#xtravirt

By Curtis Brown

Windows Admin Center is a new, locally-deployed, browser-based management tool set that lets you manage your Windows Servers with no Azure or cloud dependency. It gives you full control over all aspects of your server infrastructure and is particularly useful for managing servers on private networks that are not connected to the Internet.

Windows Admin Center is the modern evolution of "in-box" management tools, like Server Manager and MMC. It complements System Center - it's not a replacement.

 This blog is a ‘how to’ guide on installing and using the Admin Center.

Installation

The installation starts with a pretty straightforward Window Installer.

It will ask if you want to use MS Update to keep it updated – probably a good idea!

When you install it, it can be a local install on Windows 10 accessed via a browser directed to https://localhost:6516 or installed on a Server in Gateway mode (https://servername).  You’ll need a supported browser – MS Edge (obviously) and Google Chrome currently. Internet Explorer doesn’t make the cut.

You can use a self-signed SSL certificate (not good) or a signed one.  If you’ve got a domain CA, simply create a Computer certificate in the server’s Personal Store and get the thumb print of this certificate.  A tip – Copy the thumbprint into notepad first and take out the spaces otherwise it won’t accept it.

Using Admin Center

Open the browser and point at the URL discussed above.

If you click on the Cog icon, you can access settings.  We can configure a number of items, notably access rights.

In Extensions, we can see further functionality that can be added.

Immediately useful ones are Active Directory, DHCP and DNS.

From the Server Manager page, we add servers.  This requires suitable credentials, so Service Accounts might be worthwhile here. Here we can see we’ve got two servers. LABSRV01 is the server we’ve installed the Admin Center on, while LABDC01 is our Domain Controller (DC).

If we select the DC, we see that we can remotely configure quite a lot of both server configuration items, but also, where applicable, we can use the Extensions installed earlier.

The PowerShell option allows us to open a PowerShell session on the target system – quite useful.

How about remote access to the Windows Registry?

The Active Directory extension allows for some administration of Computer and User objects.

Closing Thoughts…

As an administration tool, especially in the second line upwards support context, this is actually quite a useful tool in a modern environment.  In order to support slightly older Windows server releases, a few adjustments are needed on the server side to allow access, though the effort might be worth it.

Although aimed at a largely server management context, it may also be useful in some desktop contexts, particularly for diagnostic and investigation work.

Although Xtravirt are a primarily Virtualization focused business, by the very nature of what we do, we also have to use tooling and technology both within the virtual estate (such as Guest Operating Systems) as well as in the wider environment supporting the virtualization platform (such as Active Directory, DNS etc).  If you’re in the process of a virtualization effort and require guidance on integration into a wider estate, then Xtravirt may be able to help.

About the author

Curtis Brown joined the Xtravirt consulting team in October 2012. His specialist areas include End User Compute solutions and Virtual Infrastructure design and implementation with particular strengths in VDI, storage integration, backup and disaster recovery design/implementation. He was awarded VMware vExpert 2019.

About Xtravirt

By Stuart Robinson & Jainie Morar

At a time when applications are moving to the cloud and workers are increasingly mobile, organisations are finding that their traditional perimeter defence techniques like VPNs and firewalls simply don’t give them the security they need.  If finding a new approach to network security is on your IT agenda, then you’ve probably heard ‘Software Defined Perimeter (SDP)’ being thrown around a fair bit.  If you are wondering what is SDP and what all the fuss is about, then please read on.

What is SDP?  

Identified by Gartner as a top technology for security in 2017, Software Defined Perimeter (SDP) is an architecture and protocol guide, the original 1.0 specification was released in 2014 and its goal was to highlight the benefits of an ‘authenticate first’ and ‘connect later’ approach to connecting users to their data. Originally developed for IT infrastructure in the defence sector it was developed on the premise that connections are restricted on a need to know basis, it wasn’t just out of bounds to people without permission, it wasn’t visible to them, this is where the term ‘Black Cloud’ came in. It is now spreading wider into enterprise use where it promises to help mitigate a broad set of security vulnerabilities that affect IT infrastructure protected by more conventional perimeter security.

Currently the accepted method to connect to environments is with TCP/IP via Virtual Private Networks (VPN) or Network Access Controls (NAC), the issue here essentially being that these rely on a connect and authenticate method. A malicious data packet getting as far as authentication is already at your gates and from here may be able to innumerate your assets, if someone were to get within your walls with malicious intent they may be able to move laterally around your system and uncover all manner of goodies that you thought were off limits.

