blog.storming

cisco.waas.kvm.hypervisor.revealed.100708.txt

2008-10-07T19:42:00.005-04:00

Disregard XenSource as the hypervisor (only looking at OUI gets you nowhere).. (updated)

Apparently OUI has little relevance.. 00:16:3E is used by KVM/QEMU as well.

Figure 14-3 on the following documentation page: http://www.cisco.com/en/US/docs/app_ntwk_services/waas/waas/v411/configuration/guide/virtual.html#wp1052098
Screenshots show a virtual interface with the MAC of: 00:16:3E:54:B6:23
and with a quick OUI lookup at:
http://www.wireshark.org/tools/oui-lookup.html

we'll see that 00:16:3E is: Xensource, Inc. (irrelavent, sorry)

- quick note on this.. what is the point of having a standard if everyone is going to canabilize it! I can understand MAC spoofing from a hackers point of view, but just disregarding it from a vendor level makes it even worse.. I was upset when I couldn't copy the existing MAC from a physical NIC to one under VMware, but I understood their point (and rightly so, they did put a switch to allow an override via the .vmx config)

Other notable points:

- virtio is a selectible disk emulation type, used by KVM.
- KVM uses .img file formats and that is discussed as the backup option (file.img)
- kvm.tar.gz exists in WAAS41.bin (not going any further than that)

retrospect time..

- Cisco works with Microsoft to be one of the first vendors to be certified on the new SVVP program.. people shake there heads and say what??

- Cisco announces a new virtual switch designed to run under the new VMware ESX platform based on the Nexus product line running a Linux kernel.

- Cisco releases a new WAAS product with 4.1 allowing for virtual-blades utilizing the open-source KVM hypervisor. (PV drivers yet to be determined.)

So, I would say this is a very smart move for Cisco in the virtualization space.. they have no allegiance to anyone and are able to capitalize from everyone! Great job!

citrix.pvs.large.ad.slow.console.hotfix.092908.txt

2008-09-29T23:08:00.003-04:00

quick note - http://support.citrix.com/article/CTX118566

this hotfix along with it's rudimentary installation method of manually stopping a service and then copying in files and restarting a service does work to dramatically increase the speed of the management console when working with any size PVS farm with a large AD environment.

if you are looking to deploy PVS 5.0 and/or demo some of the features and it is looking rough with the response times to change device properties this patch is for you! the bad thing is that it doesn't show up in a small demo vm lab since you usually don't have a large AD environment to deal with, then you go and rebuild in production and everything slows to a crawl.

I'm just curious how many PVS hotfixes will have to be deployed like this.. I think there are a few application packagers out there under GPL.. you know, Citrix being an "Application Delivery" company any all...

silly.vendors.ft.is.for.everyone.092408.txt

2008-09-24T19:50:00.005-04:00

From Mike D's blog entry: Time for Some Real Names Stratus

It is only advantageous to the end user for you guys to duke it out in order to weed out the marketing fluff.. not sure you should "ban" a user from posting comments because he may have lied about his site being down. He did say "my site" and not necessarily that of the company that his ARIN ip lookup shows. I think people have many facets, and the fact that a Stratus employee is running VMware and updating it to the latest code should be a good sign.
I was affected by the time bomb bug as well, and I do feel VMware should have had a bigger hit.. it was a grave mistake and you guys got off pretty easily. Congrats, when yahoo or blackberry has an outage, people start getting skeptical.. just remember it was your loyal customers that wanted to make sure your product looked good that kept you afloat during this.
As for FT, everyone is on this bandwagon.. I don't care so much for the super-high Stratus tax and the fact the even the $40k servers run 80gb SATA drives, or that Marathon has teamed up with Xen only, or that you guys haven't released the product and that it will only support 1 core. The bottom line is that it is a race, and there is going to be pushing and shoving... All I can say is supply your engineers plenty of energy drinks, and may the best vendor reach the market first with a FT product that is semi-affordable for the masses.

Until then, we will continue to rely on the software manufacturers to develop active-passive and active-active configurations.. oh wait! That is what they should be doing and you shouldn't even be worried about FT anyway! Unfortunately that will never happen.. so you guys are still in luck.

thinlaunch.quick.take.092008.txt

2008-09-20T01:06:00.004-04:00

after reading Michael Keen's post at: http://www.brianmadden.com/blog/MichaelKeen/Have-you-heard-of-ThinLaunch I headed over to http://www.thinlaunch.com/ for the eval since repurposing existing winxp clients is something I am interested in..

first thing is that it requires .net 2.0 framework.. this shouldn't be an issue but just another hurdle and for whatever reason I don't have snapshot for my winxp sp2 vm with .net 2.0 already installed.. atleast not on this laptop.

quick install and at the end it asks you for what executable you want to run at startup.. browse and select something.

now for the guts.. it's is scary!!

it creates a local user that is a member of Local Users AND Administrators called:
ThinDesktopUser with a password of: test!123abc!!@#

then proceeds to modify the registry to autologin and run C:\Program Files\Thin Desktop\ThinDesktop.exe /s, via the UserInit key.

