut to the vSphere cluster with vSAN:

mark (vcenter FQDN)/(datacenter object)/computers/(Cluster)

To silence the given service:

vsan.health.silent_health_check_configure -a (service) ~vsan

For example:

The following services will need attention:

• vumconfig - vSAN Build Recommendation Engine Health check
  
• controllerdiskmode – Controller Disk Group Mode
  
• controllerdriver - Controller Driver is VMware Certified
• controllerfirmware - Controller firmware is VMware certified
• controllerreleasesupport - Controller is VMware certified for ESXi release
• controlleronhcl - SCSI Controller is VMware certified
  

For example, the vSAN Build Recommendation Engine Health Check:

You can use the command vsan.health.silent_health_check_status ~vsan to check the status.  -a switch can be used for specific entries.

Expanding the Cluster

If you want more nodes, then you will need to add them as additional hosts. This will allow you to test RAID5 and RAID6 Erasure Coding (four and six hosts respectively) and add capacity and performance, but you need more tin for this.

Shutting Down

To shut down the lab, you should simply:

1. Check that all re-sync operations are complete:

1. Place the hosts in Maintenance Mode with ‘No Data Evacuation’ selected and don’t move powered off VMs
   
2. Power off the hosts
   

With respect to setting up a vSAN lab, it’s “job done” – go celebrate!

If you’re interested in exploring the ways in which you can modernise your datacentre but not sure where to start, please contact Xtravirt, and we’d be happy to use our wealth of knowledge and experience to assist you.

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He is a VMware vExpert 2017.

by Michal Grzeszczak

My name is Michal Grzeszczak and I am a senior consultant at Xtravirt (www.xtravirt.com), an independent cloud consulting business and VMware Master Services Competent Partner.  In this blog, I’d like to share with you my experience of L2 bridging with VMware® NSX-T Data Center and help you to understand some of the differences between NSX-T and NSX-V, as well as cover some NSX use cases.  

Customer background:

The customer is one of the leading organisations in the betting and gambling industry and have been using NSX-V for some time now. When it came to their new greenfield environment, they decided to deploy NSX-T 2.4 Data Center. This decision was largely based on the fact that NSX-T Data Center provides bridging firewalls natively for L2 software bridging, which was their main requirement. Also, given that NSX-T will be the de facto network and security virtualisation platform offered by VMware going forward, by specifying it for this environment the customer is able to future proof the deployment. 

Future upgrades are also accounted for as upgrading from NSX-T 2.4 to future NSX-T releases is simpler than performing upgrades from a previous version of V or T.

NSX-T 2.4 was a major update and brought many changes to the architecture of the product, the main ones being:

• The NSX Manager and NSX Controllers were merged into one appliance deployed in a Cluster of 3 Nodes therefore minimising the footprint of the solution and operational complexity. 
• The other major change was the introduction of the new Simplified UI which “requires just the bare minimum of user input, offering strong default values with prescriptive guidance for ease of use. This means fewer clicks and page hops are required to complete configuration tasks.”

NOTE: In NSX 2.4 two UIs are presented - one is the new Simplified UI, the other one is Advanced. The latter is taken from NSX-T 2.3. The future plan is to remove the Advanced UI and provide all of the functionality via the Simplified UI.

 What are the key benefits of choosing NSX-T over NSX-V?

 There are many benefits of NSX-T over NSX-V, to name a few:

• NSX-T doesn’t require vCenter, however it can be added to NSX-T as a Compute Manager and allows for up to 16 Compute Managers per NSX 2.4 solution . There is no longer a 1:1 requirement like there was with NSX-V. 
• KVM Hypervisor support
• Bare Metal Edges provide sub-second failover 
• Data Plane Development Kit (DPDK) Optimising Forwarding - DPDK is a set of data plane libraries and network interface controller drivers for fast packet processing
• New, more flexible Overlay technology - Geneve replaces     VXLAN  https://docs.vmware.com/en/VMware-Validated-Design/4.3/com.vmware.vvd.sddc-nsxt-design.doc/GUID-CF3C47CA-9BEB-4213-8F08-1494261BF3EC.html 
• Bi-directional Forwarding Detection support
• BGP (Border Gateway Protocol) expanded functionality with features like Route Maps
• Much clearer User Interface (UI)

What were the specific use cases for this case customer and the design considerations?

USE CASE 1 - NSX-T Edge L2 Bridging - Integration of physical, non-virtualised database servers that require L2 connectivity to the virtualised environment. 