SDP works on a zero-trust model, which means that before someone can even approach the data layer they have to go through the Gateway, this will assess who you are via a Single Packet Authorisation (SPA) and will also go through a number of other parameters such as the device being used, location, time of day and number of other checks. It will then look at the policy laid out by your organisation and define the perimeter of what you have access to.  Once in, you are strictly restricted to the perimeter your policy has set you, no ifs, no buts, no peeking over the wall, that is all you can see. As a default SDP trusts no-one and admits users on a case by case basis.

Why do I need it?  

In short, IT has moved on and is continuing to move at quite a pace. Twenty years ago, apps sat on servers in one room and access control was set by a simple firewall existing between IP addresses and servers and now we are in the age of cloud computing and virtualisation

If you’re reading this, then it probably has not escaped your notice that malware attacks and data leaks are on the news frequently and this could be attributed to the fact that organisations aren’t keeping their infrastructure security up to date with their infrastructure or their working model. More people are working from home, on flexible hours, on varying devices from all over the world and this creates a plethora of problems.  

The rise of cloud has also created a problem for the world of security, your information is now distributed in a variety of places, apps are located in globally distributed public clouds, hosted on 3rd party platforms, as well as on corporate and co-located datacentres.  It’s no longer nestled in the warm cosy safety of your building. Users are also now no longer based at a single premise and are mobile and distributed.  Here lies the problem, people coming in from everywhere trying to get to information hosted all over the place, it’s hard to build a wall around everything (and we know, Trump’s tried). Effectively the traditional perimeter has blurred – SDP re-establishes the perimeter and puts it back with the user. It overcomes the constraints of traditional tools by creating an individual perimeter for each user.  

Traditional perimeter-based approach to network security has failed to adequately protect organisations and a new approach is needed. SDP is user centric and based around a set of policies laid out by the owner, implemented and looked after by the IT team. No more adjusting firewall permissions because Ben from accounting is on location and working from home more often, the gateway sees where he’s coming from and adjusts the perimeter accordingly, no more access to the competitor account data while he’s sat in Evil Corps headquarters.  

OK, so it’s safer?

So, that’s the measure of it – SDP redefines the perimeter and associates it back with the user to create a zero-trust security model, but it can also allow you to manage resources more effectively. Due to its policy-based approach the requirement to adjust firewalls and user permissions is reduced so saving time now and is scalable for future savings. With everything going through the single point of access, you can change everything at once at the network layer and make policies a lot more granular to cover a vast array of scenarios.  

Because SDP is about creating dynamic and secure network segments between a source and destination systems, it provides a better security solution for how today’s IT works. The source can be any type of device in any location and the destination can be any type of application or service in any location accommodation for mobility, BYOD and cloud computing.

Most impressively, because all traffic is encrypted, and all the policies are applied top to bottom, you can easily transition to an IaaS cloud environment and keep the same level of security on and off premises. All of this and it offers you reporting to save your IT team even more time.  

Where did it come from and what’s next?

Let’s not beat around the bush, this is not new. Google have had an internal means of having employees connect securely from untrusted networks without the use of a VPN for years, called BeyondCorp it has essentially achieved many of the goals set out by the CSA’s SDP specification. Before them a collective called the Jericho Forum out lined the problem of de-perimeterisation in 2003 and set the goals to; define the problem, define the solution, work on fully utilising the cloud via collaborative methods securely and write the Identity, Entitlement and Access Management Commandments. They also debated ‘smart data’ before the forum was declared a success and disbanded in 2013, so Software Defined Perimeter already had a solid base to stand on and has been proven in both a defence and corporate environment courtesy of Google.  

The future then is looking good for SDP, as the method is adopted more widely, and more companies are creating SDP solutions the offering can only get stronger. These zero trust network concepts are adopted by many security or network gear vendors such as VMware NSX, Cisco ACI and Cyxteras AppGate to name but a few. There are also several opensource SDP products out there such as SDP Waverly Labs, so it’s very much out there for you to get your hands on.  

The advantages to a company with workloads on-premises and in the cloud seem endless, for ease of the user, ease of the IT admin and deterring Cyber Criminals. If security is a major part of your IT plans in the coming years, then an SDP solution could well be the answer.

