Although I cannot talk about the specifics VMware posted a press release yesterday regarding the new vCloud Hybrid Service.  If you want to learn more about it you can register for the web-cast online which will be happening on May 21st at 10:00am PDT.

VMware vCloud Hybrid Service Launch Details

To register, please go to:
http://www.vmware.com/go/vmwarehybrid

Get signed up and see what the news will be all about.  I myself just registered as well so I can hear some of the real time information along with everyone else.  I am curious to hear what other’s thoughts are as well.  Please comment below to start a discussion on the topic!  Due to the nature of the official announcement I will reply to comments but I cannot give specifics on anything.  I hope you will join the web-cast!

Building your hybrid cloud is also the topic for my upcoming VMUG sessions as well as the VMworld Submission.  Although I am not talking specifically about this offering, the concepts apply to extending any physical datacenter to the public cloud in order to build a vCloud Hybrid.  I have of course blogged a lot about this a few months ago, so take a look at those articles.

About Chris Colotti

Chris is currently a Consulting Architect in the Pre-Sales Solutions group of the Global Services Organization at VMware. He focuses on designing and integrating Cloud solutions for the field and VMware customers. Chris is amongst the first VMware Certified Design Experts (VCDX#37), and author of multiple white papers. Most recently Chris has become heavily involved with fitness as a Team Beachbody Coach through P90X and other Beachbody Programs. Although Technology is his day job, Chris is passionate about fitness after losing 60 pounds himself in the last few years. Now he spreads both the word of technology and fitness along with the Team Beachbody Business through both his blogs.

The post VMware vCloud Hybrid Service Launch appeared first on Chris Colotti's Blog.

Well kids here we are again ready for the VMworld 2013 Call For Papers Voting.  This is going to be a short post but as always you can easily filter by the name of the presenter you want to find to make things easier.  Below you can see the filter results for my sessions.  I’ve also listed a few others that I think you should also look at since the presenters are always great.  I’d suggest anything by these folks to keep it simple these are the usual suspects, some are just obvious so I am not bothering to list them all out,  and some new comers:

• Kris Boyd
• David Hill
• Kamau Wanguhu
• Rawlinson Rivera
• Mike Foley
• Cormac Hogan
• Jeremy Sage
• Thomas Ralph

About Chris Colotti

Chris is currently a Consulting Architect in the Pre-Sales Solutions group of the Global Services Organization at VMware. He focuses on designing and integrating Cloud solutions for the field and VMware customers. Chris is amongst the first VMware Certified Design Experts (VCDX#37), and author of multiple white papers. Most recently Chris has become heavily involved with fitness as a Team Beachbody Coach through P90X and other Beachbody Programs. Although Technology is his day job, Chris is passionate about fitness after losing 60 pounds himself in the last few years. Now he spreads both the word of technology and fitness along with the Team Beachbody Business through both his blogs.

The post VMworld 2013 Call For Papers Voting Is Open appeared first on Chris Colotti's Blog.

#1 Do you know the application inter-dependencies?

More often than not this is the biggest problem to understand.  How many times have you upgraded an application, changed an IP address, or anything else for that matter and the help desk phone started ringing?  That’s generally because we simply do not know what things have become dependent on that application over time.  Not only external applications that have started using the one in question, but also the application interdependencies itself.  Things to consider in this area might be:

• Is this a Multi-tier Application and do we know all the components?
• Does if have Active Directory Requirements?
• What external applications have started leveraging this application?

#2 What are the network dependencies?

In many cases you will need to change IP addresses of your application when you move it to the cloud.  This will become easier over time as Network Virtualization becomes more mainstream, we won’t have this problem as much.  However, today how is your application connected to the network?  You must not only know the application interdependencies but the network ones as well.  A few things to consider here might be:

• Does the application have firewall rules?
• How are users accessing the application?
• Does this application need to connect to other systems?

#3 How is the application administered?

Interestingly enough, this is a forgotten step when thinking about how to move the application to the cloud.  Today if the application is on your standard infrastructure you may be using one of three methods to administer the application in question.

• Admin Web Interface
• Secure Shell Access (Linux)
• Terminal Server (Windows)

The thing to understand here is once that application is moved to the cloud, will these same means be directly accessible or will you need to “jump” to them.  The answer will depend on how you decide to connect to your cloud, but certainly in some cases these interfaces may not be made “Publically” accessible so you need to think about how you are going to get to the system itself.

#4 Does the application require specific resources?

This is a very valid question to ask when looking at the current application   Recently, more people are starting to leverage the true power of VMware vSphere by using the resource options better and with more intelligence.  This may mean that you now have an application with per virtual machine settings to provide specific resources to it.  You need to determine if you can provide this same level of service in the cloud you have chosen.  Of course with some vCloud Director allocation models you can certainly do so.  Before you move the application check not only for existing settings on the following in your local datacenter, and determine if you can provide the same.

• CPU Reservations or Limits
• Memory Reservations or Limits

You may need to figure out a way to translate some of these settings into the cloud either by getting multiple Virtual Datacenters with different capabilities, or deciding if these settings are truly a requirement.

#5 What kind of storage is the application using?

Sometimes this may be a factor for performance, or capacity.  When you think about moving the application to the cloud, you need to absolutely consider the current storage requirements of the application.  There are a few factors to consider, specific to this that you may want to think about including:

• Current Storage Capacity and Utilization of the application?
• Storage performance requirements of the application?
• Are there multiple virtual disks?

