VMworld 2016 wishlist

So, with another VMworld approaching, I thought I'd jot down a few things I would like to see announced. Not saying any of this is going to happen, but it's what I'd like to see...

Bundle NSX with vSphere

I doubt this will actually happen while VMware is making a lot of money on standalone NSX, but at some point, it needs to bundle the product into vSphere (or one of the vSphere/vCloud/vRealize suites). Of course, I'm still smarting at the loss of vCNS from the vCloud Suite, but even the "cut price" NSX for vSphere was not low enough to make it affordable to most organisations.

If NSX is going be pervasive, it needs to get everywhere, so VMware are going to have to push it out at a lower entry price point to gain mass adoption.

Stable release of vSphere 6.x

Okay, so that may be unfair, but I still read news reports detailing some pretty major bugs. It seems to me that vSphere 6 hasn't been the highest quality release that VMware has ever done. As a result, we have held off going to vSphere 6, and judging by the show of hands at the last VMUG I attended, we're not the only ones.

VMware's answer to Azure Stack

VMware's biggest competition in the private cloud space is only just getting started. If Microsoft are able to make a version of Azure that can run internally and is simple to install and manage (a big "if"), then this will be a big threat to VMware. Microsoft will have the same stack for both private and public clouds and the ability to move between both. A true hybrid cloud.

VMware has been very weak in public cloud (is vCloud Air still a thing?) but has a credible private cloud story. With a concerted effort, it could provide an equivalent stack solution, perhaps leveraging Cloud Foundry for the PaaS platform. But it's going to have to get moving on this before Microsoft deliver something that is actually pretty compelling for many organisations.

vRealize Automation IaaS appliance

vRealize Automation has a reputation for being a bit of a pain to install. Things have apparently improved massively with version 7, but I'm waiting for VMware to remove the Windows IaaS server requirement. I'm hoping that there will be a release that introduces a Linux-based IaaS appliance that we can easily deploy. I'm guessing this is in progress will be released at some point. When this is done, deploying vRA will be a lot simpler.

Let's wait and see what the keynotes reveals...

Things to learn... 2016 edition

As 2015 fades away in the rear view mirror, the prospect of a new year looms, and with it, a chance for me to reflect on the new technologies that are going to become increasingly important in 2016.

For a number of years, I've kept a "Things to learn" note, but I've never blogged about it before. This year, I decided to put this online and will (hopefully) be able to track how I'm doing.

So, here are the things I'm aiming to learn in 2016...

Puppet

I've started to dabble with Puppet and really like what can be done with it. I'm planning on investing a significant of time and effort into becoming fluent in Puppet so that the desired state method to system administration becomes the default approach.

Powershell / PowerCLI

I like to think I'm decent at Unix shell scripting, but my Powershell skills are very much at a beginner's level.  I've now purchased a couple of ebooks (from Packt Publishing; recommended) on the subject and want to become as comfortable in Powershell as I am BASH.

I mention PowerCLI along with Powershell because, although an extension to the base Powershell, PowerCLI provides all the functionality for managing a VMware environment through Powershell. So it's a pretty big deal in its own right.

VMware vRealize Automation / Orchestrator

This is the year that we aim to phase out our vCloud Director private cloud and replace it with vRealize Automation. It seems that for any customisation, vRealize Orchestrator is the obvious tool, which means learning some (more) Javascript as well.

Citrix XenApp 7.6

On a purely practical level, I have some older XenApp servers (test and dev) that need to be replaced with the latest XenApp release (currently 7.6). This brings a significant change to XenApp as 7.x is built off the XenDesktop FMA architecture.

It also means a migration from the old Secure Gateway and Web Interface to Netscaler VPX and StoreFront.

I still maintain that XenApp is a great "access-layer" platform for endpoints to connect in through. The new version is going to be different and take some time to understand and then fully exploit.

Microsoft Azure

As Microsoft transition from being the Windows/Office company, to a major provider of public cloud services, we're seeing an uptake of Azure usage, primarily through developers who are using it for "quick and dirty" deployments.

These developments are now transitioning to a production state, which means they need to be looked after, tended, watered and weeded by IT. So learning what can and can't be done with Azure is going to be an increasingly important requirement.

Other Stuff...

This isn't an exhaustive list. There are other things that will need research, development and deployment: Solaris 11, RHEL7, Red Hat IDM (aka FreeIPA), Cisco ASA upgrades, Zabbix monitoring and alerting and probably other things I've forgotten.

In terms of certifications, I didn't have a great experience in 2015 with my Cisco CCDA and as a result, my CCNA and CCNA Security certifications have expired. I'm not yet sure which (if any) I'll look to retake, especially given the required investment in time.

Having now been doing IT for over 15 years, it's pleasing to see that there is still a whole lot of stuff I don't know and need to learn. It keeps the job interesting. May your 2016 be equally stimulating!

Not passing the Cisco CCDA exam

"Do not underestimate this exam" - comment seen on the Cisco Learning Network.

Over the years, I've published a few posts with the title "Passing the [insert_cert] exam". Sadly, this post is "Not passing the Cisco CCDA exam". I've taken the exam twice, and failed both times.

While I can't talk about the exam (for NDA reasons), I can talk about the studying...

The CCDA is an odd certification. It sits alongside the more familiar CCNA certifications (R&S, Security, Voice etc.) and, as an "Associate" certification, is classed as entry level. Despite that, reading the Cisco Learning Community discussions reveals that a lot of people only tackle it once they have most, or all, of their CCNP or have at least taken all the CCNA concentrations. There is a common theme in the discussion forums that I've read, that this is not an easy exam.

My CCNA R&S and Security certifications were coming up for renewal, so I thought I'd give CCDA a go. I'd bought the (now out-dated) 640-863 "Designing for Cisco Internetwork Solutions" years ago and while I'd found parts of it interesting, I'd never put the effort into actually studying it.

So I equipped myself with the following:

• Designing for Cisco Internetwork Solutions (third edition)
• The Cisco CCDA Official Cert Guide
• CCDA Simplified

To go alongside that, I also bought the ARCH book, "Designing Cisco Network Service Architectures" which is actually part of the CCDP and goes into a lot more detail. I also read a bunch of the Cisco SAFE reference guides.

All in all, a lot of reading!

I then spent nearly two months of study, going through the above and learning the material. I've seen some people comment how the CCDA is a Cisco sales/marketing certification, and I sort of see where they're coming from because it does use a lot of Cisco jargon that relates to Cisco products.

However, that's not to say it's easy or that it isn't technically demanding. There are a lot of details to understand and the main challenge is that while it's very broad and in some ways theoretical, the material expects you to have an understanding of some pretty technical details, such as:

• In OSPF, what does LSA type 7 do?
• Syslog level 5 is what level of severity?
• Which H.323 protocol is responsible for call setup and signaling?
• Which IPv6 routing protocol uses FF02::9?

Quite a lot to understand and know.


So, in order to cover all the bases, I dived into:

• Network architectures (three layer, modular enterprise, borderless, collaboration, data centre)
• Campus LAN and Data centre design
• Branch office and WAN design
• IP addressing (both IPv4 and IPv6)
• Routing protocols: RIPv2, EIGRP, OSPF, BGP
• Security
• Wireless
• Voice
• Network management procotols

My first attempt, a couple of weeks ago, was a bit shakey. As I went into the exam I felt it was going to be a close thing and I failed with a score of 752 out of 1000 (pass score was 790). However, I was able to see the areas that I was not strong in and focus on that. So with nearly two weeks of additional revision and study, I took it again, feeling more confident...

This time I got 777, much closer than before and potentially only a couple of questions away from a pass. Without wanting to sound like a sore loser, I've actually flagged a couple of the questions with Cisco as the wording was very poor and ambiguous. I'm not honestly expecting much to change, but we'll see.

Sadly, this is the end of the road for my Cisco certifications for the time being. My current certs will expire in a few days, so I'll have to take them all again if I want to get back to this point. Disappointing, but that's how it goes sometimes.

