There is a lot to say about System Center VMM 2012 SP1. Some say System Center VMM 2012 is a must for any serious Private Cloud, others say some of its features should have been incorporated into the Windows Server OS. Early adopter of Windows Server 2012 were forced to design their environment without System Center VMM and are facing some challenges when to want to move their management functionalities to System Center VMM 2012 SP1. I did a couple of sessions on networking in System Center VMM 2012 SP1. Most Fabric Administrators find this part of VMM a bit daunting, to put it mildly.

No matter what you think of System Center 2012 SP1, if you decide to use System Center VMM 2012 SP1 to manage your Private, Hybrid or Hosted Cloud (and you should) you will find that with some features will create dependencies on System Center VMM 2012 SP1. A solid basis for your management environment requires redundancy at all levels.

In this blog I will walk you through the step to create a High Available (HA) System Center 2012 SP1 environment. The design exists of a Hyper-V cluster for physical redundancy, a guest based SQL Server 2012 Always On Availability Group for database redundancy, a guest based System Center VMM 2012 SP1 failover cluster for VMM redundancy and a Scale Out File Server (SOFS) for Library redundancy.

The quorum settings for the VMM cluster and the SQL cluster are based on Node and File Majority. In a single location design the preferred additional cluster vote is a quorum disk. The advantage of a Node and File Majority is that you can divide the management environment over two geographical locations without the need for synchronous replication of a SAN based quorum disk. You could use a Windows Azure Virtual Machine to provide the file share for the SQL and the VMM cluster node and file majority.

A Scale Out File Server (SOFS) requires a shared disk for a high available share. Each location will have its own SOFS. This blog describes to steps to configure the SQL Always On Availability Group and the System Center VMM Failover Cluster.

If you need guidance on how to set up a Scale Out File Server check this great blog by Jose Barreto.

Prerequisites

Before you start make sure you have the following prepared.

• Active Directory domain
• Windows Server 2012 host cluster dedicated for management
• Scale Out File Server with the following shares
  • SQLQuorum
  • SQLAG
  • VMMQuorum
  • VMMLibraryAdmin
  • VMMLibraryReadOnly
• Two virtual machines, domain joined and named SQL1 and SQL2
• SQL1 and SQL2 have an additional VHDX for storing the databases
• Two virtual machines, domain joined and named VMM1 and VMM2 with a minimum of 4GB Memory
• It is recommended (but not required) that you have two Hyper-V switches in each physical host connected to NIC teams. Add both Hyper-V switches to the virtual machines SQL1, SQL2, VMM1 and VMM2. In the virtual machine configure one NIC for management (with a default gateway) and one NIC for Cluster traffic (without a default gateway). It is also possible to add two virtual network adapters to a virtual machine, attached to the same Hyper-V switch, that connects to one NIC team.

Required user accounts

You can designate separate service accounts for each SQL Server 2012 service and you will create additional Run As accounts in System Center VMM 2012 SP1. The following domain user accounts are required as a minimum:

• SQL Server service account (domain\SVCSQL)
• VMM service account (domain\SVCVMM)

SQL Server 2012 Always On Availability Groups

Failover Cluster

Logon to SQL1 as a domain administrator and install the following features

• .Net Framework 3.5
• Failover Clustering

After a default Windows Server 2012 installation the .NET Framework 3.5 installation files are not location on your hard drive. When you add the feature, Server Manager allows you to specify an additional path where the files are located.

After repeating these steps on SQL2 open the Failover Cluster console from the Server Manager. Select to validate a configuration and add server SQL1 and SQL2 to the test. Specify to run all test and complete the Wizard.

The Failover cluster wizard performs several tests to check if SQL1 and SQL2 can be clustered. Since there is no shared storage, some tests will generate a warning. In you have not created a second Hyper-V switch for Cluster traffic, additional warnings will be generated. When the wizard completes without errors, you can create the cluster using the validated nodes.

Specify the name and IP address of the cluster. Please take note that this name is not the Client Access Point.

When the cluster is successfully configured, logon to SQL1 with as a domain administrator.

SQL Server 2012

Create a firewall rule on SQL1 and SQL2 that allows inbound TCP port 1433 and TCP port 5022. These ports are required for the SQL Server Always On Availability Group.

Start the installation of SQL Server 2012. Select a new SQL Server stand-alone installation. Include the SQL Server updates, select SQL Server Feature Installation and specify what features you want to install. For this blog we will choose the minimum. Database Engine Services and the Management Tools. Select to use the default instance.

In the server configuration tab of the installation wizard provide the domain service account and password we created earlier.

System Center VMM 2012 SP1 is compatible with the default SQL Server 2012 collation Latin_General_CI_AS.

The Database Engine Configuration tab of the installation wizard allows you to select an Authentication Mode. For System Center VMM 2012 SP1 HA you can use Windows authentication mode. SQL Server 2012 SP1 Always On Availability Groups replicates databases that are stored on local disks on the SQL Servers. Shared storage is not required. Specify a location for the databases on the Data Directories Tab.

Complete the installation and repeat the SQL Server 2012 installation steps on SQL2.

Logon to SQL1 and open SQL configuration and services, right click SQL Server service and select properties.

Open the Always On High Availability tab and enable Always On Availability Groups.

Restart the SQL Server Service and repeat these steps on SQL2.

We need to enable the Availability Group before we can use the Availability Group Listener. This procedure requires a database. We will manually delete this temporary database when System Center VMM 2012 SP1 has created its database in the Availability Group. Each database that will be added to the availability group must meet two prerequisites.

• Database recovery model must be set to Full
• A backup of the database is completed

Logon to SQL1 as a domain administrator. Open SQL Server Management Studio. Create a database. The name is not really relevant. I used Enable Always On so the role of the database is clear.

Open the properties of the SQL server, select the Logging tab and verify that the recovery model is set to Full.

Apply the settings and perform a backup of the database to local disk.

