Lead the Transfomation

Speaking with customers everyday the most common thing I see the infrastructure teams struggle with is how do we get from X to Z. We are virtualizing first. Evaluating tier 1 apps as VM’s. Migrating non-essential services to the cloud. As an overall strategy how do I get from what I have, to where I want to go?
While there are many topics to get you going on this path, from management and orchestration to improved monitoring and security. One thing we as infrastructure guys often forget to ask is, “Are our applications ready for the future?” Many of the off the shelf applications are just fine for many of our use cases today will they still be viable in 5-10 years? Can we take a design that was created from a physical silo, virtualize it, and hope to be cloud ready? Maybe. How can we think in a new way about our applications?
Currently we take our application and think of it this way:

20120509-100452.jpg
It consumes parts of these buckets. Physical or Virtual, the application is bound by the contraints of a general purpose OS accessing some sort of physical resources that are bound a physical RU in a datacenter.
So even as we look to build out like this:

20120509-104434.jpg
We take the same solutions that we used in the physical world in order to provide scale and high availability. Mainly clustering. Does clustering provide actually cloud enabled applications? Most likely not. We look to the new bubble of dot com innovators for solutions to the boxes the old guard of application vendors have locked us in. I am not going negative on any current application but rather trying to challenge us to think beyond the way we have always done things.
So if we want to move towards a new model, public, private or hybrid cloud. It would be in the best interest of the infrastructure teams to lead the charge and provide thought leadership when moving applications to a cloud. I would argue in the near future you do not want to be the one that is seemingly hugging your infrastructure. It is always better to be leading the change than
roadblocking it, especially when the change will drive the business to the next level of service capabilities.

20120509-105917.jpg
So a few questions to start asking:

  • What does my data actually look like?
  • How does the business use the rows and columns to function?
  • Are all application decisions made in a room walled in by current capabilites?
  • How are we going to deliver applications with a new model? (think mobile)
  • At what point do we need to expand the foundation of what we are built on in order to increase our effectiveness in the market?
  • In 5 years do I want to be working on plumbing of the datacenter or have enough agility and scalability built in where I can drive innovation rather than daily maintenance?
  • vSphere Metro Stretched Clusters – Some Info/Links

    A lot of questions lately about vSphere Clusters across distance. I really need to learn for myself so I collected some good links.

    Make sure you understand what “Only Non-uniform host access configuration is supported” means. Someone correct me if I have this wrong but your device that enables the distributed virtual storage needs to be sure that hosts in site A are writing to their preferred volumes in site A and vice versa in Site B. Probably way over simplifying it.


    LINKS

    http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2007545

    http://virtualgeek.typepad.com/virtual_geek/2011/10/new-vmware-hcl-category-vsphere-metro-stretched-cluster.html

    http://www.yellow-bricks.com/2011/10/07/vsphere-metro-storage-cluster-solutions-what-is-supported-and-what-not/

    http://www.yellow-bricks.com/2011/10/05/vsphere-5-0-ha-and-metro-stretched-cluster-solutions/

    Big thanks to Scott Lowe for clearing the details on this topic.

    Trunks – Dell Power Connect and Cisco

    I recently needed to install a stack of Dell 6224 Power Connect switches. The core of the network was actually a Cisco 3560 (no G). While there are already posts existing from Scott Lowe about using the “General” mode to keep VLAN 1 untagged and also have other VLAN’s tagged. Dell’s General mode traditionally works just like a default dot1q trunk in Cisco. However when VLAN 1 is in use I secretly grumble because I know the fact that Dell’s general mode is finicky when interoperating with some devices. Most of the time general mode works like a charm but not on this day.

    Dell’s “trunk” mode worked fine. Any tagged VLAN would pass fine to the Cisco. Except that pesky native VLAN 1. We HAD to have VLAN 1 passed down to the ESX servers. So after kicking around wondering what I did wrong I decided to just work around the problem. I tagged vlan 1 on the Dell port and changed the native vlan on that specific trunk on the Cisco to another vlan (not being used on the Dell). BAM it worked.

    Note: Dell was running their newest firmware on that day – 3.2.0.9 (they have since released 3.2.0.10)
    Note 2: I am all about auto-negotiation at Gigabit but still like 100Mbps switch links to be hard coded.