ThinDesktop.exe then reads: HKLM\SOFTWARE\ThinLaunch\Thin Desktop\LaunchCommand (which has the full path to the exe you defined earlier)

so... my quick and dirty lockdown that is going to set me back $20-26 per workstation has created a local admin account with a standard password and is still running explorer.exe as the shell..

good news is there is an alternative and Microsoft was so kind to provide it for free.. regedit.exe

simply browse to: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and change the Shell key to the full path of the executable of your VDI client, XenApp full client or better yet, frontend a web-portal with Public Web Browser from TeamSoftware Solutions

PWB will set you back $125 per year for a site license so you'll need atleast 5 clients to repurpose to realize your ROI versus ThinLaunch. This is only if you want to do the web portal, setting the Shell key to any other .exe is free and requires a keyboard, but PWB does give you alot of other neat features.

The above solution works as a local or domain USER not admin, and won't expose you to the vulnerabilities that appear very obvious with ThinLaunch.

Sorry, throwing together a quick .NET 2.0 app that modifies the registry and perform a ShellExec API command (possibly more, don't want to understate it) isn't worth $26 per client when there is alot of hard work and engineering that goes into many other client licensed products around that price range such as appvirt, antivirus, device control, and full disk encryption.

kayo.fs.aka.crippled.melio.fs.091808.txt

2008-09-18T23:09:00.006-04:00

(enter rant mode - you've been warned)

- bear in mind I am looking at using one of the Sanbolic products for a HA solution, but with all of the potential announcements with vmworld and the new release of Sanbolic Kayo FS, I have to stop and wonder where it is all going..

Kayo FS is priced at $299/physical server designed to run on a Windows 2008 Hyper-V machine to give VMware ESX and Citrix XenServer a run for their money. After all, after 20 some odd years of existance our operating system vendor of choice has never made a true multi-host aware filesystem.. nothing new here, I think they just now gained the concept of a multi-user system. meanwhile the *nix world has their clustered filesystems and have pretty much commoditized them.

enter Sanbolic, filling the niche and making their money.. if you thought VMware ESX was expensive, wait until you see the pricing to patch up NTFS.. I'm wondering if it wouldn't be cheaper to pay premier support to MS and have them rewrite NTFS.. I seem to recall that you could pay a onetime fee for them to program the DST changes for unsupported OSes... maybe they'll do the same for Windows 2008 since they just launched it..

my problem is that I'm not sure how long Microsoft will let them continue.. and at $299/server I wouldn't mind Kayo.. but I want to run it under vmware esx for Citrix Provisioning Server and that is a no no.. the setup.exe pops up a dialog and immediately tells you that is unsupported uner a virtual machine and exits. after quite a few right clicks, double-clicks and drag and drops, kayo_fs looks to have the capability to run under vmware, there is just a nice DetectVirtualMachines.dll that is being called.. that and the combination of HKLM registry keys with per_process keys of vmware.exe, vmserverdWin32.exe, vmserverdWin32.exe set to report_ntfs..

I would come to the assumption that this is clearly a crippled version of melio_fs that is set not to run under any virtualization platform and only to make Hyper-V look good until MS can enhance NTFS.

(end rant mode)

UPDATE - after speaking with Sanbolic, I felt bad and removed the post since it was after a long day of work and school, but after re-reading it, I don't feel there is anything geniunely wrong with my first assumption. I will most likely be utilizing Melio FS Enterprise (since standard isn't supported under ESX).. but it all works out and will only end up being a $30-35/per wks cost.. a few tests next week will help determine this figure.

cisco.virtual.office.redesign.time.091708.txt

2008-09-17T02:08:00.004-04:00

- time to stop ordering the cisco 871w and move to the 881w

- consolildate the current rollout of the 871 with an LWAPP and inmotion or junxion box with one device.

looks like the 3G option will be later as there in no sku currently at:
http://www.cisco.com/en/US/prod/collateral/routers/ps380/data_sheet_c78_459542.html
but instead of using the proprietary wic modules it will be based off of standard express cards. this will be nice since they are easily to replace/upgrade.

thoughts on this would be that the end user would carry the 3g sprint/verizon/at&t card with them (using a pcmcia to express card tray) then unplug the device and place it in their 881w when the are at home "docked" not sure how well the ios will handle hot-insertion and removal of the express card if that is the primary link.. seems doable.

the managed built-in lwapp will be perfect to replace the extra ap that we are currently using.
bumping up to (8) vlans will be great since 4 really never existed since you couldn't get rid of vlan 1.

