Category:

Virtualization

Patching VCSA 6.5 to Update 1 in a vCenter HA configuration

by Philip Sellers October 4, 2017

written by Philip Sellers

One of the best things included in the vCenter Server Appliance is the automatic update feature in the Appliance Manager. This handy feature makes updates to a VCSA simple and quick. Unfortunately, using vCenter HA, included in the VCSA 6.5, breaks this patching for most users. Why? The simple answer is that the secondary and witness appliances exist on a non-routable IP range for customer who have chosen

Patching a vCenter Server Appliance (VCSA) in a vCenter HA configuration is a little different than patching, but its still easy.

Get the Patch Needed

Login to My VMware
Go to View & Download Products
Select Download Patches on the right sidebar
Select VC and 6.5 under the menus and then click Search
Locate the update in the list and select Download.

Update the VCSA’s

Maintenance Mode

With a VCSA in HA configuration, you need to put the HA cluster into maintenance mode. Before you can do this, the HA cluster must be healthy. To check for this, navigate to the vCenter root on the left tree of vCenter Web Client, then click on Configure and then select vCenter HA. Under the vCenter HA is enabled label, look for a green indicator. If it is green, you’ll see the “All vCenter HA nodes are accessible and replication is enabled. Automatic failover protection is enabled.” message and you’re good to go.

Click Edit and select Maintenance Mode and click OK. This puts the cluster into maintenance mode so it will not automatically failover.

Upload the Patch to Datastore

The easiest way to access the patch ISO for me was to upload it directly to a datastore. To do this, browse to a datastore accessible to all of the nodes running the VCSAs. Go to Files on the datastore and then upload to the datastore. You will use this later in the process.

You could also use the ISO as a client device or from the Content Library. I think the Content Library is overkill for an ISO that will be used once and then discarded, but it is an option, too.

Patch the Nodes

The rough plan for updating is to :

Take a snapshot of all three vCenter VMs
Patch the Witness node
Patch the Secondary node
Failover the cluster to Secondary
Patch Primary node
Failover back to the Primary node

On each node, you will do the following steps:

Attach the Patch ISO as a Datastore ISO on the VM
Open console and press ALT+F1 to go to the login page
Login to the VCSA as root ** DO NOT go into the BASH shell
Execute <code>software-packages install –iso –acceptEulas</code>
The patches will all be loaded and you will be prompted to reboot
Execute <code>shutdown reboot -r “ESXi 6.5 Patching”</code>
Repeat for next node

Simple, easy & quick.

October 4, 2017 1 comment

An easy fix for vSphere 6.5, web client and certificates to keep your uploads flowing

by Philip Sellers September 22, 2017

written by Philip Sellers

An upgrade vSphere 6.5 means no more beloved Windows/C# vSphere Client and loads of people are being forced to the web client. With the web client, certificates play a much more important role in the overall design and untrusted certificate on your vCenter and ESXi hosts will plague you when trying to deploy new VMs, import OVF’s and other upload situations. This is because those uploads talk directly to the ESXi host, so even if you’ve accepted the certificate for the vCenter and you’re uploading from vCenter, the upload itself occurs between your machine and the ESXi, whose certificate is also untrusted.

The fix is fairly simple. At vSphere 6.0, VMware introduced the VMware Certificate Authority (VMCA) as part of the Platform Services Controller component of vCenter. The VMCA has its own root certificate that is used to issue all host and service certificates in the environment. If your computer trusts the root certificate, you trust all of the issued certificates from this CA. The solution is to download and import the root certificate from your VMCA.

To do this, navigate to your vCenter’s web UI. Accept the untrusted certificate when prompted and then the Getting Started page is displayed. On the lower right side of the page, there is a link to download the trusted root CA certificates.

This will begin a download for a zip file. In vCenter 6.5, the zip file is organized with a certs subfolder, then subfolders by operating system. Navigate to your OS folder. In simple deployments, a single certificate will be inside of the zip file along with a .crl file or files.

For Windows, double click the .CRT file and a properties window appears. Click Install Certificate… then choose Local Machine & Next, allow the UAC if prompted, choose the Place all certificates in the following store and then click Browse…

In the window that appears, choose Tursted Root Certificate Authorities as the certificate store, then click OK. Click Next and Finish to complete the process.

A reboot may be required to activate the change, but afterwards, the pesky untrusted certificate warnings will be gone.

