VMworld Europe Day Two

Today is pretty much the day the whole conference springs to life. All the remaining delegates join the party with the TAM and Partner delegates. The Solutions Exchange opened for business and there’s just a much bigger bustle about the place than there was yesterday.

The opening general session was hosted by Carl Eschenbach, and credit to him for getting straight in there and talking about the Dell deal. I think most are scratching their heads, wondering what this means in the broader scheme of things, but Carl reassured the delegates that it would still be ‘business as usual’ with VMware acting as an independent entity. That’s not strictly true, as they’re still part of the EMC Federation, who are being acquired by Dell, so not exactly the same.

Even Michael Dell was wheeled out to give a video address to the conference to try and soothe any nerves, giving one of those award ceremony ‘sorry I can’t be there’ speeches. Can’t say it changed my perspective much!

The event itself continues to grow. This year there are 10,000 delegates from 96 countries and a couple of thousand partners.

Into the guts of the content, first up were Telefonica and Novamedia. The former are a pretty well known European telco, and the latter are a multinational lottery company. The gist of the chat was that VMware solutions (vCloud, NSX etc) have allowed both companies to bring new services and solutions to market far quicker than previously. In Novamedia’s case, they built 4 new data centres and had them up and running in a year. I was most impressed by Jan from Novamedia’s comment ‘Be bold, be innovative, be aggressive’. A man after my own heart!

VMware’s reasonably new CTO Ray O’Farrell then came out and with Kit Colbert discussed the ideas behind cloud native applications and support for containers. I’ll be honest at this point and say that I don’t get the container hype, but that’s probably due in no small part to my lack of understanding of the fundamentals and the use cases. I will do more to learn more, but for now, it looks like a bunch of isolated processes on a Linux box to me. What an old cynic!

VMware have taken to approaches to support containers. The first is to extend vSphere to use vSphere Integrated Containers and the second is the Photon platform. The issue with containerised applications is that the vSphere administrator has no visibility into them. It just looks and acts like a VM. With VIC, there are additional plug-ins into the vSphere Web Client that allow the administrator to view which processes are in use, on which host and how it is performing. All of this management layer is invisible and non-intrusive to the developer.

The concept of ‘jeVM’ was discussed, which is ‘just enough VM’, a smaller footprint for container based environments. Where VIC is a Linux VM on vSphere, the Photon platform is essentially a microvisor on the physical host, serving up resource to containersa running Photon OS, which is a custom VMware Linux build. The Photon platform itself contains two objects – a controller and the platform itself. The former will be open sourced in the next few weeks (aka free!) But the platform itself will be subscription only from VMware. I’d like to understand how that breaks down a bit better.

VRealize Automation 7 was also announced, which I had no visibility of, so that was a nice surprise. There was a quick demo with Yangbing Li showing off a few drag and drop canvas for advanced service blueprints. I was hoping this release would do away with the need for the Windows IaaS VM(s), but I’m reliably informed this is not the case.

Finally, we were treated with a cross cloud vMotion, which was announced as an industry first. VMs were migrated from a local vSphere instance to a vCloud Air DC in the UK and vice versa. This is made possible by ‘stretching’ the Layer 21 network between the host site and the vCloud Air DC. This link also includes full encryption and bandwidth optimisation. The benefit here is that again, it’s all managed from a familiar place (vSphere Web Client) and the cross cloud vMotion is just the migration wizard with a couple of extra choices for source and destination.

I left the general session with overriding feeling that VMware really are light years ahead in the virtualisation market, not just on premises solutions but hybrid too. They’ve embraced all cloud providers, and the solutions are better for it. Light years ahead of Microsoft in my opinion, and VMware have really raised their game in the last couple of years.

My first breakout session of the day was Distributed Switch Best Practices. This was a pretty good session as I’ve really become an NSX fanboy in the last few months, and VDSes are the bedrock of moving packet between VMs. As such, I noted the following:-

  • DV port group still has a one to one mapping to a VLAN
  • There may be multiple VTEPS on a single host. A DV port group is created for all VTEPs
  • DV port group is now called a logical switch when backed by VXLAN
  • Avoid single point of failure
  • Use separate network devices (i.e switches) wherever possible
  • Up to 32 uplinks possible
  • Recommend 2 x 10v Gbps links,  rather than lots of 1 Gbps
  • Don’t dedicate physical up links for management when connectivity is limited and enable NIOC
  • VXLAN compatible NIC recommended, so hardware offload can be used
  • Configure port fast and BPDU on switch ports, DVS does not have STP
  • Always try to pin traffic to a single NIC to reduce risk of out of order traffic
  • Traffic for VTEPs only using single up link in an active passive configuration
  • Use source based hashing. Good spread of VM traffic and simple configuration
  • Myth that VM traffic visibility is lost with NSX
  • Net flow, port mirroring, VXLAN ping tests connections between VTEPs
  • Trace flow introduced with NSX 6.2
  • Packets are specially tagged for monitoring, reporting back to NSX controller
  • Trace flow is in vSphere Web client
  • Host level packet capture from the CLI
  • VDS portgroup, vmknic or up link level, export as pcap for Wireshark analysis
  • Use DFW
  • Use jumbo frames
  • Mark DSCP value on VXLAN encapsulation for Quality of Service

For my final session of the dayt, I attended The Practical Path to NSX and Network Virtualisation. At first I was a bit dubious about this session as the first 20 minutes or so just went over old ground of what NSX was, and what all the pieces were, but I’m glad I stayed with it, as I got a few pearls of wisdom from it.