IP SLA is great and works wonderfully with the voip monitor for IPSwitch Whatsup Gold.
There are plently of other really good products that can read the SLA stats now as well but for straight-forward MOS scoring and the detailed history charts it will accomplish what you need to troubleshoot and trend problems with slow and flaky dsl and cable circuits.

Quick cost run down (street range).. not considering msrp or the typical 35-42% off:

CISCO881W-GN-A-K9 $700 - everything in a box (be nice if they already had express card slots)
800-IL-PM-2 $110 - 2 port PoE module if you have a VoIP phone or IP camera
SL-880-AIS $100 - need this for advanced ip - eigrp and dmvpn back to the 28xx/38xx headends.

So, we are still under $1000 for a fully functional box at a remote site and then I can pull back the lwapp AP and reuse at fiber connected sites so this it an internal discount of $450 per site!

I guess I wil find out tomorrow whether the distribution warehouses have these in stock or not.

The content filtering option is pretty nice and could be used for public lab use - looks like they have a 30-day trial sku but the 1yr is right around $100 so this would be good for split-tunnel use as well.. no reason to backhaul their internet traffic if the policy could atleast be applied at the edge.

datacenter.cisco.vmware.091408.txt

2008-09-14T00:22:00.005-04:00

in reference to the link between cisco/microsoft server virtualization validation and upcoming announcements, it clearly look like cisco wants to work with vmware in the datacenter environment and have the full support from microsoft.

this whitepaper @ cisco.com contains more acronyms than you can shake a stick at, but clearly paints the picture of what their vision is in a microsoft shop running exchange 2007. now after reading that article, I would boil it down, to wow, that is alot of infrastructure for email! why not just get a gmail account :)

putting everything together, the following paragraph from that whitepaper sums up why they went for the SVVP:

Solutions built using VMware HA and VMware DRS combined with EMC and Cisco technologies provide out-of-the-box high availability for the entire Exchange environment without requiring any Microsoft or other third-party clustering software. A critical weakness in most clustered Exchange architectures is their coverage of mailbox servers only, leaving critical supporting server roles (DNS, domain controllers, Exchange Hub, CAS servers, etc.) vulnerable to outages due to hardware failure. Cisco provided the necessary redundancy through the Cisco Nexus® 1000v.
http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/emcinfra_wp_master.html

since the nx-os is based on linux it makes good sense for this to plug into the vmware environment.

so now you'll have a good reason virtualize all of your critical infrastructure servers (microsoft or not) and feel comfortable that your in good hands.. combine that with the vn-link services that appear to be a service offering from a combination vmware and cisco certified team and you can figure out how to migrate to a completely virtualized datacenter running exchange 2007.

the combination appears to be very powerful.. only next week will tell us if we have to wait for vmware esx 4.0 for this to happen!

this document also gives insight to the ironport purchase and how that fits in.. hopefully that will become a vmware virtual appliance in the near future as well. otherwise it's just another point of failure that would down this really nice virtual exchange infrastructure they just designed.. that and it runs on linux with oem dell hardware so it can't be that hard to build an OVF from..

there has already been some talk of the WAAS having it's own hypervisor and being able to run Windows "blades" so it will be interesting to see how that fits in.. maybe the WAAS itself should just be virtual under vmware..

ASA code can already be virtualized so it shouldn't be too much longer before that should become a VM.. maybe then I would get rid of ISA server.. until then I'll settle for both.

nclgisa.can.teleport.goats.with.google.chrome.090908.txt

2008-09-09T10:53:00.004-04:00

- together we can accomplish anything at NCLGISA

to answer the "goats teleported" question I had for some odd reason when I was running bintext against the chome application is:

http://lists.unc.edu/read/messages?id=4792653

[McArdle, Joseph]
It is a covert meaning for Google.

It Means “ Thanks for installing the new browser, we have just stolen all the cookies, temp files, password files, documents, and all other data off your computer and “Teleported” the info
to our “Good Old Application Trusties”, that we will use as we need….

( but the browser is secure against anyone else ) did we mention that we have a Free Email Program for you ?