If IT security is on your organisation’s agenda, then we can help. We help businesses transition from the world of securing devices and zones to protecting entire agile cloud infrastructures and ecosystems, tackling breaches before they occur, and providing practical steps for safeguarding your people and organisation from cybercrime. If you want to find out more, visit https://www.xtravirt.com/cybersecurity/ or click here to contact us.

Related services

Network Virtualisation Planning workshop

Secure infrastructure services and solutions  

About Xtravirt

Xtravirt are an experienced consulting firm dedicated to delivering outcomes to help customers solve their IT challenges. We design and build strategies to help customers unlock the full potential of cloud, datacentre and workspace technology.

We are the VMware Global and EMEA Professional Services partner of the year.

by Steve Wood

In January 2018, VMware® announced the release of VMware NSX® 6.4. You may be forgiven for thinking that this is just another minor release, but NSX 6.4 has several new headline features which customers have been requesting for a while. In this blog I highlight two, that in my opinion, will make difference to how NSX is deployed and adopted.

 Network flow app detection and enforcement at Layer 7

 NSX version 6.30 brought with it the ability to look inside the VM at the application using Endpoint monitoring, however, until this latest release NSX has not been able to construct firewall rules based solely around the application. NSX 6.4 has the ability to do network flow app detection and enforcement at Layer 7; which is great but what does this really mean?

 Let’s look at a quick example, a customer might be blocking SSH across their estate, to do this prior to version 6.4, you would create a rule to block port TCP/22, if anything tried to connect or listen on port TCP/22 it would be blocked by the NSX Distributed Firewall. However, if the user or malware changed the SSH port from its default of TCP/22 it would now not be blocked by the rule as its not on the expected port and therefore not a match.

 With this release, NSX now negates that threat with the ability to inspect at Layer 7, meaning you can create distributed firewall rules for several pre-determined applications, therefore creating a block rule purely based around the application SSH rather than its port (TCP/22). NSX 6.4 will come packaged with support for several pre-defined applications out- of-the-box and I suspect VMware will be expanding this list in future versions.

 Virtual Desktop and Remote (RDSH) Session Security per User

 This feature has been long overdue, but it has been dependant on the Layer 7 functionality discussed above.  

 The NSX Identity Firewall has, for me, always been the poor cousin when exploring the NSX feature set, it kind of did what you expected but at the same time for most customer use cases it didn’t. That’s because until the 6.4 release if you used the NSX Identity Firewall to apply a firewall rule, it could only apply those rules to a single user per VM, this ruled out the majority of use cases such as securing Citrix or RDS servers using the NSX Identity Firewall.

 With the addition of Layer 7 support with the NSX Distributed Firewall we can now detect the user’s identities at source and therefore have multiple different firewall rules applied to multiple users on the same VM. This is a very welcome addition and I know a lot of customers will be looking forward to finally being able to implement the NSX Identity Firewall fully across their Citrix or RDS estate.

 Other Features

 VMware have managed to package in quite a few new features in this version of NSX such as support for BGP and static routing over GRE tunnels, the packet capture tool now has a UI and an upgrade co-ordinator to help with the planning and execution of your NSX upgrades.

 This release addresses a number of specific customer bugs and resolves some key issues from previous versions which I feel will make a significant difference to customer environments running NSX.  For a full list of changes please refer to the VMware NSX Release Notes

 Xtravirt is a leading VMware NSX specialist and has the ultimate combination of deep experience and agility to design and deliver your IT transformation. If you’re interested in exploring Network Virtualization but are not sure where to start, contact us, and we’d be happy to use our wealth of knowledge and experience to assist you.

To find out more visit: https://xtravirt.com/nsx/

 About the Author

By Michal Grzeszczak

OLD WORLD

The landscape of modern IT is constantly evolving and an aggressive shift towards the software defined data centre is arising. Nowadays, virtualisation of storage and networking is becoming as, or even more important than the virtualisation of compute. In this rapidly transforming realm, traditional networking and security can’t keep up with location-agnostic and application-centric workloads and even if they could, there are now simply better ways to solve the problems occurring in traditionally managed data centres. Security, agility, automation and visibility are the key areas where there is a need for new tooling. During a recent customer engagement, we faced all of these issues and to mitigate them, VMware NSX® and VMware vRealize® Network Insight™ (vRNI) were deployed in the environment.  

