Shaun's Virtual Ramblings

Let’s face it. The public cloud model of software services makes no sense for some organizations. Here are my reasons for saying this:

1.      There are plenty places in the world with poor internet connectivity. The cloud depends on internet connectivity – no internet – no cloud.

2.      Public cloud information is usually stored on servers in the so-called developed nations. They usually have some Patriot-Act like legislation which allows the government of that country to view your information “at will”. Some companies/individuals disagree with this simply on principle. Others are restricted by regulations which require them to maintain privacy. All in all, for some people this just won’t work.

3.      While you can arguably say that larger cloud entities have the more resources and know-how than the individual and can therefore better ensure the integrity of your data and protect against internet borne miscreants, you could also say that larger entities make better targets and are more likely to be attacked than individuals or smaller businesses.

We could sit here and debate these and other points for some time however, since this article states my views, not yours, I choose to say that the public cloud model makes no sense for some organizations.

So what does make sense Shaun? I’m glad you asked. I want to share with you my view of the future of cloud computing based on my humble observations of the IT industry over the years and simple common sense extrapolation of what currently exists.

The future of cloud computing as I see it, is set of private clouds all joined together to form the new Internet equivalent. Let’s reflect for a moment on how this would work.

On the lowest level, most companies of any size will end up having their own cloud for one reason or another. A cloud for me is defined as:

1.      Servers, networks and storage are completely virtual entities which can be generated easily from a seemingly endless pool of amorphous resources. As a new service is required it just needs to be clearly specified and it will take shape.

2.      Solutions design and deployment within the cloud will just be about shaping you subsection of that resource pool to fit your needs. The resources don’t care what you use them for, only how much you need and what shape you want them to assume.

3.      The resource pool will be managed and offered by the IT departments of privately held concerns, Educational Institutions, Governments and other entities. They will form a new kind of Internet where each contributor offers some subset of it’s processing resources, storage, and network infrastructure or some combination of the three and where a set of standards and inter-cloud protocols governs cloud interactions.

4.      Usage of storage, network and server virtualization will make this cloud invisible to the users however the contributors will receive their ROI maybe by way of cloud fees paid by the user and by way of marketing to the captive user audience (or whatever passes for marketing by that time).

5.      The underlying infrastructure will be completely redundant and resistant to the failure of any one component or location because the information at any given point in time exists everywhere and yet nowhere.

6.      Client devices will connect to the cloud services from any location with internet or LAN access and receive just about the same level of service wherever they go as their services and data are in no way bound to any geographic location but can follow them from cloud to cloud as they move around.

7.      Users will be able to pay premium for better levels of service which represents more access to the shared resource. Companies may also pay more to access a greater share of the resource pool.

Hi All,

Yesterday I had to add a LUN to an existing SQL cluster. Child's play you say. Not so. The process is pretty simple.

1. Expose the LUN to each cluster server

2. Make sure it shows up in Disk Management

3. Add it as a storage resource in the Failover Cluster Manager

4. Add the storage resource to the SQL cluster

Now this last step I didn't know about - In order for the SQL server to see the new drive as a location you need to:

5. Add the new storage resources as dependencies in the SQL Server service in Failover Manager

This is actually kinda hard to find - Expand the SQL cluster in the Applications and Services item in Failover Manager. Then look at the bottom of the panel below the network section, drives section and everything else - You should see the SQL Server and SQL Agent services listed there.

Right click on SQL Server and there is your dependencies tab with the existing drives already listed there - Add the new drives.

Who woulda thunk it was so convoluted.

Have A Great Day - 

Hi All,

This one came about as a result of an assignment I had at work. A user at the client wanted to connect to a Microsoft PPTP VPN but it was failing miserably because the lovely zone-based firewall on the Cisco router at my client.

It turns out that in order for a PPTP VPN to work from behind a cisco zone-based firewall you have to:

1. Create an access list which references all GRE traffic. Something like

ip access-list ext 110

10 permit gre any any

should do the trick.

2. Create a class which references that access list

class-map type inspect match-any GRE-TRAFFIC

match access-group 110

3. Ensure PPTP (TCP 1723) is inspectedoutgoing on the inside to outside zone pair. YOu can create a class just for this or just include it in one of the ready built classes which are inspected outgoing.

4. Ensure the GRE-TRAFFIC class gets  passed on the inside to outside zone pair and  on the outside to inside zone pair. You would have to create individual entries in your policy map for the GRE-TRAFFIC class.

Below I show how to create the PPTP class, add it and the GRE-TRAFFIC class to policies and assign the appropriate polcies to appropriate zone pairs.

create the PPTP class

class-map type inspect match-any PPTP-TRAFFIC

match protocol pptp

Add the PPTP class and the GRE-TRAFFIC class to policies

policy-map type inspect inside-to-outside-pol

class type inspect PPTP-TRAFFIC

inspect

class type inspect GRE-TRAFFIC

pass

  policy-map type inspect outside-to-inside-pol

Define zones if necessary and assign policies to the zones

zone security in-zone

zone security out-zone

zone-pair security in-to-out source in-zone destination out-zone

service-policy type inspect inside-to-outside

zone-pair security out-to-in source out-zone destination in-zone

 Please keep in kind that these examples only take into consideration PPTP traffic. If you use this code verbatim you will deny everything but PPTP. The goal here is to teach you this simple lesson:

Pass GRE and Inspect PPTP

nuff said - Have a Great Day/Night folks

Shaun 

Hi All,

I have recently had some experience with configuring a Cisco switched network for Avaya switches. I hit a few issues along the way and I figured I would share with you guys how this is supposed to be done.