In the SQL Server Management Studio right click Availability Groups and start the New Availability Group Wizard. Specify a group name for the availability group. This group name is only used as a label in SQL Server. The select databases tab display all the databases on SQL1 and if these databases meet the prerequisites to be added to the availability group. Select the database you just created.

The specify replicas screen shows four tabs. In the replica tab select Add Replica and connect to SQL2 with Windows Authentication. Enable the checkmarks on Automatic Failover and Synchronous Commit on both Replicas.

Open the Listener tab and select Create an availability group listener. Specify a Listener DNS name, a port and IP address. We will use the Listener DNS name later when configuring System Center 2012 SP1.

On the Select Data Synchronization screen select full data synchronization and specify a shared network location for initial synchronization. The share will be used to create a backup of the database by SQL1 and a restore of the backup on SQL2.

With the prerequisites in place the Validation screen should pass successfully. When the wizard runs you will probably end up with an error on the Create Availability Group Listener step.

Clicking on the Error hyperlink will display SQL Server error: 19471

The WSFC duster could not bring the Network Name resource with DNS name ‘SQL’ online. The DNS name may have been taken or have a conflict with existing name services, or the WSFC duster service may not be running or may be inaccessible. Use a different DNS name to resolve name conflicts, or check the WSFC duster log for more information. The attempt to create the network name and IP address for the listener failed. The WSFC service may not be running or may be inaccessible in its current state, or the values provided for the network name and IP address may be incorrect, check the state of the WSFC duster and validate the network name and IP address with the network administrator.

This error message can be somewhat misleading. The real cause for this issue is that the SQL cluster virtual network name account does not have permissions on its OU in Active Directory to create computer objects. To resolve the issue open the Active Directory Users and Computers console right click the Organizational Unit that contains the SQL Server computer accounts and the SQL Server cluster virtual network name account and select properties.

Open the security tab and click Advanced. Select Add and add the Create Computer objects permissions for the SQLCluster account. Apply these settings to this object and all descendant objects.

The previous New Availability Group wizard created a backup on the file share and restored a database copy on SQL2. We need to delete the backup file on the file share and the restored database on SQL2 before running the New Availability Group wizard again on SQL1. The New Availability Group wizard should complete successfully now.

System Center Virtual Machine Manager 2012 SP1 high availability - the first node

With a high available SQL Server in place we are ready to install System Center 2012 SP1. High Availability in System Center VMM 2012 SP1 also uses Windows Server 2012 failover clustering. Install the Failover Clustering feature on VMM1 and VMM2. Logon to VMM1 as a domain administrator and open the Failover Cluster Console from the Server Manager. Select to validate a configuration and add server VMM1 and VMM2 to the test. Specify to run all test and complete the wizard.

Start the Create Cluster wizard after the tests complete without errors. You need to specify a name and IP address for the Cluster (the Client Access Point will be created later by the System Center 2012 SP1 installation wizard).

System Center VMM 2012 SP1 requires the Deployment Tools and the Windows Preinstallation Environment features from the Windows Assessment and Deployment Kit (ADK). You can download the Windows Assessment and Deployment Kit here (http://www.microsoft.com/en-us/download/details.aspx?id=30652). Select the required features in the ADK installation wizard.

Before we start the System Center VMM 2012 SP1 setup add the VMM service account (hypervnu\SVCVMM) to the local administrators group on server VMM1 and VMM2.

Logon to server VMM1 as a domain administrator and run the System Center 2012 VMM SP1 setup. The prerequisite check should complete without warnings or errors. In the Database configuration screen specify the SQL Server 2012 Always On Availability Group DNS listener we created earlier (in this example SQL). The wizard will communicate with the SQL server to verify the SQL Server environment. If you have not changed the default port in SQL Server it is not necessary to enter the port number in the wizard.

The cluster configuration screen allows you to specify the System Center VMM 2012 SP1 cluster name and IP address (in this example VMM). These settings are used when clients are accessing the environment.

VMM encrypts some data in the VMM database. In a high available System Center VMM 2012 SP1 environment multiple servers need to access this encrypted data. The setup wizard allows you to specify a container in Active Directory to store the encryption keys. This container should be created before continuing with the setup wizard.

Logon to a domain controller, open adsiedit.msc and connect to the default naming context. Right click the domain object and select New > Object.

Select the container class and specify VMMDKM as value. Right click the CN=VMMDKM container you just created and select properties. Select the security tab and give the VMM Service account created earlier (in this example hypervnu\SVCVMM) Full control on this object and all descendant objects.

When the object is created and the permissions are applied we can continue with the System Center 2012 SP1 setup wizard. In the Configure service account and distributed key management screen specify the VMM service account and password we created earlier. In the Distributed key Management section specify the common name for the VMMDKM object we just created.

Please take note of the misleading dot at the end of the example. You could mistake the example to enter the location is the following format.

CN=VMMDKM,DC=hyper-v,DC=nu.

This dot at the end will result in the following error.

The error is not related to permissions. Entering the common name without the ending dot will result in a successful validation by the setup wizard.

CN=VMMDKM,DC=hyper-v,DC=nu

The Port configuration screen allows you to change the ports used for various VMM features. It is not supported to host a Virtual Machine Library on a System Center VMM 2012 SP1 node in a high available environment. The setup wizard will prevent you from doing so by greying out the Library configuration screen.

When the setup wizard completes you will probably end up with the following errors.

• Starting the clustered VMM service VMM failed. Ensure that the user has permission, the VMM service is installed properly, and cluster resources can be brought online.
• A service connection point (SCP) could not be registered in Active Directory Domain Services (AD DS) for the VMM management server. Run “C:\Program Files\Microsoft System Center 2012\Virtual Machine Manager\setup\ConfigureSCPTool.exe –install VMM.hyper-v.nu HYPERVNU\VMM$” in a command windows and then check AD DS. If a SCP is not registered, VMM consoles on other computers will not be able to connect to this VMM management server and deploying a Hyper-V host to a bare-metal computer will not work.