You could have the option of creating storage tiers in your cloud to support each of these requirements, but before you move the application it’s good to identify these areas to avoid potential problems.

Is Your Application Cloud-Ready?

You need to ultimately decide the answer to this question, but it’s not something you can do without at least asking the five questions above.  Make sure you do some investigation with tools or on your own to get the answers to these questions.  Then and only then can you decide if your application is cloud ready.  Once you do that, go ahead and start planning your move to your new Virtual Datacenter and begin leveraging the power of the Cloud.

Please comment if you have other things to add in this area, I’m sure there are more than five, but I wanted to hit what I thought might be the most important ones.

About Chris Colotti

Chris is currently a Consulting Architect in the Pre-Sales Solutions group of the Global Services Organization at VMware. He focuses on designing and integrating Cloud solutions for the field and VMware customers. Chris is amongst the first VMware Certified Design Experts (VCDX#37), and author of multiple white papers. Most recently Chris has become heavily involved with fitness as a Team Beachbody Coach through P90X and other Beachbody Programs. Although Technology is his day job, Chris is passionate about fitness after losing 60 pounds himself in the last few years. Now he spreads both the word of technology and fitness along with the Team Beachbody Business through both his blogs.

The post 5 Questions to Ask – Is Your Application Cloud-Ready? appeared first on Chris Colotti's Blog.

So I finally got around to getting my VMworld 2013 session submitted based on my work a few weeks ago with the Hybrid Cloud setup I was working on between multiple public clouds.  I know voting is not opened yet, but I am hoping many of you will earmark this session for your list.  The details are below so you can read about it before the catalog goes live.

VMworld 2013 Session Title:  

How To Build Your Hybrid Cloud and Consume the Public Cloud

VMworld 2013 Session Type:  

Breakout Session

VMworld 2013 Session Abstract:

Are you a VMware vSphere Customer today that is on the verge of deciding to expand your current deployment or start considering vCloud Providers? Are you a start-up trying to decide how to consume the vCloud Provider public clouds as your Infrastructure as a Service, (Iaas)?  These are two very common use cases for customers looking to move to a Hybrid Cloud solution with VMware vCloud Providers.

This session will discuss the concepts for design of your Hybrid Cloud fully integrated into your existing vSphere and/or physical only infrastructure, or even your own private cloud. We will examine and explain some ideas in how you can better consume and expand your current datacenter capacity into one or more public cloud providers running VMware vCloud Director. You will leave the session with a better understanding of how to go out and start consuming the vCloud providers to best suit your needs to grow your capacity and connect them to your existing infrastructure. This session is ultimately about understanding how to consume the vCloud public cloud providers not building your own private cloud.

What will make this session unique is it will leverage live white boarding for the majority of the session instead of just PowerPoint slides.

VMworld 2013 Session Outline:

VMworld 2013 Key Takeaway 1

VMworld 2013 Key Takeaway 2 

VMworld 2013 Key Takeaway 3 

About Chris Colotti

Chris is currently a Consulting Architect in the Pre-Sales Solutions group of the Global Services Organization at VMware. He focuses on designing and integrating Cloud solutions for the field and VMware customers. Chris is amongst the first VMware Certified Design Experts (VCDX#37), and author of multiple white papers. Most recently Chris has become heavily involved with fitness as a Team Beachbody Coach through P90X and other Beachbody Programs. Although Technology is his day job, Chris is passionate about fitness after losing 60 pounds himself in the last few years. Now he spreads both the word of technology and fitness along with the Team Beachbody Business through both his blogs.

The post VMworld 2013 Session Submission Complete appeared first on Chris Colotti's Blog.

Recently Veeam gave away some passes to Microsoft TechED, and now they are doing the same for VMworld.  You can actually enter into their drawing to win a free pass to the VMworld 2013 conference.  You might as well do it you never know, you could win and make it to VMworld on Veeam!  You just need to register and you are done.  Here is a few reasons why you want to get there!

VMworld Breakout Sessions

Breakout Sessions provide product, industry, and solution-specific presentations to the most current and prevailing issues. Every Session can be locked into your schedule during pre-registration, giving you the peace of mind that you will have a spot to learn about topics that matter most to you and your business. Most sessions are repeated at least once and additional sessions are added leading up to VMworld.

VMworld Knowledge Experts

Connect with subject-matter authorities through our Knowledge Experts program. These members of the VMware community conduct and participate in Breakout Sessions and Group Discussions throughout the conference.

VMworld Group Discussions

Led by Knowledge Experts, these informative and interactive discussion groups are a great opportunity for you to gain insight from like-minded colleagues in similar industries.

VMworld Hands-on Labs

Hands-on Labs (HOLs) provide a unique interactive learning environment designed around typical customer use-case and business scenarios. Conference attendees are literally “hands-on” with the technology, exercising workflows that relate to real-world issues.

About Chris Colotti

Chris is currently a Consulting Architect in the Pre-Sales Solutions group of the Global Services Organization at VMware. He focuses on designing and integrating Cloud solutions for the field and VMware customers. Chris is amongst the first VMware Certified Design Experts (VCDX#37), and author of multiple white papers. Most recently Chris has become heavily involved with fitness as a Team Beachbody Coach through P90X and other Beachbody Programs. Although Technology is his day job, Chris is passionate about fitness after losing 60 pounds himself in the last few years. Now he spreads both the word of technology and fitness along with the Team Beachbody Business through both his blogs.