---

[Jerry Hogan]
I think a running joke based on a documentation reference. See below:

“2. Create a changelist. We use Subversion, but use some tools on top of it for the review and committing process. Make a changelist with the gcl change command. The changelist name is only to help you refer to it on your local computer, so call it whatever you want:

C:\code\src\chromium> gcl change mychange

This will open your text editor. Write the change description at the top of the file. The description should describe what your patch changes and why. This is important for people who are looking at commit logs in the future to track down an issue: they should be able to see why you changed it without going anywhere else. You should also add a BUG=bug_number line at the end of the description so they can find the associated bug. Example:

Increase the goat teleporter timeout threshold to 100 because the old
value of 10 caused problems for extremely overweight goats. Tests show
that the largest goat in existence should be teleported in 50ms, so...

BUG=112358
Cut and paste the filenames above or below the divider to add files to or remove files from the changelist. You can use the gcl opened command to see your changed files and changelists:

C:\code\src\chromium> gcl opened
M browser\browser.vcproj ← this is a modified file not in any changelist

--- Changelist mychange:
M browser\browser.cc”

wireless.pxe.bios.090908.txt

2008-09-09T00:08:00.003-04:00

quick thoughts from some conversations today..

- why is there no wireless pxe booting? it should be straight forward to put this in bios..

- bios manufacturers should be bought out by the major companies such as Dell, HP, etc.. the innovation is really lacking and Phoenix's announcement of a hypervisor in bios is long overdue in hindsight.. the bios vendors should have had this underwraps when everything first started to get big.

- with proprietary flash dead and solid state here to stay the bios could really get promising

- place 802.1x wired and wireless in a newly revamped bios with an integrated hypervisor and I'll be happy.

- this brings back memories of trying to find a 16mb cisco proprietary ISA flash card to build my frankenstein PIX box.. good thing the 501s came out before I spend the $600 on the card!

while the bios vendors are at it, they should go ahead and carve up 4/8gb of storage the run their os of choice and our recovery partition.. sounds more and more like the PC manufacturers should gobble up the bios companies now.

Better yet, let's have citrix or vmware purchase a bios mfr since phoenix was supposed to based of xen anyway and then license the whole thing to the pc mfrs for thin clients.. not sure what the point of xp embedded would be if a thin client could boot the xenserver hypervisor then launch an ica client for vdp, oh and be managed with xencenter while we are at it!

or if Microsoft could buy them they could just put Hyper-V in it for everything.. hey they managed to get the keyboard mfrs to put a windows key on every ps2 keyboard in the world..

but back to the basics.. I'd just like an easy way to put the asset tag in the bios of a Dell or HP went I enter the bios menu during an inital boot!

google.chrome.appdata.local.090408.txt

2008-09-04T00:53:00.006-04:00

yapagc - yet another post about google chrome.

- no google toolbar, a bit of an oversight

- installing to local appdata? defeats it governance, causes headaches to it staff.. thanks, google

- talk about the about:internets page.. it calls sspipes.scr, that is why your pipes are clogged under vista, just copy in your favorite screensaver or hexedit and have fun.

- still want to know how to teleport goats.. "Goats teleported" too tired to dig further

- I know its beta, but the size of the app could have been considerably smaller if they would have removed all of the full text and debugging code..

- http://dl.google.com/chrome/plugins/plugins.xml - don't see silverlight in there.. hmm, wonder why!

- back to the appdata stuff.. this is getting ridiculous.. this is where microsoft as an "operating system" vendor of a proprietary OS should step in and say no to running executable content from the "AppData" folder.. maybe I'm reading the folder name wrong, but AppData seems to imply application DATA.. not code! I think this whole concept has been tackled many times over with DEP, etc... let's not rely on IT staff setting group policies to prevent application execution to a small whitelisted group of executables with md5 hashes in order to keep this in line.

Microsoft, if this is too hard to comprehend, load up your favorite *nix distro login as root,

cd /, ls -la take a look at the file structure.. notice the "bin" and "sbin" directories.. you are getting close, and I understand you had no real processes before to keep this underwraps, but it's time to move forward.. afterall, you don't want everyone downloading chrome and bypassing internet explorer 8.0 do you? just release a "hotfix" and set the disable executables by default in the appdata folder, then publish a kb article that documents why this was poor design and offer a quick registry hack to keep it like it currently is.. problem solved.

esx.cluster.vmware.workstation.6.5.beta

2008-09-01T21:48:00.004-04:00

following the directions of a few helpful links:

http://www.ntpro.nl/blog/archives/470-ESX-3.5-is-running-on-Workstation-6.5-Build-91182-!!!.html

grab vmware workstation 6.5 release candidate build 110068 @:
http://www.vmware.com/communities/content/beta/ws65/download.html

need a iSCSI target since the shared scsi bus doesn't work with 6.5 anymore.. why I don't know.. seems like a quick thing.. also seems like I'm taking it upon my self to run the beta version, so I'l up for a non-supported option..