While at VMworld this year, I attended a great session from Adam Eckerle about certificate management in vSphere 6.5. He recommended this method, as opposed to making your VMCA a subordinate CA. Its not the first time he’s presented this information – if you’re interested, you can see the presentation from VMworld 2016 posted online for free. The 2017 session with info about 6.5 should be posted later.

September 22, 2017 0 comments

Datacenter Storage Virtualization

Migrating VMDK to VVOL fails, logs error ‘Requested size is not a 1MB multiple’

by Philip Sellers May 4, 2017

written by Philip Sellers

I am in the middle of a storage migration and hit a snag while trying to storage vMotion a VM from a VMFS datastore onto a VVOLs. When I started the storage vMotion, it would quickly error out. As a troubleshooting method, I decided to migrate only the VMX and base OS disk files, leaving the large data disk file on its original datastore. Those worked. But every time I tried to move its data disk, it failed with a generic error in the UI

<code>A fatal internal error occurred. See the virtual machine’s log for more details.</code>

Investigating the virtual machine’s logs, I see entries for the storage vMotion attempting to begin, but then it logs these errors:

<code>OBJLIB-VVOLOBJ : VVolObjCheckSize: Requested size (######) is not an MB multiple.</code>

<code>VVolObjDetermineSizeInMB: Requested size (#####) is not a MB multiple.</code>

<code>Mirror: scsi0:1: SVMotionLocalDiskCreate: Failed to create destination disk: The requested size is not a multiple of 1MB. </code>

Solution

After seeing those 3 errors, I decided to look at the VM’s disk configuration. Within the Edit Settings window, the data file showed size of 1,740.7999992370605 MB. That decimal and odd sizing is what was causing my migration to fail.

I increased the disk size to an even MB size, saved the VM configuration and then retried the storage vMotion. This time, it moved the disk without any issue. Apparently with VVOLs, the disk sizing must be full 1MB sizes – so any oddly sized disks will fail to move.

A quick piece of PowerCLI can help you identify these odd shaped disks in your environment:

[code]Get-Datastore | Get-HardDisk | Select Parent, Filename, @{N="Remainder";E={$_.CapacityKB % 1024}} | Where {$_.Remainder -ne 0}[/code]

This post over at Nimble’s community site describes the same issue: https://connect.nimblestorage.com/thread/14391

May 4, 2017 0 comments

Datacenter Home Lab Storage Virtualization

Setting up VSAN in vSphere 6.5 > Hint, its super easy!

by Philip Sellers April 4, 2017

written by Philip Sellers

New job, new lab. I’ve been rebuilding our lab environment and for the first time, I have enough hardware to really give VSAN a whirl. I have 6 hosts with Intel Xeon E5645 procs and 4 x 400GB SSD’s in each server.

Being a lab environment, I knew I wanted to deploy a different SDS solution. I’ve worked with HPE’s StoreVirtual in the past and I was able to do a hands-on POC with an EMC ScaleIO SDS earlier this year. VSAN, however, had been elusive for me, so I took this opportunity to work through that solution.

The biggest hurdles in building VSAN is the underlying hardware. The software, as with most of VMware’s solutions, is dead simple to configure and make the solution work. Even though I have good hardware, I’m not strictly compatible per the HCL, but this doesn’t keep VSAN from working very well.

But my SSD’s show up as HDD’s

Back to the hardware – these older IBM System x’s – did not support JBOD passthrough on the RAID controllers. While it was a pain to setup, there is a workable solution. In the RAID controller, you have to build a RAID disk in a RAID 0 configuration for each drive and then present it out as a virtual drive. This is far from ideal, but works in a lab. The one problem it creates is masking the SSD capabilities from ESXi. ESXi sees these virtual disks as hard drives instead of solid state.

Fortunately, a little ESXCLI magic and you can override this – first you have to list all the local disks – the exact command will vary a little based on your hardware, but since all these were connected to my IBM servers, I was able to use a grep for IBM.

<code>esxcli storage core device list | grep IBM</code>

You just need to figure out what identifies your local disk type and then grep for the same thing.

For the rest, I followed the instructions in this VMware tech document – https://pubs.vmware.com/vsphere-55/index.jsp?topic=%2Fcom.vmware.vsphere.storage.doc%2FGUID-99BB81AC-5342-45E5-BF67-8D43647FAD31.html (these instructions work with 6.0 and 6.5, even though the document is for 5.5).

<code>esxcli storage nmp satp rule add -s SATP –device device_name –option=”enable_ssd”</code>

Lastly, you need the system to ‘reclaim’ the disk with the new policy.