    Cisco 3560 (no G).

    interface FastEthernet 0/24
    speed 100
    duplex Full
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 1,10,11
    swtichport trunk native vlan 8
    switchport mode trunk

    Dell 6224

    interface Ethernet 1/g24
    no negotiation
    speed 100
    duplex full
    switchport mode trunk
    switchport trunk allowed vlan add 1,10,11

    Firewalls are not Routers

    I am no network super-genius but I do enough with networking to be able to get by. Two common mistakes I find many times are flat networks and firewalls as the default gateway. A flat network is when generally switches are connected to one another without any configuration. There is one broadcast domain which means every packet that the switch does not have an entry in the MAC address table, is sent out all the ports but the originating port. This repeats across all of the switches until the layer 2 destination is found. Now, this means your expensive Cisco switches are barely better than hubs. You don’t have collisions like you would on a hub and once the switch learns where the MAC address lives it keeps that information for a certain amount of time. Then again in this network setup the logs are most likely not monitored so if there where collisions and other errors it goes unnoticed.
    That is not the title of this post though. Although related to a flat network using the firewall is a different issue. Using the firewall as the router works just fine when you have a flat network. You may never notice the problem in a small network, but as your network grew you noticed how problems can come up when there is just one big network. So someone smart said use vlans to segment the network, create smaller broadcast domains. Then when you try to fix or change the flat network with subnets and vlans can you find out the new vlans can not reach the rest of the original network.

    media_1272596360227.png

    The current flat network with switches and the firewall used as the default gateway or router.

    media_1272597099867.png

    The problem comes when you add subnets that are different than the interface ip of the firewall. Firewalls in general have issue with redirecting traffic bound for other networks back out of the same interface. So in the picture above traffic from vlan 1 that is using the firewall as the default gateway trying to reach the subnet on vlan 10. Since the host on vlan 1 does not know where that network lives it sends the traffic to the default gateway. Even if you added a static route to the firewall the traffic will often fail. That is because firewalls are not meant to route but rather send traffic between trusted and untrusted networks and vice-versa. So the question becomes how do you actually fix your flat network that has the firewall as the router. There is of course more complicated solutions to provide high availability using VRRP or HSRP.
    First get a real layer 3 device. That is a router or a switch capable of routing between multiple vlans. The good news is many of your newer switches are capable of layer 3, it is included in many Dell and HP switches, it may still be an add-on with Cisco. I haven’t used a new switch in the last year that did not have layer 3.
    Next important step is use the layer 3 device (switch or router) to route everything. Set a default route in the layer 3 device to send only outbound traffic to the firewall and bam everything works. Why is this so hard. Many times there is hundreds of servers and desktops already configured to use the firewall as their router. We will do a lot of work to avoid having to do a bunch of manual work.

    media_1272597858840.png

    Now you are using a router to route and the firewall to block bad things and maybe even do NAT. (note: If you are doing NAT be sure to add your new VLANs to your NAT rules so the new networks can reach the outside of your firewall.)

    Ask Good Questions

    This happened a long time ago. I arrived at a customer site to install View Desktop Manager (may have been version 2). This was before any cool VDI sizing tools like Liquidware Labs. I am installing ESX and VDM I casually ask, “What apps will you be running on this install?” The answer was, “Oh, web apps like youtube, flash and some shockwave stuff.” I thought “ah dang” in my best Mater voice. This was a case of two different organizations thinking someone else had gathered the proper information. Important details sometimes fall through the cracks. Since that day, I try to at least uncover most of this stuff before I show up on site.

    Even though we have great assessment tools now, remember to ask some questions and get to know what is your customers end goal.

    Things I learned that day. As related to VDI.

    1. Know what your client is doing, “What apps are you going to use?”

    2. Know where your client wants to do that thing from, “So, what kind of connection do you have to that remote office with 100+ users?”

    This is not the full list of questions I would ask, just some I learned along the way.

    VMware View and Xsigo

    *Disclaimer – I work for a Xsigo and VMware partner.

    I was in the VMware View Design and Best practices class a couple weeks ago. Much of the class is built on the VMware View Reference Architecture. The picture below is from that PDF.

    It really struck me how many IO connections (Network or Storage) it would take to run this POD. Minimum (in my opinion) would be 6 cables per host with ten 8 host clusters that is 480 cables! Let’s say that 160 of those are 4 gb Fiberchannel and the other 320 are 1 gb ethernet. The is 640 gb for storage and 320 for network.

    Xsigo currently uses 20 gb infiniband and best practice would be to use 2 cards per server. The same 80 servers in the above cluster would have 3200 gb of bandwidth available. Add in the flexibility and ease of management you get using virtual IO. The cost savings in the number director class fiber switches and datacenter switches you no longer need and the ROI I would think the pays for the Xsigo Directors. I don’t deal with pricing so this is pure contemplation. So I will stick with the technical benefits. Being in the datacenter I like any solution that makes provisioning servers easier, takes less cabling, and gives me unbelievable bandwidth.

    So just in the way VMware changed the way we think about the datacenter. Virtual IO will once again change how we deal with our deployments.

