Xtravirt — What’s your IT infrastructure up to?

by Simon Eady

For the last few months and certainly very recently (at the London VMUG meeting) I have had the chance to talk to peers and vExperts and share “war stories” with regards to vRealize Operations Manager.

What has become a consistent theme in all the stories is just how much compute resources vROps requires when you “go big” and not just what is clearly defined in the sizing spreadsheet.

For example some of the large deployments I have either been involved in or heard about (to monitor upwards and beyond of 30000 VMs) required the deployment of Large vROps nodes.

A single large node collecting data for a large deployment as outlined above requires the following resources.

• 16x vCPU
• 48GB RAM
• 2TB Storage
• 1700 IOPS

About the Author

by Curtis Brown

In a time where security is top of mind, patch management for both the health and security of a VMware vSphere® estate has never been more important.

VMware vSphere® Update Manager™ is an essential, but often under-appreciated part of VMware vSphere. However, punching VMware vCenter® straight out to the internet may not be an attractive option for several reasons, most notably security, but also scaling. If you have a large estate with many vCenter servers and Update Managers, do you want all of them pulling down updates straight from VMware?

VMware Update Manager Download Service is a software solution that provides the means to place an intervening server between Update Manager (or multiple Update Manager installations) and the internet.  It can be used as a host for updates itself, or it can be configured to publish the updates on an upstream web server.

Previous releases only supported Windows, however, we can now deploy a Linux derivative, permitting a more solid appliance to be constructed.  The guidance in this article is a combination of VMware’s documentation, guidance from noted VMware blogger William Lam and my own testing.

 Installation of UMDS on Linux

The first step is to prepare a Linux server.  For this deployment, Ubuntu 14.04 was used.  Ideally, this should be provided with a static IP address for ease of use. I tested a multi-homed configuration with an external and internal connection which worked fine.

The next step is to prepare the VM for UMDS and then install it.

Install the following pre-requisite components for Linux:

• perl

• tar

• sed

• psmisc

• unixodbc

• postgresql

• postgresql-contrib

• odbc-postgresql

William Lam has a really elegant script that automates this: (http://www.virtuallyghetto.com/2016/11/automating-the-installation-of-vum-update-manager-download-service-umds-for-linux-in-vsphere-6-5.html)

Once these are in place, it creates a PostGreSQL database and sets up a local ODBC connection to it, including establishing authentication to allow UMDS to access the database.  The script creates an answer file to configure the UMDS installation prior to installing it. This is explained very well in William’s blog post referenced above.

At this point we have a UMDS server up and running, which can be confirmed by running:

/usr/local/vmware-umds/bin/vmware-umds -v

Configuration of UMDS

Once UMDS is in place, it needs to be configured.  The commands are identical to the Windows release of UMDS.

Existing configuration can be checked by running the following command:

/usr/local/vmware-umds/bin/vmware-umds -G

This will show the following:

·        Configured URLs – where UMDS is configured to pull patches down from.  We can add vendor URLs to this, but the default VMware depots are listed.

·        Patch Store location – where UMDS will download files to.  The default is /var/lib/vmware-umds.

·        Export Store Location – we can specify a remote location where UMDS can export patches to – we won’t be using this here, but vmware-umds -o [ –default-export-store] (path) can configure this.

·        Proxy Server – where needed, proxy server values can be configured using vmware-umds -p.

·        Patch Content – we can select whether to enable Host and Virtual Appliance patching and define which Host Releases we wish to support.

Let’s go through some of these, firstly deciding what content to download.

Selecting whether to enable Host or VA support is simple – we run vmware-umds with the -S option.  For example, the following will prevent download of VA patches but enable Host patches:

/usr/local/vmware-umds/bin/vmware-umds -S –enable-host –disable-va

For Host patches, we can refine which releases we wish to support.  Again, this uses the -S switch.  The example below disables ESX 5.0 patching.  To enable a release, substitute -d for a -e:

/usr/local/vmware-umds/bin/vmware-umds -S -e embeddedEsx5.0.0-INTL

Next, we might want to add third party download sources for vendor-specific patches.  Obviously, you’ll need the URL for their repository. Use –remove to remove a URL.  

/usr/local/vmware-umds/bin/vmware-umds -S –add-url https://host_URL/index.xml –url-type HOST

To select where to download to, we use:

/usr/local/vmware-umds/bin/vmware-umds -S –patch-store your_new_patchstore_folder

The default in 64-bit Windows is C:\Program Files (x86)\VMware\Infrastructure\Update Manager while the default location in 64-bit Linux is /usr/local/vmware-umds.

Running the -G command again gives us the following:

In our example, we’ve left the default configuration for the URLs and patch store, but have restricted ourselves to just ESXi 6.5 host patches.

Once all this is set as required, we need to download the patches from VMware.  The command for this is straight forward:

/usr/local/vmware-umds/bin/vmware-umds -D

This can be set up as a scheduled task in Linux by configuring crontab.  If we need to, we can re-download patches using -R and specifying a date range as per the following example.

/vmware-umds -R –start-time 2010-11-01T00:00:00 –end-time 2010-11-30T23:59:59

At this point we have a populated UMDS server. A simple listing of our UMDS patch store shows our content:

We then need to either export the content to an upstream location or host it on our UMDS server for collection by the VMware Update Manager installation.  VMware Update Manager can only use a local path or a Web Server URL as a local repository - the latter option is preferred.  If we have an upstream repository set up, we can use the **-E **command to upload the content.

We’ll focus on setting up a web server on our UMDS server.

Setting up Nginx to serve UMDS content

VMware provide this guidance as part of their validated design – and it’s relatively simple to use to provide a persistent web server.