The post VMworld 2013 FREE PASS appeared first on Chris Colotti's Blog.

VMware Horizon View iOS 2.0 Changes

Now since I updated to the new version, I am not sure why I tried, but it seems the lock out on app allowing un-trusted certificates has been removed so this will now appears to work again for your own Certificate Authority as well as the self signed certificates as it is in my case.  You can see below the old options are back to connect.  Now it is still always recommended to use real certificates of course but this solves my connection problem to my View Server inside vCloud Director from my iPad

You can also see the certificate is allowed to be accepted

Key VMware Horizon View iOS Client 2.0 Highlights

• Unity Touch
  • Requires a VMware Horizon View 5.2 or later virtual desktop
  • Navigate All Programs easily and quickly from the Unity Touch sidebar
  • Access files in your Users folder easily from the Unity Touch sidebar
  • Easily search for apps and files on your virtual desktop
  • Switch between running applications and open windows
  • Close windows and quit apps with a left swipe and click Close
  • Create list of your favorite apps and files and use across your devices
• Unity Touch
  • Improved client side caching in View 5.2 is ideal for mobile devices
  • Admins use 90 MB & get the equivalent of 250 MB from earlier releases

About Chris Colotti

Chris is currently a Consulting Architect in the Pre-Sales Solutions group of the Global Services Organization at VMware. He focuses on designing and integrating Cloud solutions for the field and VMware customers. Chris is amongst the first VMware Certified Design Experts (VCDX#37), and author of multiple white papers. Most recently Chris has become heavily involved with fitness as a Team Beachbody Coach through P90X and other Beachbody Programs. Although Technology is his day job, Chris is passionate about fitness after losing 60 pounds himself in the last few years. Now he spreads both the word of technology and fitness along with the Team Beachbody Business through both his blogs.

The post VMware Horizon View iOS Client 2.0 Un-trusted Certificates Work appeared first on Chris Colotti's Blog.

I was talking to Rick Vanover a couple of weeks ago on Twitter and the topic of Veeam and vCloud Director came up.  Incidentally Rick is a member of one of my challenge groups for Les Mills Combat and is doing AWESOME and down about 20 pounds last time we talked.  So give him a WOOT on that next time you see him.  I’m hoping I can get him to write a little blog post on his site about his progress.

Anyway, I was asking him what I always ask him about Veeam and vCloud Director Support.  This was just before PEX and I did mean to post something during PEX but I was busy with my little Hybrid Cloud Project.

Long story short, Veeam V7 will be coming out soon with vCloud Director support.  If you want to be in the “Know”, then head on over and get signed up to hear about the updates.  I will of course be trying to get some early access to it so I can provide feedback to the Veeam Team on the usability and integration when it has a public BETA.  Most people know I have a vested interested not only in Cloud DR, but in the basic Backup and Recovery aspects and what the different vendors will be able to provide.

As the Software Defined Datacenter gets more mainstream, and people move to Hybrid Cloud as I talked about last week, this will be come as important as moving the workloads around.  I for one am very interested in seeing how these vCloud Director integrated backup solutions come together.  Click below to learn more about this new version!

About Chris Colotti

Chris is currently a Consulting Architect in the Pre-Sales Solutions group of the Global Services Organization at VMware. He focuses on designing and integrating Cloud solutions for the field and VMware customers. Chris is amongst the first VMware Certified Design Experts (VCDX#37), and author of multiple white papers. Most recently Chris has become heavily involved with fitness as a Team Beachbody Coach through P90X and other Beachbody Programs. Although Technology is his day job, Chris is passionate about fitness after losing 60 pounds himself in the last few years. Now he spreads both the word of technology and fitness along with the Team Beachbody Business through both his blogs.

The post Countdown To Veeam V7 With vCloud Director Support appeared first on Chris Colotti's Blog.

Firewall Rule Protocols Example:

In the View PCoIP on vCloud Director ost the other day I had this screen shot of the firewall rules.

I pointed out the there is a protocol listed called ESP that is NOT in the standard list of protocols at the very end of the list.  You can see the default protocols listed below:

VMware View Requirement:

The reason I was messing with this is that the new VMware View 5.1 Security Server to Connection Server link is secured with IPSEC.  I had all the other things open per the documentation except something known as “IP Protocol 50 – ESP”.  When the rule was ANY-ANY it worked but I could not for the life of me figure out how to add a new Protocol Rule.  Then it occurred to me that in the “Source” and “Destination” Port fields we can type anything we want, so why not give it a try here.

I did a little digging and found this VERY useful listing of the IP Protocol Numbers and names that gave me both the IP Protocol Number and Name for ESP.  SO I took a shot in the dark and entered ”ESP” in the field, and low and behold….it worked!  I have not tested using the IP Protocol numbers, yet but I suspect that may work too.

As best I can tell I’m not sure if this is “well” documented or not in the vCloud Director guides, but now I keep that IP Protocol link handy and I know I can now add BOTH custom ports and protocols to my vCloud Director Edge Gateway Firewall rules.  I always knew the port numbers were capable of being typed in.  I’m not sure if I was the only one to not know the Protocol field worked the same way but I certainly did not find any information to the effect after searching for a few hours on it.  I hope this helps others leverage the new 5.1 vCloud Director Edge Gateway Services.

