Azure Stack TP3 Overview Preview (Part II) Install Review

This is part two of a two-part series looking at Microsoft Azure Stack with a focus on my experiences installing Microsoft Azure Stack Technical Preview 3 (TP3) including into a nested VMware vSphere ESXi environment. Read part one here that provides a general overview of Azure Stack.

Azure Stack Review and Install

Being familiar with Microsoft Azure public cloud having used it for a few years now, I wanted  to gain some closer insight, experience, expand my trade craft on  Azure Stack by installing TP3. This is similar to what I have done in the past  with OpenStack, Hadoop, Ceph, VMware, Hyper-V and many others, some of which I  need to get around to writing about sometime. As a refresher from part one of this series, the following is an image via Microsoft showing the Azure Stack TP3 architecture, click here or on the image to learn more including the names and functions of the various virtual machines (VMs) that make up Azure Stack.

  Click here or on the above image to view list of VMs and other services  (Image via Microsoft.com)

Whats Involved Installing Azure Stack TP3?

The basic steps are as follows:

• Read this Azure Stack blog post (Azure Stack)
• Download the bits (e.g. the Azure Stack software) from here, where you access the Azure Stack Downloader tool.
• Planning your deployment making decisions on Active Directory and other items.
• Prepare the target server (physical machine aka PM, or virtual machine VM) that will be the Azure Stack destination.
• Copy Azure Stack software and installer to target server and run pre-install scripts.
• Modify PowerShell script file if using a VM instead of a PM
• Run the Azure Stack CloudBuilder setup, configure unattend.xml if needed or answer prompts.
• Server reboots, select Azure Stack from two boot options.
• Prepare your Azure Stack base system (time, network NICs in static or DHCP, if running on VMware install VMtools)
• Determine if you will be running with Azure Active Directory (AAD) or standalone Active Directory Federated Services (ADFS).
• Update any applicable installation scripts (see notes that follow)
• Deploy the script, then extended Azure Stack TP3 PoC as needed

Note that this is a large download of about 16GB (23GB with optional WIndows Server 2016 demo ISO).

Use the AzureStackDownloader tool to download the bits (about 16GB or 23GB with optional Windows Server 2016 base image) which will either be in several separate  files which you stitch back together with the MicrosoftAzureStackPOC tool, or as a large VHDX file and smaller 6.8GB ISO (Windows Server 2016). Prepare your target server system for installation once you have all the software pieces downloaded (or do the preparations while waiting for download).

Once you have the software downloaded, if it is a series of eight .bin files (7 about 2GB, 1 around 1.5GB), good idea to verify their checksums, then stitch them together on your target system, or on a staging storage device or file share. Note that for the actual deployment first phase, the large resulting cloudbuilder.vhdx file will need to reside in the C:\ root location of the server where you are installing Azure Stack.

Azure Stack deployment prerequisites (Microsoft) include:

• At least 12 cores (or more), dual socket processor if possible
• As much DRAM as possible (I used 100GB)
• Put the operating system disk on flash SSD (SAS, SATA, NVMe) if possible, allocate at least 200GB (more is better)
• Four x 140GB or larger (I went with 250GB) drives (HDD or SSD) for data deployment drives
• A single NIC or adapter (I put mine into static instead of DHCP mode)
• Verify your physical or virtual server BIOS has VT enabled

The above image helps to set the story of what is being done. On the left is for  bare metal (BM) or physical machine (PM) install of Azure Stack TP3, on the right, a nested VMware (vSphere ESXi 6.5) with virtual machine (VM) 11 approach. Note that you could also do a Hyper-V nested among other approaches. Shown in the image above common to both a BM or VM is a staging area (could be space on your system drive) where Azure Stack download occurs. If you use a separate staging area, then simply copy the individual .bin files and stitch together into the larger .VHDX, or, copy the larger .VHDX, which is better is up to your preferences.

Note that if you use the nested approach, there are a couple of configuration (PowerShell) scripts that need to be updated. These changes are to trick the installer into thinking that it is on a PM when it checks to see if on physical or virtual environments.

Also note that if using nested, make sure you have your VMware vSphere ESXi host along with specific VM properly configured (e.g. that virtualization and other features are presented to the VM). With vSphere ESXi 6.5 virtual machine type 11 nesting is night and day easier vs. earlier generations.

Something else to explain here is that you will initially start the Azure Stack install preparation using a standard Windows Server (I used a 2016 version) where the .VHDX is copied into its C:\ root. From there you will execute some PowerShell scripts to setup some configuration files, one of which needs to be modified for nesting.

Once those prep steps are done, there is a Cloudbuilder deploy script that gets run that can be done with an unattend.xml file or manual input. This step will cause a dual-boot option to be added to your server where you can select Azure Stack or your base prep Windows Server instance, followed by reboot.

After the reboot occurs and you choose to boot into Azure Stack, this is the server instance that will actually run the deployment script, as well as build and launch all the VMs for the Azure Stack TP3 PoC. This is where I recommend having a rough sketch like above to annotate layers as you go to remember what layer working at. Don't worry, it becomes much easier once all is said and done.

Speaking of preparing your server, refer to Microsoft specs, however in general give the server as much RAM and cores as possible. Also if possible place the system disk on a flash SSD (SAS, SATA, NVMe) and make sure that it has at least 200GB, however 250 or even 300GB is better (just in case you need more space).

Additional configuration tips include allocating four data disks for Azure, if possible make these SSDs as well as, however more important IMHO to have at least the system on fast flash SSD.

Another tip is to enable only one network card or NIC and put it into static vs. DHCP address mode to make things easier later.

Tip: If running nested, vSphere 6.5 worked the smoothest as had various issues or inconsistencies with earlier VMware versions, even with VMs that ran nested just fine.

Tip: Why run nested? Simple, I wanted to be able to use using VMware tools, do snapshots to go back in time, plus share the server with some other activities until ready to give Azure Stack TP3 its own PM.

Tip: Do not connect the POC machine to the following subnets (192.168.200.0/24, 192.168.100.0/27, 192.168.101.0/26, 192.168.102.0/24, 192.168.103.0/25, 192.168.104.0/25) as Azure Stack TP3 uses those.

Since I decided to use a nested VM deploying using VMware, there were a few extra steps needed that I have included as tips and notes. Following is view via vSphere client of the ESXi host and VM configuration.

The following image combines a couple of different things including:

A: Showing the contents of C:\Azurestack_Supportfiles directory

B: Modifying the PrepareBootFromVHD.ps1 file if deploying on virtual machine (See tips and notes)

C: Showing contents of staging area including individual .bin files along with large CloudBuilder.vhdx

D: Running the PowerShell script commands to prepare the PrepareBootFromVHD.ps1 and related items

From PowerShell (administrator):

# Variables
$Uri = 'https://raw.githubusercontent.com/Azure/Azure stack/master/Deployment/'
$LocalPath = 'c:\AzureStack_SupportFiles'

# Create folder
New-Item $LocalPath -type directory

# Download files
( 'BootMenuNoKVM.ps1', 'PrepareBootFromVHD.ps1', 'Unattend.xml', 'unattend_NoKVM.xml') | foreach { Invoke-WebRequest ($uri + $_) -OutFile ($LocalPath + '\' + $_) }

After you do the above, decide if you will be using an Unattend.xml or manual entry of items for building the Azure Stack deployment server (e.g. a Windows Server). Note that the above PowerShell script created the C:\azurestack_supportfiles folder and downloads the script files for building the cloud image using the previously downloaded Azure Stack CloudBuilder.vhdx (which should be in C:\).

Note and tip is that if you are doing a VMware or virtual machine based deployment of TP3 PoC, you will need to change C:\PrepareBootFromVHD.ps1 in the Azure Stack support files folder. Here is a good resource on what gets changed via Github that shows an edit on or about line 87 of PrepareBootFromVHD.ps1. If you run the PrepareBootFromVHD.ps1 script on a virtual machine you will get an error message, the fix is relatively easy (after I found this post).

Look in PrepareBootFromVHD.ps1 for something like the following around line 87:

if ((get-disk | where {$_.isboot -eq $true}).Model -match 'Virtual Disk')       {      Write-Host "The server is currently already booted from a virtual hard disk, to boot the server from the CloudBuilder.vhdx you will need to run this script on an Operating System that is installed on the physical disk of this server."      Exit      }

You can either remove the "exit" command, or, change the test for "Virtual Disk" to something like "X", for fun I did both (and it worked).

Note that you only have to make the above and another change in a later step if you are deploying Azure Stack TP3 as a virtual machine.

Once you are ready, go ahead and launch the PrepareBootFromVHD.ps1 script which will set the BCDBoot entry (more info here).

You will see a reboot and install, this is installing what will be  called the physical instance. Note that this is really being installed on the  VM system drive as a secondary boot option (e.g. azure stack).

After the reboot, login to the new Azure Stack base system and complete any configuration including adding VMware Tools if using VMware nested. Some other things to do include make sure you have your single network adapter set to static (makes things easier), and any other updates or customizations. Before you run the next steps, you need to decide if going to use Azure  Active Directory (AAD) or local ADFS.

Note that if you are not running on a virtual machine, simply open a PowerShell (administrator) session, and run the deploy script. Refer to here for more guidance on the various options available including discussion on using AAD or ADFS.

Note if you run the deployment script on a virtual machine, you will get an error which is addressed in the next section, otherwise, sit back and watch the progress..

CloudBuilder Deployment Time

Once you have your Azure Stack deployment system and environment ready, including a snapshot if on virtual machine, launch the PowerShell deployment script. Note that you will need to have decided if deploying with Azure Active Directory (AAD) or Azure Directory Federated Services (ADFS) for standalone aka submarine mode. There are also other options you can select as part of the deployment discussed in the Azure Stack tips here (a must read) and here. I chose to do a submarine mode (e.g. not connected to Public Azure and AAD) deployment.

From PowerShell (administrator):

cd C:\CloudDeployment:\Setup
$adminpass = ConvertTo-SecureString "youradminpass" -AsPlainText -Force
.\InstallAzureStackPOC.ps1 -AdminPassword $adminpass -UseADFS

Deploying on VMware Virtual Machines Tips

Here is a good tip via Gareth Jones (@garethjones294) that I found useful for updating one of the deployment script files (BareMetal_Tests.ps1 located in C:\CloudDeployment\Roles\PhysicalMachines\Tests folder) so that it would skip the bare metal (PM) vs. VM tests. Another good resource, even though it is for TP2 and early versions of VMware is TP2 deployment experiences by Niklas Akerlund (@vNiklas).

Note that this is a bit of a chick and egg scenario unless you are proficient at digging into script files since the BareMetal_Tests.ps1 file does not get unpacked until you run the CloudBuilder deployment script. If you run the script and get an error, then make the changes below, and rerun the script as noted. Once you make the modification to the BareMetal_Tests.ps1 file, keep a copy in a safe place for future use.

Here are some more tips for deploying Azure Stack on VMware,

Per the tip mentioned about via Gareth Jones (tip: read Gareths post vs. simply cut and paste the following which is more of a guide):

Open BareMetal_Tests.ps1 file in PowerShell ISE and navigate  to line 376 (or in that area)
  Change $false to $true which will stop the script failing when checking  to see if the Azure Stack is running inside a VM.
  Next go to line 453.
  Change the last part of the line to read “Should Not BeLessThan 0”
  This will stop the script checking for the required amount of cores  available.

After you make the above correction as with any error (and fix) during Azure Stack TP3 PoC deployment, simply run the following.

cd C:\CloudDeployment\Setup .\InstallAzureStackPOC.ps1 -rerun

Refer to the extra links in the where to learn more section below that offer various tips, tricks and insight that I found useful, particular for deploying on VMware aka nested. Also in the links below are tips on general Azure Stack, TP2, TP3, adding services among other insight.