Starting the clustered VMM service failed

A high available System Center VMM 2012 SP1 installation is configured as a generic cluster service. When you open the failover cluster manager on VMM1 you will notice that the VMM clustered service is in the status failed.

The Failover cluster virtual network name account does not have the required permissions on its Organization Unit in Active Directory. To resolve this issue logon to a domain controller and open an Active Directory Users and Computers console. Right click the Organizational Unit where the vmmcluster.hyper-v.nu failover cluster virtual network name account is located and select properties. Give create computer objects permissions to the vmmcluster.hyper-v.nu failover cluster virtual network name account on this object and all descendant objects.

After applying the settings open the failover cluster manager on VMM1 again. You should now be able to start the VMM clustered service. When the clustered service is started an additional failover cluster virtual network name account (in our example VMM) is created in the same Organization Unit.

A service connection point (SCP) could not be registered in Active Directory

The service connection point for System Center VMM 2012 is a child object to the failover cluster virtual network name account that was created in the previous step. Since this parent object could not be created during the installation, the creation of the child object also failed. Before we can resolve this issue the VMM clustered service must be successfully started (which ensures the required object in Active Directory is present).

Open a command prompt on VMM1 as domain administrator and run the following commands.

Cd C:\Program Files\Microsoft System Center 2012\Virtual Machine Manager\setup\

ConfigureSCPTool.exe -Install <Client Access Point FQDN> <domain>\<Client Access Point NetBIOS Name>$

In this example

ConfigureSCPTool.exe -Install VMM.hyper-v.nu HYPERVNU\VMM$

This command creates a service connection point object as a child object to the Client Access Point in Active Directory. You can verify the creation of the object by opening adsiedit.msc on a domain controller. The SCP has a common name of MSVMM.

If you skip this step and install the second VMM server in the cluster the setup wizard will result with the same error but a different command to resolve the issue.

Cd C:\Program Files\Microsoft System Center 2012\Virtual Machine Manager\setup\

ConfigureSCPTool.exe -AddNode <Client Access Point FQDN> <domain>\<Client Access Point NetBIOS Name>$

In this example

ConfigureSCPTool.exe -AddNode VMM.hyper-v.nu HYPERVNU\VMM$

Please take not that running the AddNode command will not create the SCP.

Preventing the issues

The issues can be prevented by applying the create computer objects permissions to the vmmcluster failover cluster virtual network name account before running System Center VMM 2012 SP1 setup.

Enable high availability for the System Center VMM 2012 SP1 database

Before adding the second node to the VMM cluster it is a good idea to test the availability of the database in the SQL Server Always On Availability Group. Login to SQL1 and open the SQL Server Management Studio. To prepare the VMM database for the availability group the logging model must be adjusted to Full. Open the properties of the VirtualManagerDB database and select the options tab. Change the Recovery model from Simple to Full.

Next an initial backup of the database must be performed before we can add it to the availability group. After the initial backup is completed right click the Availability Databases entry of the Availability Group (in this example SQL) and select Add Database.

The Add Database to Availability Group wizard will display all available databases and if they meet the requirements to be added to the Availability Group. Select the VirtualManagerDB database. Select a full data synchronization and complete the wizard.

The VirtualMachineDB database is now part of the SQL Server Always On Availability Group and can be moved to SQL2 by failing over the availability group. Open the Failover Cluster Manager on SQL1, right click the SQL clustered service, select move and select node SQL2.

The failover will complete successfully. But the Failover Cluster manager on VMM1 will display the VMM clustered service in a failed status.

SQL Server Availability Groups synchronizes databases between the cluster nodes. Other settings are not synchronized. When you compare the Logins between SQL1 and SQL2 you will notice that SQL2 does not have a login for the VMM service account (in this example hypervnu\SVCVMM).

Right click logins in SQL Server management studio connected to SQL2 and select add. Add the VMM service account (in this example hypervnu\SVCVMM). The database already contains the settings for this domain account so other settings do not need to be changed.

After adding the account the VMM clustered service can be started successfully. The SQL Server Availability group is now configured correctly for System Center VMM 2012 SP1.

System Center Virtual Machine Manager 2012 SP1 high availability – the second node

With the VMM database in an operational SQL Server Always On availability Group we are ready to add the second node to the System Center VMM 2012 SP1 cluster. Before running the setup wizard verify the prerequisites on VMM2 are completed.

• Installed the Deployment Tools and the Windows Preinstallation Environment features from the Windows Assessment and Deployment Kit (ADK)
• Added the VMM service account (hypervnu\SVCVMM) to the local administrators group

After verifying the prerequisites start the System Center VMM 2012 SP1 setup wizard. The setup wizard will detect that VMM2 is part of a Failover Cluster and prompt you to add this server as a node.

The Database configuration screen will be grayed out. In the Configure service account and distributed key management screen specify the password for the VMM service account. With all prerequisites in place the setup wizard should complete successfully.

Open a Failover Cluster manager console on VMM2 and move the VMM clustered service from VMM1 to VMM2. With all servers in place you now own yourself a high svailable System Center 2012 SP1 environment, with high availability at the host level, the database level and the VMM level.

More information

Introduction to Failover Clustering with Windows Server 2012

Windows Server 2012 Scale-Out File Server for SQL Server 2012 – Step-by-step Installation

Now some days after the event we can conclude that everything was great. Amply 100 visitors has visit the event, the visitors were really satisfied about the location, the reception, the lunch, the coffee, the presenters, the presentations actually about the whole event! ….and that’s great to see and hear!

A special word of thanks to VX Company, they facilitate a great location and were very hospitable. Also many thanks to the sponsors: Amsio, Comparex, Duvak, Imara ICT, Inovativ, Savision and Wortell.