<code>esxcli storage core claiming reclaim –device device_name</code>

Now the easy part

VSAN is built-in to vSphere 6.0 and 6.5, so via the vSphere Web Client, so setup is very simple. Instead of step-by-step, these instructions are the outline of steps to setup your own VSAN.

On each of your nodes to be used for VSAN, setup 10Gig VMKernel adapters and check the box for Enable Virtual SAN. You need at least one and I decided to re-use my iSCSI connections for the lab. [Someone familiar with best practices, comment is this is bad idea].
In the vSphere Web Client, navigate to your cluster object, navigate to the Configure tab for it and then select General under Virtual SAN.
Enable virtual SAN > click Edit… next to Virtual SAN and then check the box to “Turn ON Virtual SAN.” [as a side note, I’ve always loved how easy HA clustering is to enable, and Virtual SAN is just as simple – although you have a little config left to complete]

I kept the default of adding disks Manually to my installation. If you have JBOD passthrough and your SSD’s show up as SSD’s automatically, go for Automatic disk add…
Next step is adding disks, just a simple – go to Disk Management, click the Claim Disks button and then for each host, choose how you’d like to adopt the disks. For my systems, I chose Capacity at the host level, which is inherited to all disks in the host, then I went back and chose one Cache disk per host. Click OK and your VSAN is building.

You’ll see a number of tasks in the background under Recent Tasks.

Last, you’ll see a new Datastore presented from your VSAN which is an aggregate of all the disks and groups from all your participating systems.

One last tip, go ahead to the Monitor tab and then go to Performance. Click on Virtual SAN – either option – and then enable performance monitoring.

Why VSAN for the lab?

I had several reasons…

No drive penalty… With solutions like HPE’s StoreVirtual and EMC’s ScaleIO, you must have a VM ‘controller’ that is the main connection to your local storage and presents it up to servers for consumption. StoreVirtual has a virtual appliance and ScaleIO has its SDS in virtual appliance form – but with a VM, you have to store the base VM image somewhere, meaning one less drive to be setup in your drive pool.
It is tightly integrated into vSphere, meaning less management points.
I have entitlements for my lab via the vExpert program, so price is not an issue. For others, check out VMUG Advantage – while not free, it is a great value for your home lab.

April 4, 2017 0 comments

Datacenter Storage Virtualization

Use raw disks for StoreVirtual VSA to avoid warnings and maximize capacity

by Philip Sellers August 21, 2015

written by Philip Sellers

Last year at HP Discover, I was preparing for my first StoreVirtual VSA deployment. I spoke with a couple different folks from the StoreVirtual team. The main piece of advice I was given was to use raw disk mappings under the StoreVirtual VSA. At first, I questioned this. But there is good logic to this recommendation. Now, my source is HP staff, but this isn’t in their official guidelines anywhere that I have found…

Scenario without RDM’s

So, take the scenario if we did not use raw disk mappings with the StoreVirtual VSA. You would create local VMFS datastores on the local drives connected to the host. You would only need one VMFS and you would deploy the VSA onto this disk. Then, you would then create additional VMDK files for the data disks behind the StoreVirtual VSA on the same VMFS datastore. You could create multiple VMFS and do the same thing, if you like.

Now, when you created your VMDK data disk to use your full VMFS capacity, vSphere would throw a disk space alarm for your VMFS datastore. The alarms are not customizable to say alarm on these VMFS created in the StoreVirtual VSA (which you will want later), but do not alarm on these local disk VMFS. So, you would always have alarm conditions if you used the full size of the VMFS.

First point, to avoid alarms, you would need to consume 80% or less of the VMFS capacity. But, why would you ever want to leave capacity on the table, never to be used? You want to maximize the capacity you have in your local servers.

Second point, you are never going to snapshot your VSAs. You don’t need any spare capacity for snapshot delta disks. With the VSA, you have multiple copies of the data on additional StoreVirtual (VSA or physical) and that is your redundancy. In fact, snapshots at the VSA level are dangerous. You should avoid these at all cost.

Scenario with RDM’s

My recommendation would be to create two local disks on the ESXi host that will run the VSA. The first disk should be small – possibly RAID1 – and will be formatted as a VMFS datastore. The second, possibly RAID5 or RAID6 would be your storage for the VSA. It would not be a VMFS and would instead be presented to the VSA as a raw disk mapping. This allows you to use 100% of the raw capacity, with no alarms and direct access to the underlying disk.

When you deploy the VSA, do not specify any data disks during the deployment. I used the Zero To VSA toolkit for my deployments and it allows this configuration to be deployed.