Firstly, we install Nginx. A simple one-liner will suffice (though you’ll need the root password!)

sudo apt-get -y install nginx

Once complete, we need to allow access to our UMDS Patch Store:

sudo chmod -R 755 /var/lib/vmware-umds

Next, we copy out the default Nginx configuration file to create one for UMDS.  We then edit this using a text editor such as vi or nano – I’ll use vi:

sudo cp /etc/nginx/sites-available/default /etc/nginx/sites-available/umds

sudo vi /etc/nginx/sites-available/umds

The amendments we make are highlighted in green below.  We amend the root path to our UMDS patch store, add the DNS short name and Fully Qualified Domain Name, and turn on autoindexing.

**               server {**

**             listen 80 default_server;**

**             listen [::]:80 default_server ipv6only=on;**

**                       root /var/lib/vmware-umds** ;      

**             index index.html index.htm;**

**                       # Make site accessible from http://localhost/**

**             server_name localhost exampleumds exampleumds.domain.local;**

**                       location / {**

**                     # First attempt to serve request as file, then**

**                             # as directory, then fall back to displaying a 404.**

**                                            try_files $uri $uri/ =404;**

**                             # Uncomment to enable naxsi on this location**

**                             # include /etc/nginx/naxsi.rules**

**                               autoindex on;**

**             }**

We then delete the default configuration, enable our UMDS configuration and restart Nginx.

sudo rm /etc/nginx/sites-enabled/default

sudo ln -s /etc/nginx/sites-available/umds /etc/nginx/sites-enabled/

sudo service nginx restart

We should then be able to browse our UMDS patch store.

Configuring VMware Update Manager

Configuring VMware Update Manager to use a Shared Repository is a straight forward process.

From the Home Menu, select VMware Update Manager; then select the Update Manager from the Server list and go to the Settings Tab.

Pick Download Settings from the left-hand menu and select Edit Download Sources.  As per shown below, select Shared Repository and enter a URL.

VUM will validate this setting.  After that, we can download our patches into Update manager and then it’s business as usual. Set up Baselines, scan and remediate as you would do when Update Manager pulls directly from VMware.

Closing Thoughts….

With this approach, we can provide a secure gap between VMware vCenter and the internet and still retrieve updates.  One downside of the new VMware Update Manager integration with VMware vSAN in VMware vSphere 6.5 Update 1 is that vSAN requires a direct connection to VMware in order to establish vSAN Baselines.  Currently, proxying of this through UMDS is not possible, so if this functionality is required, then vCenter will still need some internet connectivity, though at least the patch downloads are segregated.

If you need assistance in getting the best from your VMware vSphere estate,  please contact Xtravirt, and we’d be happy to use our wealth of knowledge and experience to assist you.

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He is a VMware vExpert 2017.

by Sam McGeown

VMware have put a lot of development into their latest release of vRealize Automation 7.3 and it certainly feels like a bigger release than a ‘.1’ version –  as is evident in the “What’s New” section of the  release notes.

 As part of a push to make it easier to manage and operate a vRA-based cloud platform, VMware have made some great improvements – the main features that stand out for me are:

•  Automated failover for the PostgreSQL database, and IaaS Manager Service – something that many customers have been asking for and now finally have, is a fully “HA” distributed platform.

• A new API for installation, upgrade and migration of the platform itself. This means scripted installs, upgrades and migrations are now simple and can be orchestrated.

• Parameterised blueprints – this allows out-of-the-box support for one of the most frequently asked for blueprint options – t-shirt sizes. In addition, the new Component Profiles will simplify the number of blueprints required and reduce catalogue management.

• Integration with vRealize Operations 6.6 (vROps); allowing intelligent placement of workloads based on analytics data and a Workload Placement Policy.

• Enhanced integration with IPAM – an extended IPAM framework allowing deeper integration with Infoblox initially, but expect other IPAM providers to start providing plugins.

• Enhanced integration with ServiceNow – a new plugin version will deepen the integration with ServiceNow as a CMDB and governance engine, with support for things like day 2 operations.

 There have been huge improvements and developments with the NSX integration, with all the native functionality now using the REST API rather than the vRealize Orchestrator (vRO) Plugin – this is great news and will simplify operations and troubleshooting. The plugin is still available for custom integrations if required.

 The main highlights for me are:

• Deeper integration with NSX Load Balancers – which allows customised load balancer configuration per-blueprint (algorithms, persistence, health monitors, port, etc.)  as well as day 2 reconfiguration of the load balancer. This is a fantastic improvement!

• NSX Security Group and Tag integration – much better integration with the UI and the ability to add and remove Security Groups and Tags as a day 2 operation

• NSX Edge Sizing and HA – Edge Gateways can be customised on a per blueprint basis to size correctly or in HA mode for resilient services like load balancing, NAT and firewall.

 vRA 7.3 should also have a greater appeal to those who have developer environments, with its deeper integration with Puppet, Docker, vSphere Integrated Containers and Docker volumes.

• Puppet as a “1^st class citizen” – this is part of a wider move to get configuration management tools integrated with the platform, but it’s starting with Puppet. This means drag and drop configuration management in the blueprint designer, and day 2 configuration management for deployed applications.

• Container management has been improved with support for vSphere Integrated Containers, alongside the traditional Docker hosts, and support for Docker volumes.

 And for those who are already running vRA, there are a couple of bug-bears that have been relieved, such as:

• A force destroy option to get rid of those “stuck” deployments. These would previously require a CloudClient command line clean up, or a database edit under the watchful eye of GSS.