Then our ‘Beast from Belgium’ Didier van Hoye aka WorkingHardInIT. Still suffering from a jetlag he came over to the Netherlands and present a top session, with deep technical content and a good sense of humor! Thank you Didier!!

Last but not least we thank all visitors for this great event, you all made this a great success.

The presentations are online and you can find them on the following locations:

• NIC Teaming and Converged Fabric – Marc van Eijk
• Cluster Aware Updating – Maarten Wijsman
• Make your VM mobile – Hans Vredevoort
• The way you can deploy Hyper-V – Peter Noorderijk
• Advanced networking capabilities – Didier van Hoye

See you all on our next event!

To change this priority we first tried to use the Set-VMMigrationNetwork PowerShell command. Unfortunately this command can only be used when dealing with non-clustered Hyper-V hosts. So we dug deeper and deeper using different PowerShell commands and BING without any satisfying results.

Then we realized there is something called “the registry” which holds the HKEY_LOCAL_MACHINE\Cluster key. After some more digging we found two registry entries called MigrationExcludeNetworks and MigrationNetworkOrder. These entries hold the IDs and order from the Cluster Networks available in your cluster.

Aha … room for possibilities! So, changing these registry entries would order and select the Cluster Networks in the way you want? Yes it does!

For this we fabricated some PowerShell lines.

$ClusterNetworkLM = Get-Clusternetwork LM
$ClusterNetworkCLUSTER = Get-Clusternetwork CLUSTER
$ClusterNetworkMGMT = Get-Clusternetwork MGMT
$ClusterNetworkISCSI = Get-Clusternetwork ISCSI

$includeIDs = $ClusterNetworkLM.id + ";" + $ClusterNetworkCLUSTER.id
$excludeIDs = $ClusterNetworkMGMT.id + ";" + $ClusterNetworkISCSI.id

Set-ItemProperty -Path "HKLM:\Cluster\ResourceTypes\Virtual Machine\Parameters" -Name MigrationExcludeNetworks -Value $excludeIDs
Set-ItemProperty -Path "HKLM:\Cluster\ResourceTypes\Virtual Machine\Parameters" -Name MigrationNetworkOrder -Value $includeIDs

The result is very very satisfying as you can see in the screen dump below. We are now able to control the order and the selection of the Live Migration settings in a cluster using the Cluster Network ID’s.

The Microsoft Virtual Machine Converter provides a Microsoft-supported, freely available, stand-alone solution for converting “the other guys”-based virtual machines and virtual disks to Hyper-V-based virtual machines and virtual hard disks (VHDs)—including conversion from “the other guys” to Hyper-V on Windows Server 2012. Because MVMC has a fully scriptable command-line interface (CLI), it integrates especially well with data center automation workflows such as those authored and run within Microsoft System Center 2012 – Orchestrator. It can also be invoked through Windows PowerShell.

MVMC provides you with:

• A quick, low-risk option for “the other guys” to evaluate Hyper-V.
• Converts “the other guys” virtual machines to Hyper-V virtual machines: The VM Conversion will convert “the other guys”-hosted virtual machines and ensure that the entire configuration, such as memory, virtual processor, and other machine configurations, is also migrated from the initial source. The tool also adds virtual NICs to the deployed virtual machine on Hyper-V.
• Supports a clean migration to Hyper-V with uninstallation of VMware tools on the source virtual machine.
• Provides a wizard-driven GUI, making it simple to perform virtual machine conversion.
• Installs integration services for Windows 2003 guests that are converted to Hyper-V virtual machines.
• Supports conversion of virtual machines from “the other guys” vSphere 4.1 and 5.0 hosts, including those hosted on a vSphere cluster, to Hyper-V. The tool also supports migration of virtual machines to a Hyper-V host that is part of a failover cluster.Note   MVMC also supports conversion of virtual machines from “the other guys” vSphere 4.0 if the host is managed by vCenter 4.1 or vCenter 5.0. You have to connect to vCenter 4.1 or 5.0 through MVMC to convert virtual machines on vSphere 4.0.
• Supports offline conversions of “the other guys”-based virtual hard disks (VMDK) to a Hyper-V-based virtual hard disk file format (.vhd file).
• Includes a fully scriptable command-line interface (CLI) for performing machine conversion and offline disk conversion, integrating with data center automation workflows such as those authored and executed within System Center 2012 – Orchestrator. The command line can also be invoked through Windows PowerShell.

MVMC simplifies low-cost, point-and-click migration of Windows 7, Windows Vista, Windows Server 2008 R2, Windows Server 2008, Windows Server 2003 R2 with SP2, and Windows Server 2003 with SP2 guest operating systems from VMware to Hyper-V.

The MVMC Automation Toolkit is a collection of PowerShell scripts that will automate conversions using the MVMC.exe. It is back-ended by a SQL instance (SQL Express will work). You can use it to convert several machines at once, on a single server or across many servers at once.

MVMC Automation Toolkit can be considered as a low budget very easy to use toolkit to automate migrates from “the other guys” to Hyper-V. If you want to know more about this tool you have to watch this session!

As you might have noticed from my previous blogs I have a great interest in Windows Azure for Windows Server. In session WS-B303 Windows Server Virtual Machine: Adding Windows Azure Services Program Managers Marc Umeno and Anjli Chaudhry explain the components, lessons learned (some of them looked very familiar ) and some demos.

One slide caught my attention.

In this slide Marc Umeno talks about an upcoming development in Windows Azure For Windows Server. In the current version user accounts are stored in an ASP.NET membership SQL database. This is a great solution for Service Providers, but (except for the Admin Site) there is no integration with Active Directory.

The product team is working on Active Directory integration for a future release.

What users will logon to the portal with Active Directory accounts? Users from the internal organization.

If you think about it, it is a logical step. Whether self-service users manage their services in Windows Azure, in a hosted cloud or in their own private cloud, they can access them through a uniform portal. It also fits in the roadmap to drive the adoption of Windows Azure in a great way.