Tip: If you are deploying Azure Stack TP3 PoC on virtual machine, once you start the script above, copy the modified BareMetal_Tests.ps1 file Once the CloudBuilder deployment starts, sit back and wait, if you are using SSDs, it will take a while, if using HDDs, it will take a long while (up to hours), however check in on it now and then to see progress of if any errors. Note that some of the common errors will occur very early in the deployment such as the BareMetal_Tests.ps1 mentioned above.

Checking in periodically to see how the deployment progress  is progressing, as well as what is occurring. If you have the time, watch some  of the scripts as you can see some interesting things such as the software  defined data center (SDDC) aka software-defined data infrastructure (SDDC) aka  Azure Stack virtual environment created. This includes virtual machine creation  and population, creating the software defined storage using storage spaces  direct (S2D), virtual network and active directory along with domain controllers  among others activity.

After Azure Stack Deployment Completes

After you see the deployment completed, you can try accessing the management portal, however there may be some background processing still running. Here is a good tip post on connecting to Azure Stack from Microsoft using Remote Desktop (RDP) access. Use RDP from the Azure Stack deployment Windows Server and connect to a virtual machine named MAS-CON01, launch Server Manager and for Local Server disable Internet Explorer Enhanced Security (make sure you are on the right system, see the tip mentioned above). Disconnect from MAS-CON01 (refer to the Azure Stack architecture image above), then reconnect, and launch Internet Explorer with an URL of  (note documentation side to use  which did not work for me).

Note the username for the Azure Stack system is AzureStack\AzureStackAdmin with a password of what you set for administrative during setup. If you get an error, verify the URLs, check your network connectivity, wait a few minutes as well as verify what server you are trying to connect from and too. Keep in mind that even if deploying on a PM or BM (e.g. non virtual server or VM), the Azure Stack deployment TP3 PoC creates a "virtual" software-defined environment with servers, storage (Azure Stack uses Storage Spaces Direct [S2D] and software defined network.

Once able to connect to Azure Stack, you can add new services including virtual machine image instances such as Windows (use the Server 2016 ISO that is part of Azure Stack downloads), Linux or others. You can also go to these Microsoft resources for some first learning scenarios, using the management portals, configuring PowerShell and troubleshooting.

Where to learn more

The following provide more information and insight about Azure, Azure Stack, Microsoft and Windows among related topics.  

• Azure Stack Technical Preview 3 (TP3) Overview Preview Review
• Azure Stack TP3 Overview Preview Review Part II
• Azure Stack Technical Preview (get the bits aka software download here)
• Azure Stack deployment prerequisites (Microsoft)
• Microsoft Azure Stack troubleshooting (Microsoft  Docs)
• Azure Stack TP3 refresh tips (Azure Stack)
• Here is a good post with a tip about not applying certain Windows updates to AzureStack TP3 installs.
• Configure Azure Stack TP3 to be available on your own network (Azure Stack)
• Azure Stack TP3 Marketplace syndication (Azure Stack)
• Azure Stack TP3 deployment experiences (Azure Stack)
• Frequently asked questions for Azure Stack (Microsoft)
• Azure Active Directory (AAD) and Active Directory Federation Services (ADFS)
• Deploy Azure Stack (Microsoft)
• Connect to Azure Stack (Microsoft)
• Azure Stack TP2 deployment experiences by Niklas Akerlund (@vNiklas) useful for tips for TP3
• Deployment Checker for Azure Stack Technical Preview (Microsoft Technet)
• Azure stack and other tools (Github)
• How to enable nested virtualization on Hyper-V Windows Server 2016
• Dell EMC announce Microsoft Hybrid Cloud Azure Stack (Dell EMC)
• Dell EMC Cloud for Microsoft Azure Stack (Dell EMC)
• Dell EMC Cloud for Microsoft Azure Stack Data Sheet (Dell EMC PDF)
• Dell EMC Cloud Chats (Dell EMC Blog)
• Microsoft Azure stack forum
• Dell EMC Microsoft Azure Stack solution
• Gaining Server Storage I/O Insight into Microsoft Windows Server 2016
• Overview Review of Microsoft ReFS (Reliable File System) and resource links
• Via WServerNews.com Cloud (Microsoft Azure) storage considerations
• Via CloudComputingAdmin.com Cloud Storage Decision Making: Using Microsoft Azure for cloud storage
• www.thenvmeplace.com, www.thessdplace.com, www.objectstoragecenter.com and www.storageio.com/converge

What this  all means

A common question is if there is demand  for private and hybrid cloud, in fact,  some industry expert pundits have even said private,  or hybrid are dead which is interesting, how can something be dead if it is  just getting started. Likewise, it is  early to tell if Azure Stack will gain traction with various organizations,  some of whom may have tried or struggled with OpenStack among others.

Given a large number  of Microsoft Windows-based servers on VMware, OpenStack, Public cloud services  as well as other platforms, along with continued growing popularity of Azure,  having a solution such as Azure Stack provides an attractive option for many environments. That leads to the question  of if Azure Stack is essentially a replacement for Windows Servers or Hyper-V  and if only for Windows guest operating systems. At this point indeed, Windows  would be an attractive and comfortable option, however, given a large number  of Linux-based guests running on Hyper-V  as well as Azure Public, those are also primary candidates as are containers  and other services.

Some will say that if OpenStack is struggling in many organizations  and being free open source, how Microsoft can have success with Azure Stack.  The answer could be that some organizations  have struggled with OpenStack while others have not due to lack of commercial  services and turnkey support. Having installed both OpenStack and Azure Stack  (as well as VMware among others), Azure Stack is at least the TP3 PoC is easy  to install, granted it is limited to one node,  unlike the production versions. Likewise,  there are easy to use appliance versions of OpenStack that are limited in  scale, as well as more involved installs that unlock full functionality.

OpenStack, Azure Stack, VMware and others have their places,  alongside, or supporting containers along with other tools. In some cases,  those technologies may exist in the same environment supporting different  workloads, as well as accessing various public clouds, after all, Hybrid is the  home run for many if not most legality IT environments.

Ok, nuff said (for now...).

Cheers
Gs

Dell EMC Azure Stack Hybrid Cloud Solution

Dell EMC have announced their Microsoft Azure Stack hybrid cloud platform solutions. This announcement builds upon earlier statements of support and intention by Dell EMC to be part of the Microsoft Azure Stack community. For those of you who are not familiar, Azure Stack is an on premise extension of Microsoft Azure public cloud.

What this means is that essentially you can have the Microsoft Azure experience (or a subset of it) in your own data center or data infrastructure, enabling cloud experiences and abilities at your own pace, your own way with control. Learn more about Microsoft Azure Stack including my experiences with and installing Technique Preview 3 (TP3) here.

What Is Azure Stack

Microsoft Azure Stack is an on-premise (e.g. in your own data center) private (or hybrid when connected to Azure) cloud platform. Currently Azure Stack is in Technical Preview 3 (e.g. TP3) and available as a proof of concept (POC) download from Microsoft. You can use Azure Stack TP3 as a POC for learning, demonstrating and trying features among other activities. Here is link to a Microsoft Video providing an overview of Azure Stack, and here is a good summary of roadmap, licensing and related items.

In summary, Microsoft Azure Stack and this announcement is about:

• A onsite, on-premise,  in your data center extension of Microsoft  Azure public cloud
• Enabling private and hybrid  cloud with good integration along with shared  experiences with Azure
• Adopt, deploy, leverage cloud on your terms and timeline  choosing what works best for you
• Common processes,  tools, interfaces, management and user experiences
• Leverage speed of  deployment and configuration with a purpose-built integrated  solution
• Support existing and cloud-native  Windows, Linux, Container and other services
• Available as a public preview via software download, as well  as vendors offering solutions

What Did Dell EMC Announce

Dell EMC announced their initial  product, platform solutions, and services  for Azure Stack. This includes a Proof of  Concept (PoC) starter kit (PE R630) for doing evaluations, prototype, training,  development test, DevOp and other initial activities with Azure Stack. Dell EMC also announced a larger for production  deployment, or large-scale development, test DevOp activity turnkey solution. The  initial production solution scales from 4 to 12 nodes, or from 80 to 336 cores  that include hardware (server compute, memory, I/O and networking, top of rack  (TOR) switches, management, Azure Stack software along with services.  Other aspects of the announcement include initial  services in support of Microsoft Azure Stack and Azure cloud offerings.

Image via Dell EMC

The announcement builds on joint Dell EMC Microsoft  experience, partnerships, technologies and services spanning hardware,  software, on site data center and public cloud.

Image via Dell EMC

Dell EMC along with Microsoft have engineered a hybrid cloud  platform for organizations to modernize  their data infrastructures enabling faster innovate, accelerate deployment of resources. Includes hardware  (server compute, memory, I/O networking, storage devices), software, services, and support.

Image via Dell EMC

The value proposition  of Dell EMC hybrid cloud for Microsoft Azure Stack includes consistent  experience for developers and IT data infrastructure professionals. Common experience across Azure public cloud and Azure  Stack on-premise in your data center for private or hybrid. This  includes common portal, Powershell,  DevOps tools, Azure Resource Manager (ARM), Azure Infrastructure as a Service  (IaaS) and Platform as a Service (PaaS), Cloud Infrastructure and associated  experiences (management, provisioning, services).

Image via Dell EMC

Secure, protect, preserve and serve applications VMs hosted  on Azure Stack with Dell EMC services along with Microsoft technologies. Dell  EMC data protection including backup and restore, Encryption as a Service, host  guard and protected VMs, AD integration among other features.

Image via Dell EMC

Dell EMC services for Microsoft Azure Stack include single contact support for prepare, assessment, planning; deploy with rack  integration, delivery, configuration;  extend the platform with

applicable migration,  integration with Office 365 and other applications,  build new services.

Image via Dell EMC

Dell EMC Hyper-converged scale out solutions range from minimum of 4 x PowerEdge R730XD (total raw specs include 80 cores (4 x 20), 1TB RAM (4 x 256GB), 12.8TB SSD Cache, 192TB Storage, plus two top of row network switches (Dell EMC) and 1U management server node. Initial maximum configuration raw specification includes 12 x R730XD (total 336 cores), 6TB memory, 86TB SSD cache, 900TB storage along with TOR network switch and management server.

The above configurations initially enable HCI nodes of small (low) 20 cores, 256GB memory, 5.7TB SSD cache, 40TB storage; mid size 24 cores, 384GB memory, 11.5TB cache and 60TB storage; high-capacity with 28 cores, 512GB memory, 11.5TB cache and 80TB storage per node.
 
Image via Dell EMC

Dell EMC Evaluator program for Microsoft Azure Stack including the PE R630 for PoCs, development, test and training environments. The solution combines Microsoft Azure Stack software, Dell EMC server with Intel E5-2630 (10 cores, 20 threads / logical processors or LPs), or Intel E5-2650 (12 cores, 24 threads / LPs). Memory is 128GB or 256GB, storage includes flash SSD (2 x 480GB SAS) and HDD (6 x 1TB SAS). and networking.

Image via Dell EMC

Collaborative support single contact between Microsoft and Dell EMC

Who Is This For

This announcement is  for any organization that is looking for an  on-premise, in your data center private or hybrid cloud turnkey solution  stack. This initial set of announcements can be for those looking to do a proof  of concept (PoC), advanced prototype,  support development test, DevOp or gain cloud-like elasticity, ease of use, rapid procurement and other experiences of public  cloud, on your terms and timeline. Naturally,  there is a strong affinity and seamless experience for those already using, or  planning to use Azure Public Cloud for Windows,  Linux, Containers and other workloads, applications,  and services.

What Does This Cost

Check with your Dell EMC representative  or partner for exact pricing which  varies for the size and configurations.  There are also various licensing models to take into consideration if you have Microsoft Enterprise  License Agreements (ELAs) that your Dell EMC representative  or business partner can address for you. Likewise being cloud based, there is also time usage-based  options to explore.