About Chris Colotti

Chris is currently a Consulting Architect in the Pre-Sales Solutions group of the Global Services Organization at VMware. He focuses on designing and integrating Cloud solutions for the field and VMware customers. Chris is amongst the first VMware Certified Design Experts (VCDX#37), and author of multiple white papers. Most recently Chris has become heavily involved with fitness as a Team Beachbody Coach through P90X and other Beachbody Programs. Although Technology is his day job, Chris is passionate about fitness after losing 60 pounds himself in the last few years. Now he spreads both the word of technology and fitness along with the Team Beachbody Business through both his blogs.

The post How To Configure vCloud Edge Gateway Protocols appeared first on Chris Colotti's Blog.

vCloud Director Edge Firewall Rules

Like anything else in this little experiment, nothing is left wide open from a firewall perspective between the security server, connection server, and the desktops.  I did decide to put all desktops on one network for ease of writing the firewall rules.  Below is the output of the vShield Edge Gateway firewall rules just for the View Security Server which is obviously configured for secure tunneling.

You can see there is a couple of rules for external access to the View Server through the external NAT address.  There is three rules for the Security Server to access the desktops on certain ports, and finally there is the rules for Security Server to Connection Server.  I will write another post on the ESP protocol tomorrow as this is a little bit of an undocumented feature of the Edge Gateway.  There is also a rule not show that is an allow any FROM the desktop subnet to the Public Subnet and the Private Subnet since traffic in that direction may be trusted.

View Manual Pool

Obviously in a public hosted cloud there is no vCenter access so the desktops I created are on the domain and not controlled by vCenter.  I installed the VMware View Agent using the unmanaged command in the templates:

VMware-viewagent-XXXXXX.exe /V”VDM_VC_MANAGED_Agent=0"

By doing this the desktops are unmanaged and can be added to a Manual Pool for use by VMware View.  Of course if you are a Virtual Private Cloud customer with your own vCenters you can host the connection and Security Servers in vCloud Director and keep the desktops in a dedicated vCenter outside vCloud Director.  However, for me the manual pool option is fast and works just fine to get me the remote access I need to my back end public cloud IaaS.

Limitations of View PCoIP Inside vCloud Director

Now although this all works pretty well and is a standard kind of setup, something I discovered that makes this not so practical yet is that there is a limitation on the Video RAM that vCloud Director allows on Windows virtual machines.  In testing I always got the dreaded “Black Screen” and I was troubleshooting for a day or so.  Finally I stood this up in a lab and did some digging.  I examined the virtual machines settings and noticed on any Windows machine controlled by vCloud Director, the Video RAM is set to 8MB.  This is much too long for most PCoIP larger resolutions to work.  Although Remote Desktop seems to have no issues PCoIP cannot go much above 1200 pixels before you lose the screen.

At this time there is no way to adjust the Video RAM setting through vCloud Director’s UI or API’s so if you do this in lab understand you should be good on mobile devices, but on a laptop you will need to shrink the window.  It goes without saying I did try to manually change the Video RAM, but with anything vCloud Director controlled the settings revert back to the coded ones on the vApp.  I am trying to dig further to see if this can be changed someone on the backend.  This will happen consistently if you try to build the virtual machine from within vCloud Director.  So there is better answer to this.

Per Hugo’s comments below the best way to create a Desktop image for vCloud Director, is to build it in vCenter first.  Then you can adjust the Video RAM settings to something higher and they will remain.  I created a new template in a remote vCenter Server, set the Video RAM to 512MB, enabled 3D, and then exported it as an OVF and imported into vCloud Director.  To make things faster you COULD just create the VM Shell as you want, and export that into vCloud Director then build from ISO.  The trick here is to make sure you pre-configure the virtual machine and export to an OVF and import into vCloud Director.  Below you can see the DXDIAG output showing the increased memory and full screen now works perfectly!

About Chris Colotti

Chris is currently a Consulting Architect in the Pre-Sales Solutions group of the Global Services Organization at VMware. He focuses on designing and integrating Cloud solutions for the field and VMware customers. Chris is amongst the first VMware Certified Design Experts (VCDX#37), and author of multiple white papers. Most recently Chris has become heavily involved with fitness as a Team Beachbody Coach through P90X and other Beachbody Programs. Although Technology is his day job, Chris is passionate about fitness after losing 60 pounds himself in the last few years. Now he spreads both the word of technology and fitness along with the Team Beachbody Business through both his blogs.

The post Running VMware View PCoIP Inside vCloud Director 5.1 appeared first on Chris Colotti's Blog.

Setting the Stage For vCloud Director Hybrid Clouds

So who are these consumers and users I am speaking about trying to help?  It can be any one of us but for the purpose of this case study I want to take two specific examples that fit many possible situations out there.

• A new startup with NO Infrastructure
• An enterprise that has reached the limit of their current Datacenter

In both cases the need is simple.  They both need to find new infrastructure without having to build it themselves.  In the case of both I am actually focussing on them not building more themselves, but rather leveraging the vCloud Providers out there.  They could consume in either a public cloud fashion, or a hosted private cloud fashion.  For purposes of this study let’s assume they have decided to go to public cloud providers.  I will play the role of the consumer as we continue forward.  I will also be taking the aspect of the second scenario above.  I have a datacenter, that’s met its limits of compute, memory, and storage.