• Improved integration with Storage Policies – anyone who has used the SPBM plugin will know that it’s been a little … clunky. A new plugin, shipped with the latest version of vRO, will make it easier to leverage vSAN and VVOL based storage.

• Role based access for vRO – given the huge power within the SDDC that vRO has, it’s great to see this finally being implemented.

 That’s a vast number of really significant improvements for a single point release and in this blog I’ve only drawn out the ones that I know customers will love. This release is without a doubt, a massive step forward in the maturity of VMware’s Cloud Management Platform.

 If you are considering a move to a Cloud Management platform and need assistance in deciding on the right solution for you and your organisation, please contact us and we’d be happy to use our wealth of knowledge and experience to assist you.

by Simon Eady

Having missed VMworld 2016, I was looking forward to attending this year, especially after the big announcements from the 2016 events and VMworld US 2017.

Hardly surprising, VMware on AWS featured heavily and the available sessions to attend were numerous. But, due to the current and future projects I’m engaged with, my primary focus this time was on vRealize Operations and vRealize Automation.

Of all the key note announcements made, the HCX one was the most impressive. Available in late 2017 via IBM and OVH, HCX will allow you to connect your private cloud to any VMware cloud vendor, allowing you to seamlessly move your apps easily into the cloud and back.

I’ve heard it said that whoever nails the flexibility of moving around in the cloud will be a huge success. So, I believe HCX will be a very attractive offering to those businesses looking for an option to easily “burst” into the cloud when required.

The first session I attended was “How to build a software defined DR practice with vSAN and SRM”. This was very useful as nearly every customer I have visited in the past 12 months was using either one or both products so it was good to understand how they can be used together with great effect.

Some key take-aways from the session were:

• vSphere Replication is free with Essentials Plus and higher
• vSphere Replication is not limited to just SRM you can get a little creative with it if you wish
• The SRM Roadmap finally as an appliance on it
• For SRM to work the products need to be the same version
• SRM supports vSAN stretched clusters, this is great to be able to move VMs to other DCs in separate vCenters (migration workflows)
• vSAN Stretched Cluster requires 5ms RTT 1-Gbe (works on L2 and L3 networks) a 3^rd site is needed for the witness server.

 Another area I am upskilling in is PowerShell/PowerCLI so it was beneficial to get along to the “Introduction to the PowerCLI Repository” session presented by Kyle Ruddy. If automation and daily operations is your thing, then you need to get your head into Powershell and PowerCLI ASAP.

So why Powershell/PowerCLI? Well, in this rapidly changing industry the cloud is king and it functions via automation and there are many products and languages that enable this. From a VMware point of view, PowerCLI is extremely powerful and fortunately relatively straight forward to learn (if you invest some time). The bonus here is that Powershell (which is what PowerCLI sits on) works very nicely with Azure, so if you can get competent with it you will effectively be killing 2 birds with one stone. If you are a sysadmin or consultant and have not yet made the jump to learning a language then now is the time. Staying relevant and valuable as an IT professional, and learning a language is key because automation has arrived and it is here to stay.

As someone who does not personally find coding easy, I have found a great deal of value from learning it, however, I have also found it to be a reasonable learning curve.

A key feature of VMworld events are the Design Workshops and this year I was fortunate to be invited to attend a vRealize Operations Design Workshop. While the content is under an NDA I can say that VMware have really got a good handle on getting feedback from experts and customers alike. I thoroughly enjoyed the workshop and am really looking forward to what comes next for the product. On a similar product theme, I was also invited to attend a TAM session focused on vROps.

Taking a break from the main sessions, I had my first experience of a hackathon. It was an excellent learning experience as well as a chance to meet new people from the wider vCommunity. The team I was a part of was called “one pod to rule them all” which focused on automating the deployment of various VMware products, to which we made some good progress but the 4 hours quickly disappeared. My key take-away from this, is that the Hackathon is a fun learning exercise along with being a great way to meet new people. So, if you have an opportunity to attend a hackathon near you, I would strongly encourage you to try it out.

The solutions exchange AKA the vendor hall provided another aspect to VMworld. I always enjoy wandering around the solutions exchange as I like to see what is new from the vendors and it helps get a feel for where the market place is right now. I made sure I visited a few vendors with whom I have worked with in the past and present, such as Blue Medora but also took time to check out anything new that caught my eye. This year I found a product and company called Morpheus. If you are looking at implementing your own in house and hybrid cloud solution they are very much worth a look.

For anyone that has attended before you will (I hope) be keenly aware of the fantastic networking opportunities at the conference and of course the evening activities.  If I was not in a session or in the Solutions Exchange, then I spent most of my time in the VMTN area (community’s area) catching up with and meeting new people from the wider vCommunity. I have no doubt in my mind that one of the huge strengths to the VMware eco-system is the community behind it. Having the VMTN lounge apart of the vBrownbag stage was a genius idea as you could blog, chat, network and learn all at the same time.

For me personally, aside from the sessions, the key strength to VMworld is the networking component. It is what you make of it, so getting involved and meeting people brings such great value to the event.

Rounding up, it was an excellent VMworld, good solid announcements and superb sessions to attend and as always, the networking and evening events were absolutely worth the trip.

To find out more about how your organisation can benefit from VMware products and solutions, please contact us and we’ll be happy to use our wealth of knowledge and experience to assist you.

**About the Author **

Simon Eady is an Xtravirt Senior Consultant with over 20 years’ experience in the IT industry. He has delivered a wide range of projects including solutions for server consolidation, data centre migration and upgrade, and deployment of Microsoft and VMware product sets.  His specialist areas include VMware virtualisation products and Microsoft Server Technologies and solutions. Simon is also a vExpert 2017 and leader of the South West UK VMUG (VMware User Group).