The complication with the RDM plan is that vSphere does not show local disks as available storage to present as a raw disk mapping. You will need to do some work with vmkfstools to create a VMDK file, on the primary VMFS with the StoreVirtual VSA files, and point this to the physical location of the second volume. Once you create the VMDK, you may attach it to the VSA and begin your configuration.

The first step is to identify the device ID of the unformatted, data disk. To do this, open SSH or a remote shell to the ESXi host. You will want to navigate to /vmfs/devices/ or /dev/disks and run an ls -la to list the device names. Hopefully you only have two or three devices listed – possibly your boot disk, your VMFS disk and your data disk. You may identify your data disk because it will be the name without a symbolic link associated. The ID you are looking for will begin with “naa.”

The vmkfstools command to create the VMDK raw disk mapping file is:

[code]vmkfstools -z /vmfs/devices/ID /vmfs/Volumes/VMFSDatastore/SVApplianceName/SVApplianceName_2.vmdk[/code]

Change VMFSDatastore to match the name you assign to your VMFS when you created it. Change the StoreVirtual1 to be the directory/name you named your appliance on this host. And lastly, specify a name for the vmdk file.

Now, edit settings. You attach the VMDK file you just created. Browse to the location you specified in vmkfstools and select the VMDK file. Repeat this for each virtual appliance.

Lastly, boot the VSA and use the StoreVirtual Centralized Managed console and its wizards to setup the VSA and cluster the individual VSAs into a software storage array.

August 21, 2015 1 comment

Datacenter PowerCLI Software Storage Virtualization

Power disguised as command line – 10 reasons SysAdmins should learn PowerShell scripting

by Philip Sellers August 4, 2015

written by Philip Sellers

I’m a big proponent of learning PowerShell as an administrator, engineer or any other practitioner role. And I think you should learn it. It is the path to the future.

The pipeline. I’ve written a blog post in my head many times about the PowerShell pipeline. I think it is the single feature that makes PowerShell powerful. No, Microsoft didn’t invent the pipeline and I know I’ll be chastised by *nix admins (ooo we had it first), but the pipeline really does make PowerShell incredibly effective. Once you have a data set, you can easily send it into another command where it accepts and makes changes based on that data. Get-this | Do-that. Its that simple!
Data Objects. Even non-developers have encountered object oriented programming at one time or another. Objects exist to encapsulate, define and allow data to be easily manipulated. Objects are well formed and defined. You can explore them and find out more about your data. Objects are mini packages and inside the package are many tools to manipulate the data.
Time. Doing things in PowerShell will save you lots of time. If you are repeating a task, it is easy to find a command to retrieve a list of data – whether its mailboxes, accounts, computers, servers, etc. – that you need to change and then pipe it over to another command and make the change you need. Why click 500 times when you can do it in 30 characters in PowerShell?
Extensibility. You can DIY til your heart desires. You’re not constrained to a list of executable files and built in paramters in PowerShell. If you find something lacking or missing, you can easily change the data in an object, scope it down, and change it to meet your needs. And you’re not alone. PowerShell has a thriving community of DIY-ers, many of whom freely contribute their scripts and ideas online.
It is Friendly. Learning scripting in VBscript, C#, or many other languages require you to really dig in and learn a language. PowerShell isn’t that way. You don’t have to learn a lot of complex syntax to begin using PowerShell. From the first time you launch PowerShell, For the most part things make a lot of sense and you can pickup the language quickly (but I won’t mention formatting numbers, for instance).
Break the GUI glass. Sometimes you run up against a problem in the Windows management tools where you can’t export or get to the data you really want from the GUI. PowerShell gives you access to many repositories of information you’d work much harder to access with other tools. Not only this, PowerShell includes a wide range of formatting commands to take data objects and output them quickly, easily and simply in CSV, HTML, and plain text tables, lists and other views. With simple SQL-like commands like Select, Where and Sort, you can also limit the output to exactly what you, or more like, what your manager wants to see.
It is Microsoft’s future. Microsoft has publicly stated that all future server products starting with Wave 15 (which included SharePoint 2013, Exchange 2013, etc.) would include PowerShell as the de-facto administration platform. Any GUI environments would become secondary and may be missing some things that can be only done in PowerShell. Don’t get left behind by not adopting PowerShell. Not only is it Microsoft’s future, but automation is a big part of the future of IT. PowerShell gives you an effective way to automate.
Its what *nix geeks always wanted. For years, Unix and Linux admins griped at all the things missing from Windows and how abysmal the command line was in Windows. Microsoft took all those complaints off the table with PowerShell. It is a very powerful and capable environment to perform lots of work quickly. My *nix counterparts have always raved about having MAN pages for everything. PowerShell also has its version of MAN pages using the Get-Help command to explore other commands and find out parameters and options for each one, including examples. Going even further than *nix, PowerShell also includes tools like Get-Method to help you discover the functionality hidden in objects.
You can join your Devs and commit your script to Git. Ok, so I joke a bit, but many time Devs look down on administrators – aka server jockeys – because they are the ones who create the code. Once you learn proficiency in scripting PowerShell, don’t be afraid to share with the community and start committing your scripts to Git and public repositories for others to use. That’s how the community grows and learns from one another. Don’t only be a taker – be a giver, too… As a byproduct, you may understand your developers a little better, too.
Its not just Microsoft… Many other vendors have adopted PowerShell for scripting against their tools. I’ve written a lot (including a book) about PowerCLI, which is VMware’s PowerShell environment. What is great about third-party support is the ability to leverage everything you already know about the base PowerShell and combine it with specific commands for a particular product. The same goes for Microsoft’s specific modules for its server products. Once you adopt PowerShell for Active Directory and Exchange, it is a natural extension to use it for SharePoint and Lync (Skype for Business).