Choosing your Providers

To be clear I am not suggesting where you go, but for my purposes here I happened to already have resources at two vCloud Public providers running vCloud Director 5.1 so I decided I was going to split my Infrastructure as a service (IaaS) between the two for some level of redundancy.  Also I personally think that makes you a smart IT person leveraging two different providers.  For my scenario as we know I have been using:

• The VMware Eval Cloud
• The Stratogen Cloud

Obviously you can choose whomever you want, but in this case we are focussing on providers that are using vCloud Director 5.1 for it’s flexibility and simplicity to build your new organization   Once I have decided on the providers I am going to use the next steps are fairly simple and frankly are no different than you would do if you were building a physical datacenter, except now we are doing a Software Defined Datacenter, (SDDC).

Build your SDDC – Start with the Networking

Like any new datacenter you need to get the basic things configured.  As I have shown in previous posts, vCloud Director 5.1 provides a lot of power to the organization administrator….YOU.  The first order of business in my mind is the networking.  You want to design this separately for each site as you would for a new physical site.  Most all your traffic will leverage the Edge Gateway as well.

• Decide on and configure your routed networks
• Decide on and configure and isolated networks
• Configure your SNAT rules
• Configure basic outbound internet access firewall rules
• Determine DHCP settings and Static IP Rules if any
• Be sure to get from your provider various Public IP’s

Once you have gotten this figure out in your design of the two remote datacenters you can move forward.  It goes without saying you don’t want to cross networking subnets between sites or VPN will not work.  At this point you will also want to establish VPN connectivity between the sites and write the basic firewall rules for traffic to pass as you wish.  This will be important as you begin to stand up your infrastructure as a service.

Build your SDDC – Setup vCloud Connector, Import or Build New Templates

Here you can basically download and import the vCloud Connector Nodes into your two Public Clouds.  However, some providers are now building Multi-Tenant Nodes that you can simply leverage based on vCloud Connector 2.0.  If this is the case you only need to build your vCloud Connector Server hosted in one of your clouds, but maybe you want one in both.

Once you have this you can choose to move templates you already have in your current datacenter, or build fresh ones.  You can upload ISO images and just build new if you want to be sure things are setup fresh.  Either way you have the option so proceed as you wish.  So at this point, we have networking, templates, and site 2 site VPN connectivity established.  Now we just need to build out the Infrastructure we need to get started.

Build your SDDC – Active Directory

Like any new datacenter the first thing we probably need is localized Active Directory.  Assuming you have Active directory servers in your first datacenter you will want to make sure you setup new Sites and Services with the correct IP ranges.  Now I am now Active Directory expert, I am just trying to at least cover the basics.  Below you can see in my scenario I have set up the three sites, and also gone ahead and installed at least one Active Directory server in each of the new sites.  This will become the local authentication and DNS server for any new Windows infrastructure in that site.

Once you have pre-configured Active Directory Sites and Services in your Physical Datacenter controllers you can install from templates and promote the ones in the other sites.  At this point you are ready to continue installing application servers, or other IaaS you want to add to your enterprise using your new vCloud Director Hybrid setup.  These can be things like Public DNS, Public SMTP servers, maybe even Desktops at some point although that’s neither tested, nor supported on vCloud Director.

Some Final Thoughts And Diagram

Although this has been a basic study of how you can leverage vCloud Director Hybrid Clouds to expand your enterprise, it should give you a foundation to start thinking about.  The diagram below is a much more expanded view of the possibilities you can reach to host many services in your new public vCloud Director Hybrid cloud.  Really the point is that this is just like building a new physical datacenter, only in most cases it’s much faster.  Of course as Network Virtualization and Storage Virtualization moves along this will only get better.  I will be presenting this on next weeks vBrown Bag as well so we can open up discussion.

Click the Image for a Full Size PDF version

About Chris Colotti

Chris is currently a Consulting Architect in the Pre-Sales Solutions group of the Global Services Organization at VMware. He focuses on designing and integrating Cloud solutions for the field and VMware customers. Chris is amongst the first VMware Certified Design Experts (VCDX#37), and author of multiple white papers. Most recently Chris has become heavily involved with fitness as a Team Beachbody Coach through P90X and other Beachbody Programs. Although Technology is his day job, Chris is passionate about fitness after losing 60 pounds himself in the last few years. Now he spreads both the word of technology and fitness along with the Team Beachbody Business through both his blogs.

The post vCloud Director Hybrid Cloud Design Case Study appeared first on Chris Colotti's Blog.

• VMware Eval Cloud 
• Stratogen Cloud
• My House

The trick here is that this is now turning into a true Hybrid cloud as two sites are running vCloud Director, and my house is not.  It’s a standard datacenter with a Cisco Firewall for IPsec VPN.  The idea is to connect the two vCloud Director clouds first, then connect the home datacenter to each of the two vCloud providers.  Let’s look at the vCloud to vCloud VPN setup as that is the easiest thing to configure in the world with both ends are vCloud Director.

Configure vCloud 2 vCloud VPN

Select your Edge Gateway in your vCloud organization and select the VPN tab.  Once there select “Add” and you will see the following screen.