Where to learn more

• Dell EMC announce Microsoft Hybrid Cloud Azure Stack (Dell EMC)
• Dell EMC Cloud for Microsoft Azure Stack (Dell EMC)
• Dell EMC Cloud for Microsoft Azure Stack Data Sheet (Dell EMC PDF)
• Dell EMC Cloud Chats (Dell EMC Blog)
• Technical Preview (get the bits aka software download here)
• Frequently asked questions for Azure Stack (Microsoft)
• Microsoft AzureStack forum
• Dell EMC announce Microsoft Azure Stack solution
• Azure Stack Technical Preview 3 (TP3) Overview Preview Review
• Azure Stack TP3 Overview Preview Review Part II
• Gaining Server Storage I/O Insight into Microsoft Windows Server 2016
• Overview Review of Microsoft ReFS (Reliable File System) and resource links
• Via WServerNews.com Cloud (Microsoft Azure) storage considerations
• Via CloudComputingAdmin.com Cloud Storage Decision Making: Using Microsoft Azure for cloud storage
• www.thenvmeplace.com, www.thessdplace.com, www.objectstoragecenter.com and www.storageio.com/converge

What this  all means

The dust is starting to settle on last falls Dell EMC  integration, both of whom have long histories working with, and partnering  along with Microsoft on legacy, as well as virtual software-defined data centers (SDDC), software-defined data infrastructures  (SDDI), native, and hybrid clouds. Some may view the Dell EMC VMware relationship as a primary  focus, however, keep in mind that both Dell and EMC had worked with Microsoft long before VMware came into being. Likewise, Microsoft remains one of the most commonly  deployed operating systems on VMware-based  environments. Granted Dell EMC have a significant  focus on VMware, they both also sell, service and support many services for Microsoft-based solutions.

What about Cisco, HPE, Lenovo among others who have to announce or discussed their Microsoft  Azure Stack intentions? Good question, until we hear more about what those and  others are doing or planning, there is  not much more to do or discuss beyond speculating  for now. Another common question is if there is demand  for private and hybrid cloud, in fact,  some industry expert pundits have even said private,  or hybrid are dead which is interesting, how can something be dead if it is  just getting started. Likewise, it is  early to tell if Azure Stack will gain traction with various organizations,  some of whom may have tried or struggled with OpenStack among others.

Given a large number  of Microsoft Windows-based servers on VMware, OpenStack, Public cloud services  as well as other platforms, along with continued growing popularity of Azure,  having a solution such as Azure Stack provides an attractive option for many environments. That leads to the question  of if Azure Stack is essentially a replacement for Windows Servers or Hyper-V  and if only for Windows guest operating systems. At this point indeed, Windows  would be an attractive and comfortable option, however, given a large number  of Linux-based guests running on Hyper-V  as well as Azure Public, those are also primary candidates as are containers  and other services.

Overall, this is an excellent  and exciting move for both Microsoft  extending their public cloud software stack to be  deployed within data centers in a hybrid way, something that those  customers are familiar with doing. This  is a good example of hybrid being spanning public and private clouds, remote  and on-premise, as well as familiarity  and control of traditional procurement with the flexibility, elasticity experience  of clouds.

Some will say that if OpenStack is struggling in many organizations  and being free open source, how Microsoft can have success with Azure Stack.  The answer could be that some organizations  have struggled with OpenStack while others have not due to lack of commercial  services and turnkey support. Having installed both OpenStack and Azure Stack  (as well as VMware among others), Azure Stack is at least the TP3 PoC is easy  to install, granted it is limited to one node,  unlike the production versions. Likewise,  there are easy to use appliance versions of OpenStack that are limited in  scale, as well as more involved installs that unlock full functionality.

OpenStack, Azure Stack, VMware and others have their places,  along, or supporting containers along with other tools. In some cases,  those technologies may exist in the same environment supporting different  workloads, as well as accessing various public clouds, after all, Hybrid is the  home run for many if not most legality IT environments.

Overall this is a good announcement from Dell EMC for those who are interested in, or should become more aware about Microsoft Azure Stack, Cloud along with hybrid clouds. Likewise look forward to hearing more about the solutions from others who will be supporting Azure Stack as well as other hybrid (and Virtual Private Clouds).

Ok, nuff said (for now...).

Cheers
Gs

Broadcom aka Avago aka LSI announces SAS SATA NVMe Adapters with RAID

In case you missed it, Broadcom formerly known as Avago who bought the LSI adapter and RAID card business announced shipping new SAS, SATA and NVMe devices.

While SAS and SATA are well established continuing to be deployed for both HDD as well as flash SSD, NVMe continues to evolve with a bright future. Likewise, while there is a focus on software-defined storage (SDS), software defined data centers (SDDC) and software defined data infrastructures (SDDI) along with advanced parity RAID including erasure codes, object storage among other technologies, there is still a need for adapter cards including traditional RAID.

Keep in mind that while probably not meeting the definition of some software-defined aficionados, the many different variations, permutations along with derivatives of RAID from mirror and replication to basic parity to advanced erasure codes (some based on Reed Solomon aka RAID 2) rely on software. Granted, some of that software is run on regular primary server processors, some on packaged in silicon via ASICs or FPGAs, or System on Chips (SOC), RAID on Chip (RoC) as well as BIOS, firmware, drivers as well as management tools.

For some environments cards such as those announced by Broadcom are used in passthru mode effectively as adapters for attaching SAS, SATA and NVMe storage devices to servers. Those servers may be deployed as converged infrastructures (CI), hyper-converged infrastructures (HCI), Cluster or Cloud in Box (CiB) among other variations. To name names you might find the above (or in the not so distant future) in VMware vSAN or regular vSphere based environments, Microsoft Windows Server, Storage Spaces Direct (S2D) or Azure Stack, OpenStack among other deployments (check your vendors Hardware Compatibility Lists aka HCLs). In some cases these cards may be adapters in passthru mode, or using their RAID (support various by different software stacks). Meanwhile in other environments, the more traditional RAID features are still used spanning Windows to Linux among others.

Who Is Broadcom?

Some of you may know of Broadcom having been around for many years with a focus on networking related technologies. However some may not realize that Avago bought Broadcom and changed their name to Broadcom. Here is a history that includes more recent acquisitions such as Brocade, PLX, Emulex as well as LSI. Some of you may recall Avago buying LSI (the SAS, SATA, PCIe HBA, RAID and components) business not sold to NetApp as part of Engenio. Also recall that Avago sold the LSI flash SSD business unit to Seagate a couple of years ago as part of its streamlining. That's how we get to where we are at today with Broadcom aka formerly known as Avago who bought the LSI adapter and RAID business announcing new SAS, SATA, NVMe cards.

What Was Announced?

Broadcom has announced cards that are multi-protocol supporting Serial Attached SCSI (SAS), SATA/AHCI as well as NVM Express (NVMe) as basic adapters for attaching storage (HDD, SSD, storage systems) along with optional RAID as well as cache support. These cards can be used in application servers for traditional, as well as virtualized SDDC environments, as well as storage systems or appliances for software-defined storage among other uses. The basic functionality of these cards is to provide high performance (IOPs and other activity, as well as bandwidth) along with low latency combined with data protection as well as dense connectivity.

Specific features include:

• Broadcom’s Tri-Mode SerDes Technology enables  the operation of NVMe, SAS or SATA devices in a single drive bay, allowing for  endless design flexibility.
• Management software including LSI Storage Authority (LSA), StorCLI, HII  (UEFI)
• Optional CacheVault(R) flash cache protection
• Physical dimension Low Profile 6.127” x 2.712”
• Host bus type x8 lane PCIe Express 3.1
• Data transfer rates SAS-3 12Gbs; NVMe up to 8 GT/s PCIe Gen 3
• Various OS and hypervisors host platform support
• Warranty 3 yrs, free 5x8 phone support, advanced replacement option
• RAID levels 0, 1, 5, 6, 10, 50, and 60

Note that some of the specific feature functionality may be available at a later date, check with your preferred vendors HCL

In case you need a refresher on SFF cable types, click on the following two images which take you to Amazon.com where you can learn more, as well as order various cable options. PC Pit Stop has a good selection of cables (See other SFF types), connectors and other accessories that I have used, along with those from Amazon.com and others.

Left: SFF 8644 Mini SAS HD (External), Right SFF-8643 Mini SAS HD (internal) Image via Amazon.com

Left: SFF 8643 Mini SAS HD (Internal), Right SFF-8642 SATA with power (internal) Image via Amazon.com

Wait, Doesnt NVMe use PCIe

For those who are not familiar with NVMe and in particular U.2 aka SFF 8639 based devices, physically they look the same (almost) as a SAS device connector. The slight variation is if you look at a SAS drive, there is a small tab to prevent plugging into a SATA port (recall you can plug SATA into SAS. For SAS drives that tab is blank, however on the NVMe 8639 aka U.2 drives (below left) that tab has several connectors which are PCIe x4 (single or dual path).

What this means is that the PCIe x4 bus electrical signals are transferred via a connector, to backplane chassis to 8639 drive slot to the drive. Those same 8639 drive slots can also have a SAS SATA connection using their traditional connectors enabling a converged or hybrid drive slot so to speak. Learn more about NVMe here (If the Answer is NVMe, then what were and are the questions?) as well as at www.thenvmeplace.com.

Left NVMe U.2 drive showing PCIe x4 connectors, right, NVMe U.2 8639 connector

Who Is This For?

These cards are applicable for general purpose IT and other data infrastructure environments in traditional servers among others uses. They are also applicable for systems builders, integrators and OEMs whom you may be buying your current systems from, or future ones.

Where to  Learn More

The following are additional resources to learn more about vSAN and related technologies.

• Read the Broadcom announcement here
• SSD, flash, Non-volatile memory (NVM) storage Trends, Tips & Topics
• Get in the NVMe SSD game (if you are not already) with Intel 750 among others
• InfoStor – SSD Trends, Tips and Topics
• Server and Storage I/O Benchmarking and Performance Resources
• If the Answer is NVMe, then what were and are the questions?
• Announcing SAS SANs for Dummies book, LSI edition
• Thessdplace.com and Thenvmeplace.com
• Server StorageIO CI and HCI microsite landing page www.storageio.com/converge

What this  all means

Even as the industry continues to talk and move towards more software-defined focus, even for environments that are serverless, there is still need for hardware somewhere. These adapters are a good sign of the continued maturing cycle of NVMe to be well positioned into the next decade and beyond, while also being relevant today. Likewise, even though the future involves NVMe, there is a still a place for SAS along with SATA to coexist in many environments. For some environment there is a need for traditional RAID while for others simply the need for attachment of SAS, SATA and NVMe devices. Overall, a good set of updates, enhancements and new technology for today and tomorrow, now, when do I get some to play with? ;).

Ok, nuff said (for now...).

Cheers
Gs

How to Manage VCSA 6.5 Embedded Postgres Database using pgAdmin (With GUI)

Default database for vCenter Server appliance 6.5 and windows based vCenter Server 6.5 is Postgres database. Most of the VMware administrators are more comfortable with managing the Microsoft SQL servers using the GUI based database management tools. When we start using the default embedded database for vCenter Server appliance 6.5. You need to manage the postgres database from command line and other option is to manage the embedded database using other third party postgres database management tools such as pgAdmin. pgAdmin allows you to manage the vCenter Server appliance 6.5 embedded postgres database via GUI. In this article, we will discuss about how to manage the vCSA 6.5 embedded postgres database using pgAdmin.

How to Manage VCSA 6.5 Embedded Postgres Database using pgAdmin

pgAdmin tools are available for Windows, Liux and also for Mac OS.  I am going to install the pgAdmin on the windows server, So download pgadmin for windows. Once download is completed, Start the pgAdmin installation. Click on Next to continue.

Follow the wizard instructions, and Click on Finish to complete the installation.

Before We start managing the postgres database using pgadmin, we need the postgres database connection information. Take a look at how to interact with VCSA 6.5 Embedded VPostgres Database.  Connect to the VCSA 6.5 using SSH and login with root credentials. Execute the below command in bash shell to get the embedded postgres database configuration information

It displays the embedded database configuration information such as DB Type, DB Server name. DB port, DB instance name , DB user name and also PG User Password in Quotes. This information are needed when you need to manage and troubleshoot the VCSA 6.5 Embedded VPostgres Database from outside the server.