Where does this leave System Center App Controller? Maybe the product team working on Windows Azure for Windows Server might be reinforcement with the System Center App Controller product team. At the end of the session Marc Umeno specifies that at TechEd (taking place June 3-6, this year) more information will be disclosed. So stay tuned.

After experimenting a lot with VMM 2012 SP1 networking, I am slowly getting more proficient in this area but I can assure you there is a lot of ground to cover.

Posters like this help you get all the pieces together.

I am currently rebuilding our lab using the Logical Switch using uplink port profiles, native port profiles, virtual network adapters and port classifications. It is cool stuff and in the end makes a lot of sense. It’s just the learning curve that is fairly steep.

The other hard thing is that if you have already deployed your Hyper-V clusters using PowerShell for building your NIC Teams and Hyper-V Extensible Switches, it is not possible to just apply a Logical Switch on top of your existing configuration. The only way is to wipe your network configuration or your entire server. A bare metal deployment via VMM 2012 SP1 is probably the best method, including the various VMM integrations you might be able to download from your server hardware vendor. HP has released a nice integration which adds all latest device drivers into the VMM Library.

In your VMM Host Profile you can use these drivers tagged for the correct operating system.

When you deploy a new physical Hyper-V server you get a chance to configure your NICs using the Logical Switch which is built from the Uplink Port Profile mentioned earlier.

Rolling out a new cluster including all networking complexity can be done with VMM 2012 SP1 Bare Metal Deployment.

So here is the link to the poster:

http://www.microsoft.com/en-us/download/details.aspx?id=37137

Series on VMM 2012 SP1 Virtual Networking:

http://blogs.technet.com/b/scvmm/archive/2013/01/08/virtual-networking-in-vmm-2012-sp1.aspx

Greg Cusanza’s TechDays 2013 presentation What’s New in VMM 2012 SP1:

http://technet.microsoft.com/en-US/video/Dn189146(MSDN.10)?query=1

Greg Cusanza’s TechDays 2013 presentation on VMM 2012 SP1 networking:

http://technet.microsoft.com/en-us/video/tdbe13-network-management-in-system-center-2012-sp1-vmm

HP Insight Control including SCVMM 2012 SP1 Integration:

http://www.hyper-v.nu/archives/hvredevoort/2013/03/making-virtual-machine-2012-sp1-networking-work/

• Installing and configuring System Center Service Provider Foundation
• Installing and configuring Windows Azure for Windows Server – Part 1
• Installing and configuring Windows Azure for Windows Server – Part 2
• Installing and configuring Windows Azure for Windows Server – Part 3
• Installing and connecting System Center App Controller to System Center Service Provider Foundation

In the previous part of this blog we prepared the Service Management Portal and API for tenant access. This part of the series covers the experience from a tenant point of view.

Signing up

When a tenant connects to the Tenant Site on the public secure URL (in our example https://portal.hyper-v.nu) the portal presents the login page.

A new tenant can sign up to a public plan by selecting signup in the top right.

When a new tenant selects a plan that was made public, the descriptions we specified earlier are shown. When a new tenant enters an email address, a password and clicks sign up the user account will be created in the SQL database and the tenant logs in to the Tenant Site.

It is possible to create an additional step for a new tenant by specifying an invitation code in the public plan.

When a new tenant selects to sign up to a public plan that has an invitation code specified the user is presented with an additional column Access Code in the portal.

If a new tenant is unable to specify the correct invitation code, the signup process will fail. This allows you to prevent anonymous users from signing up and still use a public plan, by providing new tenants with an invitation code upfront.

Create VM Network

When the initial configuration of Network Virtualization (as described in the previous part) is completed, a tenant is able to create a new network from the Tenant Site. Select New > Networks > Quick Create and specify the friendly name for the Network and select the Provider Address Space. The name of the Provider Address Space is defined in System Center VMM 2012 SP1. I this blog series I have named it “Provider Address Space” so that is clear to see what setting is displayed here. But you can define a more appropriate name for your environment.

After the tenant selects to Create a Network, a new VM Network is created in System Center Virtual Machine Manager 2012 SP1. The Address Space for the new VM Network is a fixed value in the current release of Windows Azure for Windows Server. The first VM Network a tenant creates is assigned a network address of 10.0.0.0/16 and the tenant is unable to change these settings.

In System Center VMM 2012 SP1 it is possible to change these settings. To change the subnet for a VM Network that was created by a tenant, select the VM Networks tab in the VMs and Services menu. Select the VM Network created by the tenant, add a VM Subnet and specify an IP Pool. Delete the default 10.x.x.x IP Pool.

After refreshing the Tenant Site, the VM Network will reflect the new settings. You might call it BYOIPWALHFTSP (Bring Your Own IP with a little help from the Service Provider).

Hopefully the product team will improve this feature in time for the first network virtualization gateways to be publicly available.

When the tenant creates a second VM Network in the Tenant Site a new VM Network is created in System Center VMM 2012 SP1. The second VM Network is assigned a network address of 10.1.0.0/16 and is a dedicated routing domain. No routing is possible between the different VM Networks.

The VM Networks tab in the VMs and Services menu in System Center VMM 2012 SP1 displays the VM Networks from all different tenants. When different tenants use the same name for a VM Network the VM Networks tab does not show a clear distinction. I have not found a way to easily filter this overview per tenant.

Create a virtual machine

After logging into the Tenant Site an overview is shown of all configured objects for this tenant. By clicking New > Virtual Machines in the bottom menu the tenant can choose to Quick Create or Custom Create a virtual machine.

The biggest difference between the two is that Custom Create allows a tenant to select a VM Network at virtual machine creation time rather than adding it to the configuration after the virtual machine is created. This requires the tenant to create a VM Network before creating a new virtual machine.

Each option (Quick or Custom create) will instruct System Center VMM 2012 SP1 to create a virtual machine based on the settings defined in the VM Template created earlier.