Select “A Network in another Organization, and then select ” Log Into Remote vCD”

Fill in the required fields for just the vCloud URL and the org with your credentials.  Once you log in you will be presented with the other vCloud Organization’s networks so you can multi-select the mappings for the networks in each Organization.  The rest of the options you can pretty much leave the defaults as they are populated.

Once this is done the two sites should come up with VPN between them.  However, you will need to configure the firewall rules in the Edge Gateway before you can connect the networks.  I will cover that last after the IPsec VPN setup.

Configure IPsec VPN From Cisco RV042

Now I am sure everyone has a different router or IPsec firewall, but I have located and found the correct IPsec settings to use that seem to work best for this which are listed below.  I have included the RV042 specific settings as well.

vCloud Edge Gateway IPSEC Setup:

For this end it’s pretty simple but there are a few things I noticed and this is what I configured that worked for me.  When you add the new VPN simply Select “A Remote Network” and use settings similar to these:

Peer Networks:  List the remote networks for mapping
Local ID:  I have found using the external IP of the Edge Works
Peer ID:  Also use the External Address of the Peer Firewall
Peer IP: Same as the Peer ID
Encryption: 3DES seems to work best
Shared Key: <Various>

RV042 IPsec Setup:

Phase 1 Mode:  IKE with pre-shared Key
Phase 1 DH Group: Group 2
Phase 1 Encryption: 3DES
Phase 1 Authentication: SHA1
Phase 1 SA Life: 28800

Perfect Forward Secrecey: On

Phase 2 DH Group: Group 2
Phase 2 Encryption: 3DES
Phase 2 Authentication: SHA1
Phase 2 SA Life: 3600

Pre-Shared Key:  <Various>

Configure the vCloud Edge Gateway Firewall Rules

This is probably the SINGLE most missed area by people setting this up.  Even with the connections made, nothing will pass for traffic through the vCloud Director Edge Gateway to the peer networks without firewall rules.  Last month I wrote about the Changing Role of the VMware Admin, and this section alone is why I think many people will struggle.  I was an ex-admin for checkpoint in my day so I personally like writing firewall rules.  It’s sad but true.  Below are the rules I have in both the Stratogen and VMware Eval Cloud Edge Gateways for traffic to pass between the two clouds as well as to the ‘Server’ network back at my house.

This is a screen shot from the VMware Eval Cloud, and you can see I have allowed traffic on both directions from the Stratogen Cloud to and from the Desktop and Private networks as well as from the Home Server network to the Private network.  You MUST create rules in the vCloud Edge Gateway or you will not have connectivity just with the VPN connections.  I cannot stress this enough, and you can control which networks are accessible from the other sites through the VPN this way.

In my case I also use vShield App rules in the home lab to prevent traffic from the Hybrid Active Directory server to my “Corporate” network while allowing it to access the Server Network and the router.  This is an added step I took to isolate the Active Directory server on the Server segment from the rest of my network.

The bottom line here from this step?  You really must brush up on your firewall rule skills for both the Edge Gateway and App Firewall for that matter.  These are both tools that the new vSphere Administrator really must understand how to use.  Personally, I like creating and figuring out firewall rules for some reason, and I was a Checkpoint Admin for years.  Get these things under your belt and the next and last post will be the final Hybrid Cloud Configuration with the final Visio Diagram for what I have built.  I really do hope to maybe turn this into a couple of VMworld 2013 submissions, so if you think these topics are useful, be on the lookout!

About Chris Colotti

Chris is currently a Consulting Architect in the Pre-Sales Solutions group of the Global Services Organization at VMware. He focuses on designing and integrating Cloud solutions for the field and VMware customers. Chris is amongst the first VMware Certified Design Experts (VCDX#37), and author of multiple white papers. Most recently Chris has become heavily involved with fitness as a Team Beachbody Coach through P90X and other Beachbody Programs. Although Technology is his day job, Chris is passionate about fitness after losing 60 pounds himself in the last few years. Now he spreads both the word of technology and fitness along with the Team Beachbody Business through both his blogs.

The post How To Configure vCloud 5.1 Hybrid Cloud Site 2 Site VPN appeared first on Chris Colotti's Blog.

vCloud Connector Nodes Installed in:

• Virtacore’s IAD Cloud
• Virtacore’s LAX Cloud
• VMware IAD Eval Cloud
• Stratogen Cloud

Each of these nodes is on a “Public” network with external IP Addresses and firewall rules for the following ports:

• 443
• 5480 (Management)

vCloud Connector Server Installed in:

• VMware IAD Eval Cloud
• Same vApp as the Node

Now the firewall rules for the server are a little different and I did get an error on vCloud.vmware.com that it does need an additional port open but it does work 100% from the online vcloud.vmware.com portal

Firewall Rules for the Connector Server:

• 443
• 5480 (Management)
• 80 for vCloud.vmware.com

NOTE:  These are not deployed from OVF with the VMXNET3 interface so for giggles be sure to remove the current interface and add a new one that is using VMXNET3 specifically by checking the “Show Network Adapter Type” box.