Before managing the embedded database using pgadmin, you should ensure you have configured your vCenter server appliance firewall to Manage VCSA 6.5 Postgres Database Remotely. Configure the VCSA 6.5 firewall prior to manage the embedded database using pgadmin. Once you are done with the firewall configuration, Open the pgadmin console. Right-click the Severs -> Create -> Server

Enter the vCenter Server FQDN hostname or IP address in the general tab.

Click on Connection tab -> Enter the connection information copied from the VCSA database configuration information. Copy the username and password from the embedded database configuration information. Click on Save.

That’s it . We have connected to the VCSA 6.5 embedded  database using pgadmin.  Now you can manage the embedded database via GUI as similar to your SQL management.

That’s it. VCSA database management become easy now. I hope this is informative for you. Thanks for Reading!!. Be social and share it in social media, if you feel worth sharing it.

Welcome to Triple-Point TUESDAY at CloudCredibility.com

vote; support; play; discover; engage - around the cloud

Scale the Leaderboards 3X faster, today only!

New Task 4260: VVD Quick Reference

New Task 4261: The Marvel Comic REST API

New Task 4262: VMware Flings: Top 5 – 2017 Edition

New Task 4263: Help send Sophia to space

New Task 4264: Introducing Top vBlog 2017

New Task 4265: VMware at #DellEMCWorld 2017

+++

If you missed a few from yesterday:

Take advantage of these recent News & Trends tasks

And two new Hands-On Labs!

New Task 4252: Govt Cloud Storage: Its Uses and Benefits

New Task 4253: The Thing - about IOT

New Task 4254: Police Learn to Fight Global-Scale Cybercrime

New Task 4255: Docker Names New CEO to Bolster Container Market

New Task 4256: Taking the Threat of 'Containerization Contamination' Seriously

New Task 4257: Enterprise cyberattacks - The new normal?

New Task 4258: HOL-1710-SDC-6What's New with vSphere 6.5

New Task 4259: HOL-1710-SDC-3: vSphere with Operations Management: Advanced

+++

FROM THE EDITORS VIRTUAL DESK
Hi everyone, this week I bring you news regarding VMworld and TAM Day, an event that we hold every year for our TAM Customers. We are still a few months away from VMworld however as is customary TAM Day filled up pretty fast and we want to make sure that you are aware of this event if you are planning on attending VMworld this year. If you are intending on going to VMworld this is a not to be missed day focused around the needs of our TAM customers, and a great opportunity to hear first hand from many VMware leaders prior to the actual event itself. So if this is interesting to you then please reach out to your VMware TAM and they can assist you with how to register for TAM Day to ensure that you do not miss a thing.

This past week I was also privileged to attend my local VMUG. If you haven't been to a VMUG before or for a while I suggest you check them out online at www.vmug.com and register to get updates for you local VMUG as well as the many excellent online events that they produce. We also keep a handy link in every newsletter below of the upcoming VMUG webcasts.

I wish you a fantastic week ahead and look forward to the next edition of the TAM Newsletter. In the meantime please enjoy this weeks newsletter and all of its goodness.

Virtually Yours
New Isserow | VMware TAM Team
Latest News | Twitter | Facebook | LinkedIn | Blog | Newsletter | Archive
-
TAM BLOG | TAM WEBCASTS |
(Kelly Dare) | (Michelle Kaiser) |

VMUG (Jodi Shely)
Full Webcasts List

NEWS AND DEVELOPMENTS FROM VMWARE
Understanding How Host Profiles Handles Host-Specific Configuration Settings Through Customizations
Host Profiles is an advanced capability of VMware vSphere that provides for configuration and compliance checking of multiple VMware ESXi hosts. Although a profile can be attached directly to a single host in vCenter Server, typically, a profile is attached to a vSphere cluster, where all the hos...

Virtual Network Provisioning via the Hypervisor
We’ve shared other resources with you before that discuss what network virtualization is and the essential of micro-segmentation . Today, we’re taking a look at provisioning virtual networks. According to our free whitepaper Network Virtualization Makes Your Life Easier : Virtual networks can be ...

New KB articles published for week ending 22nd April 2017
VMware ESXi “AddVirtualMachine: VM ‘XX’ already registered” warnings keep logging into hostd.log Published Date: 2017/04/18 Platform Erratum messages related to USB controller may be observed on Intel Platforms Published Date: 2017/04/20 The DCUI sometimes displays less memory than is available o...

vRealize Network Insight, NSX and Palo Alto Networks for micro-segmentation
  Data Center cyber security is a fast-moving target where the IT teams need to constantly stay ahead of those that wish to do evil things. As security attacks can come from all directions, externally, and internally as well, the IT teams must fortify all the data, with a zero-trust security appr...

The Public Cloud: The True Next Step in Modern Data Center Control and Evolution
After virtualization itself, the public cloud is considered the natural second step in helping both private and public organizations protect, extend, and replace existing data center infrastructure. And spending trends indicate that many enterprises are keen to jump on the public cloud bandwagon....

White Paper: Aligning vRealize Operations with Business Outcomes
by Peter Tymbel Over the past few years, I have been designing, deploying, and customizing vRealize Operations (vROps) Manager for many VMware customers. Working with different clients, I noticed a common theme emerge among various business and IT leaders. Many customers are looking for IT report...

vTechTalk: Disaster Recovery to the Cloud and VMware vCloud Air Network
The VMware vCloud® Air™ Network is a global network of over 4000 service providers in 116 countries. Together, these providers distribute and deploy over 3 million VMs! It’s an unbelievable scale, but what does this mean for users?   It means giving users the cloud solutions they need at the ente...

Understanding Layer 2 Extensions for the Hybrid Cloud
By Trey Tyler, Sr. Solutions Strategist Taking a VLAN and extending that broadcast domain across two sites can be identified by many names including; Data Center Interconnect (DCI), Data Center Extension (DCE), Extended Layer 2 Network, Stretched Layer 2 Network, Stretched VLAN, Extended VLAN, St...

Revera Delivers Self-Served Excellence with vCloud Director®
By Tina Cressia-Thomas, Senior Product Marketing Manager for vCloud Director     When Revera, a New Zealand-based IT Infrastructure and Platform Services company, needed to supply cloud IT services to government agencies they turned to VMware. With the aid of VMware’s vCloud Director cloud manage...

In Top Mobile News: Windows 10 Smartwatches & Android-Supported Laptops
Windows 10 smartwatches come to the enterprise. It’s 1.54 inches, runs Universal Windows Applications, secure and built to “survive a hard day at work,” said Microsoft . The TrekStor IoT Wearable runs on Windows 10 IoT Core, a version of Windows 10 for the Internet of Things. Microsoft will revea...

Silent Mobile Threat: How Apps Steal Your Data
Do your personal mobile apps steal data from you, with or without your consent? On the business side, does this mobile surveillance put your company’s data at risk? Read this insightful guest blog from Appthority Co-Founder and President Domingo Guerra. It seems like a fair trade: Get your favori...

New Video! Simplifying App Access & Management with VMware Workspace ONE
In today’s mobile cloud world, it’s all about the apps. Apps are what help your workforce be productive and successful. Unfortunately, employees do not often use the apps their company provides. Studies have shown that with each extra step required for onboarding a new app, you lose 7% of your us...

Experience High-Performance Graphics with Free NVIDIA GRID & VMware Blast Extreme Test Drive
It can be quite challenging for IT administrators to provide great user experience for high-performance desktops remotely. With VMware Blast Extreme and its new adaptive transport capabilities, we made this possible. With all the excitement a few weeks ago around the announcement of VMware Horizo...

VMworld 2017 Registration Is Open: Here’s What EUC Experts Can Expect
Registration is open for VMworld 2017 . For VMware EUC customers and experts, this is a once-in-a-lifetime experience you won’t want to miss. Experience End-User Computing (EUC) at VMworld Date: Aug. 27-31 Location: Las Vegas | Mandalay Bay Hotel & Convention Center Get connected with EUC subject...

Exclusive AirWatch Experience at VMworld 2017: Your Ticket Awaits!
Registration is open for VMworld 2017 . For VMware AirWatch customers and experts, this is a once-in-a-lifetime experience you won’t want to miss. Experience End-User Computing (EUC) at VMworld Date: Aug. 27-31 Location: Las Vegas | Mandalay Bay Hotel & Convention Center Get connected with EUC su...

Better Together: VMware Workspace ONE & Office 365
Consider this: when it comes to securing enterprise applications, you might not have the whole story. You may have heard that an application-only security framework for Office 365 provides adequate protection. However, unless you secure the entire endpoint, applications face security risks. VMwar...

EXTERNAL NEWS FROM 3RD PARTY BLOGGERS
vSAN and Predictive DRS, Network-Aware DRS and Proactive HA
vSphere 6.5 saw the release of a number of improvements in the areas of DRS. I won’t detail all of the improvements here, since my colleague Brian Graf has done a great job of describing the features in a number of different blog posts. He discussed Network-Aware DRS here , Predictive DRS here an...

Latest Fling from VMware Labs - ESXi Learnswitch
ESXi Learnswitch is a complete implementation of MAC Learning and Filtering and is designed as a wrapper around the host virtual switch. It supports learning multiple source MAC addresses on virtual network interface cards (vNIC) and filters packets from egressing the wrong port based on destinat...

New Technical White Paper - VMware vSAN Network Design
vSAN is a hypervisor-converged, software-defined storage solution for the software-defined data center. It is the first policy-driven storage product designed for VMware vSphere environments that simplifies and streamlines storage provisioning and management. vSAN is a distributed, shared storage...

Where’s the HA enforce VM-Host and Affinity rules option in vSphere 6.5?
Advertise here with BSA Last week on (VMware internal) Socialcast someone asked where the UI option is in vSphere 6.5 that allows you to enable the ability for vSphere HA to respect VM-Host Affinity and VM-VM Anti Affinity rules. In vSphere 6.0 there is an option in the Rules part of the UI as sh...

Norway VMware User Group Meetings – May/June 2017
I’m delighted to report that I’ve been invited to speak at the upcoming Norway VMUG (VMware User Group) meetings. These take place in three different cities over the week of May 29th (week 22), with three meetings in three days. On Tuesday, May 30th, the Oslo VMUG will take place. On May 31st, it...

ESXi Learnswitch – Enhancement to the ESXi MAC Learn DvFilter
The ESXi MAC Learn dvFilter Fling was released a little over two years ago and it has become a must have when it comes to running our ESXi Hypervisor within a VM, also referred to as Nested ESXi. The reason this Fling has become such a popular hit amongst our customers and partners is that […]

Managing & silencing vSAN Health Checks using PowerCLI
One neat capability that was introduced with vSAN 6.6 is the ability to "silence" and disable specific vSAN Health Checks. A recent use for this came up on Duncan's blog where the vMotion health check would fail if you are using a vMotion network stack. As you can imagine, this feature can also c...

Free e-learning course - VMware vSphere: What's New Fundamentals [V6.0 to V6.5]
This course highlights the new features and enhancements in vSphere 6.5. It also presents use cases that describe how the new features align with customer needs. This course begins by discussing VMware vCenter and VMware vSphere administration. To simplify what’s new in vSphere 6.5, we can break ...

DISCLAIMER
While I do my best to publish unbiased information specifically related to VMware solutions there is always the possibility of blog posts that are unrelated, competitive or potentially conflicting that may creep into the newsletter. I apologize for this in advance if I offend anyone and do my best to ensure this does not happen. Please get in touch if you feel any inappropriate material has been published. All information in this newsletter is copyright of the original author. If you are an author and wish to no longer be used in this newsletter please get in touch.