Now, how to you learn?

Microsoft’s Official Home for PowerShell – https://msdn.microsoft.com/en-us/powershell
Powershell.org – ’nuff said
PowerShell Magazine – Particularly the Tips & Tricks Column
Pluralsight has great courses to help you adopt PowerShell
Books… Many many PowerShell titles out there.
Twitter is a another great source for finding people who create PowerShell scripts and make them available. The first you should follow is the father of PowerShell – Jeffery Snover (@jsnover). A couple more you’ll want to follow are the Ed Wilson/The Scripting Guys (@ScriptingGuys) and Adam Bertram (@adbertram).
Microsoft has a great resource called the Script Center – https://technet.microsoft.com/en-us/scriptcenter. If you check out the Other Resources section here, you’ll see the archive of Hey Scripting Guy!, a blog from Ed Wilson and others.
You should also look for PowerShell Saturdays scheduled time to time, which are an onsite event devoted to PowerShell learning. They’re free and all around the world.
In addition to Twitter, Adam Bertram runs a blog called Adam the Automator where he shares a lot of the scripts he creates. He is a Microsoft PowerShell MVP, which is Microsoft title for community contributors for specific products.
When it comes to PowerCLI, you’ll want to follow VMware’s Official PowerCLI account (@PowerCLI), Alan Renouf (@alanrenouf), and Brian Graf (@vBrianGraf). These guys are all involved with VMware’s PowerCLI effort and you can see great content on the office PowerCLI Blog at VMware.
PowerShell on GitHub – https://github.com/powershell
You might even find a few PowerShell and PowerCLI scripts on this site.

August 4, 2015 1 comment

Datacenter PowerCLI Software Virtualization

From SearchVMware.com: How PowerCLI fit one admin’s VMware automation needs

by Philip Sellers July 28, 2015

written by Philip Sellers

I recently had the opportunity to talk with TechTarget’s Tom Walat, site editor for SearchVMware.com, about PowerCLI and writing the PowerCLI Cookbook. That conversation is featured in SearchVMware’s new podcast. Our conversation ranged from my background and responsibilities, to how I decided upon PowerCLI as my go-to automation tool, how someone new can get started with PowerCLI and resources where someone can learn more about PowerCLI. Head over to SearchVMware and check out How PowerCLI fit one admin’s VMware automation needs.

Some highlights from the conversation:

If you’re new to PowerCLI and you don’t have a development background, the easiest way to get started is with the native cmdlets, which work like normal command line tools. These accept parameters and then go and do work.
There is a wide community of contributors who post their PowerCLI scripts that solve all sorts of problems and make them freely available.
What made me want to write the PowerCLI Cookbook.

July 28, 2015 0 comments

Home Lab Home Tech Networking Personal Virtualization

The Ubiquiti EdgeRouter Lite is a Swiss Army Knife for Home Lab networks

by Philip Sellers July 27, 2015

written by Philip Sellers

Building out the networking side of my home lab has been the most challenging part of my home lab. I’ll be the first to confess – I’m not a networking guy – at least, that’s not a primary focus for me. I rely on my network folks at work – but I understand enough to handle networking in vSphere, but when it comes to routing and things like OSPF and Spanning Tree, I let the professionals handle it.