  • Customer used NSX for PCI compliance, move VM across data center and keep security. No modification to network design and must work with existing security products
  • Defined security groups for VMs based on role or application
  • Used NSX API for custom monitoring dashboards
  • Use tagging to classify workloads into the right security groups
  • Used distributed objects, vRealize for automation and integration into Palo Alto and Splunk
  • Classic brownfield design
  • Used NSX to secure Windows 2003 by isolating VMs, applying firewall rules and redirecting Windows 2003 traffic to Trend Micro IDS/IPS
  • Extend DC across sites at layer 3 using encapsulation but shown as same logical switch to admin
  • Customer used NSX for metro cluster
  • Trace flow will show which firewall rule dropped the packet
  • VROps shows NSX health and also logical and physical paths for troubleshooting

It was really cool to see how NSX could be used to secure Windows 2003 workloads that could not be upgraded but still needed to be controlled on the network. I must be honest, I hadn’t considered this use case, and better still, it could be done with a few clicks in a few minutes with no downtime!

NSX rocks!





VMworld Europe Day One

Today saw the start of VMworld Europe in Barcelona, with today being primarily for partners and TAM customers (usually some of the bigger end users). However, that doesn’t mean that the place is quiet, far from it! There are plenty of delegates already milling around, I saw a lot of queues around the breakout sessions and also for the hands on labs.

As today was partner day, I already booked my sessions on the day they were released. I know how quickly these sessions fill, and I didn’t want the hassle of queuing up outside and hoping that I would get in. The first session was around what’s new in Virtual SAN. There have been a lot of press inches given to the hyper converged storage market in the last year, and I’ve really tried to blank them out. Now the FUD seems to have calmed down, it’s good to be able to take a dispassionate look at all the different offerings out there, as they all have something to give.

My first session was with Simon Todd and was titled VMware Virtual SAN Architecture Deep Dive for Partners. 

It was interesting to note the strong numbers of customer deploying VSAN. There was a mention of 3,000 globally, which isn’t bad for a product that you could argue has only just reached a major stage of maturity. There was the usual gratuitous customer logo slide, one of which was of interest to me. United Utilities deal with water related things in the north west, and they’re a major VSAN customer.

There were other technical notes, such as VSAN being an object based file system, not a distributed one. One customer has 14PB of storage over 64 nodes, and the limitation to further scaling out that cluster is a vSphere related one, rather than a VSAN related one.

One interesting topic of discussion was whether or not to use passthrough mode for the physical disks. What this boils down to is the amount of intelligence VSAN can gather from the disks if they are in passthrough mode. Basically, there can be a lot of ‘dialog’ between the disks and VSAN if there isn’t a controller in the way. I have set it up on IBM kit in our lab at work, and I had to set it to RAID0 as I couldn’t work out how to set it to passthrough. Looks like I’ll have to go back to that one! To be honest, I wasn’t getting the performance I expected, and that looks like it’s down to me.

VSAN under the covers seems a lot more complex than I thought, so I really need to have a good read of the docs before I go ahead and rebuild our labs.

There was also an interesting thread on troubleshooting. There are two fault types in VSAN – degraded and absent. Degraded state is when (for example) an SSD is wearing out, and while it will still work for a period of time, performance will inevitably suffer and the part will ultimately go bang. Absent state is where a temporary event has occured, with the expectation that this state will be recovered from quickly. Examples of this include a host (maintenance mode) or network connection down and this affects how the VSAN cluster behaves.

There is also now the ability to perform some proactive testing, to ensure that the environment is correctly configured and performance levels can be guaranteed. These steps include a ‘mock’ creation of virtual machines and a network multicast test. Other helpful troubleshooting items include the ability to blink the LED on a disk so you don’t swap out the wrong one!

The final note from this session was the availability of the VSAN assessment tool, which is a discovery tool run on customer site, typically for a week, that gathers existing storage metrics and provides sizoing recommendations and cost savings using VSAN. This can be requested via a partner, so in this case, Frontline!

The next session I went to was Power Play :What’s New With Virtual SAN and How To Be Successful Selling It. Bit of a mouthful I’ll agree, and as I’m not much of a sales or pre-sales guy, there wasn’t a massive amount of takeaway for me from this session, but Rory Choudhari took us through the current and projected revenues for the hyperconverged market, and they’re mind boggling.

This session delved into the value proposition of Virtual SAN, mainly in terms of costs (both capital and operational) and the fact that it’s simple to set up and get going with. He suggested it could live in harmony with the storage teams and their monolithic frames, I’m not so sure myself. Not from a tech standpoint, but from a political one. It’s going to be difficult in larger, more beauracratic environments.

One interesting note was Oregon State University saving 60% using Virtual SAN as compared to refreshing their dedicated storage platform. There are now nearly 800 VASN production customers in EMEA, and this number is growing weekly. Virtual SAN6.1 also brings with it support for Microsoft and Oracle RAC clustering. There is support for OpenStack, Docker and Photon and the product comes in two versions.

If you need an all flash VSAN and/or stretched clusters, you’ll need the Advanced version. For every other use case, Standard is just fine.