So is it worth doing the CCDA? I think so. Once you get past the marketing stuff, there is a lot of good content that helps focus the architect in identifying what's important in designing a network solution. It's not a hands-on exam, but you do learn a lot that can be applied to actual network implementations. The current syllabus is getting pretty old and refers to products that have now gone end-of-life, but the concepts are sound and I assume an update will fix that.

After all these weeks of spending spare time studying, I might take a few days to sit in the sun (weekend's coming!), spend time with my neglected family and play some Elite:Dangerous. I think I deserve it.

Thoughts on migrating from vCloud Director

A couple of years ago, VMware provided a "free" upgrade from vSphere Enterprise Plus to the "vCloud Suite" standard edition. This gave enterprises access to the vCloud Networking and Security (vCNS) and vCloud Director (vCD) products, enabling vApp firewalling and routing, self service provisioning and multi-tenancy support. Third party companies such as Veeam and VMTurbo started adding vCloud Director support into their products and the future seemed bright. We had the tools to build private clouds.

Then VMware bought Dynamic Ops and decided to refocus enterprise customers on what was now called vCloud Automation Center (vCAC). vCloud Director would continue as a Service Provider tool only. As mild compensation, a cut down version of vCAC was added to the vCloud Suite for standard edition users.

With the release of vCloud Suite 6.0, vCD and vCNS appear to have been dropped. While VMware are continuing support for these products through to 2017, it is obvious that they are not the future if you are in the enterprise space.

So what should vCD and vCNS users do?

The answer VMware gave back in 2013 when this happened was to look to vCAC (now vRealize Automation) to replace the portal aspects of vCD. That blog post gave a suggestion that some vCloud Director functionality would move "up" to vCAC and other functionality would move "down" to vCenter Server:

VMware has been pretty much silent on the subject ever since.

For vCAC/vRealize Automation to successfully replace vCD, it needs to:

• Support multiple organisations/tenants
• Enable delegation of organisation VMs to non-IT end users
• Provide IT with tools to easily assign computer, memory and storge resources to specific organisations
• Allow for the creation of standard images through a service catalogue
• Allow for the creation and dynamic implementation of networks and complex vApps
• Allow for firewall/routing/VPN between vApp networks
• Provide integration points for third party backup and monitoring tools

At this stage, I'm not sure if vCAC can do this or not. My limited exposure to the product (thanks to a presentation at the South West VMUG) left me with a feeling that to do anything with vCAC required a fair amount of development work and integration with vCenter Orchestrator.

So with vCD's migration path unclear, what about vCNS?

In the knowledge base article, End of Availability (EOA) of vCloud Networking and Security (vCNS) in vCloud Suite 6.0 (2107201), VMware recommends that customers migrate to NSX at a "discounted price". Hmm, so if customers don't pay more, what do they lose? Edge and App firewalls? VPN into vApps? Load balancing? So how will more complex vApps with private networks utilising network pools work in this situation? Will any of this even be possible without NSX?

Again, more questions than answers.

In the past, some customers were burnt when VMware deprecated Lab Manager in preference to vCloud Director, and they've done it again now with vCloud Director to vRealize Automation and vCNS to NSX. This creates a lot of work for customers, for little apparent gain, and does nothing to instil a sense of confidence that the "new" solution is going to be around in five years.

To VMware, you need to improve communication in this area. Customers need to make plans and the silence regarding on-premise private cloud is uncertain. At the moment, there seems to be no like-for-like migration plan that doesn't cost the customer more, both in terms of effort required and additional SKUs.

And the "discounted price" for NSX is frankly insulting. Don't sell enterprises the dream of private cloud, provide the tools to build it, then pull the rug from under us because you have a new product you want to sell. Providing a discount that expires in year is useless to organisations who have already submitted their budget requests.

For me, I guess I need to schedule some time in to see what vRealize Automation is actually capable of. But I'll also be watching closely to see what others in our position are doing and if there are any alternative options.

[Update - 4th March 2015:  The VMware knowledge base article referenced above has gone offline. Perhaps VMware are re-evaluating???]

Passing the VCP550D exam

Last year VMware announced that the VMware Certified Professional (VCP) certification would only be valid for two years, ostensibly to ensure that candidates didn't become out of date. Now, I have no problems with recertifying when the certification isn't version specific (e.g., CCNA), but because the VCP is tied to a release of software (VCP4, VCP5 etc.), forcing a recertification does seem a bit like a cash-grab by VMware Education.

With my VCP scheduled to expire next month, I spent a couple of weeks revising and took the exam today. Fortunately I passed with a score of 340 (the passing score is 300). To be honest, I'm a bit disappointed that I didn't score higher, but a pass is a pass and it got the job done.

The exam I took was the VCP550D "delta", which focuses on the differences between vSphere 5.0/5.1 and 5.5. However, it would be worth revising the standard VCP material too as there are a lot of generic questions. The exam blueprint for the 550D is the same as for the 550, which didn't help much.

For revision, I did the following:

Took the free VMware vSphere What's New Fundamentals [v5.5] course

Took the free VMware VSAN 101 course, which has subsequently been replaced by the VSAN 6.0 course.

Signed up for the Pluralsight 10 day trial subscription and took the VMware vSphere 5.5 New Features course

Built a nested home lab environment to test a bunch of new features. William Lam's OVF template for creating Nested ESXi VSAN clusters was very helpful in getting an environment up and running quickly (as was using the vCenter Server Appliance).

There are a number of features that I specifically focussed on when revising because I don't use them day-to-day, including: vSphere Data Protection (we use Veeam), vSphere Replication (we use Veeam), VSAN (we have a SAN/NAS) and VCOPS. Getting hands on with these features in the lab was extremely helpful, although make sure you're not too rusty of "basic" VCP questions covering network, storage, DRS/HA, update manager etc.

The exam itself is online and open book, but this doesn't make passing it a foregone conclusion. You still need to know your stuff! I found it helpful to have my home lab powered up and logged in, along with the VCOPS dashboard in case I needed to quickly cross-reference something. I made sure I had access to the VMware PDFs (but didn't actually use them). Having access to Google was very useful too(!).

With 65 questions in 75 minutes, there was plenty of time to go through the exam and then have time to review "marked" questions. I did use all my time and didn't finish the review, but, obviously did enough to pass.

If you are a VCP5 holder, you only have until the 10th March 2015 to recertify. Doing the VCP550D is the most efficient and easiest way to stay certified.

Solaris Live Upgrade, ZFS and Zones

I've been working on this problem for a few days and have only just solved it, so thought it might be worth sharing...

Solaris is a very powerful operating system with some great features. Zones brought Docker-like containers to Solaris back in 2005, ZFS is one of the most advanced filesystems currently available, and the Live Upgrade capability is highly underrated and is a great way to patch a server while ensure you have a back out plan.

All good stuff, but when you put Live Upgrade into a mix of Zones and ZFS, things get a bit flakey.

The issue I was having was that when I ran the "lupc -S" (Live Upgrade Preflight Check) script on my zone, I'd get the following message:

# lupc -S
This system has Patch level/IDR  of 121430-92.
Please check MOS (My Oracle Support) to verify that the latest Live Upgrade patch is installed -- lupc does not verify patch versions.

Zonepath of zone is the mountpoint of top level dataset.
This configuration is unsupported

Oracle has a document on My Oracle Support: "List of currently unsupported Live Upgrade (LU) configurations (Doc ID 1396382.1)" which lists a lot of ways in which Live Upgrade won't work(!). On checking this document for the top level dataset issue, it gives the following text:

If ZFS root pool resides on one pool (say rpool) with zone residing on toplevel dataset of a different pool (say newpool) mounted on /newpool i.e. zonepath=/newpool, the lucreate would fail.

Okay, except that's not what I've got. My zone, s1, has a zonepath set to  /zones/s1. The zpool is called "zones" and "s1" is a separate ZFS filesystem in this dataset.