Change VM settings

When the Virtual Machine is deployed the tenant is able to make changes to the “hardware settings” of the virtual machine. The tenant can change these settings by applying a different Hardware Profile. The tenant can choose from the Hardware Profiles created in System Center VMM 2012 SP1, that are assigned to the hosting plan. A virtual machine needs to be stopped before another Hardware Profile can be applied.

Besides the predefined Hardware Profiles a tenant is also attach a VM Network, a virtual hard disks and a DVD. To attach any of these objects, select a virtual machine and select attach on the bottom menu.

A virtual machine needs to be stopped before any of these objects can be attached.

Attach VM Network

To attach a new or an additional VM Network to a virtual machine, select Attach > Network and select the VM Network that the tenant created earlier.

Before we can add a virtual hard disk or an ISO file, the tenant should have access to a library where these objects are located. First create a read-only library share where all the objects will be saved. You can define a single share for all clouds or create a dedicated share for each cloud. Future updates will probably provide access to more types of objects (for example service templates).

When the read-only library share is created, select the cloud that is associated with the public hosting plan, open the properties, select libraries and add the read-only library share that you created for this plan.

Attach Disks

After the read-only library has been attached to the cloud that maps to the hosting plan, a tenant can add a virtual hard disk to a virtual machine. Select the virtual machine in the Tenant Site. Verify that the virtual machine is in a stopped state. Select Attach > Disk in the bottom menu.

The public Cloud OS Windows Azure limits you to add a maximum of 16 disks to a virtual machine. Adding disks in Windows Azure for Windows Server is limited to 64 disks per virtual machine specified by the amount of disks that can be attached to a SCSI controller in Hyper-V.

All disks are attached by System Center Virtual Machine Manager 2012 SP1 to the virtual machine SCSI controller.

Attach ISO

It is also possible for the tenant to attach an ISO file to a virtual machine. The prerequisites for attaching an ISO are identical to attaching a virtual hard disk. A read-only library share must be specified in the System Center 2012 SP1 cloud that is mapped to the Hosting Plan.

Remote access

Remote access is probably the biggest challenge with the current release. A virtual machine is not much of use when you are unable to access it. Without a NVGRE gateway available Network Virtualization is completely isolated, the only thing we can do here is wait for a public release of a NVGRE gateway. With VM Networks based on VLANs we have some possibilities in place. Besides routing and VPN policies managed by the Service Provider there is also a connect button for every virtual machine in the Tenant Site. By default the IP address of the virtual machine is injected into an RDP file that is presented to the tenant when he clicks the connect button. No additional settings are specified in this RDP file. Without a VPN tunnel in place the connection to the virtual machine will fail.

The product team created an extension in the web.config file that allows you to specify a custom HTTP endpoint location where these RDP files can be placed. I have played with the idea of creating a RD Gateway accessible for all tenants that will only allow a single tenant to route to his VLAN without access to other VLANs. This would mean a lot of work, but it can be functional.

Besides the configuration of the RD Gateway, the custom HTTP endpoint needs to be created. To change these settings we must first decrypt the web.config file. The web.config file can be decrypted by running the following PowerShell command.

Unprotect-MgmtSvcConfiguration –Namespace <namespace>

Where <namespace> is one of the following:

• TenantPublicAPI
• TenantAPI
• AdminAPI
• AdminSite
• TenantSite

After decrypting the Tenant Site open the web.config file in c:\intetpub\MgmtSvc-TenantSite

Locate the following lines

<add key=”Microsoft.SystemCenter.RDPPlugin.Enabled” value=”False”/>

<add key=”Microsoft.SystemCenter.RDPPlugin.BaseUri” value=”http://localhost:5656/”/>

<add key=”Microsoft.SystemCenter.RDPPlugin.UriTemplate” value=”Rdp/{subscriptionId}/{stampId}/{vmId}.rdp”/>

Change the RDPPlugin.Enabled to True and specify the URL and relative path where the custom RDP file can be downloaded from when a tenant clicks the connect button on a virtual machine. You might then use something like System Center Orchestrator to get the IP addresses when a virtual machine is created or changed, inject this together with the RD Gateway into a text file and save it as a RDP file on the specified location.

When the changes has been made, save the web.config file and encrypt it again by running the PowerShell command

Unprotect-MgmtSvcConfiguration –Namespace TenantSite

Finally perform an IISReset.exe and your new settings are applied.

I’m still struggling to get this remote access part working properly. To be honest I do not consider this usable for a production environment of any considerable size.

Conclusion

Windows Azure for Windows Server (formerly known as Katal) is a huge step in the right direction by Microsoft to embrace Service Providers with an end to end solution. Surely some features still require some development and network virtualization is playing its part as well, but the product has gained interest from most serious Service Providers and this will only result in more effort into the product.

In the next part we will look at connecting App Controller to a Service Provider Foundation. But not before I displayed two tweets by two guys who are also working with this product extensively and experiencing all kind of challenges and questions from Service Providers who are interested in Windows Azure for Windows Server. I’d would like to add TCP Endpoints to their list.

One of the authors of Windows Server 2012 Hyper-V Installation and Configuration Guide, Patrick Lownds, is offering the readers of Hyper-V.nu an exclusive chance to win a signed copy of the book.

All you need to do is start the download of an evaluation copy of Windows Server 2012 by clicking on this link Windows Server 2012 ISO, make a screenshot showing at least 1% of the download of the ISO and send it to:

patrick_lownds@hotmail.com and please also mention Hyper-V.nu

When Patrick has enough responses, your name will be put into a draw and a winner will be selected at random.

• Installing and configuring System Center Service Provider Foundation
• Installing and configuring Windows Azure for Windows Server – Part 1
• Installing and configuring Windows Azure for Windows Server – Part 2
• Installing and configuring Windows Azure for Windows Server – Part 3
• Installing and connecting System Center App Controller to System Center Service Provider Foundation

In the previous part of this blog we installed the Service Management Portal and API. This part of the series covers the post-installation steps to prepare your environment for tenant access. Some of these steps are optional but recommended.