After all the VSAN content I decided to switch gears and attend an NSX session called  Disaster Recovery with NSX, SRM and vRO with Gilles Chekroun. Primarily this session seemed to concentrate on the features in the new NSX 6.2 release, namely the universal objects now available (distributed router, switch, firewall) which span datacentres and vCenters. With cross vCenter vMotion, VMware have really gone all out removing vCenter as the security or functionality boundary to using many of their products, and it’s opened a whole new path of opportunity, in my opinion.

There are currently 700 NSX customers globally, with 65 paying $1m or more in their deployments. This is not just licencing costs, but also for integration with third party products such as Palo Alto, for example. Release 6.2 has 20 new features and has the concept of primary and secondary sites. The primary site hosts an NSX Manager appliance and the controller cluster, and secondary sites host only an NSX Manager appliance (so no controller clusters). Each site is aware of things such as distributed firewall rules, so when a VM is moved from one site to another, the security settings arew preserved.

Locale IDs have also been added to provide the ability to ‘name’ a site and use the ID to direct routing traffic down specific paths, either locally on that site or via another site. This was the key takeway from the session that DRis typically slow, complex and expensive, with DR tests only being invoked annually. By providing network flexibility between sites and binding in SRM and vRO for automation, some of these issues go away.

In between times I sat the VCP-CMA exam for the second time. I sat the beta release of the exam and failed it, which was a bit of a surprise as I thought I’d done quite well. Anyway, this time I went through it, some of the questions from the beta were repeated and I answered most in the same way and this time passed easily with a 410/500. This gives me the distinction of now holding a full house of current VCPs – cloud, desktop, network and datacenter virtualisation. Once VMware Education sort out the cluster f**k that is the Advanced track, I hope to do the same at that level.

Finally I went to a quick talk called 10 Reasons Why VMware Virtual SAN Is The Best Hyperconverged Solution. Rather than go chapter and verse on each point I’ll list them below for your viewing pleasure:-

  1. VSAN is built directly into the hypervisor, giving data locality and lower latency
  2. Choice – you can pick your vendor of choice (HP, Dell, etc.) And either pick a validated, pre-built solution or ‘roll your own’ from a list of compatible controllers and hard drives from the VMware HCL
  3. Scale up or scale out, don’t pay for storage you don’t need (typically large SAN installations purchase all forecasted storage up front) and grow as you go by adding disks, SAS expanders and hosts up to 64 hosts
  4. Seamless integration with the existing VMware stack – vROps adapters already exist for management, integration with View is fully supported etc
  5. Get excellent performance using industry standard parts. No need to source specialised hardware to build a solution
  6. Do more with less – achieve excellent performance and capacity without having to buy a lot of hardware, licencing, support etc
  7. If you know vSphere, you knopw VSAN. Same management console, no new tricks or skills to learn with the default settings
  8. 2000 customers using VSAN in their production environment, 65% of whom use it for business critical applications. VSAN is also now third generation
  9. Fast moving road map – version 5.5 to 6.1 in just 18 months, much faster rate of innovation than most monolithic storage providers
  10. Future proof – engineered to work with technologies such as Docker etc

All in all a pretty productive day – four sessions and a new VCP for the collection, so I can’t complain. Also great to see and chat with friends and ex-colleagues who are also over here, which is yet another great reason to come to VMworld. It’s 10,000 people, but there’s still a strong sense of community.


VCIX-NV Exam Experience


Last Thursday I went over to Leeds to sit the VCIX-NV exam. Obviously regular readers will know I haven’t been using NSX all that long (around 6 weeks, I’d say) and I’ve already managed to get the VCP out of the way, so I figured I needed a new challenge! As per usual, there are no exam questions listed as per the NDA, but if you’re thinking of doing this exam any time soon, I’d recommend it. Advanced exams are always a tough but rewarding experience.

The exam itself, as per the blueprint, is 18 questions with a selection of subtasks. Passing score is 300 out of 500 and obviously you can score points even when you don’t fully meet all question requirements. Total time allowed is 225 minutes, although I didn’t spend a lot of time clock watching until the end.

I’ve read a lot of people complain about latency issues, but I didn’t really see that during my sitting. I have a level of expectation that there will be latency anyway, and it wasn’t so severe that it really made much of a difference to me getting things done. I did have an issue with low colour on the screen, which is obviously a known issue as it was listed on the exam start screen. Again it didn’t prevent me performing any tasks, so I elected against disconnecting and reconnecting as recommended, I’m always paranoid that something bad will go wrong second time around!

The exam itself is very faithful to the blueprint, but as the blueprint is so wide in scope and there are only 18 questions, some areas were not covered at all, which you’d sort of expect. There was certainly nothing in there that I thought was not fair game.

About half way through I had a major issue where a host stopped responding. After informing the proctor and some phone calls to and fro between the test centre, Pearson and VMware, it was decided it was my fault and so therefore wouldn’t be fixed. I wasn’t sure I agreed with that assessment, but as things turned out it worked out in my favour, in a crazy way. Firstly, up to that point I’d been going quite slowly and not managing my time very well (a constant point when sitting VCAP/VCIX exams), so having 20 minutes out of the room to look at the host issue meant that when I went back in, the dead host issue meant a fire was lit under me to get things done quicker and in the end, the dead host had no effect on any other tasks I had to do (and I should add that Pearson did give me the time back on the exam timer).