I’ve written several times about the hardware and plans for my home lab systems. But, to mock up the enterprise environments that I’d like to in my lab, I needed a more powerful router – something capable of carrying multiple VLANs and routing for each. I have always relied on an integrated router with WiFi for my home, but this just wasn’t getting the job done. Last week, I wrote about upgrading my WiFi and this week, the router is in the cross-hairs.

The primary goals I had in my network were:

A dedicated home network for my wife, kids and TV’s to connect to Internet
Separate set of VLANs to mock up production vSphere environments
Separate video network for multicast traffic from an HD HomeRun to my MacPro with EyeTV
The MacPro needs to be on my primary, home network but also must route to the other VLANs to manage vSphere, VMs, and the HDHomeRun.

There are some software solutions that would help me like VyOS, the open source distribution of Vyatta which is owned by Brocade. I looked at VyOS a couple times, but I disliked this method because everything would still come back to my primary home network. I wanted a cleaner solution – so I looked at hardware. There are several flash-able, hardware routers and I looked at several running DD-WRT or Tomato. I was very close to purchasing one of these solutions when a coworker suggest I look at an Ubiquiti’s EdgeRouter Lite.

The Ubiquiti EdgeRouter Lite is an under-$100 hardware router running a flavor of Vyatta. If offers 3 ports on the Lite model with your choice of more ports if you needed them on higher models. There is also a Power Over Ethernet variant of the Lite model. The device is router only – no WiFi or other converged functions. The router is rated at 1 million packets per second, but not being a network nerd, that only sounds impressive to me – not sure how that stacks up versus the competition. It is certainly better than my Apple AirPort Extreme.

With this hardware router, I can have a dedicated port for my primary home network and one for home lab systems, with multiple VLANs, multiple DHCP zones and keep everything separate. It also means I had a host of other things capable from command line on the small, hardware box.

This wasn’t my first Ubiquiti network purchase. I had recently purchased a Ubiquiti UniFi AC wireless access point, which I wrote about last week. What I have discovered is that Ubiquiti makes good quality hardware, with enterprise-like features at a home cost. So, let me recap how this hardware hit my list of must-haves.

Step 1 – Dedicated Home Network

Out of the box, the EdgeRouter Lite comes with DHCP enabled on port 0 so you plug in the router, plug in a computer and go to the web interface on 192.168.1.1. You login with the generic ubnt/ubnt password combination and off you go. There is a wizard that allows for quick configuration of 2 LAN and 1 WAN ports – I used it to setup the EdgeRouter Lite as I intended to use it. Ports 0 and 2 became LAN ports and port 1 became my WAN port. Plug in my internet to port 1 and then uplink the EdgeRouter from port 0 to my network switch and my primary network was back online. This hit the first point on my list – a dedicated primary home network that is a no tinkering zone.

Step 1a – OpenVPN from EdgeRouter

Not long after getting my EdgeRouter, I began having some issues getting to Hulu. I was able to leverage Vyatta to setup an OpenVPN tunnel for my Apple TV only, thanks to instructions from Larry Land, to get around some sort of routing or blocking issue. Another great feather in the EdgeRouter’s cap. This configuration required some command-line action, but it was simple to configure and get running.

This exercise also taught me a bit about special routing tables and utilizing the Vyatta firewall features to redirect a single IP on my network to a specific set of routes or location. It was a bit of a crash course for me. But I can appreciate the flexibility that Vyatta brings under the covers of this device.

Step 2 – Separate VLANs for Home Lab

Next came setting up the separate VLANs for the home lab. That was a piece of cake. Within the EdgeRouter Lite’s web interface, you can add a VLAN interface onto a port with the click of button. Within 5 minutes, I had all 5 of my VLANs that I wanted for the home lab created on port 2 of the EdgeRouter. The add interface allows you to set an IP for the EdgeRouter on the new VLAN while defining it. After adding the VLAN, you have to create a DHCP scope within Services for each of the VLANs.

Step 3 – Separate Video Multicast from the Primary Network

While the EdgeRouter allows me to create a dedicated VLAN for video to keep multicast off of my primary network, I finally had a different light-bulb moment. I decided instead to direct wired my HD Homerun into the Mac Pro where I run EyeTV. The one problem that I ran into was getting an address for the HD HomeRun. I hard coded an IP on a different subnet on the secondary NIC of Mac Pro and then added DHCP on the Mac for that NIC only to hand out an address to the HD HomeRun.

Other Capabilities

This is a router, after all, so static and dynamic routes along with a host of network routing protocols are included – like OSPF, RIP and BGP.

