#xtracbrown

By Curtis Brown

Windows Admin Center is a new, locally-deployed, browser-based management tool set that lets you manage your Windows Servers with no Azure or cloud dependency. It gives you full control over all aspects of your server infrastructure and is particularly useful for managing servers on private networks that are not connected to the Internet.

Windows Admin Center is the modern evolution of "in-box" management tools, like Server Manager and MMC. It complements System Center - it's not a replacement.

 This blog is a ‘how to’ guide on installing and using the Admin Center.

Installation

The installation starts with a pretty straightforward Window Installer.

It will ask if you want to use MS Update to keep it updated – probably a good idea!

When you install it, it can be a local install on Windows 10 accessed via a browser directed to https://localhost:6516 or installed on a Server in Gateway mode (https://servername).  You’ll need a supported browser – MS Edge (obviously) and Google Chrome currently. Internet Explorer doesn’t make the cut.

You can use a self-signed SSL certificate (not good) or a signed one.  If you’ve got a domain CA, simply create a Computer certificate in the server’s Personal Store and get the thumb print of this certificate.  A tip – Copy the thumbprint into notepad first and take out the spaces otherwise it won’t accept it.

Using Admin Center

Open the browser and point at the URL discussed above.

If you click on the Cog icon, you can access settings.  We can configure a number of items, notably access rights.

In Extensions, we can see further functionality that can be added.

Immediately useful ones are Active Directory, DHCP and DNS.

From the Server Manager page, we add servers.  This requires suitable credentials, so Service Accounts might be worthwhile here. Here we can see we’ve got two servers. LABSRV01 is the server we’ve installed the Admin Center on, while LABDC01 is our Domain Controller (DC).

If we select the DC, we see that we can remotely configure quite a lot of both server configuration items, but also, where applicable, we can use the Extensions installed earlier.

The PowerShell option allows us to open a PowerShell session on the target system – quite useful.

How about remote access to the Windows Registry?

The Active Directory extension allows for some administration of Computer and User objects.

Closing Thoughts…

As an administration tool, especially in the second line upwards support context, this is actually quite a useful tool in a modern environment.  In order to support slightly older Windows server releases, a few adjustments are needed on the server side to allow access, though the effort might be worth it.

Although aimed at a largely server management context, it may also be useful in some desktop contexts, particularly for diagnostic and investigation work.

Although Xtravirt are a primarily Virtualization focused business, by the very nature of what we do, we also have to use tooling and technology both within the virtual estate (such as Guest Operating Systems) as well as in the wider environment supporting the virtualization platform (such as Active Directory, DNS etc).  If you’re in the process of a virtualization effort and require guidance on integration into a wider estate, then Xtravirt may be able to help.

About the author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strengths in VDI, storage integration, backup and disaster recovery design/implementation. He was awarded VMware vExpert 2019.

About Xtravirt

By Curtis Brown

Introduction

As VMware Horizon® 7 has developed, we’re starting to see the product evolve from the existing Horizon Admin Console based on Flash to a new Horizon Console based on HTML5. It’s a steady evolution, in much the same light as VMware® vCenter HTML5 console evolved through releases of VMware vSphere® 6.5 and 6.7.

The 7.8 release of VMware Horizon is the most feature-rich to date and adds much in the way of configuration settings as well as provisioning.

A Quick Guided Tour

So how do we access this new console?  VMware have been particularly imaginative with the URL.  While the old console had the URL of HTTPS://(Connection Server)/admin, we now have HTTPS://(Connection Server)/newadmin for the new console. Which at least allows us to access both consoles.

At the logon page, we can enter our admin credentials.

Once logged in, we see the nice, clean HTML5 interface.

On the left a navigation pane; at the top, we have a dashboard view – this has a splash screen at the moment, so it appears to be more of a placeholder.

Users & Groups covers entitlements while the Inventory section covers the resources to be published, much in the same way as the old console.

JMP is new – this refers to the Just-In-Time Management Platform.  This will be covered in a future post, but it provides a means to integrate Horizon View, User Environment Manager and App Volumes for assigning and controlling resources.

The last section, Settings, is a new area in the Console.  It provides the direct replacement for the Settings in the old admin console, allowing the admin to configure Servers, Cloud Pod Architecture and other settings.

Notice in the vCenter Servers page, it still includes Composer.  Although there’s a push to move to Instant Clones, Composer based Linked Clones are still alive and well.

If we add a vCenter, we get presented with a cleaned up, but familiar wizard.