I did miss one question out that I was saving to the end, but I ran out of time to come back to it. After hitting the finish button with seconds left, I got my score report back on Friday night (thanks again Josh @ VMware for pushing the scoring through) and much to my surprise and utter relief I passed with 300/500. Right on the limit, but a pass is a pass and the exam has helped me identify areas I need to strengthen, so a win-win all around.

In terms of study materials, let me recommend the following:-

The Hands On Lab environment is very similar to the exam environment and working through each exercise several times until you have it down pat is a really effective way of preparing for the exam. Remember during the exam that you can score points in a variety of ways, so make sure to read the question and complete as many tasks as you can, this was basically the key to me just about getting over the line. Even if it’s only one sub task out of three or four, if you can complete it, do it and add it to your total.

Finally, get to your exam centre in plenty of time, stay relaxed and don’t be intimidated! No idea what is next for me exam wise, I think I’ll probably have a breather and wait until the new VCIX-DCV and DTM are released, probably towards Christmas/New Year time.



VCP6-CMA Study Guide : Section 5: Allocate and Manage vRealize Automation Resources


As I predicted in my last blog post, VMware have announced that starting at VMworld 2015 in August, it will be possible to schedule VCP6 exams such as VCP-DCV, VCP-DTM and VCP-CMA. Hopefully this will mean that my beta score for my CMA exam is not too far away now, it would be nice to get a full house of VCPs!

Anyway, also as per my last blog post, I’m publishing section 5 of the study guide, which is as far as I got. Unless I fail the beta and have to resit, I don’t envisage me having the time to go back and complete the remaining sections. Hopefully it will be of some use to people planning on having a go at the CMA, any feedback is welcome via Twitter as always.

Objective 5.1: Create and Manage Fabric Groups

Adding and configuring vSphere Endpoints

  • Creating an endpoint creates access to compute resources on a virtualised platform
  • The process involves creating a credential set, defining a cloud endpoint and mapping resources for consumption
  • Log in to the vRealize Automation console as an IaaS administrator.
  • Select Infrastructure > Endpoints > Credentials.
  • Click New Credentials.
  • Enter a name in the Name text box. (Optional) Enter a description in the Description text box.
  • Type the username in the User name text box.
    • Must be in domain\username format, for example mycompany\admin. The credentials must have permission to modify custom attributes
  • Type the password in the Password text boxes.
  • Click the Save icon (green tick)
  • Select Infrastructure > Endpoints > Endpoints.
  • Select New Endpoint > Virtual > vSphere.
  • Enter a name in the Name text box.
    • This must match the endpoint name provided to the vSphere proxy agent during installation or data collection fails.
  • (Optional) Enter a description in the Description text box.
  • Enter the URL for the vCenter Server instance in the Address text box.
  • Select the previously defined Credentials for the endpoint.
    • If your system administrator configured the vSphere proxy agent to use integrated credentials, you can select the Integrated credentials.
  • Only select Specify manager for network and security platform if you plan to integrate with an existing NSX or vCNS instance

Adding and configuring vRealize Automation endpoints

  • I’m assuming here that this refers to Orchestrator!
  • Same process as for vSphere endpoint, except you choose to create a vCO credential using administrator@vsphere.local (assuming using the vCO engine as part of the vRO appliance)
  • Create a new Orchestration endpoint for vCenter Orchestrator
  • Give it a meaningful, type in the address (typically https://vcoserver:8281/vco)
  • Select the appropriate vCO credential you just created
  • Add a custom property VMware.VCenterOrchestrator.Priority and set it to 1. This is mandatory.

Map compute resources to endpoints

  • A compute resource is an object that represents a host, host cluster, or pool in a virtualization platform, a virtual datacenter, or an Amazon region on which machines can be provisioned.
  • An IaaS administrator can add compute resources to or remove compute resources from a fabric group.
  • A compute resource can belong to more than one fabric group, including groups that different fabric administrators manage.
  • After a compute resource is added to a fabric group, a fabric administrator can create reservations on it for specific business groups. Users in those business groups can then be entitled to provision machines on that compute resource
  • Compute resources such as storage and networking can be assigned from endpoints to Business Groups
  • Reservations are used to carve up resource from compute resources to apply to a Business Group

Assign correct permissions to manage Fabric Groups

  • An IaaS administrator can organize virtualization compute resources and cloud endpoints into fabric groups by type and intent. One or more fabric administrators manage the resources in each fabric group.
  • Fabric administrators are responsible for creating reservations on the compute resources in their groups to allocate fabric to specific business groups. Fabric groups are created in a specific tenant, but their resources can be made available to users who belong to business groups in all tenants.
  • Fabric administrators are created and assigned when creating the Fabric Group
  • A Fabric Administrator can do the following:-
    • Manage build profiles
    • Manage compute resources
    • Manage cost profiles
    • Manage network profiles
    • Manage Amazon EBS volumes and key pairs
    • Manage machine prefixes
    • Manage property dictionary
    • Manage reservations and reservation policies