By Ian Cook

Introduction

VMware vSphere comprises one or more virtual centre servers and multiple ESXi hosts. Virtual networking using distributed switches and NSX, and virtual storage (VSAN) can all be managed through the virtual centre server. The VMware update manager is also integrated. vSphere 6.5 comes with many features that enable customers to easily manage their private, public and hybrid cloud environments.

 Customer Background and Issues

During a recent engagement for a renowned healthcare provider, a vSphere 6.5 Cluster issue was encountered with VCSA and external PSC.

The customer’s environment is built on Cisco UCS FlexPods with FCoE (Fibre Channel over Ethernet) - all flash storage. There are two tier 3 datacentres, two VMware Virtual Centre Server appliances (one at each site) running vSphere 6.5 in enhanced linked mode. The Platform Service Controllers are external, which is a requirement for linked mode. There are six clusters, with three blades in each cluster, three clusters in each site.  

The customer was seeing numerous issues with one of the six clusters including:

1)     No management of VM’s possible (power on/off, create or delete snapshots, edit settings was greyed out on every VM)

2)     vMotion failing

3)     DRS non-functional due to vMotion failure

4)     HA wasn’t enabling/disabling correctly (one of the three hosts in the cluster would function, two would not)

5)     Unable to disconnect/connect a host from the vCenter using the GUI

6)     Tasks showing as ‘running’ in tasks on the vCenter server, but not showing as running on the host when directly connected

During troubleshooting with VMware GSS, it was discovered that the database entries for the hosts/cluster were corrupt.

The Solution

After further investigation, we identified that the problem was linked to the vCenter and not the hosts, as all of the commands could be run when connected directly to the host console. VMware GSS were engaged, and they agreed with the initial findings, that the vCenter vPostgres entries were corrupt.  The decision was made to disconnect the hosts from the vCenter and then reconnect, with the aim to refresh the agents and force the database to update. Because we could not disconnect or reconnect from the web interface, the hosts from the vCenter were forced to disconnect, using the vPostGres database commands. This was completed during a pre-planned, out of hours change window, where the fix below was applied:

1)     SSH to VCSA

2)     /opt/vmware/vpostgres/current/bin/psql -d VCDB -U postgres press <Enter>

3)     Should give VCDB=# prompt

4)     Select id,dns_name,enabled from vpx_host;

5)     Will list all hosts and the id number of the host.

6)     Update vpx_host set enabled = 0 where id = <Host ID from table above>;

7)     Response should be UPDATE 1

8)     Select id,dns_name,enabled from vpx_host;

9)     Should show the host removed with a 0 under enabled

10)  Repeat for any other hosts

11)  \q

12)  Stop vpxd – service-control –stop vmware-vpxd press <Enter>

13)  Start vpxd - service-control –start vmware-vpxd press <Enter>

14)  Refresh/log in to vSphere web client and reconnect the disconnected hosts by right click on host, Connection > Connect

 The Results

Once the fix had been applied, the cluster within the customer’s environment returned to a manageable state, with zero downtime for the customers virtual machines. The fix was also applied with zero impact to the services, resulting in the functions that would not previously work now working without fault.

 Xtravirt is a leading VMware specialist and has the ultimate combination of deep experience and agility to design and deliver IT transformations. If you need assistance in getting the best from your VMware vSphere estate, please contact us, and we’d be happy to use our wealth of knowledge and experience to assist you.

About the author

 Ian Cook joined the Xtravirt consulting team in December 2015 as a Technical Consultant. He has over 20 years’ experience in the IT industry, with an in-depth understanding of VMware Virtualisation product sets and NetApp, along with experience in data centre migration and delivery and upgrading of virtualisation solutions.

by Nick Goldman

VMware Cloud Foundation brings the best in breed virtualisation of network, storage and compute in a pre-validated and automated package. VMware cloud is used in VMware based public cloud solutions such as; VMware cloud on AWS and IBM cloud for VMware solutions. VMware Cloud Foundation lets you spin up a private cloud environment in a much-reduced time frame and deliver a reliable hybrid cloud environment.  

VMware Cloud Foundation 3.0 was announced only a few months ago at VMworld US 2018. Version 3.0 removed the requirement to use Cisco or Arista switches. Now any switch provider that is on the VMware Hardware Compatibility List (HCL) can be used which will allow for VCF fitting into existing environments.  VMware has now also added all vSAN ready nodes which opens up far more flexibility with hardware.  

A number of management of improvements were also made also assist with enterprise deployments. These included the ability to skip upgrades of vCenter and ESXi which helps with compatibility of 3rd party solutions). Cloud Foundation 3.0 also supports multiple clusters in a workload domain to allow for larger workload domains and reduced size of failure domain and specific use cases which require small clusters (such as licensing) and stretch clusters.

Now only a few months later the next release 3.5 is announced and brings a raft of new features including support for NSX-T and PKS (Pivotal Container Service), support for composable infrastructure (initially HPE Synergy) and support for external NFS (which allows the use of existing storage for workloads).

Including NSX-T in VMware Cloud Foundation shows the direction that VMware are heading towards with much larger use cases for NSX-T.

What is VMware Cloud Foundation?

VMware’s Cloud Foundation was born out of the VMware EVO SDDC (Software Defined Data Centre) platform and is designed to make private and public clouds easy to deploy, manage and secure. It also allows cloud providers such as IBM and VMware Cloud on AWS, as well as private data centres, to quickly deploy and scale out a cloud platform.  