First create a voice VLAN on your switch. My voice VLAN is 40:

enable config t VLAN 40 name VoIPVLAN

Lets assume your default/data VLAN is 1

On the access switches there are three possible configurations:

1. For a phone/workstation port use

switchport mode access switchport access VLAN 1 switchport voice VLAN 40 spanning-tree portfast

2. For a server port (Especially essential for your DHCP servers):

switchport mode access switchport access VLAN 1 spanning-tree portfast

3. For a trunk/uplink port (routers to switches or switches to each other):

switchport mode trunk switchport trunk native VLAN 1

On the router you can use the following configuration (Assuming your LAN interface is Fast Ethernet 0/0):

interface Fa 0/0 no ip address

interface Fa 0/0.1 Encapsulation dot1Q 1 native (sets Fa 0/0 up as a trunk port and creates the default VLAN as 1)

ip address (use the address originally on Fa 0/0 here)

interface Fa 0/0.40 Encapsulation dot1Q 40 (sets Fa 0/0 up as a trunk port and creates the default VLAN as 1)

ip address (use the an IP address here which you will use as default gateway for the VoIP network)

ip helper-address (The IP address of your DHCP server on the data VLAN)

Finally you need to log into your DHCP server on the Data VLAN (Assuming this will be providing DHCP services for the Voice and Data networks)

On the DHCP server you should create option 242. This can be called "Avaya Voice Option" or whatever tickles your fancy. This is a String value and should be populated on the voice and data network.

On the Data network/scope use the following string: L2Q=1,L2QVLAN=40

(Tells the phone that the voice VLAN is 40 and the data VLAN is 1)

You can then create a DHCP scope for your phones and add the default gateway/router address you defined as the IP of Fa 0/0.40 on your router.

On that scope also add option 242 with the following value: MCIPADD="PBX Server",MCPORT=1719,HTTPSRVR="IP address of HTTP server for firmware upgrades",L2Q=1,L2QVLAN=40,VLANTEST=0

You won't need the " marks in the real string. If you have a TFTP server for your phones I think you can substitute TFTPSRVR for HTTPSRVR.

You may also need to create an option 176 with the same information for specific types of Avaya phones.

The phone should boot to the default VLAN (one in this case) then reboot into the voice VLAN (40 in this case) an finally start loading firmware if any exists.

I hope this helps someone get this right in a shorter space of time than it took me.

Have a Great Day

Hi IT Guy,

First let me make the assumption we are talking about the self service portal for Virtual Machine Manager 2008 R2. If we aren't please feel free to correct me because I am talking about SCVMM R2.

Like all products Microsoft, it does work...if you configure it correctly. Luckily, configuring it correctly is pretty easy.

This dude does a pretty good job of explaining the process: http://www.virtualizationadmin.com/articles-tutorials/microsoft-hyper-v-articles/management/installing-configuring-scvmm-2008-self-service-portal.html.

I have set it up and used it a few times and it works well. If I remember correctly though it can break if you play around too much with the web components. I distinctly remember breaking something when trying to customize the appearance by hand from the code.

Have A Great Day,

I was recently asked to implement the Windows Optimized Desktop for a clients desktops. Its only after talking this over with a number of my colleagues that I realised that no one seemed to know what a Windows Optimized Desktop is. So I figured I would dedicate a short post to sharing my findings with you.

The official blurb about the Windows Optimized Desktop can be found here. The Business Needs section of this site has actually proven to be the most helpful. This can be found here. After you strip away about 70,000 lbs of marketing fluff, the Windows Optimized Desktop really outlines 6 benefits, outcomes or goals a company can achieve and the combination Microsoft Technologies required to achieve those benefits.

I have listed these benefits and their corresponding technologies in the section below.

I hope this helps it all make sense. If not respond with a question and I'll see if I can clear it up for you.

Benefit:

Flexible Desktop - Rebuild user desktop experience in minutes after a hardware failure/loss

Technologies Utilized:

System Center Configuration Manager for centralized management of group policy and security.

Folder redirection, offline files, roaming user profiles in Windows 7 Enterprise for instant access to your desktop and applications settings and data anywhere.

App-V for easy simple application deployment and management.