Perform compute resource data collection

  • vRealize Automation collects data from both infrastructure source endpoints and their compute resources.
  • Data collection occurs at regular intervals. Each type of data collection has a default interval that you can override or modify.
  • IaaS administrators can manually initiate data collection for infrastructure source endpoints and fabric administrators can manually initiate data collection for compute resources.
  • To perform a manual data collection, Log in to the vRealize Automation console as an IaaS administrator.
  • Select Infrastructure > Endpoints > Endpoints
  • Point to the endpoint for which you want to run data collection and click Data Collection.
  • Click Start.
  • (Optional) Click Refresh to receive an updated message about the status of the data collection you initiated.
  • Click Cancel to return to the Endpoints page
  • There are seven different types of data collection:-
    • Infrastructure Source Endpoint Data Collection (Updates information about virtualization hosts, templates, and ISO images for virtualization environments. Updates virtual datacenters and templates for vCloud Director. Updates regions and machines provisioned on them for Amazon. Updates installed memory and CPU count for physical management interfaces.)
    • Inventory Data Collection (Updates the record of the virtual machines whose resource use is tied to a specific compute resource, including detailed information about the networks, storage, and virtual machines. This record also includes information about unmanaged virtual machines, which are machines provisioned outside of vRealize Automation.)
    • State Data Collection (Updates the record of the power state of each machine discovered through inventory data collection. State data collection also records missing machines that vRealize Automation manages but cannot be detected on the virtualization compute resource or cloud endpoint.)
    • Performance Data Collection (vSphere compute resources only) (Updates the record of the average CPU, storage, memory, and network usage for each virtual machine discovered through inventory data collection)
    • vCNS inventory data collection (vSphere compute resources only) (Updates the record of network and security data related to vCloud Networking and Security and NSX, particularly information about security groups and load balancing, for each machine following inventory data collection)
    • WMI data collection (Windows compute resources only) (Updates the record of the management data for each Windows machine. A WMI agent must be installed, typically on the Manager Service host, and enabled to collect data from Windows machines.)
    • Cost data collection (compute resources managed by vRealize Business Standard Edition only) (Updates the CPU, memory, and storage costs for each compute resource managed by vRealize Business Standard Edition. The costs of catalog items that can be provisioned by using the compute resources are updated.)

Perform resource monitoring tasks

Resource Monitoring Scenario Privileges Required Location
Monitor the amount of physical storage and memory on your compute resources that is currently being consumed and determine what amount remains free. You can also monitor the number of reserved and allocated machines provisioned on each compute resource Fabric Administrator (monitor resource usage on compute resources in your fabric group) Infrastructure > Compute Resources > Compute Resources
Monitor physical machines that are reserved for use but not yet provisioned. Fabric Administrator Infrastructure > Machines > Reserved Machines
Monitor machines that are currently provisioned and under vRealize Automation management Fabric Administrator Infrastructure > Machines > Managed Machines
Monitor the amount of storage, memory, and machine quota of your reservation that is currently allocated and determine the capacity that remains available to the reservation Fabric Administrator (monitor resource usage for reservations on your compute resources and physical machines) Infrastructure > Reservations > Reservations
Monitor the amount of storage, memory, and the machine quota that your business groups are currently consuming and determine the capacity that remains on reserve for them. Tenant Administrator (monitor resource usage for all groups in your tenant)Business Group Manager (monitor resource usage for groups that you manage) Infrastructure > Groups > Business Groups

Objective 5.2: Create and Manage Reservations

Create and Manage Reservations

  • Before members of a business group can request machines, fabric administrators must allocate resources to them by creating a reservation.
  • Each business group must have at least one reservation for its members to provision machines of that type.
  • Log in to the vRealize Automation console as a fabric administrator
  • A tenant administrator must create at least one business group
  • Select Infrastructure > Reservations > Reservations
  • Select New Reservation > Virtual and select the type of reservation you are creating
  • (Optional) Select an existing reservation from the Copy from existing reservation drop-down menu.
  • Data from the reservation you chose appears, and you can make changes as required for your new reservation
  • Select a compute resource on which to provision machines from the Compute resource drop-down menu.
  • Only templates located on the cluster you select are available for cloning with this reservation.
  • The reservation name appears in the Name text box.
  • Enter a name in the Name text box
  • Select a tenant from the Tenant drop-down menu.
  • Select a business group from the Business group drop-down menu.
    • Only users in this business group can provision machines by using this reservation
  • (Optional) Select a reservation policy from the Reservation policy drop-down menu.
    • This option requires additional configuration. You must create a reservation policy
  • (Optional) Type a number in the Machine quota text box to set the maximum number of machines that can be provisioned on this reservation.
    • Only machines that are powered on are counted towards the quota. Leave blank to make the reservation unlimited.
  • Type a number in the Priority text box to set the priority for the reservation.
    • The priority is used when a business group has more than one reservation. A reservation with priority 1 is used for provisioning over a reservation with priority 2.
  • (Optional) Deselect the Enable this reservation check box if you do not want this reservation active.
  • (Optional) Add any custom properties

Specify Reservation Information

  • A reservation is a share of provisioning resources allocated by the fabric administrator from a fabric group and reserved for use by a particular business group
  • A virtual reservation is a share of the memory, CPU, networking, and storage resources of one compute resource allocated to a particular business group.
  • Each reservation is for one business group. A business group can have multiple reservations on a single compute resource. A business group can also have multiple reservations on compute resources of different types.
  • A physical reservation is a set of physical machines reserved for and available to a particular business group for provisioning.