BACKGROUND

The customer's main business objective is to provide IT services to a number of hospitals. Security regulations in the health care world (the likes of HIPPA) can be difficult to comply with, especially with traditional security methods such as using perimeter firewalls for east-west traffic control. The customer had an old data centre that contained both virtual and physical workloads, 200+ undocumented applications, Cisco 6500s core switches and Cisco ASA firewalls. As they were facing multiple challenges with this setup, the decision was made to engage Xtravirt to migrate to a new NSX based data centre.

CHALLENGES

The main challenge the customer had in their previous environment was application traffic visibility, namely the 200+ applications without proper documentation outlining necessary ports to be open in the firewall. The communication between the networking team and application team wasn't as smooth as one could hope for either which created unnecessary holes in the overall security posture of the company’s IT department. Multiple DMZs from the Cisco ASA firewall did not scale well and the rule sprawl was becoming a problem. The security team was working reactively instead of pro-actively - a known issue with the traditional approach. All of these issues led to the environment becoming unmanageable.

To sum up the challenges:

Lack of visibility of the East-West traffic - resulting in poor understanding of the application flows and complicating the security policy, therefore becoming difficult to manage.

Communication breakdown between IT teams - back and forth email exchange proves time consuming and slows down the deployments or changes, identifying a need for a tool to provide a "source of truth” of what is actually happening in the environment. 

Hair-Pinning to the perimeter firewalls and routers - sending traffic for inspection to the physical firewalls and routing to the core switches, even if the workloads reside on the same host. That is a waste of bandwidth. Also, latency sensitive applications might be affected. 

 GOALS

The customer decided to build a new data centre with NSX for micro-segmentation and vRNI for visibility and security planning. The next step was to migrate the applications from the old environment to a new one, then monitor traffic flows of the applications to create an adequate security policy.

 Goals communicated before the engagement:

Use vRNI to monitor applications and services that are running in the current data centre to get a clear picture of the network flows before the migration of the applications to the new data centre. 

Use vRNI to plan security policies for the environment based on the observed flows as opposed to the (lacking) documentation from the application team. 

Design a security policy using NSX, based on the vRNI outcome. 

Monitor the entire network, both virtual and physical workloads to get the full picture of what is happening in the environment. Then design an alert system using vRNI that will help with monitoring and troubleshooting. 

D-DAY

After adding Virtual Distributed Switches as Data Sources in the vRNI we watched traffic flows of the applications. With a few clicks, we were able to see all the traffic - ports, protocols, IP addresses - to and from any selected application. To define an application in the vRNI we simply specify the workloads that are relevant. Then the visual graph shows all necessary information as well as recommended firewall rules. We could export interesting data in the CSV file format readable in Excel and use that as a base for Security Rules creation. It is recommended to collect the flows of the application for some time, like a day or two, as not all the ports of the applications are used in the given moment. It could be a good idea to send a request to the DevOps team to sweep through all the functionality of the application, just to make sure all the traffic needed to be allowed in the firewall is actually there in the output graph of vRNI. By default, vRNI collects data every 5 minutes. 

Next steps involved creating a Security Policy using a distributed firewall - kernel based East-West firewall used for micro-segmentation. The decision was made to use Security Tags for all of the virtual workloads and IPsets for external ones. 

The Security Tags allow for dynamic assignment of VMs. For example - you could create a Security Tag called “Web” and configure a Security Policy that will automatically add VMs with the name that contains “Web” to a specific Security Group. This is a useful feature as workloads quite often change IP addresses and location. We are simply shifting from network-based security to an object-based one that allows for agile and location-agnostic applications. 

IPsets are sets of IP Addresses, subnets or a group of subnets that specify the scope of affected workloads for a given Security Group. In the customer’s environment, the zero-trust model was implemented which means that only necessary traffic is allowed on the Distributed Firewall and everything else is dropped. This type of design ensures maximum security. 

Next, the vRNI notification system was used for monitoring the new Data Centre. There are two types of notifications:

System notifications, which are pre-defined. The list of notifications contains 100 of the most commonly appearing issues customers face during a deployment. For example, this could be a loss of network connection of the NSX Edge routers.  