One significant difference is the non-appearance of the Security Server tab.  However, as is common in the later 7.x iterations admin console, it is possible to register Unified Access Gateway appliances.

Closing Thoughts

There are a few areas where it’s still a work in progress, some of which are a little odd.  While you can configure Cloud Pod Architecture, you can’t control the basic global settings or the Events database, let alone add a Horizon license key.  Remember though, it’s a work in progress and for day-to-day admin, it’s pretty good.

 About the author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strengths in VDI, storage integration, backup and disaster recovery design/implementation. He was awarded VMware vExpert 2019.

About Xtravirt

By Curtis Brown

 I like product names that ‘does what it says’ on the tin (or download…) – VMware Identity Manager is such a product, and then some.  VMware Identity Manager (vIDM) does just that – it manages the various facets of Identity. Now let’s consider what we use Identity for?  Typically, it’s the following:

For the purposes of authentication into a solution – who are you?

For the entitlement to resources – what you can do, based on who you are?

VMware Identity Manager provides this layer, providing a central point to answer these key questions as a part of VMware Workspace ONE.

In order to be able to answer the authentication ‘who are you?’ it typically leans on existing directory services (usually Active Directory) to generate its own synchronized directory listings and passes through requests for validation – i.e. a password or multi-factor token, to the appropriate solution.

For the entitlement to resources, VMware Identity Manager can present a wide range of resources on its own.  These include Cloud services, complete with Single-Sign-On integration, as well as VMware Horizon (either Cloud or On-Premises).  Using the Directory above, we can use the user’s credentials as part of the ‘what can you do?’ along with other policy elements such as location (by IP address) and device type.

Because VMware Identity Manager sits as a sort of gatehouse between the user and resources, it stands apart from a single environment.  This means that it’s entirely possible to integrate several disparate environments behind a single portal.  In this scenario, you might need to integrate several different directory services and authentication layers as well as grant entitlements to resources.

This article takes a high-level look into how you’d go about this.

vIDM Connectors

VMware Identity Manager follows the concept of a Connector; providing a service for integration into an estate, usually for Directory services, but also for plugging into authentication mechanisms such as RADIUS and Kerberos as well as providing a hook into resources such as VMware Horizon.

In order to add multiple directories, you’ll need to deploy multiple Connectors – at least one per domain (ideally a pair for resilience).  In an on-premises deployment, the vIDM appliance has a built-in Connector, though it’s probably wise to deploy separate, standalone Connectors.  These are available as either a Linux based appliance, or a Windows Server installable application (included as part of the VMware Workspace ONE Enterprise Systems Connector).

In either case, within vIDM, you need to log into the Admin console and go through “Identity & Access Management”, select Setup and the “Add Connector” button to generate an activation code.

Once you’ve done this, it’s a case of deploying the Connector, and logging onto its web interface (https://connectorFQDN:8443) and completing a wizard.  All you do here is drop in the Activation Code, the root certificate used for vIDM and set a local Admin password.  Simple!

In vIDM, you’ll see your new Connector – note the installed version conforms to what you’ve deployed (here, a Windows connector).

With this in place, we can set up a Directory synchronisation.

 Creating a Directory

With the connectors in place, you add each directory.  You’ll notice below I’ve already added the first Domain, Galaxy.local.  Let’s add another.

In the Add Directory wizard, it’s the same process as would be the case for adding the first – though using the new Connector.  Remember that you’ll also need to select attribute mappings and Organisational Units for Users and Groups.  Once you’re done, you’ll see multiple directories:

Authentication

When we add our directory, we should enable the Connector to provide authentication for this directory as well.

With this done, we have quite a bit of latitude with respect to authentication.  With a Connector in place, we can integrate with domain specific multi-factor authentication (MFA) solutions, then tie it all together with the use of policies to select what conditions dictate which authentication mechanism to use – for example, a User in Group X on an iPhone on IP address Y must use Password and RADIUS.

Assigning Applications

So now we can use both directories for assigning users/groups to applications.  For cloud-based applications, it’s possible to grant access to users from any domain.  The limiting factor here is, if the application is leveraging SSO – it might not be able to support multiple domains.

Adding Horizon

When you integrate VMware Horizon into Identity Manager, it too leverages the Connector, so if you have separate Horizon instances in each Domain, you can set each of these up.

It’s possible to configure the Client Access FQDN for each Horizon instance on each IP range, configured in vIDM, so you have further options.