pick up openfiler @ http://www.openfiler.com

good iSCSI setup notes at:
http://www.applicationdelivery.co.uk/blog/leew/how-to-set-up-a-free-iscsi-or-nas-storage-system-for-vmware-esx-using-openfiler/

so end result on a Dell D630 dual-core with 4gb ram running windows 2008 x64:

(2) vmware esx 3.5.0 update 2 virtual hosts (1024mb ram/ea)
(1) virtualcenter (768mb ram)
(1) openfiler 2.3 iSCSI target serving off a simple 20gb scsi vmdk (256mb ram)
(1) windows 2003 server vm under the esx cluster with drs/vmotion/ha (384mb ram)

setup everything at first with a single NIC all set to NAT
went back and configured secondary HOST only NICs for the 4 vmware.workstation VMs for iSCSI connectivity and to assign a new vSwitch1 to both esx hosts to put the vmkernel interface.. needed a second service console as well.

tested vmotion with the windows 2003 server while running and pinging an internet site.. works great but slow.. I have a feeling this would run much better on a quad-core with an external raid array to get the disk speed up as well.

what really struck me about this is the ability to test a small scale enterprise setup of vmware esx on what would appear to be a $600-$700 laptop if the weekend sale papers are good.

ahh.. just waiting for cisco to move over to x64 processors for their routing and switching! I know gns is available but it would be great to power up a cisco catalyst switch vm!

xenserver.update.082708.txt

2008-08-27T23:25:00.003-04:00

Ok, after giving it as much hopeful effort as possible, I have decided that it isn't worth the effort at this point to try and fit XenServer into our enterprise environment. I had my concerns with no support for FC and the lack of NIC bonding since 4.0 with Xensource. I patiently awaited 4.1 and have recently finished testing the latest beta to host the new XenApp 4.5 farm.

Problems:
It takes way to long to load an initial Windows 2003 OS without the PV drivers in order to make the first template.

NIC Bonding and Trunking.. seriously, I would think this is equivalent to "anti-virus" for any product with the word "Enterprise" in the name. So why is it so difficult? VMware has a very easy to use section during the gui install that clearly lets you define the VLAN that the management interface will reside on. This indicates that they already assume you will be trunking (802.1q) if you enter something here.

In XenServer world, this is all after the fact.. it is a pain tweaking switch settings while simultaneously modifying configurations within XenCenter in order for the connection not to timeout when going from "switchport mode access" to "switchport mode trunk".. likewise when you enable channel-groups.

So, after getting somewhat of a process down to get a bond0+1 with the management interface in the proper vlan, I decide to bring up host two and create a resource pool.. oh no, that isn't possible if the management nic is in a bond or vlan.. ok, undo everything I just did and setup the master of the resource pool... Good, now redo the bonding and vlans, great.. add the second server.. nope.. looses connectivity because it inherits the bonds and vlans.. so I guess I'd need to be making those switch changes at the same time, but bottom line is that it was more than I cared to document for anyone else to try and follow.. Getting past EtherChannel and dot1q is enough for anyone to tackle without all of the added headaches.. and btw, it just works under VMware and there is no special technote article telling you to match up UUID's that are much longer than WWNs anyday :)

Also, the ISO issue was a pain.. I didn't want to setup a CIFS or NFS store, I just wanted to boot from a Windows 2003 Ent Svr R2 iso and get my os installed.. in VMware land that is just "connect/disconnect".. so I setup a local iso repository using the iso-mount folder, found a few document inconsistencies and got through it. Still.. more trouble than it is worth.

All in all, I would say that Xen will contribute greatly to the fall of VMware over time, but in the mean time, I have a XenApp farm that wants to come to life! Thank you VMware for releasing the free ESXi.. I have no problems managing each host individually with the VI client.. afterall, the real management of the farm will be within the Citrix Access Management Console and if the servers are dense enough I wouldn't really be interested in a VMotion or XenMotion..

Oh yeah, and the LVM stuff is still concerning me.. I'd still like to understand why a filesystem that is documented many times on the net as not being cluster aware is being used by XenServer? Not that big of a deal, but not sure why GFS or something made for that purpose wasn't used instead of somehow making LVM work in a clustered environment. If it wasn't that big of a deal, I'd like to see active contributions back to the open source community for LVM to help advertise it as cluster aware.. seeing as how Citrix didn't license RHEL and chose to use CentOS for their "service console" I don't think they should have a problem saying you don't need GFS for an enterprise cluster-aware filesystem. Now, VMware gets all of the marketing flack about VMFS3 as it is "proprietary"... I think those folks need to look back at NTFS from Microsoft and realize a proprietary filesystem right in front of them. It's still not too easy to get a read/write driver for Linux for NTFS!

mindtouch.deki.update.082408.txt

2008-08-24T19:42:00.004-04:00

-mindtouch deki enterprise purchased (http://www.mindtouch.com)

-using 8.05.2 version in their VM for best support

-will focus on esx vm-based replication (possibly with vReplicator) for db/attachment sync

-there is really no need to get mysql replication and rsync for filesystem syncronication because it only scales for this one app.. vm-based replication would scale better and across all systems.