User notifications are defined by user and are very simple to set up. One can simply use a search bar to search for a specific query, for example, Change in the Application “App1” - and create a notification alert with the click of a mouse. Both System and User notifications are customisable. You can specify the severity of the alerts and tags to make searching for the problem easier and quicker, and contact recipients by email to notify a specific person or a team about an issue.  

RESULTS

Quite simply, they are spectacular. In my opinion, none of the solutions available on the market could solve the customer challenges like NSX and vRNI. All the goals were met and challenges mitigated. The customer now has a new health care compliant and scalable data centre with full visibility of both physical and virtual traffic. The customer also has a solution that is centrally managed and application-centric with an agile security policy, plus a customised notification system for monitoring and troubleshooting. 

ONE STEP AHEAD

VMware appears to be reading the future pretty well; by being flexible and adjusting to the market needs, this virtualisation pioneer managed to create a one stop shop for every IT requirement. With the acquisitions of Nicira and Arkin respectively, VMware expanded their catalogue with two extremely powerful and market changing solutions - NSX and vRNI. The first providing micro-segmentation, logical switching/routing and load balancing to name a few, and the second allowing for full visibility of physical/virtual networks and assisting in security planning. The fact that these two work together and give so many unique features is a game changer in the industry. Adding to the mix products like vSAN for storage virtualisation and vRA for automation, makes it even more interesting - all in software, all managed from your browser, location-agnostic and application-centric. This is a software defined revolution and it is happening right now. Join it and stay ahead of the game. 

Xtravirt is a leading VMware NSX specialist and has the ultimate combination of deep experience and agility to design and deliver your IT transformation. If software-defined networking is on your roadmap then contact us today.

To find out more visit: https://xtravirt.com/nsx/

About the author

by Curtis Brown

VMware NSX® network virtualisation platform has been around for a little while now delivering an operational model for networking that forms the foundation of the Software-Defined-Data-Centre.  It’s often associated more with server virtualisation or as a component within a Cloud Automation solution and with good reason; it’s readily able to deliver a scaled, secure environment, while providing several mechanisms to deliver advanced network functionality such as firewalling, load balancing and anti-malware protection.  However, one area where its application is frequently overlooked is in the world of End User Compute – more specifically virtual desktop infrastructure.

Wouldn’t it be nice if…

Consider a full-on Horizon deployment (though, to be fair, these components could be replaced in the most part for an element of your choice) –

 Horizon View – This will publish Virtual Desktops in Pools, with these pools assigned to Active Directory based Groups/Users.

App Volumes – This gives you a mechanism for delivering defined stacks of applications to the Virtual Desktops.Again, you can assign using Groups or users.

User Environment Manager – You use this to manage environmental and application settings.

 So, you have the mechanisms in place to deliver Virtual Desktops, complete with some granular application and settings delivery.  This is all pretty good, but wouldn’t it be nice if you could provide some intelligent network capabilities too?

Finetuned Firewalling.

Now take VMware NSX - this has some nice features that you can leverage in a VDI estate.

One of the key areas of concern is hardening the estate.  There’s been a pretty big play in the NSX world around using NSX to provide segmentation – both at a macro level, separating workloads into different VXLANs on virtual switches – and at the micro level using the Distributed Firewall to provide firewall rules at the Vmnic. Both strategies can be used here.

You can also separate Pools at a macro level or a micro level if you wish to, with the latter being particularly interesting.

The Distributed Firewall can provide a great deal of flexibility when defining firewall rules and can leverage several different identifiers, including vSphere entities and Active Directory objects.  Using these, you can generate a rule bases to lock down traffic quite tightly, in conjunction with the VDI solution and application delivery mechanism.  Take this example:

You can set up a standard DFW ruleset that applies to your desktops that will prevent traffic between the virtual desktops, while still providing the core services and application support for anything required for the desktop. This means you can control LDAP traffic between the desktops and Domain Controllers or PCoIP between the desktops, the Connection Servers or direct to physical endpoints if you wish.

 With App Volumes, you can define an AppStack with several applications which may well have discrete client/server network traffic requirements.  The DFW can apply rules based upon the user logged into the desktop, so you can create and apply rules specific for these client server applications and tie them to the same Active Directory object that applies the AppStack.