“VMware’s Cloud Foundation allows cloud providers to quickly deploy and scale out a cloud platform” 

VMware Cloud Foundation is a Hyper Converged Infrastructure platform that that delivers software defined compute, storage and networking services (NSX) to allow agile delivery of virtual servers or containers. The solution is made up of vSphere, VSAN and NSX overlaid with a management solution (the SDDC manager) which is used for both setup and day 2 operations such as patching and monitoring. 

Cloud Foundation version 3.5 has just been released and includes the latest releases of all VMware products including vSphere 6.7U1, vSAN 6.7U1, NSX-V6.4.3, NSX-T 2.3 and optionally vRealize Automation 7.5. and vRealize Operation 7.0, vRealize Log Insight 4.7

Delivery Model

VMware Cloud Foundation is available in three delivery models: 

• Through a public cloud provider such as VMware Cloud on AWS or through one of the VMware Cloud Provider Program providers such as IBM or Rackspace   
  
• As an engineered solution such as Dell EMC’s VxRack solution which comes preconfigured and installed (however customers have informed me this at present introduces a delay while the configuration is certified 
  
• Deploying on any vSAN ready nodes from any vendors including Dell EMC, Cisco, Fujitsu, HPE, Hitachi and Quanta 
  

Cloud Foundation can speed up the delivery of an SDDC solution by having a pre-validated and tested solution using VMware best practices. This can reduce the complexities and lead times associated with traditional datacentre infrastructures. VMware on AWS will be the proving ground for many new features on VMware Cloud Foundation and as the suite is all based in software VMware will be able to rapidly add features.  

“Cloud Foundation can speed up the delivery of an SDDC solution” 

The management of Cloud Foundation is via the VMware SDDC Manager. From within here you can do the initial bring up which just requires a few details such as time, network settings and DNS and NTP servers. The SDDC manager will bring up the entire stack including switch configuration, host configuration and a management cluster (a four-node cluster containing a dedicated vCenter, NSX manager and vSAN). Once the bring up procedure has been completed, you are then able to deploy workload domains which are policy driven based on the performance and availability requirements. The workloads can either be virtual server infrastructure or virtual desktop infrastructure where the SDDC manager will automatically deploy a fully functional VMware view environment.

Is VMware Cloud foundation right for my company?

Whether Cloud Foundation is right for your organisation for not depends on what your commitment to other hardware solutions such as a SAN or blade enclosures are. In these cases, it may not be best to change your entire infrastructure to start using Cloud Foundation, but if you have end of life hardware or you are looking at putting in NSX to virtualise your organisation’s networking then it could help to reduce the time to get the new platform up and running. In addition, with the lifecycle management included it will reduce some of the burden associated with keeping your cloud platform up to date.

If your organisation has previously struggled with setting up new technology or it has taken an excessively long amount of time to deploy and expand, then VMware Cloud Foundation could be the right solution for your organisation. VMware will allow you to transfer existing unused licenses for individual components to Cloud Foundation.

VMware Cloud Foundation has similarities to other solutions such as Nutanix, which provide a simplified management for their hyper converged platform. However, the inclusion of technology such as NSX in the platform is more advanced than some of VMware’s competitors.

“Cloud Foundation takes VMware’s best of breed technology and wraps a management layer around them”.  

Version 3.5 also offers the latest versions of VMware products which was part of VMware’s commitment to reduce the time between when products were released individually and when they are available as part of VMware cloud foundation.

Closing thoughts

VMware Cloud Foundation has become a very comprehensive solution for organisations looking to deploy there SDDC in a reliable and standardised fashion whilst reducing timescales for design and deployment. It takes VMware’s best of breed technologies and wraps a management layer around them. As companies look to move towards a buy rather than build strategy with their infrastructure then VMware Cloud Foundation is on point to be a tried and tested solution. VMware are starting to open up options of hardware in this release which will make Cloud Foundation to suitable for many more organisations who are looking to upgrade or deploy a new SDDC or to put them on the path to the hybrid cloud journey via NSX hybrid connect. 

If you are interested in VMware cloud services and solutions and want to know how they can benefit your organisation Xtravirt can help. We provide advisory, design and implementation services to create the right solution for your organisation. Contact us and we’ll be happy to use our wealth of knowledge and experience to assist you. 

About the Author

Nick Goldman is a Senior Consultant within the Xtravirt consulting team. He is an experienced infrastructure consultant with experience in both technical architecture and hands-on implementation. His areas of expertise include virtualisation solutions based on the VMware stack and Microsoft based infrastructure solutions.

About Xtravirt

Xtravirt are an experienced consulting firm dedicated to delivering outcomes to help customers solve their IT challenges. We design and build strategies to help customers unlock the full potential of cloud, datacentre and workspace technology.

We are the VMware Global and EMEA Professional Services partner of the year.

www.xtravirt.com

by Curtis Brown

Introduction

VMware vSAN™ is the storage component for VMware®’s Hyper-Converged Infrastructure offering. It can be deployed (albeit with its own licensing), as a part of a VMware vSphere® cluster.  The release of vSAN is generally tied to a specific release of VMware vSphere, so the 6.5 Update 1 release includes 6.6.1.

Testing VMware vSphere in a lab can be desirable for many reasons, for example training or development. However, it can be quite hardware intensive, and adding in vSAN makes matters more complicated.  To properly test vSAN, we need multiple nodes and good networking (10Gb for all-flash). However, it’s possible to use VMware Workstation (or VMware Fusion® for you Apple fans) to test this in a nested environment, where a set of virtual machines running VMware vSphere are hosted on one physical system.