What the system is actually complaining about is that the zpool is called "zones" and is mounted as "/zones". The workaround is to set the ZFS mountpoint to be something different from the pool name.

For example,  I created a new ZFS filesystem under zones called "zoneroot":

# zfs create zones/zoneroot

Then (and this is the important bit), I set the mountpoint to something else:

# zfs set mountpoint=/zoneroot zones/zoneroot

Running zfs list for this dataset shows:

zones/zoneroot                  1.80G   122G    32K  /zoneroot

Now, I can create a zone, let's call it "s2":

# zonecfg -z s2
s2: No such zone configured
Use 'create' to begin configuring a new zone.
zonecfg:s2> create
zonecfg:s2> set zonepath=/zoneroot/s2
zonecfg:s2> verify
zonecfg:s2> commit
zonecfg:s2> exit

On installing this zone, a new ZFS file system is created, /zoneroot/s2.

Now, when running the "lupc -S" command, Live Upgrade doesn't complain about unconfigured configurations!

N36L and N54L in the same vSphere cluster

In the home lab I have a two-node cluster built around the HP Microserver N36L. Recently I took delivery of an N54L which I wanted to add to the cluster.

Although it was straightforward to add the new host, I was unable to vMotion VMs between the two types of CPU as there was a CPU incompatability:

Okay, so the CPUs are different between the two servers, but they are both AMD, so I figured I could make it work by enabling Enhanced vMotion Compatability (EVC). Unfortunately, this complained that the CPUs were either missing features, or that the VMs were using these CPU features:

As it turned out, the problem was due to the virtual machines in the cluster.

In order to work around the error, I powered off each VM in the cluster, moved them to a host outside of the cluster, edited the settings of the VM, selected Options > CPUID Mask > Advanced > Reset all to Default.

This cleared a bunch of flags that have been set at one time (not by me; must have been an automatic change). Once that I was able to configure the cluster to use EVC for AMD "Generation 2" processors.

I was then able to cold migrate the VMs back to the new cluster and power them on. One problem though: How to move the vCenter Server and its SQL Server database VM into the cluster without powering it off. I tried to vMotion them while they were on, but got the same error as above.


The answer to this, courtesy of VMware knowledge base article 1013111, is to open a vSphere Client connection directly to the host running the vCenter and SQL Server VMs, power off the VMs, right-click on them and Remove from Inventory. Then open another vSphere Client connection directly to a host in the EVC-enabled cluster, and then browse the datastore containing these VMs. Once located, right-click the VMX file and add to inventory. This will register the VMs with the host and you can power them on (be sure to say you moved the VM when prompted). Once loaded (which can take some time on low end servers), open a new vSphere Client session to the vCenter Server and you should be able to see the VMs in the correct cluster.

VNXe: Using Unisphere remotely

I'm not sure if this has always been in Unisphere or was added as a recent release, but I've only just discovered this feature...

The VNXe is managed by a web-based Flash application called Unisphere. This application makes use of smooth fades for menus and screen information. All very impressive, until you're on an RDP session at which point it's mildly annoying.

Fortunately there is an option to allow the fading to be turned off. To enable, go to Settings and then Preferences. Tick the box labled "Optimize for remote management access" and click "Apply Changes".

The application will now feel a lot snappier.

EMC VNXe volume layout

Because of the way the VNXe "simplifies" the allocation and management of storage, it can be difficult to work out just what's happening under the hood. This can result in some unexpected behaviour...

When we originally purchased the VNXe, we only had six NL-SAS disks which were automatically assigned to the "Capacity Pool". The six disks were configured by the VNXe to be part of a RAID Group in a RAID 6 (4+2) configuration (i.e., four data disks, two parity disks). From this pool, we carved out a volume. This volume is striped across all six disks:

Figure 1 - single RAID Group

Additional volumes could be created assuming there is capacity in the pool and would also be striped across the disks in the RAID Group.

Since the original installation, we have added a couple of expansion trays and now have a total of 24 NL-SAS disks. The VNXe has configured three extra RAID6 (4+2) Groups, but does not automatically rebalance existing volumes across all the RAID Groups in the pool.

When creating a new volume, the VNXe will now stripe across all four RAID Groups (in fact, four RAID Groups is the maximum that the VNXe will stripe over, regardless of the the number of RAID Groups in a pool). This means that although two volumes are created from the same pool, and may be of equal size, there may be different performance characteristics. Volume B should have four times the IOPS as Volume A:

Figure 2 - multiple RAID Groups

A further complication may arise if the first volume created completely filled the RAID Group. In this instance, the VNXe will not be able to use the first six disks and the second volume will be striped across 18 disks.

Figure 3 - Surprise!

Unfortunately, because the VNXe is "simplified", it's not possible to see this from the Unisphere web interface. EMC seem to assume that the only metric non-storage specialists care about is capacity. Not true!

Fortunately, there is a way to identify how many disks are actually assigned to a volume, even if it's not something that can be tweaked. To do this, open an SSH session (see my previous blog post on how to do this) and run the svc_neo_map command:


svc_neo_map --fs=volume_name

The list of filesystems configured on the VNXe can be viewed in Unisphere under System > Storage Resource Health. The svc_neo_map command runs a bunch of internal commands and outputs a lot of data, but it's the last part, the output of "c4admintool -c enum_disks", that interests us here. This shows the number and identity of the disks that have been assigned to the filesystem. In the following example, the volume is spread over six disks:

# Show disk info, based on wwns from RG.
root> c4admintool -c enum_disks

Disk #    0  Enc #    1  Type 10(DRIVE_CLASS_SAS_NL, RPM 7202) Flag ()  Phys Cap: 3846921026(0xe54b5b42) Disk WWID      wwn = 06:00:00:00:05:00:00:00:0f:00:00:00:00:01:00:03
Disk #    1  Enc #    1  Type 10(DRIVE_CLASS_SAS_NL, RPM 7202) Flag ()  Phys Cap: 3846921026(0xe54b5b42) Disk WWID      wwn = 06:00:00:00:05:00:00:00:10:00:00:00:01:01:00:03
Disk #    2  Enc #    1  Type 10(DRIVE_CLASS_SAS_NL, RPM 7202) Flag ()  Phys Cap: 3846921026(0xe54b5b42) Disk WWID      wwn = 06:00:00:00:05:00:00:00:11:00:00:00:02:01:00:03
Disk #    3  Enc #    1  Type 10(DRIVE_CLASS_SAS_NL, RPM 7202) Flag ()  Phys Cap: 3846921026(0xe54b5b42) Disk WWID      wwn = 06:00:00:00:05:00:00:00:12:00:00:00:03:01:00:03
Disk #    4  Enc #    1  Type 10(DRIVE_CLASS_SAS_NL, RPM 7202) Flag ()  Phys Cap: 3846921026(0xe54b5b42) Disk WWID      wwn = 06:00:00:00:05:00:00:00:13:00:00:00:04:01:00:03
Disk #    5  Enc #    1  Type 10(DRIVE_CLASS_SAS_NL, RPM 7202) Flag ()  Phys Cap: 3846921026(0xe54b5b42) Disk WWID      wwn = 06:00:00:00:05:00:00:00:14:00:00:00:05:01:00:03

What do you do if you find yourself unable to take advantage of all your RAID Groups? As mentioned above, the VNXe does not auto balance existing volumes when new disks are added. The only way to take advantage of the new disks is to create a new volume, copy everything across and delete the original. Not ideal. Even the VNXe's bigger sibling, the VNX, had this limitation until the recent "Inyo" release. Hopefully, the new auto balance feature will trickle down and appear in a future VNXe update.

I think as it stands, the current VNXe Unisphere is too simple. While I'm glad that the VNXe hides the FLARE LUNs and DART dvols, slices, stripes, metas etc from the user, it needs to go further in showing where a volume is going to be placed and what performance can be expected. This is something that even non-storage admins care about!