Design considerations:

• In NSX-T 2.4 two options are possible to bridge L2 workloads - using ESXi Bridge Clusters or Edge Bridge Profiles. The latter is recommended to use as the former will be deprecated in future. 
• Ideally the use of dedicated Bare Metal Edges, however this is not a requirement. 
• The possibility to deploy Edge Bridges in collapsed vSphere Clusters >     Management + Edge or Compute + Edge
• Consider having active and standby Edge Nodes on different hosts to avoid throughput drop, because VLAN traffic needs to be forwarded to both Edge Nodes in promiscuous mode.
• Overlay traffic can be tagged on a Distributed Port Group or Uplink Profile, but please avoid double tagging. 
• VLAN traffic should not be tagged on the Uplink Profile.
• Distributed Port Group for VLAN traffic connecting to the Edge Node should be in a Trunk Mode. The reason for this is due to the fact that Edge doing Bridging adds 802.1Q tag when transposing Overlay traffic to VLAN. 
• Consider having the same MTU value across your environment - if you can, choose MTU of 9000 for better performance. 
• Several Bridge Profiles can be configured, and a given Edge can belong to several Bridge Profiles. By creating two separate Bridge Profiles, alternating active and backup Edge in the configuration, the user can easily make sure that two Edge nodes simultaneously bridge traffic between Overlay and VLAN

Constraints:

• Edge Cluster with minimum 2 Edge Nodes in Active/Standby mode is needed.
• Standby uplinks are not supported on the Edge Node.
• Source Based Load Based Teaming is not supported on the Edge Node.
• The port group on the VSS/VDS sending and receiving traffic on the VLAN side should be in promiscuous mode, allowing MAC Address changes and Forge Transmits.

Deployment:

• Follow the deployment guide here - https://youtu.be/IwpujflzJhY 
• Or here https://docs.vmware.com/en/VMware-NSX-T-Data-Center/2.3/com.vmware.nsxt.admin.doc/GUID-7B21DF3D-C9DB-4C10-A32F-B16642266538.html 

Validation:

• Log in to the Edge Node with your credentials.
• Type “nsxcli”.
• “Get l2bridge-ports-config” will show the Bridge Port State (Active Edge will have Forwarding, Standby will have Stopped), VLAN ID configured and Bridge UUID which can be copied and used to do a packet capture on the Edge Node.
• To do the packet capture type “start capture interface “copied Bridge UUID” and hit enter, ping from VM to Physical Server to see the flows. 

USE CASE 2 - NSX bridging firewall - Secure communication between physical database servers and Overlay workloads.

• The configuration of the bridging firewall can be done currently only on the Advanced UI.
• Security rules are configured per Logical Switch aka Segment in Simplified UI. 
• NSX-T grouping objects like NSGroups can be used to provide abstraction from the IP based approach.

USE CASE 3 - vRealize Network Insight - Monitoring tool that can provide visibility into both Physical and Virtual environments. 

• NSX-T 2.4 is fully supported with the latest vRealize Network Insight version 4.1.
• Make sure you are allowing ports for communication between vRNI and other devices after the deployment. For example, ESXi Hosts to vRNI Collector on UDP 2055. The full list of ports needed can be found here - https://docs.vmware.com/en/VMware-vRealize-Network-Insight/3.9/com.vmware.vrni.install.doc/GUID-FDDA5F2F-7C3B-472A-A17D-39582FBD5996.html 
• There is a new website that provides in-depth information about new features in vRNI, definitely worth visiting - https://vrealize.vmware.com/t/vmware-network-management/  

What were the outcomes?

Overall, this deployment was a complete success as we were able to satisfy all of the requirements that the customer had. All the production physical databases were able to communicate on the same L2 segments, virtualised and connected to NSX-T segments workloads. On top of that, communication between those workloads was secured by NSX-T Bridging Firewall. vRealize Network Insight was used to provide visibility into the environment. Its ability to quickly troubleshoot network and firewall related issues in both virtual and physical realms allows admins to take a breath in the never-ending battle of making the networks stable.

I hope you enjoyed my blog, if you’d like to talk to Xtravirt about your business’s networking and security requirements, then please send an email to info@xtravirt.com

Some Useful links:

You can read more about the NSX-T 2.4 release here: https://blogs.vmware.com/networkvirtualization/2019/02/introducing-nsx-t-2-4-a-landmark-release-in-the-history-of-nsx.html/