Closing Thoughts…

So, what does this mean? VMware Identity Manager, either as part of a VMware Horizon deployment, or broader ranging as part of a Workspace ONE delivery really can be the one ring to rule them all.  It can provide a single access point for all users in a business, regardless of whether they are separated into different business units with their own Active Directory, and still present their applications.

A use case for this might be providing a single front end to unify resources following an acquisition – two separate environments fronted by a single interface as a starting point for a migration?  Maybe.

By Curtis Brown

VMware vSAN™ is VMware’s hyper-converged storage solution.  It has quite a few different methods of providing resilience for the data hosted in it, but these all require some careful consideration when designing the cluster.  In this blog I take a look at the configuration options and the design repercussions.

Storage Policy with respect to Resilience

All the approaches are ultimately defined by the VMware vSphere Storage Policy definitions. These policies are defined in VMware vCenter and are applied to objects (usually VMs, but can be individual disks, VM configuration files), subject to the compatibility with the underlying vSAN cluster.  However, there are limitations.

The most basic, default policy is RAID-1 configured with a Failures to Tolerate (FTT) of 1 – classic mirroring.  In vSAN, this means a complete mirror of the given object, creating two components. In addition, there’s a smaller Witness component.  This means we must have a minimum of three nodes in a cluster (though four would be recommended for maintenance and failover).  We can up the ante here by increasing FTT value, but while resilience improves there is an obvious impact on capacity.

We can also look at using Erasure Coding to give us RAID-5/6 protection.  This takes our object and breaks it out into components, with the data striped across them for resilience.  From a configuration perspective, all that separates them is that the FTT value of 1 means RAID-5, while FTT of 2 is RAID-6.  However, this does impact the number of components created.  In RAID-5, for any object, we have three components created with data striped with a parity bit across them.  So rather than the 200% footprint as with RAID-1, we only need 133% instead and get the same resilience, though at a performance cost. RAID-6 requires a fourth object and an extra parity bit, so the footprint is in between at 150%.  In either case, we still have a witness component too, so RAID-5 needs a minimum of 4 hosts (5 recommended) and RAID-6 needs 5 hosts (6 recommended).

Fault Domains

Of course, physically our clustered hosts are usually installed in one or more physical racks. Ideally, we’d spread the nodes across racks to mitigate the loss of a rack.  vSAN provides Fault Domain functionality to provide an awareness of these physical boundaries.

Consider a Fault Domain as a grouping of hosts within the cluster to represent a boundary of resilience to ensure that vSAN objects subject to a Storage Policy are deployed across the domains, so providing resilience to a loss of a domain (i.e. the loss of a rack) outage.

However, it’s not quite as easy as slinging your hosts into a pair of racks and setting up two zones. As stated above, even RAID-1 requires three hosts due to three objects.  This has a knock-on impact when defining Fault Domains too.  For RAID-1 based policies, the number of Fault Domains can be represented by the formula (2 x FTT)+1, while RAID 5/6 is (2 x FTT)+2. Therefore, RAID-1 at a minimum requires three domains while RAID-6 would require at least six domains (6 = (2 x 2)+2).

This obviously has limitations as to how useful the feature is when mapped to physical racks – Are you going to spread a small 6-node cluster across six racks to achieve six domains?  Or, perhaps across two racks and configure 6 zones, but you could lose three in the event of a rack failure so negating the effort of configuring Fault Domains in the first place.

We now see that the scale of the cluster and physical placement are important factors when deciding whether to use Fault Domains.

Stretch Clusters

This approach is designed to be used across different locations (latency permitting) and largely builds on the concept of Fault Domains.  Here, we have two defined Fault Domains (a Preferred and Secondary).  Alongside these, we also deploy a Witness appliance in a third location – this serves as a third Fault Domain.  We also break out the Failures to Tolerate into two values.

Primary Failures to Tolerate – Refers to Site level failure and can be a value of zero (no resilience, all data resides on either the Preferred or Secondary site) or 1, where the data is replicated between the two domains in the manner of RAID-1.

Secondary Failures to Tolerate – Analogous to FTT in a single site, this is the resilient behaviour within the single site and so can be configured as RAID-1 or RAID-5/6 with various FTT values.

The PFTT value effectively sits above the SFTT value, resulting in the following:

Logically speaking, for a given object, such as a VMDK, the Primary value essentially pushes a RAID-1 mirror across each site, with a Witness component in the appliance.  The Secondary element in concert with the RAID setting defines the policy within a site, here a straightforward RAID-1 mirror.

For the numbers of hosts, we therefore need to adhere to the needs of the local policy (be that RAID-1, 5 or 6) and double-up for the second site.