-cost per year versus sharepoint (5:1 savings)

- doesn't integrate like office/sharpoint does, but how many "work in progress" docs need to be in word vs. an html wysiwyg editor?

xenserver.update.082408.txt

2008-08-24T19:15:00.003-04:00

ok, while starting to building the new xenapp 4.5 farm (knowing 5.0 is right around the corner) I've decided not to scrap XenServer Enterprise and give the latest beta with NIC bonding and SAN FC multipathing a shot for our XenApp VMs along with Citrix PVS 5.0 (btw, Dell Flexible Computing has updated their download site) http://www.dell.com/flexiblecomputing

Right now I don't have a problem saying we'll use XenCenter to manage the XenApp hosts running XenServer since the PVS servers are running in VMware ESX 3.5 along with the rest of the backend infrastructure..

I thought I would be stuck with no room for any shared storage since the SAN is fully carved with vmfs3 volumes and place from a Xen LVM but with Provisioning Server I can just stream the vDisks to the XenApp servers without a need for any hdd being visible to those VMs.

On a side note, the VNC-based implementation for the console in XenCenter is not so cool.. it "feels" like VNC versus a guest running VM Tools with VMware. If you know what I mean by the way it "feels" you'll understand.. otherwise continue clicking along.

The XenApp prep tool for PVS works good and it doesn't take long for the server to show back up in the farm after a reboot.. I haven't timed it, but I haven't tweaked it yet either.

whatsnew.081608.txt

2008-08-16T21:19:00.003-04:00

Hmm.. I think there was a bit a lag between this post and my last!

I have come to the conclusion that there is a major bottleneck between the thoughts in my head and my hands composing blog entries.

So as typical, with no ryhme or reason, here is what is going on..

- drop MBA, pursuing MPA at AppState - first semester done.

- drop XenServer Enterprise, transition to ESX 3.5 U2 (with time-bomb patch!!) - completed.

- analyze all app streaming/virtualization offerings determine best for rollout
---purchased thinstall, then new features once vmware re-released as thinapp 4.0
---overlooked citrix app streaming feature in 4.5 (stuck in 4.0 farm with time constraints)
---now pursing citrix app streaming, trying to figure out how complete offline mode users will run and not eat a full enterprise license.. that would spell bad news for citrix's offering and put thinapp right back at the top.

-implementing MS EA, so getting MS app virtualization thrown in.. we'll see about it..

-it is hard to believe that citrix had the streaming profiler 1.1 for over a year with no updates compared to what I've seen with the build release schedule with thinstall/thinapp. Makes you wonder if they just got it right, or there is ALOT of work to be done.. time will tell for me, others that have been using it for while can chime in.

-need to transistion ISA 2004 enterprise array to 2006 and move to vm environment

-enjoying zune pass.. I'm glad it is a little known secret, just wish I had known about it sooner, could have saved some more spent on albums. would like to see the zune 2.5 software on the pc have real fullscreen playback had to tweak settings on the tv to "hide" the bottom zune bar. also, what is the point to have media player 11 and zune from the same company? seems like alot of cross-development

-wanting to implement mindtouch deki as a replacement for our wiki.. ok with the debian backend, but really would like to see a good rsync (for file attachments) and mysql replication walkthrough. That or support sql 2005 express so I can use their replication

-finished 70-290, 70-291 tests.. it's amazing how I used to dread the last couple of chapters on performance monitoring with the NT 4.0 MSCE stuff and now that I use it in an out, that is really the main thing I care about.. need to read up further on the article that says alot of the perfmon metrics (ie: disk queue length, etc) are ineffective under a vm environment

-still tired on MS and the cell carriers not upgrading their smartphones to support the lastest windows mobile version and just assume you want to buy a replacement phone.. I think blackberry showed us this was the wrong way to go about it... plus it looks like you really need to by a windows mobile 6.1 to really "compete" enterprise class with blackberry.. although I don't really care for the additional dependency on the BES and blackberry servers to get my email.

-still want to run an esx cluster on 2-3 mac minis with a time capsule running nfs or iscsi as the shared datastore. if I see a post on it, I'll just assume they got the idea from here.

there is plently more but as I said earler, the hands are not fast enough to get the data out and it's time to move to other thoughts now...