Under Services section in the web configuration tool, you will find both DHCP and DNS forwarding. The DNS forwarding allows the router to serve as a local DNS server and then forward out those requests to specified servers. This is particularly great for what I want to do, where one VLAN may need to point back to my internal DNS server for the management and VM VLANs while others need to point to Google’s DNS or my ISP.

The built-in web interface allows for a lot of configuration without ever needing to go to the command line, but both methods are possible. The built-in firewall allows for different rules to be built based on groups or individual systems behind the router.

The EdgeRouter Lite also has Quality of Service (QoS) settings so I hope to be able to prioritize traffic from my AT&T MicroCell to have highest priority in the network, though I have not set this up yet. I will need to put in some research and see how to do that.

You may setup Dynamic DNS directly from the GUI of the EdgeRouter, assisting in resolution back to your network from remote locations.

Vyatta also allows you to setup VPN server on the device for remote access. I wrote about using the EdgeRouter Lite as a site-to-site VPN for OpenVPN, but it can also become a VPN server to allow you remote access back to your network. Rackspace has a great guide to setting this up in Vyatta. There are lots of other options within the VPN space – including having the EdgeRouter become its own OpenVPN server.

Verdict

I couldn’t be happier with the outcome and decision to purchase this router. The Ubiquiti EdgeRouter Lite is small and fits nicely into my structured wiring box. It is fast and capable and has kept up with everything I have needed. It has provided additional capabilities that may have been more difficult with other flash router solutions. It is quiet and it was also fairly inexpensive.

July 27, 2015 0 comments

Datacenter Storage Virtualization

HP 3PAR SSMC 2.1 makes Peer Persistence configuration easy as 1-2-3

by Philip Sellers May 19, 2015

written by Philip Sellers

With the 2.1 release of the HP 3PAR StoreServ Management Console, HP has enabled the creation and control of Peer Persistence configurations within the management tool. Peer Persistence is the HP branding for transparent LUN failover between storage arrays with no downtime – a concept VMware administrators will recognize is Metro Storage Clustering in the VMware vernacular. HP 3PAR Peer Persistence relies on operating systems which can use the ALUA command set of of the SCSI bus to recognize open and closed paths to a single volume. The source array provides open paths while the replication target shows its paths in standby. At a high level, when a switchover command is issued, the path states change from active to standby and vice-versus. ALUA allows the OS to recognize and redirect IO. Add a quorum witness server to the switchover magic and you have a

This addition to SSMC brings a simple three step process for provisioning new Peer Persistence volumes in the management GUI: Create a new volume, add it to Remote Copy and then Export the volume from both arrays. When an administrator adds the volume it into a remote copy group, the group auto-provisions and assigns the same World Wide Name (WWN) to the target, secondary volume and that is required for Peer Persistence. Previously, administrators performed this using the 3PAR Command Line Interface, and early adopters had to manually lookup and assign the WWN on the secondary array. The auto-provisioning will simplify the process and the chance for human error. The auto-provisioning can be enabled on any Remote Copy group through the SSMC interface. The administrator pre-defines the CPG for the remote array and enables the auto_failover and path_management policies to make a normal Remote Copy group into a Peer Persistent remote copy group.

Initiating a switchover of a Peer Persistence Remote Copy Group is now an options within the SSMC interface. The switchover command is found under the Remote Copy Group within the interface and is found with all the other operations under the Actions menu for a Remote Copy Group. When a switchover is initiated, the interface shows a status of that command, shows the original Remote Copy Group go into a stopped state, the target-side Remote Copy Group named with a similar name then appears and shows that the switchover has completed.

In order to make use of Peer Persistence, there is a fairly strict list of requirements you must meet. The most restrictive of the requirements is latency, since Peer Persistence is built on synchronous replication which the 3PAR platforms limit to 2.6 milliseconds or less of latency. This amount of latency allows for fairly liberal definitions of metro distances. So, first a quick review of all of the requirements for Peer Persistence and then a quick tour of the simple SSMC provisioning process.

Requirements for Peer Persistence

Below is a consolidated list of all the requirements for running HP 3PAR StoreServ arrays with Peer Persistence.