As this resides in a stretch vSphere cluster, we also need to build in some stickiness with respect to compute – so designing DRS and HA accordingly to match the preferred sites.

Closing Thoughts…

When embarking on a vSphere with vSAN design, one should consider not just the compute factors when deciding the number of hosts, but what level of storage protection will be required for the VMs.  In fact, by using the protection as a starting point (i.e. ‘We want RAID-6, so a minimum of five hosts is recommended’), the RAM and CPU can be defined above that – whether scaling upwards (five big hosts) or outwards (more, smaller hosts).  Even the physical rack design might be a determining factor – whether you can spread across racks or not.

If you’re about to embark on a VMware vSphere based hyper-converged solution, then Xtravirt can help. We have considerable experience in this area and can help with advisory, design and implementation services to create the right solution for your organisation. Contact us and we’d be happy to use our wealth of knowledge and experience to assist you.

 About the author

Curtis Brown is a Lead Consultant at Xtravirt.   His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He was awarded VMware vExpert 2018 and is a graduate of the VMware Advanced Architecture Course 2018.

 About Xtravirt

By Curtis Brown

There are a considerable number of blog posts and articles that have looked at the individual components of the VMware® End User Compute stacks, so I thought I’d take a high-level look at some of what’s possible when we take the whole solution in its entirety.

The Moving Parts

In the early days of VMware’s End User Compute efforts, we were looking at a relatively simple stack of VMware vCenter, ESX and Virtual Desktop Manager (or, to you young folks, Horizon View 1.0 or 2.0 back in 2007/8).  These days, things are somewhat more powerful, offering a wider array of capabilities, but these capabilities also require more moving parts.

The diagram below shows the VMware components that could be deployed in a solution.  

 Now, let’s look a little deeper…

For Virtual Desktop delivery, we have the underlying infrastructure of VMware vSphere with vCenter and ESXi.  However, we can enhance this further in two ways. Firstly, we can leverage local storage by implementing VMware vSAN rather than rely on a SAN/NAS based solution. Secondly, we could deploy VMware NSX to provide enhanced security in the form of micro-segmentation of the network as well as anti-malware protection using Guest Introspection.

For publishing desktops, we have VMware Horizon View. The connection servers provide the brains, managing entitlements and provisioning of desktop and application pools. For secure access from untrusted or external networks, we deploy either Security Servers, or, more recently, Unified Access Gateway appliances to serve as a proxy into the solution.  VMware Horizon View Composer is used to manage and deploy non-persistent Linked Clone desktops.  Although this approach is in decline as Instant Clone technology replaces it.

We then need to consider the management and delivery of applications and user settings.  For the latter, we can integrate VMware User Environment Manager.  This can manage both environmental settings (including delivery of application shortcuts, drive mappings etc) as well as eliminating the issues related to Windows Roaming Profiles.  For application delivery, we can use App Volumes within the virtual estate or leverage the estate itself to publish Remote Desktop Session Host based remote applications.  ThinApp, although somewhat out of favour these days, remains an option for direct delivery to Windows Endpoints (via VMware Workspace ONE Identity Manager) or within Horizon View desktops.

When it comes to monitoring the estate, we can use VMware vRealize Operations Manager with the VMware Horizon Management Pack.  It’s possible to expand further still by leveraging more of the vRealize suite, notably VMware vRealize Log Insight for capturing logs from both the solution as well as the environment.

We then move out into two topics – The Endpoint and the User. These are somewhat integrated topics these days as they do overlap.  

VMware Workspace ONE comprises two key elements:  

Unified Endpoint Management can provide control, configuration and administration to endpoints, be they mobile devices or traditional desktops.  

Identity Manager provides the user authentication layer into the solution as a whole, while also providing a unified catalogue of applications and services, whether publish via VMware Horizon or whether through single sign-on to cloud services.  

Another offering that is often overlooked, but still a part of the VMware Horizon licensing (at the Advanced and Enterprise level) is VMware Mirage.  This can provide image level management of Windows based client desktop/laptops. FLEX leverages the Mirage infrastructure in conjunction with VMware Workstation and VMware Fusion to provide an offline VDI capability.

What parts are available is largely defined by what is purchased.  Some parts are included in the various VMware Horizon editions, while some, notably VMware vSAN, VMware NSX and VMware Horizon FLEX are separate products.  In the case of Workspace ONE, VMware Horizon Advanced and above includes just Workspace ONE Identity Manager Standard.  To get the full Workspace ONE suite requires purchase of Workspace ONE as a specific product.