Any comments/corrections welcome.

Veeam Management Suite Wish List

We've been running Veeam Backup & Replication (B&R) for a couple of years after I saw it demoed at the London VMUG. It's a great product that works well and has proven itself many times when we've had to restore a VM. It's not perfect (what is?) but overall, it's definitely our go-to backup product.

The Veeam Management Suite is a package that combines B&R with Veeam ONE, itself a suite of three products: Veeam Monitor, Reporter and Business View.

Veeam ONE competes with other VMware monitoring and reporting solutions such as VMware's vCenter Operations (VCOPS) and VMTurbo Operations Manager.

We opted for Veeam ONE as it provides a good balance between cost and features. Personally, I prefer the VCOPS user interface (especially the way it now integrates with the vSphere Web Client) and it's a seriously powerful product, but the cost is prohibitive in our environment.

We did look seriously at VMTurbo, and while I think its "Intelligent Workload Management" and "Economic Scheduling Engine" are very clever, I didn't think that the interface was accessible enough for our IT operations support team. Very whizzy, but too complicated.

In contrast, although Veeam ONE is less sophisticated than some of the above products in certain areas, the Veeam ONE Monitor interface is very functional and gives clear remediation steps for alarms. We needed to get a product that could help us with our proactive monitoring and ongoing capacity planning, and Veeam ONE meets these needs.

With both products due a version 7 refresh this year, these are the highlights that I'm excited about:

vCloud Director support

Without a doubt, this is the "must-have" feature for us and the arrival of version 7 will coincide with the deployment of vCloud Director (vCD) into our environment.

Having the ability to backup all the vCloud metadata and restore vApps back into the vCD infrastructure is an essential component that has, until now, been unsatisfactory. Veeam should be rightly proud that they have the first vCD backup/restore solution.

vSphere Web Client plugin

From vSphere 5.1, the Web Client has become the primary interface to vCenter. Veeam B&R 7 will introduce a plugin that allows visibility into backup jobs through the Web Client.

It looks pretty decent and this kind of integration reduces the number of applications vSphere admins have to open  in order to keep track of their infrastructure.

Tape support

Tape is dead. Except for all the places where it isn't!

For many organisations, bandwidth costs mean off-site backups can only be effectively done using tape. Apparently any tape drive or library that can be seen by Windows will be usable and this will help many organisations overcome a clunky backup approach that currently consists of multiple backup applications.

WAN acceleration

I'm tentatively excited about this because although the compression ratios look impressive, I'll need to do some testing when B&R 7 is released to see how effective it is in our environment. Certainly having another option alongside the much wanted tape support would be good for those really important, mission-critical VMs.

The Wishlist

Although the above additions will make Veeam 7 a compelling upgrade in itself, there are some features I'd like to see:

A vCenter specific backup job

There has been a long running "challenge" in backing up vCenter using VSS. The provided solution is to manually add the ESXi host on which vCenter is located and backup that way. Which is fine until the vCenter VM is moved to another host (via automated DRS, manual vMotion or the result of an HA failover).

Given that computers are designed to automate repetitive tasks for us, I'd like to see a Veeam backup job type that is designed specifically for vCenter and when run, queries vCenter to find out which host its on and then directly connects to that host to perform the backup.

I appreciate that there is likely to be more complexity under the hood to solve this problem, but the current method is unsatisfactory and requires too much manual intervention.

NetApp snapshot support

Veeam has obviously got a good relationship with HP and has introduced the ability to backup Lefthand SAN snapshots. As a NetApp customer, I'd love to see the same functionality for the NetApp filers.

SRM-lite

VMware Site Recovery Manager (SRM) is very impressive and allows an admin to define a "run book", essentially a series of steps to perform should DR be invoked. This includes the order in which VMs should be started, any IP address changes or network settings that need to be modified for the remote site, etc. With it, a site can be failed over (and back) by clicking a button.

Although Veeam B&R is currently focused on replication of VMs to another site, there appears to be a huge gap in the market for something that sits above the replication functionality and provides SRM functionality at a lower price point.

Backup and Restore Self Service

vSphere 5.1 is bundled with the VMware Data Protection (VDP) appliance. Based on EMC Avamar technology, this basic (and limited) backup product has a couple of nice features. Firstly, it integrates seamlessly with the vSphere Web Client (as will Avamar 7). Secondly, it provides a self-service interface that allows end users to restore their own files (as demoed on Chad's blog). I know that Veeam Enterprise Manager has similar functionality, but I'd like to take it a step further.

It would be useful to give users the ability to specify their own VM backup and restore jobs. As vCloud Director enables end users to provision their own VMs, there needs to be a way to allow these VMs to be scheduled for backup and then restore them in the future, without the need to log a call with IT.

I appreciate that there are lots of factors to consider when allowing end users to run their own backups such as how to quota backup repository space or prevent developers from backing up their VMs every hour ("just in case"), but in a multi-tenant environment, having the ability to delegate this functionality becomes important.

It's possible that this functionality may be in version 7 (I don't know, I'm not a beta tester).

Veeam ONE UI integration

There is some UI inconsistency across the Veeam ONE products. Monitor is a traditional Windows application, while Reporter and Business View are web applications. None of the above look like the Backup & Replication user interface.

Similarly, the Veeam Enterprise Manager is a web application, but has a different look and feel to the other products.

Although it's not the end of the world, I'd like to see some tighter integration between the three ONE products, Enterprise Manager and B&R to enable the oft-promised "single pane of glass". At the moment, the multiple separate icons on my desktop highlight how there is more integration to do at the front end.

As I've previously commented, I like it when applications smoothly integrate with vSphere Web Client. VMware have done this with VCOPS Foundation, and Veeam themselves will with B&R 7. This would be the logical conclusion of a UI merge for Veeam ONE.

And while the existing interfaces are functional, they're not beautiful and lack the "wow" factor when compared with vCenter Operations Manager.

Veeam ONE appliance

Okay, so this is unlikely to happen, but many of the competing solutions come in the form of virtual appliances on Linux. They don't require a separate database install or Windows licence. With VMware moving towards a Linux based appliance for vCenter Server, this appears to be the future.

I'm not really expecting this one, since Veeam support both VMware and Hyper-V, but hey, it's a wish list.

Chargeback Reporting

I've not had the opportunity to dig into all the reports thoroughly, so this functionality may already exist (but I've not found it after a quick look).

Veeam Business View provides a way to group VMs logically, such as by business unit. I'd like to see the ability to be able to define costs for vCPU, vRAM, datastores and operating systems and be able to assign these properties to specific business units (or Business View entities). With the addition of a report pack, we would then have the ability to generate custom chargeback reports for our vCloud environment.

If this sounds like VMware Chargeback Manager then its because Veeam seem to be almost there with it. Most of the pieces are already in place and it would be a useful addition.

Final thoughts

The Veeam Management Suite, especially the ONE products provide a lower cost alternative to the expensive, do-everything VMware solutions. Veeam could expand its existing products to compete in other areas where VMware is not affordable to many companies, specifically in the areas of disaster recovery and VM chargeback.

Last year's "free" upgrade for vSphere Enterprise Plus customers to the vCloud Suite Standard Edition has given many organisations access to vCloud Director and vCloud Networking and Security. But the vCloud Suite Standard Edition lacks chargeback and SRM functionality.

This has to be an opportunity for third parties such as Veeam...

vSphere 6.0 wish list

In recent history, VMware have adopted the Intel-like "tick/tock" approach to software releases. In other words, each "tick" is a major release (e.g. 5.0) and each "tock" is a minor release (e.g., 5.1). This has occurred on an annual basis for the last few years.

If this approach continues, then vSphere 6.0 is presumably due out later in 2013. With that in mind, here are some of the things I would like to see in the next release... (I'm not a beta tester, so this is all pure conjecture).