 The net result is that you end up with a combined ruleset applied to a desktop that is not just tied to a broad pool, but also to discrete needs for users within the pool. This provides strict granular access based upon the needs of the desktop and the application set for the user.  And let’s remember that this is applied at the desktop’s connection to the network – not at any perimeter level.

Malware Protection

NSX also provides the ability to integrate a compatible antivirus/antimalware solution into the mix. This is not, however, limited to the more publicised Guest Introspection where virus scanning is offloaded at the hypervisor level.  NSX can also integrate with both virtual and physical appliances such as Fortigate for intrusion detection, perimeter firewalling and more.

At the Infrastructure Level

As with any VDI estate, you have the upstream infrastructure to consider, several services can be provided here too.  

Using VMware NSX Edge Gateway appliances, you can provide perimeter firewalling between networks.

For Horizon View, both Connection Servers as well as Access Gateways/Security Servers require Load Balancers, as do App Volumes Managers.  The NSX Edge appliances are capable of being configured to provide load balancing services.

Perimeter firewalling using NSX Edge can also be provided, so you can have a DMZ layer for the Security Servers/Access Gateways as well.

Generally speaking, you could deploy something like this for the Horizon View management environment:

Our external traffic accesses the estate via a pair of NSX Edge Gateways, serving as firewall and load balancer for a pair of VMware User Access Gateways.  These are configured as two-legged, tunnelling into the vSwitch beneath, where you have a dedicated NSX Edge appliance load balancing the Connection servers.  This internal load balancer is also used by internal users who connect in via an L2 bridge or NSX Edge as appropriate.

 You then deploy NSX for the Desktop blocks as well, in order to provide the previously mentioned firewalling and malware protection for a secure end-to-end solution.

Closing Thoughts…

With NSX, it’s possible to turbo-charge the security for a VDI desktop environment in a manner that can be applied regardless of the choice of broker solution – the above would work just as well in a third party VDI solution such as Citrix XenApp or, perhaps more importantly, XenDesktop, not just VMware Horizon.  The ability to dynamically set and operate firewalling on egress outside of the guest Operating System means that such firewalling cannot be tampered with from within the VDI desktop, which might be useful in environments where desktops are used with untrusted users (public kiosks for example).

If you’re interested in exploring the combination of VMware NSX network virtualisation in a VDI estate, please contact Xtravirt, and we’d be happy to use our wealth of knowledge and experience to assist you.

About the Author

by Curtis Brown

As those of you who have the joy of supporting end-users will know (and this old techie has worn that badge of honour!), any tool that can make getting to grips with an issue easier is always welcome, particularly if it means getting your hands on the user’s desktop to see the problem in action.

So it’s welcome news that the latest release of VMware Horizon® 7.2 brings into play a fully integrated helpdesk tool, specifically for supporting VMware Horizon desktop sessions. It provides session information, as well as several remote operational abilities such as resetting sessions, remote control, logging off users etc.

Setting up Helpdesk

You don’t need to do anything fancy to install it as it’s a part of the Connection Server installation, however there are several recommended additional steps to get best use from it.

You will need to configure the Events database – this provides session information to the HelpDesk console, so it’s pretty important. To track logon events properly, a further command should be run on each Connection Server:

vdmadmin -I -timingProfiler -enable

Oh, and ensure that the VMware Horizon Agent installed in the desktop templates is also a 7.2 release – otherwise you’ll miss desktop side session information.

  Getting into the Help Desk Tool

There are two ways of accessing the Helpdesk tool.  In either case, a user will require Admin access to Horizon – Inventory Admins should be sufficient for most operations.

The first option is to log into the Admin console for horizon (HTTPS://(ConnectionServer URL)/admin). Once logged in, there is a new Help Desk button in the top bar of the console – click on this to access the helpdesk tool – the credentials pass through, all Single Sign-On style!

Alternatively, you can access the console directly (via HTTPS://(ConnectionServer URL)/helpdesk) and then log on with the right credentials.

Doing Help Desk stuff.

So, once you’re all set up and logged in, you can use the tool to do all sorts of heroic Help Desk stuff. The front page offers a search function.

Punch in the name of the user, for example, “Curtis” and it’ll pull in the Active Directory credentials of the user – if the Active Directory E-mail and phone number fields are filled in, these are also displayed.

If you click on the user, you’ll get a new page with a summary of running sessions and entitlements.