VMware Horizon editions can be compared at:

https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/products/horizon/vmware-horizon-editions-compare-chart.pdf.

 The Art of the Possible

For the purposes of looking at what is possible, let us assume that an Alien Space Bat has deemed it fit to leave an unlimited budget for us to acquire all these tools.  Here’s a few ideas of what we could achieve:

By integrating the full VMware Workspace ONE with Horizon, we can fully manage security between a user, a managed endpoint and access to Virtual Desktops.  By managing the device using VMware Workspace ONE Unified Endpoint Management and establishing Compliance checking, we can define an Identity Manager policy that allows access only to users with valid credentials who are using compliant devices to the Workspace ONE catalogue. In turn, users can then access a VDI desktop from the relevant icon in Workspace ONE.

It is possible to provide a single portal to a geographically spread VMware Horizon VDI offering that will connect users seamlessly to the nearest desktop instance. Workspace ONE Identity Manager can provide location awareness based on client IP address.  By defining IP ranges, and relating these to the public DNS name for the local Horizon site, Workspace ONE will direct users to the nearest VMware Horizon site for optimum performance.  This leverages VMware Horizon Cloud Pod Architecture to present a common entitlement across all instances.

App Volumes, User Environment Manager and NSX Distributed Firewall Rules can be tied to Active Directory groups.  We can therefore deploy an application in an App Volumes App Stack, with a standard configuration provided by UEM and permit traffic from the application to a specific server all tied to a single Active Directory Group.

And these are but a few options.  When you consider that a number of these offerings are now available in a cloud-based form, the options broaden still.  Workspace ONE components both offer cloud and on-premises variants, while VMware Horizon now includes not only the on-premises offering, but also the ability to deploy on top of VMware Cloud on AWS or the full Desktop-as-a-Service offering of Horizon Cloud.

 Closing Thoughts…

As a range of products that can be built in an array of different configurations, it is possible to design and deploy solutions that fit a broad variety of use cases, from simple to very specific.

If you are looking to deploy a new Digital Workspace solution or wish to enhance or upgrade what you currently have, then Xtravirt can help. We have a long track record of successful digital workspace projects and can provide advisory, design and implementation services to create the right solution for your organisation. Contact us and we’d be happy to use our wealth of knowledge and experience to assist you.  

 About the author

Curtis Brown is a Lead Consultant at Xtravirt.   His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He was awarded VMware vExpert 2018 and is a graduate of the VMware Advanced Architecture Course 2018.

 About Xtravirt

By Curtis Brown

Introduction

VMware PowerCLI has been in existence for quite some time and over the last 2 years it has been moving at quite a rapid pace.  It has traditionally been used to provide PowerShell based command and control functionality within VMware vSphere environments, with particular focus on the ability to create scripted functions for automation purposes.  Used in conjunction with automation and orchestration tooling, a great many bespoke capabilities are available.

During 2018, there has been a release around every 2 months, the current release, version 11 was released in October and provides support for the following:

vSphere 6.7U1

VMware Horizon 7.6

NSX-T 2.3

VMware Cloud on AWS

Being based on PowerShell, it is also compatible with third party modules, such as those administering Active Directory, to provide an integrated solution across a wide range of products.

In this blog, I look at PowerCLI’s ability to support VMware Horizon.

 Installing VMware PowerCLI

 Installing PowerCLI was once a case of downloading an installer from the VMware Portal and installing the components.  However, PowerCLI is now published from the PowerShell Gallery on the internet (https://www.powershellgallery.com/packages/VMware.PowerCLI/11.0.0.10380590) permitting installation on a connected PC straight from the PowerShell interface, simply by running:

Install-Module -Name VMware.PowerCLI

You might get something like this (accept the default):

Then it’ll install…

To allow execution of local scripts:

Set-ExecutionPolicy RemoteSigned

Then, run the following to confirm it’s all installed successfully.

Once installed, it’s worth configuring the Customer Experience Program participation by Enabling or Disabling this (It stops nag messages).

Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP $true $false

After that, the basic PowerCLI is ready to go.

 What can we do for Horizon?

 ‘Out of the box’, PowerCLI only provides  the ability to connect or disconnect to the Connection Server, so providing a conduit for accessing the Horizon APIs.  To connect to Horizon Connection Server:

Connect-HVServer -Server connectionserverFQDN -user adminuser@domain -Password XXXX

However, VMware maintain example scripts at https://github.com/vmware/PowerCLI-Example-Scripts that can be used as a basis for automation of Horizon and the other supported components.  