Create and Manage a Cloud Reservation

  • A cloud reservation provides access to the provisioning services of a cloud service account for a particular business group.
  • A group can have multiple reservations on one endpoint or reservations on multiple endpoints.
  • A reservation may also define policies, priorities, and quotas that determine machine placement.
  • The reservation must be of the same platform type as the blueprint from which the machine was requested
  • The reservation must be enabled
  • The reservation must have capacity remaining in its machine quota or have an unlimited quota.
    • The allocated machine quota includes only machines that are powered on. For example, if a reservation has a quota of 50, and 40 machines have been provisioned but only 20 of them are powered on, the reservation’s quota is 40 percent allocated, not 80 percent
  • The reservation must have the security groups specified in the machine request.
  • The reservation must be associated with a region that has the machine image specified in the blueprint.
  • For Amazon machines, the request specifies an availability zone and whether the machine is to be provisioned a subnet in a Virtual Private Cloud (VPC) or a in a non-VPC location. The reservation must match the network type (VPC or non-VPC).
  • If the cloud provider supports network selection and the blueprint has specific network settings, the reservation must have the same networks.
    • If the blueprint or reservation specifies a network profile for static IP address assignment, an IP address must be available to assign to the new machine.
  • If the blueprint specifies a reservation policy, the reservation must belong to that reservation policy.
    • Reservation policies are a way to guarantee that the selected reservation satisfies any additional requirements for provisioning machines from a specific blueprint. For example, if a blueprint uses a specific machine image, you can use reservation policies to limit provisioning to reservations associated with the regions that have the required image.
  • If no reservation is available that meets all of the selection criteria, provisioning fails.


VCP6-CMA Study Guide – Section 4: Configure and Administer Tenants and Business Groups


I started to publish a draft study guide a while back for the VCP-CMA beta exam, and never really finished it before I sat the exam itself. I have two more sections completed (out of ten, poor!) so I’m putting them out there for folks to reference. The exam itself is still in the beta process and has not been released to schedule, but I’m guessing they’ll be trying to get it ready for VMworld next month.

I wrote a previous post about my beta exam experience, which you can read here but it may well not reflect the finished article (i.e the released exam). Anyway, on with Section 4 of the study guide.

Objective 4.1: Create and Manage Business Groups

Identify Business Group roles and their specific privilege levels

  • A business group associates a set of services and resources to a set of users, often corresponding to a line of business, department, or other organizational unit.
  • Business groups are managed on the Infrastructure tab but are used throughout the service catalog. Entitlements in the catalog are based on business groups. To request catalog items, a user must belong to at least one business group.
  • A business group can have access to catalog items specific to that group and to catalog items that are shared between business groups in the same tenant. In IaaS, each business group has one or more reservations that determine on which compute resources the machines that this group requested can be provisioned.
  • A business group must have at least one business group manager, who monitors the resource use for the group and often is an approver for catalog requests. In IaaS, group managers also create and manage machine blueprints for the groups they manage. Business groups can also contain support users, who can request and manage machines on behalf of other group members.
  • Business group managers can also submit requests on behalf of their users. A user can be a member of more than one business group, and can have different roles in different groups.

Identify and Manage Business Group Manager role

  • Manages one or more business groups.
  • Typically a line manager or project manager.
  • Business group managers manage catalog items and entitlements for their groups in the service catalog.
  • They can request and manage items on behalf of users in their groups. They are also service architects in Infrastructure as a Service.
  • Responsibilities include:-
    • Create and publish business group–specific machine blueprints from IaaS.
    • Manage business group–specific catalog items and entitlements.
    • Monitor resource usage in a business group

Identify and Manage Support User role

  • A role in a business group.
  • Support users can request and manage catalog items on behalf of other members of their groups.
  • This role is typically an executive administrator or department administrator
  • Responsibilities:-
    • Request and manage items on behalf of other users within their business groups.

Identify and Manage User role

  • Presumably this means the “Business User” role, which is an end user, or consumer of catalog items from the self service portal
  • Responsibilities:-
    • Request and manage services.

Assign Active Directory Users and Groups to Business Group Roles

  • Done in the Infrastructure -> Groups -> Business Groups tab
  • Under the User Role field, enter search string and click the search icon
  • Select AD user or group you want to add and then click OK

Create and manage Machine Prefixes

  • Machine prefixes are added to VMs provisioned from within vRA but can be overridden if need be by Business Group managers
  • Managed within the Business Group by clicking the ellipsis to the right of the field for default machine prefix
  • Either select existing machine prefix or create a new one by entering the machine prefix, number of digits and next number (eg. vm-001)
  • Machine prefixes are shared across all tenants and must be created by a fabric administrator
  • Can also be created and managed under Infrastructure -> Blueprints -> Machine Prefixes

Identify and Configure Custom Properties

  • You can add custom properties to a blueprint to specify attributes of a machine or to override default specifications.
  • You can also add build profiles to a blueprint as a convenience for specifying multiple custom properties
  • A machine owner, business group manager or fabric administrator can add, change, or delete custom properties for a provisioned machine.
  • Custom properties can be added to Business Groups by editing the Business Group, scrolling to the bottom and clicking “New Property”. Add a name, value and whether or not you want to encrypt it (usually only used for passwords) and whether or not to prompt the user for a value (machine name, for example).
  • Custom properties can be used for various tasks including for example placing all VMs from a certain Business Group into a vCenter folder for management
  • Custom properties can also be added to Blueprints
  • Custom properties can be marked as required values when creating a blueprint
  • The Windows guest agent records property values on the provisioned machine in the %SystemDrive %\VRMGuestAgent\site\workitem.xml file.
  • The Linux guest agent records property values on the provisioned machine in the /usr/share/gugent/site/workitem.xml file