Configuring System Center Virtual Machine Manager 2012 SP1 components

The Service Management Portal and API maps its IAAS objects to components in System Center VMM 2012 SP1. Before we can create the required objects in the Service Management Portal we need to configure some components in System Center VMM 2012 SP1.

Cloud

An offering in the Service Management Portal is defined by a hosting plan. A plan has a one to one mapping to a cloud in System Center VMM 2012 SP1. The minimum requirements for a cloud in System Center VMM 2012 SP1 is a Host Group. To create a cloud open the System Center VMM 2012 SP1 management console. Select VMs and Services in the left bottom menu.

In the top menu select Create Cloud.

In the Create Cloud wizard give a description (for example Gold, Silver or Bronze), select a Host Group and finish the wizard. It is possible to configure additional settings in the Create Cloud wizard, but we will skip these for now.

Hardware Profile

The tenant can change the “hardware” properties of a virtual machine. You can define these settings in Hardware Profiles. To create a Hardware Profile in System Center VMM 2012 SP1 open the Library in the left bottom menu.

In the left menu select Profile > Hardware Profiles. On the top menu select Create and select Hardware Profile.

Give the Hardware Profile a description (for example 2 Procs | 2Gb Memory)

Configure the hardware settings to match the template you would like to provide to your tenants.

VM Template

A Virtual Machine Template is used to define the settings for a Virtual Machine that can be deployed. You can create a VM Template with a sysprepped virtual hard disk and define all other settings manually or you can create a VM Template from a running virtual machine. To create a VM Template open the Library node from the left bottom menu and select Templates > VM Templates from the left menu.

Create a new VM Template. In the wizard specify a description for the VM Template (for example Windows Server 2012 Standard Edition). Select the source for the VM Template. I will use a sysprepped VHDX that I have already placed in the library.

In the Wizard select a Hardware Profile that we have created earlier. This Hardware Profile will be the default profile used when a tenant creates a new virtual machine from this VM Template.

VM Network

System Center VMM 2012 SP1 enables new networking management features. In the pre SP1 environment you needed to attach a virtual machine to a Logical Network for network connectivity. In System Center VMM 2012 SP1 an extra layer has been added called VM Networks. If you want a virtual machine to have network connectivity it must be connected to a VM Network. System Center VMM 2012 SP1 provides four types of VM Networks.

• No Isolation
• Network Virtualization
• VLAN
• External

The Service Management Portal requires a minimum of one VM Network based on No Isolation or VLAN that you use for mapping to a plan. You can decide for yourself what type of VM Network you would like to use.

For most service provides the most scalable option is VM Networks based on Network Virtualization. The Service Management Portal does not allow you to create a hosting plan with a VM Network based on Network Virtualization. This is quite logical since each tenant should use their own VM Network based on network virtualization and not a shared one for all tenants. I will describe the combination of Network Virtualization and Windows Azure for Windows Server in the next part of this series. For more information on the inner workings of Network Virtualization read my previous blog here.

The only downside to this type of VM Network is that a Network Virtualization Gateway is required for connectivity outside the VM Network and the availability of gateways is scarce at this moment. Some vendors are scheduling a public release of a Network Virtualization Gateway in Q2 of 2013. I spoke with Greg Cusanza at TechDays 2013 who used a Microsoft sample Network Virtualization gateway in his demo. He assured me that this sample gateway will be up for grabs on codeplex before MMS 2013 (within a couple of weeks).

Configuring Windows Azure for Windows Server objects

When the required components in System Center VMM 2012 SP1 are configured we can create the objects in the Service Management Portal and map to the objects in System Center VMM 2012 SP1.

A hosting plan is an offering in Windows Azure for Windows Server. You can create a private plan and assign it to a single customer or you can publish a plan and make it publicly available so a new tenant can sign up to the plan. It is recommended to use Network Virtualization for publicly available plans. When you use a different type of VM Network new tenants will get the same VM Network assigned.

Private Plan

You can create a plan and assign it to a single tenant. This allows you to create specific components in System Center VMM 2012 SP1 and make them only available to one tenant. If VM Networks based on VLANs are required a Private Plan is the most obvious choice. To create a Private Plan login to the Admin Site on https://localhost:30091, select new in the bottom menu and click create on the plans section.

Give the hosting plan a name (for example the name of the tenant). Select the services accessible for the tenant. Select Virtual Machine Clouds and complete the wizard.

Next we will need to map the plan to the components we created in System Center VMM 2012 SP1 earlier. Select plans in the left menu and open the plan you just created.

Select Virtual Machine Clouds in the plan services section. In the basic section of the virtual machine clouds page select the cloud provider we configured in our previous blog and select the cloud we configured in System Center VMM 2012 SP1. Each Private Plan is mapped to its own cloud in System Center VMM 2012 SP1.

In the usage limit section specify the available capacity for the tenant. Next specify the templates you would like to make available for the tenant.

Select the Hardware Profiles and VM Networks you would like to provide to the tenant. The advanced operations sections allows you to specify additional management operations for the tenant administrator. I have not found any of these advanced operations in the Tenant Site so this is probably a future investment.

Public Plan

In a larger scale environment is would be more feasible to define a couple of SLA’s and map each SLA to a published Plan. You can, for example, create three plans (Gold, Silver and Bronze) and map these plans to three clouds in System Center VMM 2012 SP1. As specified earlier it is recommended to use VM Networks based on Network Virtualization for multi-tenancy and scalability. A new tenant is able to sign up to a plan that is made public.

It is recommended to give a plan a good description. This allows a new tenant to select the correct plan based on the additional information in the tenant portal. To specify the description open a plan and select the advertise tab.

Specify the descriptions. We will see these later on when a new tenant signs up.