By downloading the scripts as a ZIP file, it is possible to install them.  First, check $env:PSModulePath to locate the modules directory paths (usually, there’s the user specific path, plus system ones)

For Horizon, we extract VMware.hv.helper from the ZIP and drop this into C:\Program Files\WindowsPowerShell\Modules.

In PowerShell, we then unblock the newly exported folder by running

dir ‘C:\Program Files\WindowsPowerShell\Modules\VMware.Hv.Helper\’ | Unblock-File

With this in place, we can now use a whole raft of useful PowerShell commands (they can be listed by using Get-Command -Module 'VMware.Hv.Helper'). These can be used for automation of tasks and generating reports.

For example, Get-HVPoolSummary will list configured pools, including their type, assignment type and status:

And we can see how many VMs are available:

Get-HVHealth shows a basic status:

By leveraging the ‘New‘ and ‘Remove’ commands, it is possible to provision and destroy new Pools (desktops and applications), entitlements, RDS Farms and Cloud Pod objects such as Sites and Entitlements.  For Example, setting up Shared Desktop pool ‘Teachers 1’:

Closing Thoughts

What we have here is a set of powerful tools that are not just capable of managing the VMware vSphere infrastructure, but can also expand into the realm of delivering desktop pools – all from scripting and automation.  For example, it would be possible to create a script that would leverage PowerShell to create an Active Directory Group and populate it, then create a desktop pool and grant the members of the group access to it.  Further, this could be used in concert with vRealize Automation and Orchestration to provide a portal for self service requests for generating desktop pools and services.

Given that the current release supports VMware Cloud on AWS as well as VMware Horizon, this offers the tantalizing prospect of being able to programmatically manage a federated on-prem and AWS hosted Horizon Cloud Pod Architecture.  The sky is the limit!

If you’re planning to deploy a Virtual Desktop solution, we can help. Xtravirt provide design and implementation services to create the right solution for your organisation. Contact us and we’d be happy to use our wealth of knowledge and experience to assist you.  

 About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He was awarded VMware vExpert 2018 and is a graduate of the VMware Advanced Architecture Course 2018.

 About Xtravirt

Xtravirt are an experienced consulting firm dedicated to delivering outcomes to help customers solve their IT challenges. We design and build strategies to help customers unlock the full potential of cloud, datacentre and workspace technology.

We are the VMware Global and EMEA Professional Services partner of the year.

By Curtis Brown

The somewhat anticipated release of VMware vSphere 6.7 Update 1 is now with us.  So, the burning question now is “Can I upgrade?”.  The answer is not quite as simple as a yes or no as this is always a mine field, particularly where interoperability is concerned.  My intention with this article is to save you some of the leg work with respect to investigating product interoperability.

However please note, this article doesn’t dig into hardware compatibility, or compatibility with third party products, simply because of the vast array of possible scenarios.

  Compatibility with Horizon View 7

The most common starting point is VMware Horizon 7 itself.   By checking the VMware product Interoperability Matrix, we can see that the minimum release of VMware Horizon that is validated with VMware vSphere 6.7 Update 1 is the latest release, 7.6.

VMware Horizon 7.6 - COMPATIBLE

VMware App Volumes

VMware App Volumes 2.14 and the more recent patch release are both listed as a valid configuration.  This would also be the recommended release for use with VMware Horizon 7.6, although it has quite a generous level of backward compatibility.

One observation of note is that the poorly adopted cul-de-sac release 3.0 product has not been validated against 6.7, but as this was explicitly incompatible with 6.5, so this is not particularly surprising.

VMware App Volumes 2.14.2 - COMPATIBLE

VMware vRealize Operations for Horizon

With respect to VMware vRealize Operations support in general, release 6.6.1 or later is required.  This is driven by vSphere rather than Horizon which can work with older vROps releases.

For a VMware Horizon environment running on VMware vSphere 6.7 Update 1, the VMware vRealize Operations for Horizon plugin needs to be on 6.6.0 to support VMware Horizon 7.6 to retain compatibility through to VMware vSphere.

However, care should be taken with the compatibility between the Horizon plugin and vRealize Operations itself.  As the Horizon component only supports Horizon 7.6 directly on release 6.6.0 of the plugin, the interoperability matrix dictates that VMware vRealize Operations should be running on release 6.7.

VMware vRealize Operations Manager 6.7 - COMPATIBLE VMware vRealize Operations for Horizon 6.6 - COMPATIBLE

Of course, for features, guest operating system compatibility, the latest version is recommended.