Objective 4.2: Create and Manage Tenants

Configure branding for the vRealize Automation console

  • System administrators control the default branding for tenants. Tenant administrators can use the default or reconfigure branding for each tenant
  • Log in to the vRealize Automation console as a system administrator or tenant administrator
  • Select Administration > Branding.
  • Clear the Use default check box.
  • Create a banner.
  • Click Choose File to upload a logo image. Follow the prompts to finish creating the banner.
  • Click Next.
  • Type the copyright information in the Copyright notice text box and press Enter to preview your selection.
  • (Optional) Type the URL to your privacy policy in the Privacy policy link text box and press Enter to preview your selection.
  • (Optional) Type the URL to your contact page in the Contact link text box and press Enter to preview your selection.
  • Click Update. The console is updated with your changes.

Add and configure Tenant-specific inbound and outbound email notifications

  • Tenant administrators can add an outbound email server to send notifications for completing work items, such as approvals.
  • Each tenant can have only one outbound email server. If your system administrator has already configured a global outbound email server, you can override this at tenant level
  • Select Administration > Notifications > Email Servers
  • Click the Add icon
  • Select Email – Outbound. Fill out the form as needed, choose to Test Connection if required
  • Select Administration > Notifications > Email Servers
  • Click the Add icon
  • Select Email – Inbound, fill out the form as needed.
  • Click OK.

Override and Revert to system default email servers

  • To override these settings at tenant level, Select Administration > Notifications > Email Servers.
  • Select the Outbound/Inbound email server.
  • Click Override Global, fill out the form as needed
  • If the system administrator has configured a system default outbound/inbound email server, tenant administrators can override this global setting.

Identify and add Identity Stores in vRealize Automation

  • vRA uses the concept of Identity Stores to perform authentication of users and leverage existing users and groups to assign to roles.
  • If the Identity Appliance is AD joined, the default tenant can use native AD mode (i.e not LDAP lookup)
  • Any subsequent tenants must use LDAP
  • Click Administration -> Identity Stores
  • Click Add Identity Store to add a new identity store
    • Choose a Name
    • Select the type (OpenLDAP or Active Directory)
    • Enter the URL for the identity store. For example, ldap:// (636 for LDAPS).
    • Enter the domain name of the identity store
    • Enter an optional domain alias (shortens the login from the vRA appliance page)
    • Enter the login user Distinguished Name. For example, cn=demoadmin,ou=demo,dc=dev,dc=mycompany,dc=com
    • Enter the password for the identity store login user.
    • Enter the group search base Distinguished Name. For example, ou=demo,dc=dev,dc=mycompany,dc=com.
    • Enter the user search base Distinguished Name.
  • Click Test Connection.
  • Click Add.

Create and assign user roles to an Identity Store Group

  • Log in to the vRealize Automation console as a tenant administrator
  • Select Administration > Users & Groups > Identity Store Users & Groups.
  • Enter a user or group name in the Search box and press Enter. (Do not use an at sign (@), backslash (\), or slash (/) in a name).
    • You can optimize your search by typing the entire user or group name in the form user@domain.
  • Click the name of the user or group to whom you want to assign roles.
  • Select one or more roles from the Add Roles to this User list.
    • The Authorities Granted by Selected Roles list indicates the specific authorities you are granting.
  • (Optional) Click Next to view more information about the user or group.
  • Click Update.
  • Users who are currently logged in to the vRealize Automation console must log out and log back into the vRealize Automation console before they can navigate to the pages to which they have been granted access.


Why Cloud Computing Is Like Gas And Electricity


(cjohnson7 – Flickr)

I happened to tweet a link to an article from The Register the other day regarding the price of cloud based resources in Microsoft Azure going up, which detailed price rises of 11% in the Eurozone countries and worse than that, 26% in Australia. As a result, I ended up having a brief but interesting Twitter conversation with a follower about pricing and “locked in” charges like energy companies offer here in the UK.

The over-reaching point being that cloud computing has an awful lot of variables that dictate the overall pricing. Perhaps we were all a little naive at first in the industry, thinking that Moore’s Law and such would mean a doubling of compute power at half the price at regular intervals and the pricing to continuously fall. Hell, Amazon even tell you (or they did) that the more cloud resources people buy (storage, compute, networking) then the cheaper it will get because of the economies of scale and their bulk purchasing power.

What we never really seemed to factor in back in those days was the volatility of global currencies. I think it’s a reasonable statement to say that most IT pricing is inextricably linked to the value of the US Dollar, and when this goes up and down, pricing around the world for licencing and components tends to change too. As I write this post, Greece’s economy is in the toilet with no sure way to know what will happen next. It may even be possible that other Eurozone countries are close behind, and although I have strong opinions on the Euro, let’s park those for now and concentrate on the topic in hand.

Back to the original point, gas and electricity prices are governed by the free market principles of supply and demand. As the market gets saturated, prices fall. As the market resources becomes more scarce, prices rise. Prices also rise depending on the volatility of exchange rates. Stick with me here, I will get to the point.