Make vCenter Server easier to install

vSphere 5.1 changed the architecture of vCenter Server and introduced separate Single Sign On (SSO) and Inventory Services. My experience of installing all these components on a single server has been fairly easy, but a quick look around the forums and blogs show that some people have had real problems updating existing installations or doing more complex architectures.

One way to make this easier would be to...

Make the VCSA a first class citizen

The vCenter Server Appliance has been an alternative to the "traditional" Windows-based vCenter Server for the last couple of releases. The advantage of the VCSA is that it is extremely easy to deploy and update. The downside is that it does not have all the features of the Windows vCenter Server and using the built in database is only suitable for small deployments (five hosts and 50 VMs). Bigger installations require an external database.

A VCSA that fully supports all vCenter functions (including things like linked mode) and can handle large workloads without requiring SQL Server or Oracle would be a step in the right direction. The dependency on third party databases could be resolved if VMware were to...

Bundle vFabric Postgres

VMware products support a number of different databases:

• Traditional vCenter Server supports SQL Server, Oracle and DB2
• The vCenter Server Appliance supports its own internal Postgres database or external Oracle database
• vShield Manager bundles its own Postgres database
• vCloud Director supports an external Oracle or SQL Server database. The vCloud Director appliance bundles an internal Postgres database
• vCenter Operations Manager supports Postgres, Oracle or SQL Server

While the internal databases are suitable for lab work and test environments, for production workloads there is a currently a requirement to use a third party database with the licensing overheads this incurs.

VMware have their own vFabric Postgres database (itself a virtual appliance) and bundling this could allow VMware users to point all their application servers to a single, scalable database server, without needing to buy database licences. Bundling a cut-down version of vFabric Data Director would make management easier and also expose VMware admins to the vFabric product suite, gaining mindshare in the process.

Make vCloud Director easier to install

vCloud Director runs on a Linux VM and has a dependency on either an Oracle or SQL Server database. There are a number of manual steps to get a vCloud Director cell installed that requires some messing around at the command line to configure bits, followed by running SQL scripts to setup the database. I'm not adverse to the Linux command line, but would prefer it if the install was more straightforward.

VMware provide a vCloud Director appliance for testing, but it's not currently supported for production workloads. It would make sense for VMware to enhance the appliance and make it a fully supported option for production use, removing unnecessary complexity in the setup process.

This theme of turning all VMware products into appliances extends to the...

VUM appliance

Please can we have a Linux based VMware Update Manager appliance? If everything else is moving to appliances, having a dedicated Windows host for patching seems overkill. Alternatively, bundle the functionality in with the VCSA.

Update vCNS Manager

The vCenter Network and Security Manager is a rebranding of what was previously called vShield Manager. The web UI of this product is looking pretty dated and provides a completely different user experience to the new vSphere Web Client. It would be good to see this UI refreshed for the next release and to integrate it more closely with vSphere and vCloud Director.

Make the vSphere Web Client faster

The vSphere Web Client looks very nice and instantly makes the old .NET client look dated. However, for day to day operations I still find myself using the old client, simply because it's faster for most operations.

I want to use the new client, but it seems really sluggish a lot of the time, or perhaps it's simply that my Windows PC isn't quad core with 16GB RAM. VMware need to spend some time refactoring and improving the performance of the web client.

Infrastructure Overhead

This is more to do with those of us with home labs, so I'm not seriously expecting VMware to do anything about this...

The system requirements for VMware management servers is getting ridiculous and, while I appreciate the new functionality, there doesn't appear to be much effort going on to minimise system resources. For example:

• vCenter Server with Inventory and SSO services on the same VM: 10GB RAM recommended
• vShield Manager: 8GB RAM required
• vCenter Operations Manager: 10GB RAM required

While these requirements might be fine in large, production environments, for those of us wanting to build a decent lab, it's possible to use all your resources just building the infrastructure, with no capacity left over to actually run VMs!

Make vCenter Operations Manager easier to buy!

The current way of buying VCOPS is missing some obvious options:

There is a free version (VCOPS Foundation) which is missing loads of features.

vCenter Operations Manager Suite can be bought standalone in Standard, Advanced and Enterprise  editions, licensed based on the number of VMs or physical hosts monitored, but not using a per-processor licensing model.

It's possible to buy vSphere with Operations Manager (VSOM) which provides per-processor licensing. Regardless of which vSphere edition (Standard, Enterprise or Enterprise Plus), you get a copy of vCenter Operations Manager Standard.

The vCloud Suite Advanced bundles what looks like Operations Manager Advanced per-processor licensing.

The vCloud Suite Enterprise bundles what looks like Operations Manager Enterprise per-processor licensing.

But what about those of us who had vSphere Enterprise Plus (pre-VSOM) and took advantage of the offer to upgrade to vCloud Suite Standard? Can we get a per-processor licensed version of VCOPS added?

Not that I can see. We're stuck with VCOPS Foundation.

The point is moot for me. We recently bought Veeam ONE for our monitoring and reporting solution. While it's not as sexy as VCOPS, it's a lot more affordable and we were able to buy it with per-processor licensing.

VCOPS is a great product but it's licensing is too difficult and not flexible enough. And it's still too expensive.

Roll on VMworld...

Although I won't be attending VMworld this year (boo!), I'll be watching the keynote, blogs and Twitter to see what new products are announced. I think the core products are pretty much done, so at this point I think it's about improving ease of deployment and management. Whether any of the above wishes are actually implemented will become clear in a few months...

Home Lab: Storage Upgrade

I've been quiet over the last few months due to a very busy work project. With that now out of the way (for now!), I can update on a few of the things I've been doing with the home lab...

As detailed in a previous post, I've been running my NAS/SAN on Nexenta. This was originally running as a VSA under ESXi. While this configuration worked very well for me, I did notice that on the Microserver, the Nexenta VM was being CPU and RAM constrained. When my old ML110 G5 was replaced by the G7 servers, I decided to reprovision the Nexenta VM onto dedicated hardware.

The ML110 G5 has six SATA ports and I configured them as follows:

1. 250GB SATA
2. 60GB SSD
3. 1TB SATA
4. 1TB SATA
5. 1TB SATA
6. 1TB SATA

The Nexenta operating system is installed on the 250GB disk. While this is not mirrored, there is nothing particularly important on this disk and if it dies then it can be replaced, Nexenta re-installed and the important zpool reimported.

The 60GB SSD is configured as a L2ARC (read) cache device.

The four 1TB hard drives are configured in a RAID10 configuration. This gives better performance than my original configuration which used RAID-Z (aka RAID5) and is used for both NFS and iSCSI shares. It's where the "important stuff" is stored.

I added a Lights Out board for the ML110 G5 which I found on Ebay. All my other servers have lights out and it means I don't need to have a monitor attached.

In addition to the capacity and improved performance due to the faster RAID, the other advantage of going physical is that I can dedicate the entire 8GB of RAM in the server to Nexenta (up from 4GB on the VSA). Nexenta also benefits from having two Xeon cores dedicated to it, a significant increase over the cores in the Microserver.

I've not had the chance to benchmark the new build, but it "feels" faster than running under a VM and it also frees up CPU and RAM on my Microservers for more VMs.

How a disposable email address shows who is sharing your details...

I bought my iPhone 3G from an O2 store on the day of its release. A couple of years later I upgraded it to an iPhone 4, again from the same O2 store.

Over the last couple of weeks, I've had a number of missed calls to my mobile. No voicemail, just a missed call from a number I didn't recognise. I entered the number into Google and it appears to be associated with the Carphone Warehouse. The search results revealed a lot of people complaining that Carphone Warehouse were cold calling their mobiles to try and sell an upgrade.

Annoying, but since I'd missed the calls, no big deal.

Then, today, I received an email from Carphone Warehouse telling me I was eligible for an upgrade. Now, I'm not a customer of the Carphone Warehouse, so how did they know I was eligible?

The answer is in the email...