FROM THE EDITORS VIRTUAL DESK
Hi TAM Newsletter readers. There has been a lot going on over the past few weeks with new and updated releases and other items which we have been bringing to our customers attention. This week I want to point you attention to our wonderful TAM Blog and the latest post entitled "VMware Compatibility and Order of Upgrade Best Practices Review". This is a very important topic and as many of our TAM customers are upgrading their infrastructure to the latest or later editions of vSphere now is a great time to consult with your TAM on the path that is best to take for your unique situation. This is a really great blog post and I urge you to take a look at this.

I hope you enjoy all of the news in this weeks newsletter from general VMware updates to our VMUG partners and more.

Have a fantastic week everyone.

Virtually Yours
Neil Isserow | VMware TAM Team
Latest News | Twitter | Facebook | LinkedIn | Blog | Newsletter | Archive
-
TAM BLOG | TAM WEBCASTS |
(Kelly Dare) | (Michelle Kaiser) |

VMUG (Jodi Shely)
Full Webcasts List

NEWS AND DEVELOPMENTS FROM VMWARE
Secure Boot for ESXi 6.5 – Hypervisor Assurance
I’ve talked about how vSphere has been moving towards a “secure by default” stance over the past few years. This can clearly be seen in the new vSphere 6.5 Security Configuration Guide where the number of “hardening” steps are growing smaller with every release. In this blog post we will go over ...

AI – An Important Workload for the New IT
When I meet with customers, I often hear that Artificial Intelligence (AI) is presented as “machines making decisions for businesses or individuals,” but my take is that AI is a tool to help people make better decisions. AI helps us connect the dots across huge data sets and gain insights to solv...

Top 20 vCenter Server articles for April 2017
vmware-dataservice-sca and vsphere-client status change from green to yellow /storage/log directory is full in vCenter Server Appliance 6.0 Purging old data from the database used by vCenter Server Unable to log into the root account of vCenter Server Appliance “Failed to verify the SSL certifica...

Top 20 NSX articles for April 2017
ESXi 5.5 and 6.0 hosts fail with a PSOD: VMCIEventDelayedDispatchCB@com Downloading and enabling VMware vShield Endpoint 5.x on supported VMware vSphere platforms Network ports required to access vCenter Server, ESXi, and ESX hosts vCenter Server certificate validation error for external solution...

Top 20 vSAN articles for April 2017
Update sequence for vSphere 6.5 and its compatible VMware products Component metadata health check fails with invalid state error Powering on virtual machines in VMware vSAN 5.5 fails with error: Failed to create swap file vSAN host may encounter a purple diagnostic screen during performance stat...

Top 20 vRealize Automation articles for April 2017
Update sequence for vSphere 6.5 and its compatible VMware products Update sequence for vSphere 6.0 and its compatible VMware products How to use JXplorer to update the LDAP string for an identity source for vRA 6.0.x, 6.1.x Directory sync in vRA 7.x fails with error ‘Connector Communication faile...

Top 20 vRealize Operations Manager articles for April 2017
Update sequence for vSphere 6.5 and its compatible VMware products Resetting the Administrator password in vRealize Operations Manager 5.x and 6.x Collecting diagnostic information from vRealize Operations Manager 6.x Update sequence for vSphere 6.0 and its compatible VMware products Enabling SSH...

Top 20 Horizon View articles for April 2017
Provisioning or recomposing a linked clone desktop pool fails Restart order of the View environment to clear ADLDS (ADAM) synchronization in Horizon View Removing invalid linked clone entries automatically using the ViewDBChk tool in VMware Horizon View 5.3 and later versions VMware View ports an...

Top 20 vRealize Log Insight articles for April 2017
Update sequence for vSphere 6.5 and its compatible VMware products FAQ: Log Insight for vCenter Server Authentication with Active Directory is slow in VMware vRealize LogInsight 3.0 when users belong to multiple nested groups Log Insight load balancer incompatible with NSX Distributed Firewall Pr...

Top 20 ESXi articles for April 2017
ESXi host fails with PSOD when using Intel Xeon Processor E5 v4, E7 v4, and D-1500 families ESXi host fails with intermittent NMI PSOD on HP ProLiant Gen8 servers Unable to power off the virtual machine in an ESXi host Recreating a missing virtual machine disk descriptor file Permanent Device Los...

New KB articles published for week ending 29th April 2017
VMware App Volumes Excluding files and locations from Writable Volumes Published Date: 2017/04/23 VMware ESXi Hosts fails with a purple diagnostic screen when retrieving flows for ALG enabled protocols Published Date: 2017/04/24 VMware ESXi 5.5 & 6.0 may fail with PSOD when IPFIX is disabled Publ...

‘May the 4th Be with You’ on Your Journey to the Cloud
The public cloud has stepped out of the shadows and stretched across the solar system as organizations scale their usage of it to extend on-premises infrastructure, consolidate or migrate data centers, and support dynamic capacity requirements.   But many organizations also run apps and manage on...

Oracle Database 12c on VMware vSAN — Day 2 Operations and Management
Oracle Database 12c on VMware vSAN — Day 2 Operations and Management Customers deploying production Oracle workloads have stringent requirements to support and maintain critical database operational tasks such as Backup and Recovery, Cloning, Data Refresh for Development/Test environment and Patc...

Partner Spotlight: NTT’s Virtual Infrastructure Makes the Switch to the Public Cloud Even Easier
These days, every company has cloud adoption square in their sights. And frankly, it’s a matter of survival . But making the switch to the public cloud is difficult, weighted by legacy systems and incompatible architecture. Fortunately, virtualization may hold the key to success.   In the latest ...

The NSX Mindset
The NSX Mindset: one’s mental capability to be a determined leader and catalyst for change in the way a company designs, implements, manages, and operates networking and security. Change isn’t easy. Especially when it involves something personal. Unfortunately, though, it happens whether we like ...

Dogfooding the Cloud: How VMware Used vCloud Director to Consolidate Internal IT
By Tina Cressia-Thomas   In Silicon Valley, it’s common to hear of companies, “dogfooding” their product – using their own product internally – to quickly iterate and develop a better user experience before releasing to customers. There’s plenty of famous examples ; however, it’s not every day yo...

Apple Takes the Wearables Lead, Decoding Win10 S, Internet 4.0 & More Top Mobile News
Sorry, Fitbit, there’s a new sheriff in town. With nearly 60% growth in shipments in Q1 this year, Apple Watch officially became the king of the consumer wearables castle, according to CNBC . Fitbit, which was the long-time market leader, dropped to second after a 35% decline in Q1. Get the mobil...

Top EUC News: Password Misery, Windows 10 S & Dell EMC World, Oh My!
Here’s the first edition of our new series, top end-user computing (EUC) news! Sign up at the top of this page to get the weekly newsletter in your inbox every Friday. The password is … We released the results of a new VMware survey this week that revealed companies’ top 10 identity and access ma...

3 Ways Industry 4.0 & Wearables Revolutionize Supply Chains Today
At ProMat 2017, the largest material handling, logistics and supply chain show and conference in North and South America, “Industry 4.0” was THE hot topic. But what exactly is Industry 4.0 and how will it revolutionize supply chains? According to Markus Lorenz , partner and managing director at B...

Building Great Technology Starts with Building a Great Team, Part 1
Follow the VMware UX Series. Here at VMware AirWatch , we work hard to create a progressive culture that promotes cross-functional collaboration and fosters a strong drive to execute effectively. Last year, Tony Keuh saw an opportunity for our engineering, user experience (UX) and marketing teams...

Decoding Windows 10 S & How to Make It a Success in Your Organization
There’s little doubt that Windows 10 adoption is on a roll— 400+ million devices and 54% of global organizations are running Microsoft’s latest operating system (OS). It’s only about a month since the third major upgrade ( Creators Update /v1703) was launched, and Microsoft is continuing to ride ...

10 Reasons Why Enabling More than Secure Email for Mobile Workers Is So Hard
Get the 10 reasons in this free eBook. Securely enabling more than email for mobile workers is hard. You know it. We know it. The question thus far is why it’s so hard. IT gives workers the secure work apps they need to securely work from anywhere. Yet for reasons mostly unknown, workers do not a...

New Research: Top 10 Identity and Access Management Challenges
As organizations undergo digital transformation, they experience challenges along the way. This is due to the fact that this transformation often requires them to update and/or replace legacy solutions. They also have to implement new ways of securing access from the plethora of devices out there...

Azure AD Join with VMware Workspace ONE
Secure, timely support for remote Windows users can be tricky. Imagine your top remote sales rep breaks her laptop before an onsite meeting with a vital client. Does she have time to wait for IT to grab a new laptop, Domain Join it for secure access to corporate resources and then ship it out? Ev...

VMware AirWatch – NSX Integration
Integrate VMware AirWatch Enterprise Mobility Management with VMware NSX Network Virtualization and Security Platform to extend security policies from the data center to mobile application endpoints. VMware AirWatch – NSX Integration brings speed and simplicity to networking and micro-segmentatio...
May 1, 2017 3:00:24 PM

EXTERNAL NEWS FROM 3RD PARTY BLOGGERS
Virtually Speaking Podcast: VMW Cloud on AWS
Advertise here with BSA I was on vacation the past two weeks, yesterday I got a message from Frank Denneman and Pete Flecha if I had some time available. I was working in my backyard so dropped my tools and hopped on. Apparently John was sick, so I took his spot and here’s the result. Interesting...

x509 error logging into harbor registry via VIC VCH
In my last post, I showed some of the new command line functionality associated with deploying out a new Virtual Container Host (VCH) with vSphere Integrated Containers (VIC) . I also highlighted how VIC now includes both Admiral for container orchestration via templates and the harbor registry i...

VMware PowerCLI 6.5.1 Installation Walkthrough
VMware PowerCLI 6.5.1 introduces a new installation method to users. This new method pulls directly from the PowerShell Gallery

Correlating vSAN perf metrics from vSphere Web Client to both PowerCLI & vSAN Mgmt API
While going through the PowerCLI 6.5.1 release notes last week, in addition to the new Get-VsanView cmdlet which exposes the complete vSAN Management API through PowerCLI, I had learned that we had also released a new Get-VsanStat cmdlet. This new cmdlet allows customers to easily retrieve the va...

vSAN 6.6: Manual vs Automatic Disk Claim Mode
Advertise here with BSA I received this question on Manual vs Automatic disk claim mode in vSAN 6.6. Someone upgraded a cluster from 6.2 to 6.6 and wanted to add a second cluster. They noticed that during the creation of the new cluster there was no option to select “automatic vs manual”. I think...

VMware Validated Design (VVD) & VMware Cloud Foundation (VCF) Quick References
The other day, I had a customer ask about the latest version of the Ports and Protocols document that was put together by the VMware Validated Design (VVD) team which does a fantastic job of outlining all the connectivity between the products used within the VVD SDDC. It actually took me awhile t...

Getting started with VIC v1.1
VMware recently release vSphere Integrated Containers v1.1. I got an opportunity recently to give it a whirl. While I’ve done quite a bit of work with VIC in the past , a number of things have changed, especially in the command line. What I’ve decided to do in the post is highlight some of the ne...

vSAN Deep Dive
This session covers basic to advance vSAN topic. Watch this video if you to learn basics and few of the advance areas of vSAN.

Welcoming PowerCLI to the PowerShell Gallery
While I’ve always enjoyed using VMware’s PowerCLI module for PowerShell, it has been a bit annoying having to navigate to the official VMware site, log in, download the bits, agree to terms, and do a thick installation on every workstation or server that needs the code. Which is why I’m quite hap...

Dell EMC World 2017–here we come!
We are 6 days away from getting together at #DellEMCWorld 2017 with 12,000+ of our closest friends, customers, and partners.   I love that I can say “don’t just listen to me, here’s what attendees say” (click on the below for a LOT more)! So what should you expect?   Product announcements, 3 gene...

Can I front vSAN with a VAIO Caching Solution?
Advertise here with BSA I had this question a couple of times already, so I figured I would write a quick post. In short: yes you can put a VAIO Filter in front of vSAN. The question really is, which one would you like to use and why? First of all, the VAIO Filter needs to be certified to be plac...