VMware User Environment Manager 9.5 - COMPATIBLE

VMware NSX for vSphere

Although not every VMware Horizon deployment uses VMware NSX, it’s included to flag a possible concern. With respect to straight VMware vSphere interoperability, VMware NSX for vSphere 6.4.2 and 6.4.3 both support for vSphere 6.7 Update 1.  However, the supported Horizon release (7.6) has yet to be validated with NSX 6.4.2 or 6.4.3.  This is  unlikely to cause an issue, and validation is likely to be only a matter of time, though it may be enough to cause a pause for thought.

VMware NSX for vSphere 6.4.3 - SUBJECT TO CONFIRMATION BY VMware REGARDING HORIZON 7.6

Upgrading Desktop Templates

With respect to upgrading templates, the back-end components should be upgraded prior to the agents within the image.  As such, upgrading this rather depends on how many change windows are being used to upgrade the above components.  In all cases, VMware have limited support for backward compatibility for agents, so there is flexibility here.  The VM templates have the following components/dependencies:

VMware App Volumes Agent – used for registering the VM and the logged in user to App Volumes manager.

VMware UEM Agent – used for managing the user persona via UEM.

VMware vRealize Operations for Horizon Agent – although a version is integrated as part of the VMware Horizon Agent, for full functionality in line with the release of vRealize Operations for Horizon, the dedicated agent is recommended.

VMware Horizon Agent – this is used to provide components for managing deployment, assignment and the remote desktop protocol to the desktop.  It is recommended that this is installed after VMware Tools has been upgraded.

VMware Tools – required for interaction with vSphere, as well as providing optimised device drivers for the guest OS.

The VM virtual hardware version – this is defined by the VMware ESXi release. Upgrading should only be carried out once VMware Tools are upgraded but can be beneficial for performance reasons.

Where hardware GPUs are deployed, there are further considerations.  For example, if the templates are deployed using a vDGA (Dedicated Graphics) or Nvidia vGPU configuration, further investigation into supported Nvidia drivers should be carried out.

 What to upgrade first?

Where to start upgrading will be driven from your starting point, so it’s well worth looking at compatibility of the release that you’re starting at with the relevant components.

Upgrading VMware vRealize Operations and the Horizon plugin is likely to be the best starting point as this supports all the monitored components backwards for a number of releases. In addition, it is the least disruptive activity for users.

After this, updating App Volumes Managers would be the next step.

Upgrading VMware Horizon follows the order it has always followed – VMware Composer, followed by Connection Servers and Security Servers.  The recommendation, however, would be to take the time to retire any Security Servers and replace them with VMware Unified Access Gateway appliances instead.

Where deployed, VMware NSX would be next on the list..

After this, the vCenter upgrade followed by the VMware ESXi hosts should take place.  In the case of the latter, as mentioned previously, pay close attention where hardware GPUs are deployed as this may need upgraded drivers and software in-line with the vSphere release.  If vSAN is deployed, this would take place as the closing step of upgrading all the ESXi hosts in the cluster, ensuring that there is enough space to carry out such an upgrade.

With respect to the desktop templates, upgrading of components can be staged, but the supporting services must be in place first.

Closing Thoughts

Although there are a fair few items to consider, so long as the components are upgraded with consideration to each other and in the proper order, it’s possible to uplift the entire stack to support VMware vSphere 6.7 Update 1.  The only caveat is the lack of interoperability testing  between releases of VMware Horizon 7.6 and NSX 6.4, though it should be remembered that there is no direct connection between the two products and VMware have yet to actually publish test results for this combination.

 If you are looking to get the best from VMware infrastructure and understand your upgrade and compatibility options, please contact us, and we’d be happy to use our wealth of knowledge and experience to assist you.

 About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He was awarded VMware vExpert 2018 and is a graduate of the VMware Advanced Architecture Course 2018.

 About Xtravirt

Xtravirt are an experienced consulting firm dedicated to delivering outcomes to help customers solve their IT challenges. We design and build strategies to help customers unlock the full potential of cloud, datacentre and workspace technology.

We are the VMware Global and EMEA Professional Services partner of the year.

By Curtis Brown

Introduction

As a highly respected, award winning VMware partner, Xtravirt has had the opportunity to send consultants on VMware’s Advanced Architecture Course at their headquarters in Palo Alto.  The first two consultants attended earlier this year, and I got my opportunity in September 2018.

This article (a somewhat non-technical one) describes the purpose of the course and my experience attending it.