I use Yahoo mail for non-important stuff because it has disposable addresses. Basically you create a new address such as "mymail-" and you can then append a word to it depending on who you are dealing with. In this instance, the email was addressed to "mymail-o2@yahoo.co.uk". This address (and I've modified the first bit as it's not really "mymail-") was used when I signed up with O2.

I don't use it for anything else.

So if Carphone Warehouse are sending me emails to this address, it means that either a) I've given Carphone Warehouse my details using my O2 address (I haven't), or b) that O2 have passed/sold my details to a third party.

To be fair, it's probably hidden in the small print, but it's not cool. Who here likes receiving cold calls and junk email?

No, didn't think so.


So I complained on Twitter:

And got a reply, which started a conversation:

I'm not sure why me being a PAYG or Pay Monthly customer matters, or why recently upgrading would make a difference. I'm going to give the O2 Twitter operator the benefit of the doubt here. It's possible he/she doesn't know that the data is passed on.

But the reality is that somehow Carphone Warehouse have an address that should only exist in O2's customer database.

The last message I received today from O2 was:

That I will. And update this post.

Of course, if the data hasn't been intentionally passed to a third party, then there is always the possibility that O2 have experienced a data breach... (I don't honestly expect this to be the case).

Perhaps someone from O2 would like to clarify how Carphone Warehouse know the private address that only O2 and I know, unless the data is passed on?

Remember, O2, actions that result in your customers getting cold called and spammed is BAD.

And Carphone Warehouse? No. Not a chance.

*** UPDATE 19th December 2012 ***

Carphone Warehouse continue to spam me:

O2: Please make this stop. I have sent a STOP message and forwarded the text to the O2 spam reporting number.

VMworld Europe 2012: Wrap up and the next steps...

Having blogged about VMworld Europe 2012 as it happened, I felt it was important to summarise the week and highlight the key points that will shape the next 12 months:

1. Get the basics right

A solid infrastructure foundation is essential. As vSphere deployments grow, both in terms of number of VMs and complexity of applications provisioned, the need to ensure best practices for storage, networks and vSphere configurations is a pre-requisite of any new projects. This can be accomplished through the following of vendor white papers and policy management tools such as Host Profiles.

However, a pragmatic approach needs to be taken to balance any performance gains against operational complexity. For example, while it may be possible to tweak the round robin path selection parameter, or implement jumbo frames on storage switches, the additional complexity can introduce additional management problems later on. So, while tuning the number of IOPS per path may result in a performance improvement for a small number of VMs, the benefit may be negligible when dealing with a large number of hosts, datastores and VMs. Similarly, jumbo frames may provide a minor throughput improvement, but if a new switch is added later, the system administration team must remember to apply the same settings to the new switch or else experience frame fragmentation.

In other words, keep it simple.

2. Learn to automate

VMware vCenter Orchestrator is moving from being a peripheral product to a core part of a complex cloud infrastructure. Therefore, I'd consider it a must-have skill to acquire in the coming year. The knock on requirement is that vSphere admins will need to have a basic understanding of programming languages and development methodologies.

What about other scripting approaches such as PowerCLI? In many ways, Orchestrator and PowerCLI are complimentary. PowerCLI scripts can be used to make repetitive individual tasks easier to perform, while Orchestrator is more about enabling workflow (of larger tasks). It's probable that PowerCLI (or other PowerShell) scripts will be called as part of an Orchestrator workflow.

Bottom line: Learn both.

3. Virtualise more

VMware's "Software Defined Data Center" (SDDC) strategy extends the existing virtual infrastructure and introduces the automation and orchestration of edge devices. If implemented well, this means that provisioning new services should be faster and less error prone. The opportunity to upgrade Enterprise Plus to vCloud Suite Standard enables the rollout of vCNS and vCloud Director, thereby forming the first step in moving to this new "agile" data centre, and also provides the foundations to build a private cloud on top of vSphere.

In order to ensure that a private cloud implementation is "done right", the VMware vCloud Architecture Toolkit will be followed. This will dictate some changes to the existing infrastructure, further extending the use of a dedicated management cluster and separate production clusters.

There is one challenge to consider: The added complexity that comes with the additional functionality makes the learning curve significantly steeper. Today, it is possible for the IT generalist to work with VMware in addition to their regular day job (which may involve supporting everything else in the IT estate). At first glance, the SDDC makes this a lot more difficult. There are more virtual devices to manage and more places to configure more settings.

The responsibility is therefore on the VMware senior administrators/architects to design using clear principles, document and create the orchestration workflows to ensure that complex tasks are well managed so that the IT staff responsible for operations can do their job without needing to fully understand the complexity of the environment.  

IT architects: Be prepared to invest time learning how all this fits together.

4. Make it easier for users

The truth is that today, end users have to jump through too many hoops to get their VMs provisioned and the cost model is still unclear.

Although VMware have demonstrated vCloud Automation Manager, capable of handling the provision request/approval process, by limiting it to customers running vCloud Suite Enterprise, the rest of us are left with no ability to provide a request/approval mechanism for VM creation. It is likely that something will need to be written in-house, perhaps using something like WaveMaker Studio front-ending a series of Orchestrator workflows.

There are other ways to make life easier for our users. As admins, we currently use vSphere templates to make VM deployments simple, but this should be extended to create a full vCloud Director application catalogue for our end users. For example, if our end users want a Red Hat Enterprise Linux server with Apache Tomcat already installed, we should be in a position to make a catalogue item available for this purpose.

Using the vFabric suite to deploy these applications is probably overkill, but there are alternatives. It would be a useful exercise to do some work with Puppet to look into the provisioning of applications.

5. Monitor and plan

Finally, as things get more abstracted and complex, there is a real need to manage this infrastructure and proactively plan for future growth. VCOPS Foundation will be the starting point for this, but it's possible (probable?) that a fuller featured edition may be required over time.

There is going to be a real need to perform capacity planning to ensure that existing infrastructure resources are utilised properly, and that additional hardware is available when required.

Rationale

The above needs to be done in order to allow IT to keep up with the business demands of our users.  We need to stop being a stumbling block and instead come up with ways to deliver services faster.

The amount of servers and applications we now manage is greater than ever before and there is no sign that this will change in the near future (probably the opposite, and demand will continue to increase!).

We can't keep doing things the same way (it doesn't scale and it's too slow). We need to be smarter and more proactive about managing our infrastructure and providing the applications and environments our users need.

VMworld Europe 2012: Day Three

The final day of VMworld began and I again opted to spend the majority of my time in the hands on labs.

Back to the Hands on Lab

The first lab of the day was based around the new features and capabilities built into the vCloud Networking and Security (vCNS) product, previously known as vShield Edge and App. This product is a virtual appliance based firewall with some advanced capabilities such as IPsec VPN and load balancing. Previous versions of vShield sat at the border of a vSwitch port group and provided only two interfaces (inside and outside). The new version can support multiple networks with the example given being a traditional three legged design for external, DMZ and internal networks.

Another useful feature of vCNS is the ability to put two appliances in an active/passive configuration. As part of the lab, the active instance was powered off and the failover kicked in, losing only three ping packets before the peer picked up the load. As previous versions of vShield Edge represented a single point of failure, this addition is welcome for mission critical or highly available environments.

The second lab was an epic example of tying a number of products together to illustrate the automation and provisioning of applications. Understatedly titled "Deliver Your IT Services in the Cloud", the lab utilised VMware Service Manager to request a new vApp as a consumer, Zimbra for the administrator to receive the request and then action it in VMware Service Manager, which then kicked off a workflow in Orchestrator that provisioned a VM in vCloud Director and then installed the web application using vFabric Application Manager. This advanced level of automation and integration across the various products provided perhaps the best illustration of where VMware are going with its Software Defined Datacenter strategy. In contrast, it's interesting to see how little focus there is on the "traditional" VMware strengths of virtualising compute, network and storage. A hint to competing hypervisor vendors: the world has moved on and it's now about building and managing automated application stacks built on top of public/private/hybrid clouds.