NAC - A bandaid for your network?

2007-11-21T18:30:00.000-05:00

This is just a blog storming session about why I feel NAC is over-rated.. It may be the best marketing invention in a while to give vendors the opportunity to sell you a security solution, but it clearly isn't the best use of technical minds to come up with an effective way of securely managing diverse networks.

NAC - Posture Assessment

If you are responsible for keeping the corporate workstations up to date, then you are just proving to yourself that your method is ineffective if you perform posture assessment and fail the workstation. Why not concentrate on way to deliver updates and patches to a workstation while it is not directly connected to your corporate network?

- Windows Update can be configured to access an internet site accessible: (ie: windowsupdate.corporate.com) that works internally and externally.

- SMS and GPO updates can't easily be applied unless you have a VPN connection back to the corporate network.. seems like a good place for MS to work on ISA Server.

Quarantine Network

What is going to provide network services such as dhcp and dns for your quarantine environment? Are these your Active Directory DNS servers?

How isolated is it going to be if you have managed workstations that need to get updates when the users run as non-local admins?

It seems it would be more appropriate to properly engineer the network and windows services than create *another* network of update servers to do what the initial update servers should have done to begin with.

I understand that computers that aren't part of corporate policy are one of the primary reasons to quarantine. But..

Trying to stop malware by not letting the infected computers connect?

If you look at creating a network model that doesn't allow any communication to protected resources, you'll probably run across Microsoft's Server and Domain Isolation. This is a great start based on IPSEC but leaves little room for analyzing data passing across the network.

Detecting when a computer comes on the network?

- Doesn't work with SNMP notification on a switch behind an ip phone, hub, or switch
- Doesn't work with 802.1x if the port can be authorized with another device (corp workstation, print server, ip phone)
- How do you handle virtualization environments where the guests can be NAT'ed

- What about physical connectivity wired in a particular fashion:
(802.1x switch) -> (4 port hub w/ NAT) -> (Corp Workstation) + (Rogue Workstation)

Other Ideas:

Lock down all physical ports where there is really nothing to attack.. DoS is always a possibility, but when is it ever not? If you only provided DHCP, DNS, and RDP or ICA with thin clients you would have a very tight ACL that could be applied to a client VLAN.

Only allow guest's wireless access.. much easier to control how can and cannot connect to secure WPA2 enabled SSIDs.. Guests have access to open SSIDs.. then you focus on traffic shaping and ACLs to allow only certain ports. Deep inspection on those few open ports would be great, a few vendors will look inside SSL..

I'll elaborate more on the details of each of these thoughts in future posts..

Using VLC to create a web-based VOD library

2007-11-18T21:54:00.000-05:00

There are many reasons why you would want to create Video-on-Demand library with a web interface.. training videos, past security recordings, news clips, etc..

My reason was different this weekend.. it is starting to become difficult to weed through all of the DVDs with children's show for my daughter. While she has no problems sorting through the DVDs and picking out a show to watch if we label it correctly, it still is time consuming and over time the discs become worn and damaged. I needed a way to create a video on demand library and have it easy to use for her. Since she can navigate around on the web just fine, I wanted to make it as simple as YouTube for point and click access to her shows.

Enter VideoLAN VLC Player/Server

Now we can do the following:
TV -> DVR -> DVD -> VLC -> RTSP -> PC = Happy Child

The quick and dirty approach for serving DVDs over wired/wireless for VOD via the web:

Download and install VLC 0.8.6c here.
Copy the entire VIDEO_TS folder from the DVD under a directory (ie: d:\videos\kidshow1)
Create a vlm.conf folder under c:\program files\videolan\vlc with the following contents:

vlm.conf
--------
# rtsp streams

new kidshow1 vod enabled mux mp2t input "dvdsimple://d:\videos\kidshow1@1:1"

# @1:1 specifies the first title and chapter
# @2:1 would automatically select the second title

Create a shows.html under c:\program files\videolan\vlc\http with the following contents:

shows.html (for firefox plugin only, replace [] with <>)
--------
[html]
[head][title]Kids Show #1[/title][/head]
[body]
[h1]Kids Show #1[/h1]
[embed type="application/x-vlc-plugin"
name="kidshow1"
autoplay="yes" loop="no" hidden="no" width="640" height="480"
target="rtsp:@localhost/kidshow1" /][br /]
[a href="javascript:;" onclick='document.kidshow1.play()']PLAY[/a]
[a href="javascript:;" onclick='document.kidshow1.stop()']STOP[/a]
[a href="javascript:;" onclick='document.kidshow1.fullscreen()']FULLSCREEN[/a]
[/body]
[/html]

Now run the vlc app on the "server" from: c:\program files\videolan\vlc with the following arguements:

vlc -I http --vlm-conf vlm.conf --rtsp-host 0.0.0.0:554

This will launch vlc without the gui and the web admin interface is on port 8080
You can get the the vlm portion of the configuration at:
http://localhost:8080/vlm.html and verify the VOD stream is loaded.