    ESX Commands: esxcfg-vswif

    The esxcfg-vswif command allows you to create and modify Service Console ports and their IP information. Many times I have to change stuff after the install process is complete and the only place is via the direct service console because network communication is not possible. This usually happens when the network team changes a vlan in the middle of the install or they change a subnet. Not to disparage network teams many times I am the network team and the virtualization team.
    Create a new vswif:
    #first add a port group with esxcfg-vswitch
    esxcfg-vswitch -A "Service Console Test" vSwitch-Test
    #then use esxcfg-vswif to create a new vswif
    esxcfg-vswif -a -i 172.16.50.40 -n 255.255.255.0 -p "Service Console Test" vswif1
    #List your vswifs
    esxcfg-vswif - l
    #Example:
    [root@esx3 root]# esxcfg-vswif -l
    Name Port Group IP Address Netmask Broadcast Enabled DHCP
    vswif0 Service Console 172.16.50.50 255.255.255.0 172.16.50.255 true false
    vswif1 Service Console Test172.16.50.40 255.255.255.0 172.16.50.255 true false

    Modify your Service Console network information:
    esxcfg-vswif -i 172.16.50.41 -n 255.255.255.0 vswif1
    #example
    [root@esx3 root]# esxcfg-vswif -i 172.16.50.41 -n 255.255.255.0 vswif1
    Setting IP config
    Nothing to flush.
    [root@esx3 root]# esxcfg-vswif -l
    Name Port Group IP Address Netmask Broadcast Enabled DHCP
    vswif0 Service Console 172.16.50.50 255.255.255.0 172.16.50.255 true false
    vswif1 Service Console Test172.16.50.41 255.255.255.0 172.16.50.255 true false

    ESX Commands – esxcfg-firewall

    I have really forgot to keep up on my VCDX study path. So today a quick tidbit on the esxcfg-firewall command.
    Many of us today will use the vCenter Client to change firewall ports on the ESX. One instance where I exclusively mess with the firewall from the command line using esxcfg-firewall is when I install Dell OpenManage. I am already in the console to install the agents so I might as well open the firewall from the console too.
    This really applies to any kind of agent or software you add to your ESX installation. So if you find yourself already in the console why not save a step and do it from the cli?

    Lets look at the command

    # esxcfg-firewall -o 1311,tcp,in,OpenManageRequest

    First is the command, esxcfg-firewall, -o is for openport, the 1311 is the port number, tcp is protocol, in is the direction and the final part is the name of the service.

    Now if you want to see all of your esxcfg-firewall settings try:
    esxcfg-firewall -q

    Show if specifig service is enabled.
    esxcfg-firewall -q [service name]

    Of course typing esxcfg-firewall -h gives lots of good help.

    Some links: (You can google and find a ton more)

    ESX Guide
    VMware Land
    Yellow Bricks
    Vritualization Admin

    The Forging of the new Network/VMware/Storage Professional

    When I first started out in College I needed a work study job. Since I liked to help people with their computer problems I applied and was hired for a position doing phone and in person support for the University. One of the best things about starting out at a school they don’t mind teaching. Our trainer said that in previous years new employees would be slotted into being Windows or Mac or UNIX support. He said we would be Wunder-Cons (our title was consultant instead of help desk dude). We had the privilege of having to support all of it. This thrust me into the world IT no matter what the piece of paper from USC said I was a Bachelor of.

    I believe a new kind of Wunder-Consultant/Engineer is being made. With the announcement of the Nexus 1000v last fall the line between Network Engineer and Datacenter/Server Engineer is getting blurred. The SAN and Server Engineers have had this tension for a while now. Virtualization is a fun technology to learn but who gets the responsibility? I have seen where the SAN team owns the ESX’s and the Server team operates the VM’s like they are physical. The Network team not trusting or understanding why they want a bunch of 1GigE trunk ports. Across larger organizations it would look different but the struggle may be just the same. Who is in control of the VM’s? Are they secure? Who gets called at 1am when something dies? This is internal to the IT department and does not consider that Sales doesn’t want to share memory with accounting.

    I can see these technologies pushing engineers into being jacks of all trades. To be a truly Architect level in VMware today you must be awesome with storage and servers. You have to be able to SSH into an ESX, choose the right storage for an application, and setup templates of Windows 2003. That is an easy day. You already will have to troubleshoot IO (because all problems get blamed on the virtualization first).

    With the Nexus 1000v I picture the Virtualization Admins learning the skills to configure and troubleshoot route/switch inside and outside the Virtual Infrastructure. Add to that Cisco’s push this year with 10GigE and FCoE and their own embedded virtualization products. The lines between job duties are getting blown away.

    Who is poised to become the experts in this realm? The network, server or storage admins? In this economy it may be good to know how to do all three jobs. I am sure corporations would love to pay just one salary to perform these tasks.

    Randomly I though how would this relate to SOX? Could it pose any problems with compliance? I will save that for next time.

    GNS3- Graphical Network Simulator – New Release

    GNS3 is a excellent tool that uses dynamips to simulate routers running real Cisco IOS. You must have rights on your CCO account to download the IOS. It also includes the PIX emulator so you can check out your PIX/ASA configs.

    Only piece missing is the switch simulators. You can combine GNS3 with VMware Workstation to build entire lab environments. I have one friend that has most of his voice lab for CCIE built using VMware and GNS3. Good stuff. 
    Runs in Windows/Linux/OSX.