The third lab was a focus on the new features of the Distributed vSwitch. As new Enterprise Plus users, the Distributed vSwitch will be a new addition to our infrastructure and the lab provided some useful troubleshooting tips.

The final lab covered the new features in the latest release of VCOPS. The analytics engine and presentation of data in VCOPS is amazing (no change there) and it was interesting to see how this is becoming the management platform for VMware.

vCenter Operations Manager

By which point my brain was struggling to assimilate any new information! There was no big bang event to close the conference, just a steady stream of people finishing up and heading back to their hotels.

There is still much to reflect on, and my deliberate strategy of tackling the Hands on Labs at the expense of attending the sessions means there will be significant ongoing catching up online over the coming weeks and months.

The value of attending a conference such as VMworld is that it gives an opportunity to deeply dive into the technology we use everyday, familiarise ourselves with the developments that will be with us soon, and allows us the space to think, plan, learn, discuss and ultimately equips us to do our jobs. For those of us who are passionate about the work we do, it's an amazing experience and I'm personally very grateful to my company for making it possible to attend.

VMworld Europe 2012: Day Two

Day two started with another keynote, this time focused on "end user computing". VMware demonstrated a number of new features to View, Horizon and application delivery to iOS and Android devices.

None of this really interests me, so, meh.

My first session of the day was around the vCloud Architecture Toolkit, which I only stayed in for the first ten minutes. The pace of the presentation, along the presenter providing a definition of cloud (really? It's 2012!), led to me bailing and going the Hands On Lab instead.

Hands on Lab

At the lab, I took several sessions throughout the day. Two sessions were based around the vFabric Application Director and vFabric Data Director. These two products are designed to facilitate the provisioning of applications to a cloud environment. In the first lab, you had to provision a database (MySQL), application (Tomcat) and web (Apache HTTP) server, connect them dynamically, and then scale out the middle tier. The resulting blueprint is then built as a vApp which is available through vCloud Director. Clever stuff, but quite a steep learning curve (following the guides were easy, but starting from scratch would be a formidable challenge!).

Of interest was the list of options of components that can be used in building an application blueprint. In addition to the open source stacks were objects for SQL Server and IIS, although the lab didn't touch on these components.

The vFabric Data Director lab was similarly interesting, providing a single web front end into the management and deployment of Oracle and Postgres databases. The database instances could be cloned, resources hot-added and SQL run through the interface. Of interest to me was that the underlying mechanism to manage these instances is to manipulate and clone VMs. In other words, the object that is being managed is a VM. The application doesn't appear to be doing anything to enable multi tenancy within a single database installation (or if it does, this wasn't covered in the lab). It was very impressive to be able to take a Postgres 9.0 installation, rapidly copy the VM using linked clones, and then apply an upgrade to 9.1!

For more information (and to see what the above looks like):

A short video introduction to vFabric Application Director
A short video introduction to vFabric Data Director

The final lab of the day was on the new vCenter Orchestrator, a product most of us VMware admins have had for years, but few of us have used. This lab went through the creation of workflows that are then run against objects in vCenter. The lab then extended this with the use of plugins, showing how Orchestrator can be used to manipulate Active Directory. This is something that deserves a greater look and as a result, I bought the VMware Press book, Automating vSphere with VMware vCenter Orchestrator.

While in the lab, I noticed a plasma with a display that looked as if it was showing a Splunk dashboard. On wandering over to the screen, I discovered that this was labelled "VMware Strata". On enquiring with the lab staff, no one appeared to know what it was, but they thought it may be a new product based on a VMware acquisition that would eventually make it into that all-powerful monitoring and reporting tool, vCenter Operations Manager.

Mysterious VMware Application

Following the labs was the "Hall Crawl", providing another opportunity to meet the vendors. This included a very useful discussion with HP on the use of 3PAR storage and the unique features it provides. The thin provisioning and zero reclaim are very impressive ways to optimise and manage storage usage, although there is currently no deduplication or compression as found in NetApp filers.

The day was finished with the VMworld Party, a huge event with a cool 80s retro computer games theme, many activities and games, live acts and a constant supply of food and drink that ran late into the evening.

The VMworld Party

VMworld Europe 2012: Day One

Arrived yesterday afternoon in sunny, hot and humid Barcelona in preparation for VMworld Europe 2012. Having registered, taken a lab session (on the vCloud Suite), settled into the hotel and eaten an evening meal in a small, local cafe (where the owner knew no English and we knew no Spanish, which made the whole affair very interesting), I made sure I had an early night because this conference is going to be packed.

And so it is!

And so it begins

The Keynote

The keynote kicked off at 9am. Not a huge amount of new stuff announced after the US show, but there is a new version of vCenter Operations Manager (aka VCOPS) which now includes application awareness so you can drill into a VM and get the state of the underlying application (such as the RAM utilisation of an individual Oracle instance). While this is very impressive, unfortunately, VCOPS remains reassuringly expensive (but see below for some good news).

A new plugin was shown that allows the vSphere client to manage third party hypervisors. This, along with both DynamicOps and Nicira supporting multiple hypervisors, is a new approach by VMware and probably reflects the reality in many datacenters.

The vCloud Automation Center was revealed, which is based on VMware's acquisition of DynamicOps. This showed the ability for end users to request new VMs from a catalogue and to have management over their VMs (power on, off, restart etc.) through a web portal. This looks like an essential component in the provisioning process, fulfilling the self-service aspect of the cloud while facilitating an approval process, but according to the VMware website, it's priced at $400 per managed VM(!), which makes it too expensive for all but the largest customers.

The new vFabric Application Director was also shown, with the introduction of the idea of "application blueprints" which take the concept of VM templates to the next level, allowing a drag and drop approach to building an application stack. The Cloud Application Marketplace (aka App Store) was shown where third parties can publish their own blueprint components, allowing for even more sophisticated application stacks. As an example, the screenshot showed some Riverbed components, so you could imagine integrating WAN acceleration into your one-click-to-deploy vApp. The list price for this is $6250, which, like the above, is going to be difficult for many of us to justify, no matter how cool.

A couple of screens were shown of the IT Business Management Suite, which would make a CIO very happy. Lots of cost related metrics and pretty dashboards, but not something I'll personally have any need for.

The keynote ended with a demo of a social networking project. In the demo, hosts, clusters and VMs are social network entities that can be "followed" and "liked" in the same way our Facebook friends can be "followed" and "liked". If a host loses a datastore, it posts a message to the news stream. Other hosts that have the same problem "like" the original message which can be used for analytics. If dozens of hosts all report that they have lost access to a datastore, then there's probably a serious issue. All sounds a bit gimmicky, but it did look pretty decent and got the biggest, most spontaneous applause of the keynote(!).

The main things I took away from the keynote are:

VMware offer so much more than just hypervisor-based virtualisation. Where other hypervisor vendors sometimes compare vMotion/Live Migration capabilities, play "My VM is bigger than your VM" (VMware are guilty of this too), and fight to see who offers the most features for free, the VMware strategy is now about the datacentre and everything in it, automating and orchestrating according to policy.

In VMware language, this policy based automation is referred to as the "Software Defined Datacenter" (SDDC) and is a logical continuation of the ability to virtualise resources. We're now comfortable virtualising compute, storage and network connectivity, but VMware are looking to extend this to network edge devices (load balancers, WAN compression, firewalls etc.). While virtual appliances already exist for some of these, the big difference is that the SDDC is built on the idea that these devices can be scripted, orchestrated and therefore automated by policy. This further extends (through the vFabric suite) into the application layer.

Stop and think about this for a bit, because this is actually a big deal. What happens when your entire datacentre is software defined? You get to throw the word "agile" into the mix...