One of the key features in VMware Workstation 14 (and Fusion

is the addition of Virtual Machine Hardware version 14. This is significant for this exercise, as one the features of this version is the ability to add virtual NVMe drives to Virtual Machines. This is also useful as we don’t need to mess about with the host VM or guest vSphere configuration to spoof the software into thinking it has SSDs.

What’s the Shopping list?

Well, you’re going to need a machine with a decent CPU (an Intel i7 or similar) and 32GB RAM with some fast disk (SSD).  It’s worth remembering that you’re going to be standing up quite a bit if you squeeze this in one machine. From my experience, you will need:

• 6GB RAM
  
• 2 vCPU
  
• 15GB disk (for vSphere ESXi binaries)
  
• 2 NICs
  
• For vSAN, I added a 5GB NVMe as my Cache layer and a pair of 20GB NVMe as my data tier
  

Using this toolkit, I can build out my own vSphere cluster.  In addition to this, I also use a Distributed Switch with a Management port group and a VM port group (more for tidiness than anything else).  Each host needs a VMKernel for Management (adding vMotion to this also works for efficiency) and I added a separate one purely for vSAN.

Enabling vSAN

This is pretty simple – browse through the vSphere Web Client to the Cluster, go to the Configure tab, select vSAN>General and hit Configure. This will then launch a wizard that takes you through the process of enabling vSAN.  

Feature wise, to keep the load down I didn’t enable de-duplication & compression or encryption.  So long as vSAN is enabled on a VMKernel port on each host, the network validation should be fine.

The disk claiming is spot on.  As you can see, the NVMe disks are recognised correctly as flash disks and selected for the relevant tiers based on size.

This will complete the configuration and you’ll have a vSAN:

Fixing Some Warnings…

There will be a few amber warnings that require attention.

For the simpler warnings, you’ll want to enable the Performance Service as well as update the vSAN HCL Database. If you’re not connected to the internet you can download and apply this manually using ‘update from file’.  The file can be downloaded from https://partnerweb.vmware.com/service/vsan/all.json

The remaining Amber warnings are trickier.  The first warning that you will encounter will be that the hardware isn’t on the vSAN HCL. (This shouldn’t be much of a surprise given we’re running this in Workstation.)

The second will be the vSAN Build Recommendation Engine Health component. This requires an internet connection and that the service is logged into my.vmware.com with credentials.  For a disposable lab, this is unlikely to be desirable.

These warnings can be silenced via the Ruby vCenter Console (RVC. via either SSH or the console, log on as root and access the Shell. Then log onto RVC using vCenter credentials directed at the vCenter FQDN…)

Mark a shortcut to the vSphere cluster with vSAN:

mark (vcenter FQDN)/(datacenter object)/computers/(Cluster)

To silence the given service:

vsan.health.silent_health_check_configure -a (service) ~vsan

For example:

The following services will need attention:

• vumconfig - vSAN Build Recommendation Engine Health check
  
• controllerdiskmode – Controller Disk Group Mode
  
• controllerdriver - Controller Driver is VMware Certified
• controllerfirmware - Controller firmware is VMware certified
• controllerreleasesupport - Controller is VMware certified for ESXi release
• controlleronhcl - SCSI Controller is VMware certified
  

For example, the vSAN Build Recommendation Engine Health Check:

You can use the command vsan.health.silent_health_check_status ~vsan to check the status.  -a switch can be used for specific entries.

Expanding the Cluster

If you want more nodes, then you will need to add them as additional hosts. This will allow you to test RAID5 and RAID6 Erasure Coding (four and six hosts respectively) and add capacity and performance, but you need more tin for this.

Shutting Down

To shut down the lab, you should simply:

1. Check that all re-sync operations are complete:

1. Place the hosts in Maintenance Mode with ‘No Data Evacuation’ selected and don’t move powered off VMs
   
2. Power off the hosts
   

With respect to setting up a vSAN lab, it’s “job done” – go celebrate!

If you’re interested in exploring the ways in which you can modernise your datacentre but not sure where to start, please contact Xtravirt, and we’d be happy to use our wealth of knowledge and experience to assist you.

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He is a VMware vExpert 2017.

By Curtis Brown

Introduction

As VMware Horizon® 7 has developed, we’re starting to see the product evolve from the existing Horizon Admin Console based on Flash to a new Horizon Console based on HTML5. It’s a steady evolution, in much the same light as VMware® vCenter HTML5 console evolved through releases of VMware vSphere® 6.5 and 6.7.

The 7.8 release of VMware Horizon is the most feature-rich to date and adds much in the way of configuration settings as well as provisioning.

A Quick Guided Tour

So how do we access this new console?  VMware have been particularly imaginative with the URL.  While the old console had the URL of HTTPS://(Connection Server)/admin, we now have HTTPS://(Connection Server)/newadmin for the new console. Which at least allows us to access both consoles.

At the logon page, we can enter our admin credentials.

Once logged in, we see the nice, clean HTML5 interface.

On the left a navigation pane; at the top, we have a dashboard view – this has a splash screen at the moment, so it appears to be more of a placeholder.

Users & Groups covers entitlements while the Inventory section covers the resources to be published, much in the same way as the old console.

JMP is new – this refers to the Just-In-Time Management Platform.  This will be covered in a future post, but it provides a means to integrate Horizon View, User Environment Manager and App Volumes for assigning and controlling resources.

The last section, Settings, is a new area in the Console.  It provides the direct replacement for the Settings in the old admin console, allowing the admin to configure Servers, Cloud Pod Architecture and other settings.