DISCLAIMER
While I do my best to publish unbiased information specifically related to VMware solutions there is always the possibility of blog posts that are unrelated, competitive or potentially conflicting that may creep into the newsletter. I apologize for this in advance if I offend anyone and do my best to ensure this does not happen. Please get in touch if you feel any inappropriate material has been published. All information in this newsletter is copyright of the original author. If you are an author and wish to no longer be used in this newsletter please get in touch.

This guide provides a step-by-step process to configure Workspace ONE to authenticate via SAML Just-in-Time Provisioning with a Google Directory.

User provisioning is done just-in-time during user authentication.

The end-result will have a user (that doesn't initially exist in VMware Identity Manager Users list) get provisioned in the VMware Identity Manager tenant:

1. User either: (a) navigates to WS1 tenant via URL, or (2) downloads WS1 App and enters Tenant URL.
2. The app presents Google’s SAML Authentication screen (note user should not see VMware Identity Manager signin screen). User enters username password.
3. Upon successful login, user is presented with Catalog.
4. User gets provisioned in VMware Identity Manager Directory.

Configuration Steps

The attached PDF includes screenshots to assist the configuration steps.

1. Collect required information from VMware Identity Manager tenant

   1. Save User Attributes values that need to be pulled in, such as: userName, firstName, lastName, email.
   2. Under Catalog > Settings > SAML Metadata, click on “Service Provider (SP) metadata.” Save the following data from the XML:
      1. ACS URL: Find this value under Location=”ACSURL” next to AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
      2. Entity ID: Find this value in the first line, under EntityID=”EntityID”

2. Create a SAML App in the Google Admin Console

   1. Login to admin.google.com, go to Apps > SAML apps > Enable SSO for a SAML Application.
   2. Click Setup my Own Custom App.
   3. Under Option 2, click Download IDP Metadata
   4. Enter an Application Name and Description (optional)
   5. Enter Service Provider details:
      1. ACS URL and Entity ID from Step 1.
      2. NameID = Primary Email, NameIDFormat = Email
   6. Edit the Attribute Mapping to pull in certain user values, such as firstName, lastName, email, etc.
      1. Make sure these values match the User Attributes in VMware Identity tenant under Identity & Access Management > Setup > User Attributes.
      2. Required field is: userName
   7. Ensure the SAML Application is ON for your set of users.

3. Follow the steps in VMware Identity Manager Administration Guide > Just-in-Time User Provisioning > Configuring Just-in-Time User Provisioning.

   1. Create a Third-Party IdP under Identity & Access Management > Identity Providers.
   2. Copy the IDP Metadata that was downloaded from the Google Admin Console in Step 2, and Paste it under SAML Metadata.
   3. Click Process IdP Metadata.
   4. Set NameIDFormat as urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified, set NameIDValue as username
   5. Set NameIDPolicy as urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
   6. Enable the Just-in-Time User Provisioning. Enter Domain from the GSuite Application.
   7. Give the Authentication Methods a identifyable name, then set SAML Context as urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified
   8. Save

4. Configure the Policies to use the Authentication Method from the IdP that was created in Step 3

Once complete, a user that does not exist in VMware Identity Manager Directory should be able to authenticate through WorkspaceONE login, and get provisioned into the VMware Identity Manager Directory.

vSphere Integrated Containers (VIC) 1.1 がリリースされました。

VMware vSphere Integrated Containers 1.1 Release Notes

VIC 1.1 では、1.0 とはソフトウェアの提供形式が変更され、

これまでバラバラだった下記 3コンポーネントが

1つの仮想アプライアンス（vSphere Integrated Containers Appliance）にまとめられました。

• VMware vSphere Integrated Containers Engine 1.1
• VMware vSphere Integrated Containers Registry 1.1 (harbor)
• VMware vSphere Integrated Containers Management Portal 1.1 (admiral)

ということで、VIC Appliance を vCenter にデプロイしてみました。

仮想アプライアンスの ova ファイルは、MyVMware からダウンロードします。

Download VMware vSphere Integrated Containers 1.1.0

https://my.vmware.com/en/web/vmware/details?downloadGroup=VIC110&productId=614

マニュアルは、下記のあたりです。

Deploy the Appliance · VMware vSphere Integrated Containers 1.1 Documentation

VIC Appliance のデプロイ。

今回は、vCenter Server Appliance 6.5 d にデプロイしています。

vSphere Web Client でデプロイ先のクラスタを右クリックして「OVF テンプレートのデプロイ」。

ダウンロードした .ova ファイルを選択します。

今回は、vic-v1.1.0-bf760ea2.ova というファイルを使用しています。

デプロイする仮想アプライアンスにつける名前を入力します。
vCenter インベントリでのデプロイ場所も指定します。

※今回は「lab」という仮想マシン フォルダを指定しています。

デプロイ先のリソースを選択します。

※今回は「vsan-cluster-01」という名前の DRS 有効クラスタを指定しています。

仮想アプライアンスの情報です。シン プロビジョニングであれば、5GB 弱です。

使用許諾契約書です。

データストアを選択します。

デフォルトでは「シック プロビジョニング (Lazy Zeroed)」ですが、今回は「シン プロビジョニング」にします。

「vsanDatastore-01」というデータストアを選択しています。

ちなみに、VIC で Docker コンテナを起動するときに Docker Volume で vSAN を利用できますが、
それは VIC Appliance を vSAN に配置することとは特に関係しません。

ポートグループを選択します。

VIC で作成する Virtual Container Host (VCH) では vDS の分散ポートグループが必要になりますが、

VIC Appliance は vSS の標準ポートグループでもデプロイできます。

Appliance Security で、VIC Appliance の Root Password 入力します。

Networking Properties で IP アドレスなどのネットワーク設定を入力します。

「2.6. FQDN」はあとで Web UI での Registry / 管理ポータル のリンクとして使用されるので、

実際に DNS / hosts ファイルなどで名前解決できるものを入力するとよいと思います。

Registry Configuration で、Registry の admin パスワードと DB のパスワードを入力します。

※パスワード以外の項目はデフォルトのままでもデプロイ可能です。

スクリーンショットで見えない項目としては、
Registry の Garbage Collection の有効/無効、SSL Cert / SSL Cert Key を指定できます。

Management Portal Configuration は、今回はデフォルトのままにします。

Fileserver Configuration も、今回はデフォルトのままにします。

最後に、これまでの設定値を確認します。

VIC Appliance のデプロイが完了したら、手動で VM を起動します。

VIC Appliance が起動されました。

VIC Appliance へのアクセス。

Web ブラウザから HTTPS で、アプライアンスの TCP 9443 番ポートにアクセスすると、

VIC のコマンドラインツールと Web Client Plug-in のファイルがダウンロードできます。

※この環境では、すでに VIC Appliance デプロイ時に指定した FQDN を名前解決できるようにしてあります。

これは、Linux などから curl コマンドなどでダウンロードすることも可能です。

ためしに適当な Linux からダウンロードしてみました。

[gowatana@client01 ~]$ cat /etc/oracle-release

Oracle Linux Server release 7.3

[gowatana@client01 ~]$ mkdir work

[gowatana@client01 ~]$ cd work/

curl で Web ブラウザ同様 9443 番ポートにアクセスしてみると、
目視でも簡単にわかるシンプルな応答が返ってきます。

[gowatana@client01 work]$ curl -k https://vic01.go-lab.jp:9443/

<pre>

<a href="com.vmware.vic-v1.1.0.zip">com.vmware.vic-v1.1.0.zip</a>

<a href="com.vmware.vic.ui-v1.1.0.zip">com.vmware.vic.ui-v1.1.0.zip</a>

<a href="vic_1.1.0.tar.gz">vic_1.1.0.tar.gz</a>

</pre>

curl で vic のコマンドラインツールをダウンロードしてみます。

[gowatana@client01 work]$ curl -ks https://vic01.go-lab.jp:9443/vic_1.1.0.tar.gz -o vic_1.1.0.tar.gz

[gowatana@client01 work]$ tar zxf vic_1.1.0.tar.gz

[gowatana@client01 work]$ ls vic/

LICENSE  appliance.iso  ui                  vic-machine-linux        vic-ui-darwin  vic-ui-windows.exe

README   bootstrap.iso  vic-machine-darwin  vic-machine-windows.exe  vic-ui-linux

このように、VIC 1.0 ではバラバラに提供されていた vic-machine コマンドも VIC Appliance に同梱されています。

[gowatana@client01 work]$ cd vic/

[gowatana@client01 vic]$ ./vic-machine-linux help

NAME:

   vic-machine-linux - Create and manage Virtual Container Hosts

USAGE:

   vic-machine-linux [global options] command [command options] [arguments...]

VERSION:

   v1.1.0-9852-e974a51

COMMANDS:

     create   Deploy VCH

     delete   Delete VCH and associated resources

     ls       List VCHs

     inspect  Inspect VCH

     upgrade  Upgrade VCH to latest version

     version  Show VIC version information

     debug    Debug VCH

     update   Modify configuration

     help, h  Shows a list of commands or help for one command

 

GLOBAL OPTIONS:

   --help, -h     show help

   --version, -v  print the version

HTTPS で TCP 443 番ポートにアクセスすると、Registry (Harbor) の画面が表示されます。

この Web UI には、admin / デプロイ時に指定したパスワード でログインできます。

※ 443 番ポートの指定は、Web ブラウザの都合上表示されていません。

HTTPS で TCP 8282 番ポートにアクセスすると、VIC Management Portal (Admiral) の画面が表示されます。
なんと、トップページは日本語です。

バージョンは 「.1」 上がっただけですが、製品っぽい形になってきたなと思いました。

そして、この後の VCH 作成～ Docker コンテナ起動はこんな感じです。

vSphere Integrated Containers (VIC) 1.0 をためしてみる。

以上、VIC 1.1 の VIC Appliance をデプロイしてみる話でした。

In my case we have 1 VC (windows based) with 2 PSC (appliances) we got these error suddenly

Cannot synchronize host (host name) License not available to perform the operation.

Cannot complete the license assignment operation cannot assign a license to "Host" XXX Make sure the License Service is available

Investigation:- I found there was issue in time between PSC and VC

Solution:- Correct the time on PSC and restart vpxd , issue got resolved.

This article was originally posted on my personal blog IT Should Just Work back in 2014. In light of the recent WannaCry ransomeware outbreak, a script to find these old operating systems seems particularly relevant.

Some PowerShell/ PowerCLI to find all the VMs in an ESX environment which are powered on and running Windows XP or Server 2003.

In my VMware ESX environment I have (had) a number of virtual machines still running Windows XP or Server 2003- usually performing very specific tasks or allowing access to legacy applications, but still part of the production environment. With the (not so) recent End of Support for Windows XP and the upcoming one next year for Server 2003 I need to look at each of these VMs and see if they can be upgraded or decommissioned. Listing these in the GUI is fiddly at best- I want VMs with one of these two OSes, from any datacentre and I only care about VMs which are powered on. So, PowerCLI to the rescue:

get-vm |
where{$_.PowerState -eq"PoweredOn"-and($_.Guest -like"*Windows XP*"-or$_.Guest -like"*Server 2003*")}|
get-VMGuest |
select VmName, OSFullName

Sample Output:

VmName         OSFullName
------         ----------
MyServer1      Microsoft Windows Server 2003 Standard (32-bit)
MyServer2      Microsoft Windows Server 2003 Standard (32-bit)
MyServer3      Microsoft Windows Server 2003 Standard (32-bit)
MyXPVM1        Microsoft Windows XP Professional (32-bit)
MyXPVM2        Microsoft Windows XP Professional (32-bit)

Not the most complicated piece of scripting, but it’s answered my question and I can refer back to it as upgrades continue to see what systems remain.

A place where I blog things I've found, built in the homelab, seen at a VMUG and so on...

VirtualMachinery

This is the place where I blog https://andynashers.wordpress.com/

And my most popular post is on the Stanley VCP which I originally posted in January 2016 https://andynashers.wordpress.com/2016/01/14/is-this-the-cheepest-vcp-course-available/

They now have a VCP 6 install and config course and an optimise and scale course which I hope to take in the
future and will update my blog.