  Benefit: 

Anywhere Productivity – Anywhere access to applications and data for mobile users

Technology Utilized

Direct Access for automatic connectivity to resources behind corporate firewalls

BranchCache for improved performance in branch offices and reduced WAN bandwidth loads

Windows 7 Bitlocker and Bitlocker To Go for secure data in the event of loss or theft

Forefront Unified Access Gateway - To ensure all client devices, incoming and outgoing, adhere to security and compliance requirements

System Center Configuration Manager (SCCM) – Users get updated applications and security settings whenever they connect to the Internet

Microsoft VDI Suites – Rich remote desktop experience from any mobile device  

    Benefit:

Enhanced Security and Protection – In the event of hardware loss or theft all data is safely locked away for compliance

Technologies Involved:

Windows 7 – Inherently secure OS with Bitlocker and Bitlocker To Go for added protection from theft/loss

SCCM – Automated patch management, anti-virus signature delivery and automated updates

Forefront Endpoint Protection – Client security

Active Directory Rights Management – Safeguards MS Office documents from policy violations like unauthorized reproduction and other potential issues.

    Benefit:

Centralized Data Control & Compliance with VDI – Sensitive data never leaves the data centre

Technologies Involved:

Microsoft VDI Suites – Centralized desktops, data and applications

SCCM – Unified management of physical, virtual and session based desktops. Also contains a compliance and risk pack to automatically configure your network to meet top regulatory requirements

Forefront Endpoint Protection – Enterprise-wide client security reported through SCCM.

Active Directory Rights Management – Safeguards MS Office documents from policy violations like unauthorized reproduction and other potential issues.

    Benefit:

Streamlined Application Delivery – Distribute applications organization wide in days as opposed to weeks

Technologies Involved:

App-V – Contains each applications in a bubble allowing coexistence of potentially conflicting applications.

SCCM – Enables quick simple delivery of App-V applications across the enterprise. It also support s self service provisioning of applications based on user identity and role.

Virtualization – Further allows for coexistence of conflicting applications

    Benefit

Unified Lifecycle Management – Manage physical, virtual and thin client devices from a single unified tool

Techologies Involved:

SCCM – Single management console for PCs thin clients and back-end infrastructure

System Centre Service Manager -  Built in incident resolution and change control processes plus a self-service portal for service requests.

Windows 7 PC Power Settings – When combined with monitoring and reporting can reduce energy costs and carbon emissions

Forefront Endpoint Protection – Management of  this is integrated into SCCM with client management.  

  Thats all Folks - I hope to pick back up my Hyper-V backup posts tomorrow.

How It All Works

As mentioned in our previous episode, today we are focusing on the use of DiskShadow to create a snapshot of your hard drive and and everything on it. The cool think about DiskShadow is its name - DISKSHADOW - just sounds like the horse of a mythic warrior or something. Anyhow the OTHER cool thing about DiskShadow is that it uses the Volume Shadow Copy Service or VSS to create that snapshot.

Why that matters is that the VSS is able to look at the programs using that disk at the moment of snapshot and, once they are VSS-aware, cause those programs to bring their data to a consistent state and stop making changes for just a millisecond. This is long enough for a snapshot of that program and its data to be taken.

This is equivalent to asking the program to smile and say cheese during the snapshot. The technical term of it is Quiesce. The program is quiesced or put to sleep during the snapshot.

The reason for this period of quiescence becomes readily apparent when you try to restore data from that snapshot. If you try to copy a data which is in use you are likely to get corrupted or inconsistent data and trust me, ain't nothing like restoring a "good backup" to recover a critical server only to discover the backup is not as good as you thought.

If DiskShadow puts the program to sleep via VSS however, no data is written during the snapshot and furthermore the program ensures its files are nice and tidy so that restores are largely painless. Hyper-V is VSS aware and obediently goes to sleep for the millisecond when the snapshot is taken.

The goal would be to:

1. Automatically quiesce the virtual machine for a few milliseconds (not even enough for user to notice)

2. Take a snapshot of the consistent vhd files.

3. Bring the virtual machine back online.

4. Copy the VHD files from the snapshot to another location (Remember, when you work with the snapshot, you are not actually affecting the real files so users can continue to use those files with virtually no interruption while the copy operation occurs)

5. Delete the snapshot. They don't actually take up a lot of space but they can add up over time.

You should ensure your virtual host has enough RAM, processing power and network bandwidth (if copying to a remote location) to handle the copy operation while still providing resources for the current virtual machines.

Hello World,

On account of actually deleting my original post about 45 minutes into writing it, this post will be somewhat shorter than planned. But heck, you guys prefer succinct and to the point anyway RIGHT!!!

The Challenge - If copy a Hyper-V VHD file while a program is using a file it is possible/likely that the file in question on that copy will be corrupted garbage or inconsistent. This little technique looks at allowing you to create consistent copies of VHDs without compromising their integrity (or the integrity of the files contained therein).

The Solution - Enter Diskshadow. This handy dandy command line tool allows you direct access to the Volume Shadow Copy Service (VSS). VSS in turn will allow you to create a non-destructive consistent Snapshot of Hyper-V VHD files. The other part of this trick is to copy the files from the Snapshot and not the real file to your copy location. In this way the real VHD file is never touched during the copy process.

How do you actually do it - Tune in to tomorrow's episode when you will hear Shaun say...WOW I'm sure glad I didn't delete THIS post half way through.