On the viewing computer just browse to:

http://vodserver:8080/shows.html

Of course, there is alot more design that needs to go into the web pages to make this kid friendly, but that is just the icing on the cake.

This worked over a 11mb/s wireless connection without any problems. You need around 4mb/s so don't count on a weak 1mb/s wireless connection for anything but garbage!

There are some limitations with this configration, mainly not being able to use IE as the browser.. but the firefox plugin sample was so easy to get started with.

More reference information at:
http://people.videolan.org/~dionoea/vlc-plugin-demo/serversetup.php

And for a nice cross browser player with a slider bar:
http://people.videolan.org/~damienf/plugin-0.8.6.html

Now to get this running as a service and find out a quick way for my wife to be able to import new DVDs and change the vlm.conf file on the fly!

Xen-based VMM with SAN-less HA from Thinsy

2007-11-16T20:47:00.000-05:00

After reading the latest blog post from virtualization.info:
http://www.virtualization.info/2007/11/thinsy-announces-7th-xen-based.html

I just can't help wonder how many more Xen-based virtualization packages are going to delivered and how well they are going to keep up with Xen's release of the VMM along with their own enhancements and modifications. It seems like everyone is ready now that Xen 3.1.0 supports Windows-based guest OSes.

What is interesting in this release is that I've just finished a proof-of-concept with XenEnterprise 4.1 to perform disk to disk replication and XenMotion utilizing LVM on top of DRBD 8.2.1 since XenSource (now Citrix) provides a DDK image to recompile kernel modules for Dom0. It worked and I was able to perform XenMotion with running DomUs between the two hosts utilizing a primary/primary cluster with the "allow-two-primaries" option in the DRBD resource config file.

It will be interesting to see what Thinsy's EnSpeed VMM is using as an underlying filesystem and whether Jagane Sundar wrote his own disk sync program for LiveSync or is utilizing DRBD or the likes. Maybe he will post an entry on his blog explains the underlying details.. until then, I'll have to wait until my 1.3gb iso download completes before I can look under the hood.

Thin Clients, Library Shared Workstations, VDI for a perfect combo

2007-11-15T22:13:00.000-05:00

Microsoft has matured their original Shared Computer Toolkit to Windows SteadyState. The new version is well documented and really becomes a player against existing Deepfreeze environments for libraries. The Windows Disk Protection feature is very similar and now supported scheduled update windows.

If this product were to be combined with thin clients at libraries along with VDI and a SteadyState prepared load of Windows XP you would have a great combo for an IT staff and librarian freedom for implementation of new software in computer lab or kiosk environments.

Utilizing thin clients, you could reduce the hardware costs and risk of theft or damage at the physical lab setting. Having the image run on backend servers would minimize replacement or addition time frame of new lab computers. This would work especially well if you utilized a single virtual drive that they all boot from..

Library staff would be able to make changes and add software very easily with wizard interface in the SteadyState application and then re-protect the hard drive after installation.

Once SteadyState 2.5 comes out of beta and supports Windows Vista, it would be just creating another image on the VDI servers and instructing then thin clients to run the new OS. You could even offer the lab users an option and have the library staff select the image based on their preference if needed.

Site Content Introduction

2007-11-13T23:53:00.000-05:00

The purpose of this blog is to document thoughts and ideas about events that relate to my daily work and research. It's hard to try and give back thoughts and opinions in a digital communication form when you are so used to formulating ideas and concepts from Googling everything, subscribing to a hundred or so RSS feeds, and drilling through all of the marketing hoopla with vendors. There is not enough time to digest the information I've read and heard, let alone try and comment on it in any meaningful way.

Nonetheless, I feel it is about time I tried.. we'll see how it goes, and hopefully there will be some unique content that will be considered a contribution back to the greater good.

Topics that are currently at the top of my interest:

virtualization - comparison of hypervisors and the end game of commodity enterprise v12n
network security - documentation of best practices, focusing more real ways to solve problems instead of buying alot of appliances to make you feel that you are more secure.
network monitoring - how to proactively monitor your critical resources (does anyone sleep beside their Blackberry in the normal profile?? hmm.. it has to be possible)
web apps - Google Apps and Amazon EC2 are changing the way we think about storing critical business data and running our virtualized servers.. just waiting for pdf upload at Google Docs and Xen 3.1 at Amazon EC2

more to come..