Round trip latency of 2.6 milliseconds or less.
2 arrays with Remote Copy 1-to-1 configuration in synchronous mode.
3PAR StoreServ Firmware 3.1.2 MU2 or newer for VMware and Firmware 3.2.1 or newer for Windows.
VMware ESXi 5.x or newer and Windows Server 2008 R2, and Windows Server 2012 R2 for host OS.
All associated hosts are connected to both arrays.
Hosts created with 3PAR host persona 11 for VMware hosts and 15 for Windows hosts, which supports Asymmetric Logical Unit Access (ALUA).
Quorum Witness virtual machine at a third site, reachable by TCP/IP from the management port of the two 3PAR arrays.
All 3PAR Virtual Volumes (VV) exported from both arrays must have the same volume WWN, both source and target WWN should match.
Fibre Channel (FC), iSCSI and Fibre Channel over Ethernet (FCoE) are supported. iSCSI and FCoE require later version of 3PAR StoreServ Firmware.
Both auto_failover and path_management polices in 3PAR Remote Copy Group configuration are required to enable automatic transparent failover.

Provisioning Peer Persistent Volumes with SSMC

Step 1: Create a new virtual volume by going to the Main Menu and choosing Virtual Volumes under Block Persona.
(File Persona is hidden in the screenshot below because the arrays connected to SSMC do not support File Persona, otherwise it is displayed next to Block Persona).

Complete the General section, but do not export the LUN yet.

Step 2: Create the Remote Copy Group located under the Main Menu in the Replication section. If you have an existing Remote Copy Group, click on the name of the group to edit it.

For Peer Persistence, the configuration is set here. The sections outlined in red are the sections required for Peer Persistence. To make it easiest, select the Create automatically option under Source, you must set Synchronous replication under Backup and you need to tick the Advanced Options checkbox and then check the Auto failover checkbox under Backup. Checking the Auto failover checkbox automatically enables Path Management, too.

Also within Remote Copy Group, you will add your virtual volume from the source array under the Volume Pairs section. Once you select it in the dialog box, you will notice that it is added to the group and the target volume shows a message stating “auto-create”. Click Create or Ok and the changes will be made.

Step 3: Export the volumes from both arrays to the hosts. To do this, you go back to either Virtual Volumes or Virtual Volume Sets in the Main Menu and you choose the Export command to export the volumes to the desired hosts.

This assumes that you’ve already created host records, so if not, you need to create the host records using host persona 11 for VMware or host persona 15 for Windows. In SSMC, you cannot select the host persona directly. Instead, you must choose an operating system from a drop-down menu. You will either choose ESXi 4.x/5.x, Windows 2008/2008 R2 or Windows 2012/2012 R2. The host persona is also displayed after you choose the OS, so you can confirm the setting.

Implementation Guides

For all the detailed configuration and detail about implementing HP 3PAR Peer Persistence, refer to these two guides that outline the specifics for VMware hosta and for Windows hosts:

May 19, 2015 2 comments

Datacenter PowerCLI Virtualization

Introducing ‘PowerCLI Cookbook’, the step-by-step guide to adopting PowerCLI

by Philip Sellers April 6, 2015

written by Philip Sellers

If you’ve noticed that my blog posts have been a bit light over the last year, I am happy to finally tell why. Last week, my first book published. It was many months in the making, a lot of effort and it is now in the wild. PowerCLI Cookbook is written to be a guide for beginners to intermediate scripters who want to learn more about PowerCLI. The format is a Packt Publishing Cookbook, which is a step-by-step guide on how to create complex scripts and routines to solve certain problems. Although each recipe solves a specific problem, the recipes also cover ways to explore the PowerCLI objects and discover how to do similar things for other problems.

The real power of PowerCLI comes from the native PowerShell pipeline and well-formed data objects. The book covers both of these to help readers get a handle on how to leverage these features in ways that help create scripts for any purpose administering vSphere and vCloud.

I summed up my whole intent for the book with a tweet this week…

If you’re repeating the same steps in #vSphere more than once, there’s an easier way & #PowerCLI Cookbook shows how http://t.co/E2CVdRpOgx

— Philip Sellers (@pbsellers) April 2, 2015

The book is available from Amazon in print and as a Kindle ebook and is also available from the Packt Publishing website. Packt also has the first chapter available for free as a sample on their website.

Some highlights

Put together an automation script for configuring ESXi hosts
Configure and manage vCenter Server and vSphere clusters
Automate DRS share balancing in clusters
Use and manage vSphere snapshots on virtual machines
Manage DRS affinity group memberships by building custom functions
Auditing vSphere configuration by leveraging native PowerShell commands
Create objects with data for reports and format output
Use VMware Tools and PowerCLI to execute native commands in the VM guest OS
Extend the PowerCLI reach by using ESXCLI objects1
Perform vCloud administration
and much much more…

By the Numbers

247 Pages
77 step-by-step recipes
10 Chapters
9 months, start to finish

April 6, 2015 1 comment