VIC では、ESXi から Virtural Container Host (VCH) に対して ESXi Firewall のルール設定が必要です。

Environment Prerequisites for VCH Deployment · VMware vSphere Integrated Containers 1.1 Documentation

VIC 1.0 のときは下記のような感じで、悩ましい設定をしていました。

vSphere Integrated Containers (VIC) 1.0 むけの ESXi Firewall Rule 設定。

VIC 1.1 では、VIC で必要となる ESXi Firewall ルールの解放設定も、

vic-machine コマンドで実行できるようになっています。

それでは、ESXi Firewall を開放してみます。

VIC 1.1 の vic-machine-linux コマンドを使用してみます。

[gowatana@client01 vic]$ ./vic-machine-linux version

vic-machine-linux version v1.1.0-9852-e974a51

今回は、「vc-sv02.go-lab.jp」という vCenter の「cluster-01」クラスタにある ESXi の Firewall ルール設定を変更します。

vic-machine では、vCenter の thumbprint の指定をしないと下記のようなエラーになります。

[gowatana@client01 vic]$ ./vic-machine-linux update firewall --target vc-sv02.go-lab.jp --user gowatana --allow --compute-resource cluster-01

May 16 2017 08:58:11.738+09:00 INFO  vSphere password for gowatana:

May 16 2017 08:58:15.814+09:00 INFO  ### Updating Firewall ####

May 16 2017 08:58:15.857+09:00 ERROR Failed to verify certificate for target=vc-sv02.go-lab.jp (thumbprint=70:45:F3:C7:～省略)

May 16 2017 08:58:15.858+09:00 ERROR Update cannot continue - failed to create validator: x509: certificate signed by unknown authority

May 16 2017 08:58:15.858+09:00 ERROR --------------------

May 16 2017 08:58:15.858+09:00 ERROR vic-machine-linux update firewall failed: update firewall failed

thumbprint の指定をしつつ、ESXi Firewall を通信許可（allow）に設定します。
指定したクラスタに含まれるホスト 3台の設定が変更されました。

[gowatana@client01 vic]$ ./vic-machine-linux update firewall --target vc-sv02.go-lab.jp --user gowatana --allow --compute-resource cluster-01 --thumbprint 70:45:F3:C7:～省略

May 16 2017 08:58:44.670+09:00 INFO  vSphere password for gowatana: ★パスワードを入力

May 16 2017 08:58:47.196+09:00 INFO  ### Updating Firewall ####

May 16 2017 08:58:47.328+09:00 INFO  Validating target

May 16 2017 08:58:47.328+09:00 INFO  Validating compute resource

May 16 2017 08:58:47.343+09:00 INFO

May 16 2017 08:58:47.343+09:00 WARN  ### WARNING ###

May 16 2017 08:58:47.343+09:00 WARN     This command modifies the host firewall on the target machine or cluster

May 16 2017 08:58:47.343+09:00 WARN     The ruleset "vSPC" will be enabled

May 16 2017 08:58:47.343+09:00 WARN     This allows all outbound TCP traffic from the target

May 16 2017 08:58:47.343+09:00 WARN     To undo this modification use --deny

May 16 2017 08:58:47.343+09:00 INFO

May 16 2017 08:58:47.420+09:00 INFO  Ruleset "vSPC" enabled on host "HostSystem:host-29 @ /dc02/host/cluster-01/hv-n11.go-lab.jp"

May 16 2017 08:58:47.491+09:00 INFO  Ruleset "vSPC" enabled on host "HostSystem:host-32 @ /dc02/host/cluster-01/hv-n12.go-lab.jp"

May 16 2017 08:58:47.556+09:00 INFO  Ruleset "vSPC" enabled on host "HostSystem:host-34 @ /dc02/host/cluster-01/hv-n13.go-lab.jp"

May 16 2017 08:58:47.556+09:00 INFO

May 16 2017 08:58:47.556+09:00 INFO  Firewall changes complete

May 16 2017 08:58:47.556+09:00 INFO  Command completed successfully

[gowatana@client01 vic]$

ESXi のもともとの発信接続（outbound) のルールはこうなっていましたが・・・

設定変更により vSPC のルールセットが解放されました。

Firewall 設定後に Virtual Container Host (VCH) の作成をしてみると

ESXi Firewall の設定確認が OK になります。

※名前解決の都合上、vCenter はこちらでは IP アドレス（192.168.1.96）で指定しています。

[gowatana@client01 vic]$ ./vic-machine-linux create \

> --target 192.168.1.96 \

> --user gowatana \

> --compute-resource cluster-01 \

> --name vch02 \

> --public-network pg-vds02-0000 --bridge-network vic-bridge-02 \

> --image-store ds_nfs_219 \

> --no-tlsverify --force

May 17 2017 01:37:33.510+09:00 INFO  ### Installing VCH ####

May 17 2017 01:37:33.510+09:00 INFO  vSphere password for gowatana:

May 17 2017 01:37:36.594+09:00 WARN  Using administrative user for VCH operation - use --ops-user to improve security (see -x for advanced help)

May 17 2017 01:37:36.594+09:00 INFO  Generating self-signed certificate/key pair - private key in vch02/server-key.pem

May 17 2017 01:37:36.917+09:00 WARN  Configuring without TLS verify - certificate-based authentication disabled

May 17 2017 01:37:37.049+09:00 INFO  Validating supplied configuration

May 17 2017 01:37:37.154+09:00 INFO  vDS configuration OK on "vic-bridge-02"

May 17 2017 01:37:37.183+09:00 INFO  Firewall status: ENABLED on "/dc02/host/cluster-01/hv-n11.go-lab.jp"

May 17 2017 01:37:37.211+09:00 INFO  Firewall status: ENABLED on "/dc02/host/cluster-01/hv-n12.go-lab.jp"

May 17 2017 01:37:37.236+09:00 INFO  Firewall status: ENABLED on "/dc02/host/cluster-01/hv-n13.go-lab.jp"

May 17 2017 01:37:37.242+09:00 INFO  Firewall configuration OK on hosts:

May 17 2017 01:37:37.242+09:00 INFO     "/dc02/host/cluster-01/hv-n11.go-lab.jp"

May 17 2017 01:37:37.242+09:00 INFO     "/dc02/host/cluster-01/hv-n12.go-lab.jp"

May 17 2017 01:37:37.242+09:00 INFO     "/dc02/host/cluster-01/hv-n13.go-lab.jp"

May 17 2017 01:37:37.354+09:00 INFO  License check OK on hosts:

May 17 2017 01:37:37.354+09:00 INFO    "/dc02/host/cluster-01/hv-n11.go-lab.jp"

May 17 2017 01:37:37.354+09:00 INFO    "/dc02/host/cluster-01/hv-n12.go-lab.jp"

May 17 2017 01:37:37.354+09:00 INFO    "/dc02/host/cluster-01/hv-n13.go-lab.jp"

May 17 2017 01:37:37.357+09:00 INFO  DRS check OK on:

May 17 2017 01:37:37.357+09:00 INFO    "/dc02/host/cluster-01"

May 17 2017 01:37:37.378+09:00 INFO

May 17 2017 01:37:38.444+09:00 INFO  Creating virtual app "vch02"

May 17 2017 01:37:38.469+09:00 INFO  Creating appliance on target

May 17 2017 01:37:38.487+09:00 INFO  Network role "public" is sharing NIC with "management"

May 17 2017 01:37:38.487+09:00 INFO  Network role "client" is sharing NIC with "management"

May 17 2017 01:37:41.062+09:00 INFO  Uploading images for container

May 17 2017 01:37:41.062+09:00 INFO     "bootstrap.iso"

May 17 2017 01:37:41.062+09:00 INFO     "appliance.iso"

May 17 2017 01:37:49.197+09:00 INFO  Waiting for IP information

May 17 2017 01:38:07.152+09:00 INFO  Waiting for major appliance components to launch

May 17 2017 01:38:07.204+09:00 INFO  Obtained IP address for client interface: "192.168.1.2"

May 17 2017 01:38:07.204+09:00 INFO  Checking VCH connectivity with vSphere target

May 17 2017 01:38:07.315+09:00 INFO  vSphere API Test: https://192.168.1.96 vSphere API target responds as expected

May 17 2017 01:38:37.345+09:00 INFO  Initialization of appliance successful

May 17 2017 01:38:37.345+09:00 INFO

May 17 2017 01:38:37.345+09:00 INFO  VCH Admin Portal:

May 17 2017 01:38:37.345+09:00 INFO  https://192.168.1.2:2378

May 17 2017 01:38:37.345+09:00 INFO

May 17 2017 01:38:37.345+09:00 INFO  Published ports can be reached at:

May 17 2017 01:38:37.345+09:00 INFO  192.168.1.2

May 17 2017 01:38:37.345+09:00 INFO

May 17 2017 01:38:37.345+09:00 INFO  Docker environment variables:

May 17 2017 01:38:37.345+09:00 INFO  DOCKER_HOST=192.168.1.2:2376

May 17 2017 01:38:37.346+09:00 INFO

May 17 2017 01:38:37.346+09:00 INFO  Environment saved in vch02/vch02.env

May 17 2017 01:38:37.346+09:00 INFO

May 17 2017 01:38:37.346+09:00 INFO  Connect to docker:

May 17 2017 01:38:37.346+09:00 INFO  docker -H 192.168.1.2:2376 --tls info

May 17 2017 01:38:37.346+09:00 INFO  Installer completed successfully

[gowatana@client01 vic]$

VIC については、こちらもどうぞ。

vSphere Integrated Containers (VIC) 1.0 をためしてみる。

vSphere Integrated Containers (VIC) 1.1 の VIC Appliance デプロイの様子。

以上、VIC 1.1 で改善された ESXi Firewall 設定方法の様子についてでした。

Another time we are hearing about a worldwide attack using a ransomware to stole money (bitcoins) and create services unavailability or data losses. One question in many company is asked to IT department :- Are we protect against this attack?-

It’s know that this attack, like the major part of the attacks, is permitted due a security bugs in Windows systems. For this reason, last month, Microsoft made available a patch to avoid this attack. But how many people already have updated their system?

You know, sometimes is difficult for many IT department to find the right time to apply updates and patches, because in 99% of cases it requires a reboot, with consequent unavailability or dependency problems. Answering the question for protection, if you’re in a VMware farm with many windows VMs in a domain controller, you could take the advantage of the powercli to getting the state of windows update for every window VM.

A note from Microsoft is released with its KBID: https://support.microsoft.com/en-us/help/4013389/title

Requirements

• an vCenter account with enough privileges to execute a script using Invoke-VM script
• an active directory administrator account (or with enough privileges) to execute Get-HotFix command
• powercli (of course!)

The Script

Here the example:

For newbie in powercli, before launching the script you must connect to vCenter using the cmdlet Connect-VIServer. Hope this could be useful!

I got these logs

2017-05-17T18:21:13.052Z warning vpxd[7FC535D487A0] [Originator@6876 sub=VpxProfiler] Init [Vpx::Common::Sso::SsoFactory_CreateFacade(sslContext, ssoFacadeConstPtr)] took 117827 ms

2017-05-17T18:21:13.052Z error vpxd[7FC535D487A0] [Originator@6876 sub=Main] [Init] Init failed: Vpx::Common::Sso::SsoFactory_CreateFacade(sslContext, ssoFacadeConstPtr)

--> Backtrace:

-->

--> [backtrace begin] product: VMware VirtualCenter, version: 6.0.0, build: build-4541948, tag: vpxd

--> backtrace[00] libvmacore.so[0x003C6994]: Vmacore::System::Stacktrace::CaptureWork(unsigned int)

--> backtrace[01] libvmacore.so[0x001F0883]: Vmacore::System::SystemFactoryImpl::CreateQuickBacktrace(Vmacore::Ref<Vmacore::System::Backtrace>&)

--> backtrace[02] libvmacore.so[0x0019A7DD]: Vmacore::Throwable::Throwable(std::string const&)

--> backtrace[03] vpxd[0x00BCC43E]: Vmomi::Fault::SystemError::Exception::Exception(std::string const&)

--> backtrace[04] vpxd[0x00BC9EBA]

--> backtrace[05] vpxd[0x00BB6180]

--> backtrace[06] vpxd[0x00AF44E9]

--> backtrace[07] libc.so.6[0x0001EC36]

--> backtrace[08] vpxd[0x00AF3F3D]

--> [backtrace end]

-->

When I checked VCenter server was not communicating with external psc. Some removed nic from PSC , added back nic and issue resolved.

what is Virtualization?