Configuring the vCloud Connector Server

Now something I was messing with was getting the vCloud Connector Server connected to the local vCloud Connector Node.  Due to the Edge Gateway I could not use the external IP on in the vCloud Connector Server config as you can see below.  I needed to use the local IP for the Node that’s in the same vCloud Director Cloud and in the same vApp as shown above.  I think there was some routing issue but it does not really matter since the Node and the Server are in the same network you can use the local IP address or local DNS for the connection.  The other nodes you can see are true external entries.

Once I did that the server is now connector to all 4 clouds through the online portal vcloud.vmware.com

Migrating Templates

Now I was ready to move my Windows template from one cloud to Stratogen so I can continue to work on this expanded vCloud Director Hybrid Cloud setups.  As I continue with this experiment I will add more blog posts so people can really understand the power of how to use all this technology

About Chris Colotti

Chris is currently a Consulting Architect in the Pre-Sales Solutions group of the Global Services Organization at VMware. He focuses on designing and integrating Cloud solutions for the field and VMware customers. Chris is amongst the first VMware Certified Design Experts (VCDX#37), and author of multiple white papers. Most recently Chris has become heavily involved with fitness as a Team Beachbody Coach through P90X and other Beachbody Programs. Although Technology is his day job, Chris is passionate about fitness after losing 60 pounds himself in the last few years. Now he spreads both the word of technology and fitness along with the Team Beachbody Business through both his blogs.

The post How To Run vCloud Connector 2.0 Hosted With NAT appeared first on Chris Colotti's Blog.

• vShield Edge Gateway multi-interfaces
• vShield Edge Gateway full firewall capabilities
• vShield Edge Gateway VPN
• Organization Administrator ability to create new networks

Below is a rather large vCloud Director Hybrid Cloud Logical Network diagram that shows the various vApps and the various networks.  This has been made possible solely by the new Organization Administrator capability for adding net routed and isolated networks.

vCloud Director Hybrid Cloud Architecture – Leveraging vApps

What you will notice is I have various vApps by application type.  What you can also see is that there are Virtual Machines in those vApps where some are on the Public and others are on the Private networks.  I can keep different vApps for construct purposes and containers for backup and restore with future 3rd party integrations.  I can add Virtual Machines on the fly to any given vApp and maintain the organizational construct of them for other users.  You can see there is a CentOS Test vApp that is owned by another user.

vCloud Director Hybrid Cloud Architecture – The New Edge Gateway

To some this may look no different from what some current organizations do to create multiple firewalled networks with their primary edge firewall device.  Some of this is pulled from my past experience as a Checkpoint administrator for PC Connection, and how I know we had much of our original networks setup.  The power from 1.5 to 5.1 comes in the ability for the organization Administrator to create and define the different network segments you see.  In the previous version this was not possible and some could argue was a barrier to truly building your public cloud based Software Defined Datacenter, (SDDC).

vCloud Director Hybrid Cloud Architecture – Firewall Rules

Something that has been there for a while in the Edge Gateway was the ability to define the basic firewall rules.  However, in 5.1 you can see that we can now create and define multiple SNAT and DNAT rules, along with very finite network source and destination based rules.  This is one function that again will facilitate a design like this working.  What you will also notice, and I found this through trial and error, is you can even define Network Protocols with the new Edge Gateway.  In the case below notice the rule for ESP from the View Security Server to the View Connection Server to that they can establish IPSEC.  The ESP Protocol does not use a port rather it is an IP protocol with the ID 50.  This took me about a day to figure out I can just use the ESP name or the IP Protocol ID’s that are standards.  Did anyone else know this was possible?

vCloud Director Hybrid Cloud Architecture – Next Steps

Now that I have built this remote vCloud Director Hybrid Cloud, complete with multiple networks, firewall rules, and vApps I am going to try to connect it to a physical datacenter.  That will be another Software Defined Datacenter running in my home lab or possibly another location.  Once I can get the VPN component established I should be able to show the full multi-site functionality of such a design where some workloads like web servers are in the vCloud Direction Hybrid Cloud and others are in the primary datacenter.  At that point it’s all a matter of some networking and possible Active Directory configuration.  I should mention I literally built this in about 3 days and it could have gone much faster with the use of existing server templates and other means of migrating workloads to the cloud itself.  I spent a good portion of the build just getting new templates spun up.  Also all of this was done manually, but you could automate much of the creation through tools and the vCloud API.

There is so much here to talk about that I may use some of it on an upcoming vBrown Bag, but I am trying to think about how I can also use this for some upcoming presentations like VMUG’s and other venues.  I want people to see that you can now do a lot with vCloud Director and the SOftware Defined Datacenter if you just think about the design and the requirements.  I’m sure I could do even more with this given the time, but it’s enough to show the point I think.

About Chris Colotti

Chris is currently a Consulting Architect in the Pre-Sales Solutions group of the Global Services Organization at VMware. He focuses on designing and integrating Cloud solutions for the field and VMware customers. Chris is amongst the first VMware Certified Design Experts (VCDX#37), and author of multiple white papers. Most recently Chris has become heavily involved with fitness as a Team Beachbody Coach through P90X and other Beachbody Programs. Although Technology is his day job, Chris is passionate about fitness after losing 60 pounds himself in the last few years. Now he spreads both the word of technology and fitness along with the Team Beachbody Business through both his blogs.

The post How To Design Your vCloud Director Hybrid Cloud appeared first on Chris Colotti's Blog.