When cloud computing is pitched, it’s pitched as being “OK” because it’s now operational expense (OpEx) rather than a large up front capital expense (CapEx), the implication being that this will result in smaller, more predictable bite sized chunks of expenditure over a period of time. This news about Azure pricing going up 26% in the worst case means that any forward budgeting you made on prices remaining stable just got blown out of the water. 26% of anything is a lot of unbudgeted costs to find.

Where does that leave you then? Well it all depends on your business needs, but spreading the risk by using hybrid cloud solutions is one answer. Keep the “Crown Jewels” in your own DC if you can, farming off the less needy systems to cloud provider bit barns. What else can you do? Well if you’re going all in with a cloud provider, whether that’s VMware, Microsoft, Google, Amazon or anyone else, check what your escape route is. What does it cost to move your workloads? How long will it take to get out of the contract? How much time will I need to replicate workloads into the “new” cloud? Do I even have an escape clause?

I don’t profess to have the answers, and in many ways, I’m just thinking out loud. However, seeing this news has made me realise that there was a bigger picture about cloud computing I hadn’t seen before. Had you?



Networking for VMware Administrators – Book Review


Much to my surprise, I bought “Networking for VMware Administrators” back in April 2014 and it has been on my “to do” list to read it since then. Regular readers will know of my recent scrapes and japes with NSX, including passing the VCP-NV exam so there was a nice dovetail with what I’ve been learning in this area and this book.

For those familiar with the VMware curcuit, Chris Wahl is a well known presenter and author and amongst other things regularly appears at VMworld and records Pluralsight videos, which I always like to use as a jump start to anything new I learn. As I’m not a networking guy, I thought I would try and start at the bottom, get a refresher on basic concepts and then move it forward to how that applies in the vSphere world. Steve Pantol is a new name to me, but the two seem to have a nice flow to how they write.

This book certainly hits the mark where that is concerned. Starting off very simply, the basic concepts of how networking evolved from the simplest idea to be where it is now takes you from the first rung on the ladder and conceptualises each new addition to networking designs, such as hubs, repeaters and switches. This then moves along to things such as VLANs and broadcast domains.

Physical networking is covered at a decent level of detail, taking into account the OSI model, and subtle but important differences between layers 2, 3 and above. I found the authors’ easy and humorous style of delivery very easy to follow and not feeling like a dry subject being rammed down your throat. Networking isn’t necessarily the most intriguing subject you’ll ever cover, but we’d be nothing without it’s essential plumbing to get us connected.   I read the book in three sittings, which is pretty good for me, as I’ve got the attention span of a gnat.

Part II of the book concentrates on virtual networking and switching, moving the focus towards vSphere and it’s networking options. Obviously this falls into two camps – standard and distributed vSwitches. There is also some content on Nexus V1000 switches, but I pretty much skipped that as I’ve never seen it and currently don’t really care about it. That being said, it’s good to know the section is there for me to refer back to if need be.

One aspect I really liked about the book overall was how choices and requirements fed into the design of the networking infrastructure, both from a physical and virtual viewpoint. Chris is a dual VCDX and it’s useful to get inside of his head and understand how to translate these sorts of issues and choices into an overall design. Especially useful if I ever get my finger out and actually submit a VCDX design!

Part III covers storage traffic on the network, namely iSCSI and NFS. I was a little surprised to see this type of content in the book, but enjoyed reading about it none the less. I suppose storage traffic falls into the cracks a little bit as it’s not “pure” VM networking, but it’s just as essential to get this part right when designing an overall solution. Bad storage == bad performance!

Again, a good emphasis on design constraints, assumptions and choices is put into this section, giving you a good steer on what should be considered when using storage protocols over the physical network (items such as dedicated, non routed VLANs, for example). One good tip I picked up was how to configure NFS to give you more NICs by using multiple exports on the NFS server and establishing separate links. As with all other sections, single points of failure are discussed and mitigated with different design choices.

Another good titbit I picked up was using traffic shaping to throttle vMotion traffic on 10Gbps Ethernet – I’d never before actually come across a good use case for traffic shaping, I’d assumed NIOC was always the way to go.

Finally section IV covers off all other “miscellaneous” networking concerns for your design and/or environment, this includes vMotion as discussed above and how to design around multiple NICs and/or connections, exploding a few myths along the way.

At 368 pages, it’s not War and Peace but also it’s not a 100 page pamphlet that skims over the important details. Like I said, I read it in around three chunks over a couple of days without it feeling like a chore. I think for anyone pursuing the VCDX route, this book is an absolute must. Not only does it help crystallise some concepts around physical and virtual networking, but there is excellent detail on how to consider your networking design and how to justify particular design decisions.

NSX is out of the scope of this book, but is such a huge topic in and of itself that I’m sure we’ll see a release on this in the not too distant future. This is a book that helps you understand networking from the ground up and how this relates to a virtual world.

That being said, it’s a highly recommended addition to your library of resources as it helps you have a meaningful conversation with networking teams, which as we all know is not the easiest thing in the world ;-)

Remember if you have a VCP certification, you can buy this book from VMware Press with a 30% discount using the code you can obtain from the VCP portal. I also believe Chris donates all book profits to charity, so yet another excellent reason to add this to your collection. Other good stockists are also available!