What is the Advanced Architecture Course?

VMware have always been a technology company.  As the product portfolio has grown outwards far beyond the original hypervisor product, VMware have realised that while the technology is perfectly good, what is more important is the purpose to which the technology is applied.

Often, solutions get purchased (or for that matter, sold) based purely on the technology and its capabilities.  This rather misses the more important point of ‘what benefit will this solution be to the business and why should we use it?’  As such, in the worst cases, such acquisitions can end up as ‘shelf-ware’ – acquired, tested but ultimately deemed of little value and not used.  This is harmful to the customer and, significantly, harmful to how VMware is perceived by the customer.

The Advanced Architecture Course is a product of VMware’s desire to change the emphasis to being business needs driven.  The course aims to take experienced consultants and architects and provide them with a business needs oriented approach to discovering requirements and proposing solutions to meet those requirements.  A key part of this involves educating consultants on how to present to C level executives – all of which is quite a departure from the comfort zone for technically focused consultants.

My Adventures in Palo Alto

I’ll gloss over the journey out there (which was quite an adventure in itself – avoiding Hurricane Florence, almost missing a connection and losing a suitcase…) and focus on the course itself.

The course was a nine-day affair and to pass the course as a whole, we had to accrue a score of greater than 70% on all the objectives.  This included points for the pre-course online study (on matters ranging from ITIL and TOGAF through to VMware Workspace ONE), points for passing the end of day tests on content and the final presentation – which I’ll describe later.

It all started early on a sunny California Monday morning (at 7am!).  The first day focussed on VMware’s model for developing a business’ journey from basic virtualisation through to hybrid cloud and microservices as well as their model describing application of Digital Workspace technologies to business.  The approach consciously avoids specific products – so, for example, for Digital workspace, it describes the journey from traditional identity management through multi-factor authentication to single-sign-on.

Day 2 focused on the importance of requirements gathering, but broadening from just the traditional technical viewpoint outwards to business requirements – ‘we need to increase business revenue by… ’.  The importance of adapting the operating processes as well as IT were emphasised on Day 3.  A key message was that technology is only a part of the solution, without adapting to accommodate new abilities, those new abilities will still be hog-tied by legacy approaches to new needs.

We then had a particularly interesting day being taught presentation techniques, covering presenting to large audiences, conflict resolution and useful tips and tricks.

From here on out, the focus was on new technology, but with a business as a driver slant.  It’s not possible to replay much of the course content here for non-disclosure reasons, though, again, the idea was to broaden the knowledge of consultants.  As such, the breadth of technical areas covered was vast.  It included Cloud and DevOps, through network virtualisation and End User Compute to emerging solutions such as serverless computing, app containerization and Kubernetes.

The final day, although the briefest was the most challenging.  At the beginning of the course, the attendees were broken down into groups and given a case study.  From this, the groups had to work out a requirements matrix and put together a 20-minute final presentation (plus 10 minutes of questions) covering requirements, conceptual and logical design for a global solution encompassing both Software Defined Data Centre and End User Compute technologies.  This led to many long days putting in additional hours throughout the two weeks as well as some weekend work.  The presentation was to be given to a panel consisting of senior VMware staff (senior vice presidents and the likes) serving as the C-level execs of this fictional corporation.  This contributed most of the points on the course – so a pass here was important.

Fortunately, I was surrounded by thirty-seven of the smartest consultants and architects from all four corners of the world.  It was a real pleasure to work with these guys and I have to say that, despite the difficulty of the course, I wasn’t too surprised that we all passed.

Closing Thoughts

It was without doubt a tough course, intended to take the attendees out of their comfort zone to both broaden skills while also attempting to equip them for dealing with a bigger picture than just technology.  For me, it certainly has taught me a great deal, disproving the line “you can’t teach an old dog new tricks”.

Certainly, I consider myself fortunate to be working in a company that provides the opportunity to attend courses such as this.  It’s an investment for the company, of course, but one that ultimately benefits the customer.

(The day trip up to San Francisco was rather nice too, I can recommend the calamari and chips at Pier 39…).

About the Author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strength in VDI, storage integration, backup and Disaster Recovery design/implementation. He was awarded VMware vExpert 2018 and is a graduate of the VMware Advanced Architecture Course 2018.

About Xtravirt

Xtravirt are an experienced consulting firm dedicated to delivering outcomes to help customers solve their IT challenges. We design and build strategies to help customers unlock the full potential of cloud, datacentre and workspace technology.

We are the VMware Global and EMEA Professional Services partner of the year.