Want to know more about the SDDC? Check this short video: http://www.youtube.com/watch?v=Jf0KdjpxgCI

A negative comment regarding the keynote announcements, it is frustrating that customers who opted for the top end solution in the VI3.5 days with the Enterprise edition were left in the cold with 4.0's introduction of Enterprise Plus and subsequently upgraded, are now migrated to vCloud Suite Standard which still leaves many useful features out, only available in vCloud Suite Advanced and Ednterprise. I understand that each edition adds many new features, but it seems like a ploy by VMware to constantly generate new revenue by making customers pay out for ever bigger software solutions.

Post keynote

Following the keynote, I had a quick wander around the Solutions Exchange and got into a conversation with a Cisco or NetApp employee about the new ExpressPod which appears to be a low cost FlexPod built around the C-series rack mount server and Nexus 3000 switches (with NetApp storage). This may be worth investigating further...

The Solution Exchange

Also in the Solution Exchange, I had a conversation with Veeam about support for vCloud Director and end user, self-service restores on backed up VMs. Nothing yet announced, but Backup and Replication release 7 should be interesting next year. There was also the suggestion that tape support was coming, but on later reflection, this may have limitations for those of us running a purely virtual Veeam deployment.

The Solution Exchange was also the venue for an unexpected encounter with Brent Spiner who was signing photos and chatting to people!

It's Data!

And, to the probable dismay of my wife, I now own a red fedora, courtesy of Red Hat (and she thought last year's bandana was bad...).

The rest of the day was filled with sessions, including an excellent multi-vendor presentation on storage best practices by Chad Sakac (EMC) and Vaughn Stewart (NetApp). Storage is a topic of interest to me and I've read up a fair amount on it, but was pleased to find myself noting down many "to-do" items for the infrastructure I manage. Very useful!

The second session attended was on future storage developments, including vVols, Virtual SAN and Virtual Flash. Interesting technology and it's useful to know this stuff is coming down the road.

While sitting in the Hang Space reading up on the new developments, I came across a reference on VMware's website that a new, entry level version of VCOPS called vCenter Operations Manager Foundation, will be FREE to all vSphere customers. While this removes about 90% of the product's feature set, it will be a good starting point for infrastructure management and alerting.

Part of the Hang Space

The early evening was spent in the Solutions Exchange for the Welcome Reception, basically an opportunity to engage with vendors while eating canapés and drinking free wine/beer/juice/water.
And that, for me, was enough for the day! There are parties running late into the evening, but tomorrow promises to be an equally busy day, so time to get some head down time.

Other thoughts...

On a less IT related note, this venue is very impressive (but not noticeably better or worse than Copenhagen). The conference centre is huge, requiring the use of those automated walkways normally found in airports to get around. There is a constant availability of free food and drink on offer and plenty of space to sit, relax and reflect on all the new developments. Credit to the event organisers who really understand their audience and do everything to keep attendees happy and focused!

As with last year's conference, it's interesting to note the use of smartphones and tablets, alongside laptops. It seems that most people have converged down onto two devices, not one. Of all laptops being used by conference attendees, I'd guess that easily 50% are MacBooks, implying that either VMware admins prefer to spend time doing VMware stuff and not installing Windows patches, or they are easily seduced by shiny hardware...

Passing the CCNA Security exam

The CCNA certification is valid for 3 years and mine was due to expire at the end of August 2012. I could either retake the same exam and recertify, or take another CCNA "concentration" exam that would give me a new certification and renew the original certification at the same time. I opted to tackle the CCNA Security exam, IINS 640-553.

I'd originally bought the Cisco Press "Authorized Self-Study Guide", Implementing Cisco IOS Network Security by Catherine Paquet back in 2010, but the material is a bit dry and I didn't have the motivation to get into it very far. By booking the exam, I suddenly acquired the motivation required.

As things happen, the 640-553 exam is due to be retired in September 2012, to be replaced by 640-554. The main difference in the new exam appears to be an additional focus on the Cisco ASA platform, as well as de-emphasising the Cisco Secure Device Manager (SDM). This means that any advice I give here will be redundant soon, and also I'm bound by the NDA, so can't obviously comment on what is in the exam.

What I can do though is give some general thoughts on the revision process:

The Good

The Implementing Cisco IOS Network Security book is very thorough. It covers a lot of detail and assumes little prior knowledge of security. Some of it is dry, especially the first chapter which weighs in at about 100 pages and gives an introduction to the world of security. Once that's passed, the content gets better and even the chapter on cryptography was interesting(!).

I also bought the Cisco CCNA Security Lab manual for the CCNA Security course. This gave some very good exercises to run through which were very useful in grounding the theory in the practical.

All of this was made possible using the amazing GNS3 router simulation software. I installed this on a meaty Windows Server VM and was able to run the 3 routers and 2 XP images (in Virtualbox, under ESXi) without any problems. The ability to save configurations and easily re-import them was a great time saver. GNS3 doesn't do everything (specifically switches, due to the custom silicon in them), but it made the whole process of learning the syllabus a lot easier.

There is some very good material at the Cisco Learning Network including free study chapters, training videos and discussions. Highly recommended.

The Bad

Cisco sell the book for self-study, but make it very difficult to practice because IOS images are not available without having the correct support contract. If you work for a large company with either old routers sat on a shelf or a contract with the ability to download the image then you'll be okay. Otherwise I guess you'll be searching the Internet for a dodgy copy of an old image. Seriously Cisco, how about making them freely available? You can do the study material with a 2600 series router and how old is that?

The same is true of the IPS signatures. A valid contract is required just to learn how the IPS works and again, this could mean a trip to the darker parts of the Internet to find them.

The Cisco Press book covers the Cisco Access Control Server software but it's not in the syllabus or lab manual. It can be used to learn about AAA and specifically authentication and authorization with RADIUS and TACACS+. Unfortunately Cisco don't have a trial version to help self-studying students.

The Ugly

Getting the Cisco Security Device Manager (SDM) working requires jumping through a number of hoops. To cut a long story short, you need an old version of Java (1.4 worked for me) and Windows XP. I'm guessing the latter requirement is due to Internet Explorer 6 as I couldn't get it working on Server 2008 R2 no matter what settings I tried.

Conclusion

Having worked through the labs a number of times and then setting things up "blind" (without referring to any notes), I felt fairly confident as I went into the exam. I passed with a good mark well above the passing level, so I'm naturally very pleased with this. It's a good subject to read up on since security requirements impact on so much of what we design these days. The CCNA Security should demonstrate I now have a solid grounding in the subject, even if I'm still a long way from being an expert.

Home lab upgrade: HP ML110 G7

My home vSphere infrastructure has, until very recently, consisted of:

• 2 x HP Microserver N36L
• 1 x HP ML110 G5
• 1 x HP ML115 G5

The Microservers run my domain controllers, DNS servers, Nexenta NAS/SAN VMs and vCenter Server, vMA etc., leaving the ML servers to run any test servers I needed.

Unfortunately, the ML115 G5 PSU died recently, leaving me with a single server. While looking at the options (the PSU was really expensive to replace!), I came across the ML110 G7 cash back offer (£150!). Having counted the pennies and done some reading up, I ordered two of these to replace the existing ML servers. I replaced the included 2GB DIMM with 4x4GB DIMMs. (side question: what do people do with the 1GB and 2GB DIMMs that come with servers that we immediately replace with something bigger???).

This arrived today:

The inside of the ML110 G7 is pretty clean and fitting the extra RAM was very straightforward:

The G7 is roughly the same size as the G5:

And with both of them in place (with the Cisco SG200-26 and Belkin SOHO 4 port KVM on top):

In order to make the ML110 G7 work with VMware ESXi, the BIOS needs to be configured with the correct "C State". I used this very useful blog post to set mine.

I installed ESXi using a USB CD-ROM drive and everything went very smoothly. Added both to vCenter Server, mounted an NFS datastore, setup iSCSI and configured the vSwitch for correct VLAN membership and everything is now ready to go. This upgrade means I'll be in a better position to test vCloud Director, vShield etc.