Notice in the vCenter Servers page, it still includes Composer.  Although there’s a push to move to Instant Clones, Composer based Linked Clones are still alive and well.

If we add a vCenter, we get presented with a cleaned up, but familiar wizard.

One significant difference is the non-appearance of the Security Server tab.  However, as is common in the later 7.x iterations admin console, it is possible to register Unified Access Gateway appliances.

Closing Thoughts

There are a few areas where it’s still a work in progress, some of which are a little odd.  While you can configure Cloud Pod Architecture, you can’t control the basic global settings or the Events database, let alone add a Horizon license key.  Remember though, it’s a work in progress and for day-to-day admin, it’s pretty good.

About the author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strengths in VDI, storage integration, backup and disaster recovery design/implementation. He was awarded VMware vExpert 2019.

About Xtravirt

If you’re embarking on either an upgrade or a new VMware Horizon implementation, Xtravirt have the expertise and experience in the End User Compute space and can provide advisory, design and implementation services to create the right solution for your organisation. Contact us and we’ll be happy to assist you.

By Curtis Brown

Introduction

This little post is a ‘how to guide’ for enabling encryption on VMware vSAN.  To do this, we’ll need a few ingredients:

• A VMware vSphere 6.5 cluster with VMware vSAN enabled
  
• A Key Management Server Solution (KMS)
  

The Key Management Server (not to be mistaken for Microsoft’s license key solution) provides encryption keys for vSAN encryption.  This should be a robust solution (ideally, multiple nodes) as without this, vSAN becomes inaccessible!  Also, a tip – don’t put your KMS solution in the vSAN you’re about to encrypt, that would be a really bad idea!

In the case of the estate stood up for this blog post, HyTrust KeyControl 4.1 was deployed.  It’s an easy to use product that does exactly what’s required.

Registering the KMS in VMware vSphere

VMware vCenter supports the KMIP standard (VMware have certified a number of products) for connected KMS servers.  In the case of our HyTrust KeyControl appliance, we have to enable the KMIP server service and set the protocol to version 1.1.

We also need to set up a service User account on here.  It’s important not to set a password for this account.  We’re using certificates to authenticate and setting a password prevents vSphere from using the account with the HyTrust solution.  We download the SSL certificate for the user (this is a ZIP file containing the CA certificate and user certificate as PEM files).

Logged on as an administrator in the VMware vCenter Web Client, we open up the configuration of the vCenter server and add our KMS:

We enter a name for the cluster and the details for the first node (we can add other nodes under this cluster later).  The port is 5696 for most solutions.  

We then have to trust the certificate for the Server:

At this point, we have the configuration, but it’s yet to establish a trusted connection.  We need to establish the trust using the menu option below:

There are a few ways of achieving this (see the screenshot below), but we’ll be uploading the certificates snagged earlier:

In our case, we upload the User PEM twice:

And, voila, we’re ready to go forth and enable vSAN encryption

Enabling VMware vSAN Encryption

Here’s the easy bit.  We’ll assume that you already have vSAN up and running and will be enabling vSAN encryption.  If this is a pre-existing cluster, remember to leave room in the cluster to accommodate the emptying and reformatting of a host.  This operation will temporarily remove a host from the cluster as the disk formatting is changed.

We open the Cluster Configuration and select vSAN>General.

Edit the settings to enable Encryption.  We can erase the disks before use if we wish, but the key item is selecting the KMS server and clicking OK.  Allowing reduced redundancy reduces the number of VM data moves while the process to encrypt is under way.

At this point the cluster will reconfigure, enabling de-duplication.  This can take a little while so be patient. And that’s it done.

Closing Thoughts

This is a relatively simple feature to enable, providing a measure of data security for little effort.

If you’re considering developing a VMware vSAN based estate and need assistance, please contact Xtravirt, and we’d be happy to use our wealth of knowledge and experience to assist you.

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with strengths in VDI, storage integration, backup and Disaster Recovery design/implementation. He is a VMware vExpert 2018.

by Michal Grzeszczak

My name is Michal Grzeszczak and I am a senior consultant at Xtravirt (www.xtravirt.com), an independent cloud consulting business and VMware Master Services Competent Partner.  In this blog, I’d like to share with you my experience of L2 bridging with VMware® NSX-T Data Center and help you to understand some of the differences between NSX-T and NSX-V, as well as cover some NSX use cases.  

Customer background:

The customer is one of the leading organisations in the betting and gambling industry and have been using NSX-V for some time now. When it came to their new greenfield environment, they decided to deploy NSX-T 2.4 Data Center. This decision was largely based on the fact that NSX-T Data Center provides bridging firewalls natively for L2 software bridging, which was their main requirement. Also, given that NSX-T will be the de facto network and security virtualisation platform offered by VMware going forward, by specifying it for this environment the customer is able to future proof the deployment. 

Future upgrades are also accounted for as upgrading from NSX-T 2.4 to future NSX-T releases is simpler than performing upgrades from a previous version of V or T.

NSX-T 2.4 was a major update and brought many changes to the architecture of the product, the main ones being:

• The NSX Manager and NSX Controllers were merged into one appliance deployed in a Cluster of 3 Nodes therefore minimising the footprint of the solution and operational complexity. 
• The other major change was the introduction of the new Simplified UI which “requires just the bare minimum of user input, offering strong default values with prescriptive guidance for ease of use. This means fewer clicks and page hops are required to complete configuration tasks.”

NOTE: In NSX 2.4 two UIs are presented - one is the new Simplified UI, the other one is Advanced. The latter is taken from NSX-T 2.3. The future plan is to remove the Advanced UI and provide all of the functionality via the Simplified UI.