Under ‘Sessions’, you’ll see the highlights of all running sessions - the green ones are connected sessions.  It’s even Cloud Pod aware – the L status refers to a session in the local Pod, and the G status refers to a session in the global Cloud Pod environment. If you then click on the Computer name, you can drill down further.

If the Agent is 7.2+, you get detailed session info, including CPU performance, memory usage and more.  Further, you can do some active tasks on the session.

You can send messages to the specific session or offer Remote Assistance.  The latter plugs into Microsoft’s Remote Assistance functionality, so this will need to be enabled and configured in the VM.

On VDI sessions (not RDS Published Desktops or Application Sessions), you can issue a restart command to the desktop – this will reboot the VM.  You can also disconnect or log off users.  The Reset function differs from Restart in that the latter is a graceful shutdown and restart – Reset should only be used if the VM has hung.

  Closing Thoughts….

So, a welcome set of useful capabilities has been added to this point release – and one that focusses on supportability rather than the usual performance or user-centric capabilities.

If you’re in need of assistance with a troublesome Horizon solution or perhaps want some support upgrading or implementing a new one, please contact Xtravirt, and we’d be happy to use our wealth of knowledge and experience to assist you.

About the Author

by Curtis Brown

AirWatch®, for some time now a VMware® product, has been one of the most successful Enterprise Mobile Management solutions on the market (enough to justify VMware spending over $1bn to acquire them!).

Although its origins are predominantly based upon cloud based management of mobile phones, the product has spread its wings considerably in recent times. 

Deploying AirWatch

 Although it originated as a cloud based offering, and this is still very much the pushed approach, there are in fact several ways that an AirWatch solution can be deployed.

The most obvious one is the original cloud flavour.

Here, the solution is entirely hosted in the cloud.  Applications and data services are directly accessed from the estate, leveraging as the customer desires (VPN, direct access to the application in the DMZ etc.) This has zero footprint in the estate and works well where services onto the internet are already established.

The next approach, referred to as Integrated Cloud, provides a hybrid approach; a VMware AirWatch Cloud Connector is deployed within the estate.

This server provides both integration with cloud (for notifications and management), an on-premise presence for administration, as well as providing AirWatch Tunnel.  This is a secure gateway for AirWatch managed devices to access corporate resources directly – a ‘VPN-less’ VPN.

The final approach is an on-premise solution.  This leverages one or more AirWatch servers, carrying out all the AirWatch functionality on premise, including the tunnelling capability above.  For small deployments, a single DMZ based server is used. In a larger deployment, with multiple servers, the DMZ server provides AirWatch Secure Email Gateway and AirWatch Tunnel, while AirWatch Servers on the corporate network carry out the remaining provisioning services.

Further, the solution can be fully integrated with VMware Identity Manager Advanced Edition to extend the app catalogue capabilities to include single-sign-on access to web applications, Citrix® and VMware Horizon.  VMware Identity Manager Advanced is included as part of the AirWatch Suite blue and yellow licensing tiers. 

What Devices?

 VMware AirWatch coverage of devices is impressive.  From a mobile phone/tablet perspective, Android, iOS, BlackBerry and Windows Mobile are all supported.  In addition, there is also support for Rugged devices, such as scanning handsets used in warehouses etc.  Typically, these run Android, Windows Mobile or Windows CE.

Perhaps most interesting of all is the support for laptops (and essentially desktops) running Windows 10 or MacOS.  This functionality is quite powerful.  For example, not only can it provide configuration management and asset tracking, as you’d expect with an MDM solution, but it can also provide software distribution (in the case of Windows 10, this includes Win32 and Universal Apps), remote assistance (screen sharing) and endpoint protection such as configuring encryption and malware prevention measures. 

AirWatch Features

 There are a few standout features beyond the ability to manage devices and application publishing in a secure manner.

AirWatch Browser

– This provides a secure web browsing capability.  It can be centrally controlled, allowing white/blacklisting of sites, cookie handling control and restricting copy/print functionality.  On top of this, it provides a built in SSO capability and can leverage an AirWatch App Tunnel to access intranet sites without a third-party VPN.

AirWatch Content Locker

– This is a clever data management solution allowing devices (including browsers) to access corporate data in a secure, rights-managed environment.  It can integrate with cloud provisions (Box, Office 365, Google Drive) and on-premises solutions such as SharePoint and WebDAV and traditional File Servers as well.  In the case of On-Premise, these leverage AirWatch Tunnel for secure access.