I know in the last few months my content has been slim due to my role change over to the Nicira team, but I will let you know that as of April 1st, I will be back working on Pre-Sales Solutions around the Software Defined Datacenter.  That means I can start having more I can write about in 2013, and I for one am very excited.  It’s been hard to be on a project where the topic area is so very sensitive and you cannot write a lot about it.  Already in the last few weeks I have dug back into the vCloud Suite and working on some crazy use case ideas that are generating some cool thoughts on what is to happen with SDDC.

Thanks for your consideration for 2013 and all your support for 2012.  I genuinely appreciate it those people who read and comment on all my posts throughout the year.  Be sure to give some thought to the other new blogs out there you read as well and help newcomers like myself last year get onto the list.  Let’s continue to see some new names out here in 2013 instead of all the same ones.  I still consider myself to be new to this space so I’m not saying don’t vote for me.  I’m suggesting everyone broaden their base of favorite links in 2013 to go beyond the usual suspects.

About Chris Colotti

Chris is currently a Consulting Architect in the Pre-Sales Solutions group of the Global Services Organization at VMware. He focuses on designing and integrating Cloud solutions for the field and VMware customers. Chris is amongst the first VMware Certified Design Experts (VCDX#37), and author of multiple white papers. Most recently Chris has become heavily involved with fitness as a Team Beachbody Coach through P90X and other Beachbody Programs. Although Technology is his day job, Chris is passionate about fitness after losing 60 pounds himself in the last few years. Now he spreads both the word of technology and fitness along with the Team Beachbody Business through both his blogs.

The post Voting is Open for 2013 Top 25 vBlogs appeared first on Chris Colotti's Blog.

The vSphere Setup To Reproduce:

1. vSphere 5.1 and/or vCloud Director
2. CentOS 6.3 Guest (although other versions also seem to hang)
3. Tools installed post OS installation
4. Wait about 10-15 minutes
5. Reboot the Guest Virtual Machine

This is rather easy and is something anyone can do.  What I can say for sure, this is not tools version related, it is not even virtual hardware related, it is something with the tools and vSphere 5.1 specifically, regardless of versions.  I actually tested both:

• HW8 and Tools Version 8 running on vSphere 5.1
• HW9 and Tools Version 9 running on vSphere 5.1
• Uninstalled the tools and things work fine

The error itself is arbitrary and happens to be presented while the Virtual Machine is simply trying to finish the boot.  I know this as I was asked to start renaming certain libraries including libguestinfo.so which removed the error in the screen, but the Virtual Machine still stalls on boot.  This error is completely un-related to the underlying root cause which is actually that the Virtual Machine is hanging on boot for about 10-15 minutes.

The Real Problem

So in the spirit of troubleshooting, engineering used my test Virtual Machines to go through other libraries until we isolated the libtimeSync.so library.  Now, if you recall way back early in vCloud Director I ran into a time sync issue that was ultimately being caused by the fact NTP was not enabled on a cell.  However, what I pointed out in that article was that EVERY virtual machine, regardless if the tools are set to sync with the host or not when the tools running will ALWAYS time sync initially on boot if the tools are installed.  Then once the tools are running, the settings of sync with host or not are enforced.

What appears to be happening here and we don’t yet have the “why” is that the time sync library is causing the hang on the initial boot.  So now that we know the reason it is hanging and the library causing it we can do a quick work around which for most people should be good until we can get a final root cause as to the reason the library is just taking so long.

The vSphere Workaround

This is so simple you are going to wonder why I made you read the rest of the article.  Well, frankly I think it’s important to understand the troubleshooting we have taken to understand and isolate the issue so you know why it’s happening not just the “fix”.  So what that the answer right now seems to be simple assuming you only have access to the vSphere guest itself like I do in a fully hosted environment:

• Rename libtimeSync.so to libtimeSync.so.bak (or something else you choose)
• There is a KB Article that you might want to read and see it you can try that as well if you have access to the full back end

The File locations are as follows:

/usr/lib/vmware-tools/plugins32/vmsvc/libtimeSync.so
/usr/lib/vmware-tools/plugins64/vmsvc/libtimeSync.so

Since most of you using Linux are most likely using NTP, this shouldn’t interfere with the overall time sync of your guest, as NTP should start-up soon after and do it’s sync and you should be good to go for now until a more long-term explanation and fix is put forth.  This should get you by and allow you to keep the tools installed without the warm reboot hanging issue.

I hope this helps, and always troubleshooting is an ongoing effort fo trial and error.  Thanks to the vCloud Service Evaluation setup for providing a fast easy way to re-produce AND provide access to others to help continue to troubleshoot this problem.  If this was only in my lab if would have been much harder to provide the access.

About Chris Colotti

Chris is currently a Consulting Architect in the Pre-Sales Solutions group of the Global Services Organization at VMware. He focuses on designing and integrating Cloud solutions for the field and VMware customers. Chris is amongst the first VMware Certified Design Experts (VCDX#37), and author of multiple white papers. Most recently Chris has become heavily involved with fitness as a Team Beachbody Coach through P90X and other Beachbody Programs. Although Technology is his day job, Chris is passionate about fitness after losing 60 pounds himself in the last few years. Now he spreads both the word of technology and fitness along with the Team Beachbody Business through both his blogs.

The post Workaround for vSphere 5.1 Guest Unable to collect IPv4 routing table appeared first on Chris Colotti's Blog.