 What are the key benefits of choosing NSX-T over NSX-V?

 There are many benefits of NSX-T over NSX-V, to name a few:

• NSX-T doesn’t require vCenter, however it can be added to NSX-T as a Compute Manager and allows for up to 16 Compute Managers per NSX 2.4 solution . There is no longer a 1:1 requirement like there was with NSX-V. 
• KVM Hypervisor support
• Bare Metal Edges provide sub-second failover 
• Data Plane Development Kit (DPDK) Optimising Forwarding - DPDK is a set of data plane libraries and network interface controller drivers for fast packet processing
• New, more flexible Overlay technology - Geneve replaces     VXLAN  https://docs.vmware.com/en/VMware-Validated-Design/4.3/com.vmware.vvd.sddc-nsxt-design.doc/GUID-CF3C47CA-9BEB-4213-8F08-1494261BF3EC.html 
• Bi-directional Forwarding Detection support
• BGP (Border Gateway Protocol) expanded functionality with features like Route Maps
• Much clearer User Interface (UI)

What were the specific use cases for this case customer and the design considerations?

USE CASE 1 - NSX-T Edge L2 Bridging - Integration of physical, non-virtualised database servers that require L2 connectivity to the virtualised environment. 

Design considerations:

• In NSX-T 2.4 two options are possible to bridge L2 workloads - using ESXi Bridge Clusters or Edge Bridge Profiles. The latter is recommended to use as the former will be deprecated in future. 
• Ideally the use of dedicated Bare Metal Edges, however this is not a requirement. 
• The possibility to deploy Edge Bridges in collapsed vSphere Clusters >     Management + Edge or Compute + Edge
• Consider having active and standby Edge Nodes on different hosts to avoid throughput drop, because VLAN traffic needs to be forwarded to both Edge Nodes in promiscuous mode.
• Overlay traffic can be tagged on a Distributed Port Group or Uplink Profile, but please avoid double tagging. 
• VLAN traffic should not be tagged on the Uplink Profile.
• Distributed Port Group for VLAN traffic connecting to the Edge Node should be in a Trunk Mode. The reason for this is due to the fact that Edge doing Bridging adds 802.1Q tag when transposing Overlay traffic to VLAN. 
• Consider having the same MTU value across your environment - if you can, choose MTU of 9000 for better performance. 
• Several Bridge Profiles can be configured, and a given Edge can belong to several Bridge Profiles. By creating two separate Bridge Profiles, alternating active and backup Edge in the configuration, the user can easily make sure that two Edge nodes simultaneously bridge traffic between Overlay and VLAN

Constraints:

• Edge Cluster with minimum 2 Edge Nodes in Active/Standby mode is needed.
• Standby uplinks are not supported on the Edge Node.
• Source Based Load Based Teaming is not supported on the Edge Node.
• The port group on the VSS/VDS sending and receiving traffic on the VLAN side should be in promiscuous mode, allowing MAC Address changes and Forge Transmits.

Deployment:

• Follow the deployment guide here - https://youtu.be/IwpujflzJhY 
• Or here https://docs.vmware.com/en/VMware-NSX-T-Data-Center/2.3/com.vmware.nsxt.admin.doc/GUID-7B21DF3D-C9DB-4C10-A32F-B16642266538.html 

Validation:

• Log in to the Edge Node with your credentials.
• Type “nsxcli”.
• “Get l2bridge-ports-config” will show the Bridge Port State (Active Edge will have Forwarding, Standby will have Stopped), VLAN ID configured and Bridge UUID which can be copied and used to do a packet capture on the Edge Node.
• To do the packet capture type “start capture interface “copied Bridge UUID” and hit enter, ping from VM to Physical Server to see the flows. 

USE CASE 2 - NSX bridging firewall - Secure communication between physical database servers and Overlay workloads.

• The configuration of the bridging firewall can be done currently only on the Advanced UI.
• Security rules are configured per Logical Switch aka Segment in Simplified UI. 
• NSX-T grouping objects like NSGroups can be used to provide abstraction from the IP based approach.

USE CASE 3 - vRealize Network Insight - Monitoring tool that can provide visibility into both Physical and Virtual environments. 

• NSX-T 2.4 is fully supported with the latest vRealize Network Insight version 4.1.
• Make sure you are allowing ports for communication between vRNI and other devices after the deployment. For example, ESXi Hosts to vRNI Collector on UDP 2055. The full list of ports needed can be found here - https://docs.vmware.com/en/VMware-vRealize-Network-Insight/3.9/com.vmware.vrni.install.doc/GUID-FDDA5F2F-7C3B-472A-A17D-39582FBD5996.html 
• There is a new website that provides in-depth information about new features in vRNI, definitely worth visiting - https://vrealize.vmware.com/t/vmware-network-management/  

What were the outcomes?

Overall, this deployment was a complete success as we were able to satisfy all of the requirements that the customer had. All the production physical databases were able to communicate on the same L2 segments, virtualised and connected to NSX-T segments workloads. On top of that, communication between those workloads was secured by NSX-T Bridging Firewall. vRealize Network Insight was used to provide visibility into the environment. Its ability to quickly troubleshoot network and firewall related issues in both virtual and physical realms allows admins to take a breath in the never-ending battle of making the networks stable.

I hope you enjoyed my blog, if you’d like to talk to Xtravirt about your business’s networking and security requirements, then please send an email to info@xtravirt.com

Some Useful links:

You can read more about the NSX-T 2.4 release here: https://blogs.vmware.com/networkvirtualization/2019/02/introducing-nsx-t-2-4-a-landmark-release-in-the-history-of-nsx.html/