**AirWatch Video **

– This is a secure video distribution solution, a corporate YouTube to some extent. 

Closing Thoughts

 VMware AirWatch provides a big play towards VMware’s any device, anywhere mantra.  Whether used in combination with VMware Horizon or other solutions, this provides not only management and control of corporate devices, but also the means to deliver applications and services in a secure manner to practically any compute device.

 About the Author

by Guilliano Bertello

** Please Note: The NSX for vSphere 6.2.3 release has been pulled from distribution. The current version available is NSX for vSphere 6.2.2. VMware is actively working towards releasing the next version to replace NSX for vSphere 6.2.3. For more information, please visit click here.**</>

On 9th June 2016 VMware released VMware NSX (for vSphere) 6.2.3. NSX is VMware’s solution to virtualising network and security for the software-defined data centre. This 6.2.3 release is considered a minor release but it does bring in a lot of enhancements. One big new feature introduced is the support for 3rd-party hardware L2 gateway integration. This is useful when migrating physical workloads into an “NSX enabled” environment (don’t forget the controllers see issue 1477280). Another key feature is the VXLAN UDP port which has changed from 8472 to 4789. I will not list all the new features (you can use the release notes for that) but will give a quick overview of new features that I consider to be the most interesting and the issues to keep an eye on.

NSX Edge on Demand Failover: giving users the ability to run on demand failover it’s a good option not only for testing

Edge Firewall SYN flood protection: disabled by default, can be enabled via REST call. Particularity useful when the ESG is exposed publicly on the WAN

SNMP v2c support, for the NSX Manager, Edges and Controllers

Global Dashboard to quickly monitor the overall health of your NSX environment

Desired/Live location attribute is now displayed for ESGs and DLRs

It is possible to apply a NAT rule to a vNIC interface, used to be an IP address only

You can configure DHCP options on NSX Edges, a very useful one is 121 which allows you to inject a static route into the DHCP client

A new license model implements the default license upon install which is “NSX for vShield Endpoint”, enabling the use of NSX for deploying and managing vShield Endpoint for anti-virus offload capability only

Fixed issue 1456172: good to have some warnings displayed, NAT has been part of the firewall service however people tend to forget that if the firewall is disabled so is the NAT

Fixed issue 1619570: In a large-scale DFW configuration with millions of rules and Service Composer, rule publishing may require several seconds to complete after a reboot. During this time, new rules cannot be published

Fixed issue 1467774 whereby a route learned from an eBGP peer advertised to an iBGP in the same AS was retaining a previous (wrong) administrative distance

A full list of the fixed issues can be found by clicking here. There are also some known issues to be aware of, key ones include:

Issue 1529178: Uploading a server certificate which does not include a common name returns an “internal server error” message

Issue 1534606: Host Preparation Page fails to load when NSX Managers are running different versions

Issue 1386874: Networking and Security Tab not displayed in vSphere Web Client

Issue 1604506: Cannot deploy DLR without NSX Edge VM if using default gateway for static routing use case see KB 2144551

Issue 1556924: connectivity through some of the DLR LIF’s could be affected is the VXLAN layer on the hosts is not properly configured

Issue 1493611: L2 VPN could be configured with VLAN ID 0; the GUI will let you do so however this is not supported and traffic will not traverse the tunnel so be careful

Issue 1474238: After vCenter upgrade, vCenter might lose connectivity with NSX when using the root embedded SSO account

Customers using Distributed Firewalling and Security Groups are advised, by VMware directly, not to upgrade to 6.2.3. This is because there is a known issue (KB 2146227) whereby virtual machines could lose connectivity upon a vMotion operation followed by changes to configuration of the Global Address Sets in the SG referenced for that virtual machine. The list of bug fix is huge this time so triple check and take the time to read through the entire list of known and fixed issues when planning to upgrade. And don’t forget to back up all the NSX components, a good starting point is the available at NSX Backup and Restore. The official documentation for VMware NSX for vSphere can be found by clicking here. NSX for vSphere 6.2.3 Release Notes can be found by clicking here. If you’d like any assistance with a VMware NSX project or want to learn more about how Xtravirt can help your organisation, contact us and we’d be more than happy to use our real world experiences to support you.

About the author