There are some specific configurations that must be taken care of for Network Virtualization in combination with a Public Plan. Jeff Graves describes an excellent walkthrough on his blog.

After implementing Jeff’s walkthrough I have made some minor adjustments in my environment to make the configuration completely multitenant. When I specified a default VM Network in the VM Template, new virtual machines created by different tenants were able to communicate with each other. I adjusted the connectivity settings of the network adapter in the VM Template to not connected.

When a new hosting plan is created, you are required to select one or more VM Networks. Since each tenant will create and use its own VM Network you are not able to select a VM Network based on Network Virtualization when you create a hosting plan. When a tenant creates a new virtual machine through the custom create feature in the Tenant Site or adds a VM Network to an existing virtual machine, the tenant can choose from the VM Networks based on Network Virtualization he created in the Tenant Site. But he also has the ability to select the VM Network that was specified when the hosting plan was created.

As noted earlier, a VM Network based on VLAN or No Isolation is required when configuring a hosting plan. These VM Networks are not multitenant. I found a workaround by creating a temporary VM Network based on VLAN or No Isolation in System Center VMM 2012 SP1 before configuring the hosting plan.

Create and configure a new hosting plan and select the Temporary VM Network based on VLAN as the required VM Network.

Save the hosting plan and make it public. To make a plan publicly available select plans in the left menu of the Admin Site and select the plan. In the bottom menu select make public. Then delete the temporary VM Network based on VLAN in System Center 2012 SP1. Probably not supported, but it allows the creation of a hosting plan with Network Virtualization and prevents a tenant from selecting a non-multitenant network.

New Tenant

User accounts will be created in the SQL database that was created by the Windows Azure for Windows Server installer. There are some ASP.NET tables in the Microsoft.MgmtSvc.PortalConfigStore database. The user account are created in the aspnet_Users table and the aspnet_Membership table.

The Service Management Portal also references Users table from the Microsoft.MgmtSvc.Store database.

A new tenant can be created by the administrator in the Service Management Portal Admin Site. This allows the administrator to assign a private plan to the new tenant.

Login to the Admin Site, select New in the bottom menu and click Quick Create on the user account tab.

Please note that it is required to assign the new user account to a plan.

A new tenant will also be created when a user signs up to a public plan in the Service Management Portal Tenant Site.

Ports and Certificates

Before we allow access to tenants it is recommended to change the ports and certificates used by the Service Management Portal Tenant Site and Service Management Portal Tenant Public API.

After the installation of the Service Management Portal and API the tenant portal is accessible on https://localhost :30081. A self-signed certificate is assigned to the website. You can replace the self-signed certificate with a web server certificated issued by a public Certificate Authority. It is also recommended to change port 30081 to the default SSL port 443.

To change the ports and certificates open Internet Information Services (IIS) Manager on the Windows Server 2012 machine where the Service Management Portal Tenant Site was installed. Right click the MgmtSvc-TenantSite website and select edit bindings.

Change port 30081 to 443 and select the public certificate you requested from a public Certificate Authority.

After publishing port 443 in your firewall tenants can now access the Tenant Site by entering the secure URL. In our example https://portal.hyper-v.nu

In the next part of this series we will look at the tenant experience and the possibilities with Network Virtualization in Windows Azure for Windows Server.

About a year later, Aidan approached me again asking if I would be willing to contribute to another book called Microsoft Private Cloud Computing and I did not think about refusing (or should I have). It was my first experience as an author and I wrote up the Fabric chapters of VMM 2012. Aidan laid a nice foundation with his lucid Cloud introduction chapters, Patrick focused on the service management functionality and the VMM Library while Cloud and Datacenter MVP, Damian Flynn wrote a couple of brilliant chapters on private cloud management and integration with App Controller, Service Manager and Orchestrator. It was a fine job we completed in early 2012, the book was published just before the beta of SP1 was announced. We simply didn’t have the opportunity to wait until SP1 was out and digest and explain all the new features that arrived with Windows Server 2012. Fortunately Damian has joined Nigel Cain (who is a Senior Program Manager for Windows Server and System Center) to write a blog series on Technet in eight installments between Jan 2013 until July 2013, just to explain the new Virtual networking technology in VMM 2012 SP1

Another year came and here was Aidan again, asking me to join him on his new venture: the Windows Server 2012 Hyper-V Installation and Configuration Guide. Although I really liked the subject and wanted to go into great depth to learn all this cool stuff, I was simply too busy doing all those great Hyper-V and System Center projects for Inovativ. Our family was also heavily burdened by the unfortunate adventures of one of my sons, which more or less influenced me most of 2012. Writing a book was out of the question.

Convincing as Aidan can be, he said he had his author team complete, again with Damian Flynn and Patrick Lownds plus Michel Luescher, “a virtualization junkie working as a consultant at Microsoft” as he calls himself. The only omission was a technical editor fit for the job. And that’s why he asked me.

I am more than honored to be mentioned quite extensively in the Acknowledgements of the Windows Server 2012 Hyper-V book by each and every author. I really felt like being part of the author team but in the role of both learning, correcting but most of all improving. I remember advising Aidan to split one chapter into two because it was approaching 100 pages, more than twice as much as they had anticipated.

Having been the first reader (and I read the chapters multiple times), I can truly say this is a superb book that anyone interested in the technical secrets of Windows Server 2012 Hyper-V should buy. I can guarantee you will not one day regret having bought this book. There were moments I wanted to cry out how good these chapters were, thrilled by the sheer excellence of the product and the very talented explanatory writing in the 600 pages of this Must-have-Hyper-V-version-3 book.

The book can be pre-ordered now and will be published on March 25th. The European release will be April 5th. See the Windows Server 2012 Hyper-V Book Release FAQ.

I will not wait till my free copy arrives (Sybex, hope you are reading this) as I have already pre-ordered it myself, but wouldn’t mind a few extra copies to give away.