I would say virtualization as "Making something software defined  rather than physical with same features"

As per many Articles it's the creation of a virtual that is software like files -- rather than actual -- version of something, such as an operating system, a server, a storage device or network resources

=========================

What is VMware ESXI?

ESXI Stand for Elastic Sky X Integrated

VMware ESXi is a hypervisor which is the foundation of virtual infrastructure. Kind of OS which we install on bare-metal hardware. It abstracts the hardware to create a virtual infra and to consolidate and run multiple VM's on a single Computer . Hypervisor provides physical hardware resources dynamically to virtual machines as needed to support the operation of the virtual machines.

The hypervisor enables virtual machines to operate with a degree of independence from the underlying physical hardware.

For example, a virtual machine can be moved from one physical host to another.

Also, its virtual disks can be moved from one type of storage to another without affecting the functioning of the virtual machine

=========================

What are the Components of ESXi?

Footprint of ESXi is only of Size 32 MB

The VMware ESXi architecture comprises the underlying operating system, called VMkernel, and processes that run on top of it. VMkernel provides means for running all processes on the system, including management applications and agents as well as virtual machines. It has control of all hardware devices on the server and manages resources for the applications.

The main processes that run on top of VMkernel are:

• Direct Console User Interface (DCUI) — the low-level configuration and management interface, accessible through the console of the server, used primarily for initial basic configuration.

• The virtual machine monitor, which is the process that provides the execution environment for a virtual machine, as well as a helper process is known as VMX. Each running virtual machine has its own VMM and VMX process.

Virtual Machine Executable (VMX) process - A process that runs in the VMkernel that is responsible for handling I/O to devices that are not critical to performance. The VMX is also responsible for communicating with user interfaces, snapshot managers, and remote console.

Virtual Machine Monitor (VMM) process - A process that runs in the VMkernel that is responsible for virtualizing the guest OS instructions, and manages memory. The VMM passes storage and network I/O requests to the VMkernel and passes all other requests to the VMX process. There is a VMM for each virtual CPU assigned to a virtual machine.

• Various agents (hostd , vpxa, syslog etc) used to enable high-level VMware Infrastructure management from remote applications.

• The Common Information Model (CIM) system: CIM is the interface that enables hardware-level management from remote applications via a set of standard APIs.

Vmkernel :

Vmkernel is derived from Linux but it's not actually Linux

VMkernel is a Portable Operating System Interface like OS developed by VMware and provides certain functionality similar to that found in other operating systems, such as process creation and control, signals, file system, and process threads. It is designed specifically to support running multiple virtual machines and provides such core functionality as:

• Resource scheduling

• I/O stacks

• Device drivers

=========================

How is ESXI System Image Design Portioned?

• A 4MB bootloader partition, which runs upon system boot up.

• A 48MB boot bank, which contains the 32MB core hypervisor code, along with a second alternate boot bank of the same size. The reason for two boot banks is explained below.

• A 540MB store partition, which holds various utilities, such as the VI Client and VMware Tools images.

• A 110MB core dump partition, which is normally empty but which can hold diagnostic information in case of a system problem.

The ESXi system has two independent banks of memory, each of which stores a full system image, as a fail-safe for applying updates. When you upgrade the system, the new version is loaded into the inactive bank of memory, and the system is set to use the updated bank when it reboots. If any problem is detected during the boot process, the system automatically boots from the previously used bank of memory. You can also intervene manually at boot time to choose which image to use for that boot, so you can back out of an update if necessary.

At any given time, there are typically two versions of VI Client and two versions of VMware Tools in the store partition, corresponding to the hypervisor versions in the two boot banks. The specific version to use is determined by which boot bank is currently active.

The core hypervisor code also can contain custom code provided by server vendors (OEMs) that provide additional functionality, such as hardware monitoring and support information. These customizations would be present, for example, if ESXi had been obtained in embedded form from the server manufacturer or if a custom version of ESXi was installed onto the hard drive. Any update to an existing ESXi installation automatically incorporates the proper update to this custom code.

=========================

How ESXi Boots up?

ESXi base image essentially is a compressed file. When booting ESXi image, that compressed file is uncompressed into RAM

When the system boots for the first time, the VMkernel discovers devices and selects appropriate drivers for them. It also discovers local disk drives and if the disks are empty, then it formats them so they can be used to store virtual machines.

During this initial boot, the VMkernel automatically creates the configuration files using reasonable default values (for example, using DHCP to obtain network identity information).In the embedded version of ESXi, the configuration is stored in a specific part of the memory module that is both readable and writable. On subsequent reboots, the system reads the configuration from this persistent memory. In the rest of the boot process, the system is initialized and the resident file system is built in memory. The hardware drivers are loaded, the various agents are started, and finally the DCUI process is started.

=========================

Advantages and Security in Brief:

The ESXi architecture offers a variety of advantages over other virtualization platforms, including::

• Little state information — An ESXi system can be treated for practical purposes as a stateless compute node, with all the state information easily uploaded from a saved configuration file.

• Better security — With a small footprint and minimal interfaces, an ESXi system has a lower overall attack surface.

• Hardware-like reliability — When it is integrated into the firmware, software is much less likely to become corrupted than when it is stored on disk. The option of eliminating the local disk drive can provide even greater system reliability.

ESXi provides additional protection with the following features:

• Memory hardening: The ESXi kernel, user-mode applications, and executable components such

as drivers and libraries are located at random, no predictable memory addresses.

• Kernel module integrity: Digital signing ensures the integrity and authenticity of modules,

drivers, and applications as they are loaded by the VMkernel.

• Trusted Platform Module (TPM): A hardware element that creates a trusted platform. This

element affirms that the boot process and all drivers loaded are genuine.

=========================

Please do share your Thoughts about this Post . Thank-you for reading

Happy Learning

Coming to CloudCredibility.com starting Monday, May 29 through the Virtual Event, Thursday, June 8:

The VMUG Virtual Event & CloudCred Competition

Score the new VMUG 6.0 badge & be entered to WIN!

~ One Amazon Echo ~

~ Two Echo Dots ~

Check in at CloudCredibility.comMonday, May 29 for the pre-event tasks to get started.

Then, take advantage of the VMUG 6.0 Virtual Event on Thursday, June 8,

And play to WIN at CloudCred!

PowerCLI で vCenter / ESXi に接続する Connect-VIServer は以前に接続したサーバを記録していて、

「-Menu」オプションで過去に接続したサーバを表示、選択して接続することができます。

PowerCLI> Connect-VIServer -Menu

下記のような感じになります。

このサーバリストは、PowerShell からみて下記のパスにあります。

$HOME\AppData\Roaming\VMware\PowerCLI\RecentServerList.xml

XML ファイルを見てみると、下記のような感じになっています。

Server ごとに指定されている Position の数字が、-Menu での表示順です。
すでに表示されない（おそらく 10件をこえたもの）は、Position 属性が削除されています。

<ServerList>

  <CurrentMonth>May</CurrentMonth>

  <Server Name="vc60n01.godc.lab" January="0" February="0" March="0" April="0" May="0" June="8" July="3" August="0" September="0" October="0" November="0" December="0" Position="1" />

  <Server Name="vc55n01.godc.lab" January="0" February="0" March="0" April="0" May="0" June="0" July="0" August="0" September="0" October="0" November="0" December="0" />

  <Server Name="vc60n02.godc.lab" January="0" February="0" March="0" April="0" May="0" June="3" July="2" August="0" September="0" October="0" November="0" December="0" Position="3" />

  <Server Name="192.168.5.75" January="0" February="0" March="0" April="0" May="0" June="0" July="0" August="0" September="0" October="0" November="0" December="0" />

  <Server Name="vc01.godc.lab" January="1" February="9" March="1" April="0" May="0" June="0" July="4" August="2" September="2" October="0" November="4" December="1" Position="5" />

  <Server Name="vc02.godc.lab" January="0" February="0" March="0" April="0" May="0" June="0" July="2" August="0" September="0" October="0" November="0" December="0" Position="6" />

  <Server Name="vcsa50-01.godc.lab" January="0" February="0" March="0" April="0" May="0" June="0" July="0" August="0" September="1" October="0" November="0" December="0" Position="7" />

  <Server Name="192.168.1.71" January="0" February="0" March="0" April="0" May="0" June="0" July="0" August="0" September="1" October="0" November="0" December="0" Position="8" />

  <Server Name="vc65-1.go-lab.jp" January="1" February="4" March="3" April="0" May="0" June="0" July="0" August="0" September="0" October="0" November="0" December="0" Position="9" />

  <Server Name="vc-sv01.go-lab.jp" January="0" February="0" March="4" April="9" May="10" June="0" July="0" August="0" September="0" October="0" November="0" December="0" Position="10" />

  <Server Name="vc02.go-lab.jp" January="0" February="0" March="0" April="1" May="0" June="0" July="0" August="0" September="0" October="0" November="0" December="0" Position="2" />

  <Server Name="vc-sv02.go-lab.jp" January="0" February="0" March="0" April="0" May="4" June="0" July="0" August="0" September="0" October="0" November="0" December="0" Position="4" />

</ServerList>

見やすく 接続先サーバ（Name）と Position を抜粋すると、下記のようになっています。

PS C:\> $sv_list = [xml](gc $HOME\AppData\Roaming\VMware\PowerCLI\RecentServerList.xml)

PS C:\> $sv_list.ServerList.Server | sort {[int]$_.Position} | ft -AutoSize Name,Position

 

 

Name               Position

----               --------

192.168.5.75

vc55n01.godc.lab

vc60n01.godc.lab   1

vc02.go-lab.jp     2

vc60n02.godc.lab   3

vc-sv02.go-lab.jp  4

vc01.godc.lab      5

vc02.godc.lab      6

vcsa50-01.godc.lab 7

192.168.1.71       8

vc65-1.go-lab.jp   9

vc-sv01.go-lab.jp  10

最近使用してる vCenter 2台を残して、削除してみました。

<ServerList>

  <CurrentMonth>May</CurrentMonth>

  <Server Name="vc-sv01.go-lab.jp" January="0" February="0" March="4" April="9" May="10" June="0" July="0" August="0" September="0" October="0" November="0" December="0" Position="1" />

  <Server Name="vc-sv02.go-lab.jp" January="0" February="0" March="0" April="0" May="4" June="0" July="0" August="0" September="0" October="0" November="0" December="0" Position="2" />

</ServerList>

Connect-VIServer -Menu を実行してみると、2台だけ表示されるようになりました。

ちなみに、不要になったサーバを Position=""  とするとリストを読まなくなるようで、
XML ファイルを編集してサーバを削除するには
今回のように Server 要素ごと削除するか、Position 属性を削除する必要があるようです。

なお、今回は PowerCLI 6.5 Release 1 を Windows 10 で実行しています。

PowerCLI C:\> (Get-PowerCLIVersion).UserFriendlyVersion

VMware PowerCLI 6.5 Release 1 build 4624819

検証環境などで多数の vCenter に接続する場合には「-Menu」オプションが便利かもしれません。

以上、PowerCLI の -menu リストを更新してみる話でした。

Why CPU and RAM usage percentage of Guest OS is different than it appears in VMware vSphere performance monitoring tab?

The greatest confusion between VMware vSphere performance report of a VM’s CPU/RAM usage and the actual …