Musings of Rodos

The catalog for VMworld 2009 sessions is starting to appear.

If you are into Cloud here are the ones that are relevant. Don't be fooled, there are quite a few that mention cloud but they are more about the internal cloud and are stretching the wording.

Securing vCloud - TA3901

Enterprises are looking for ways to expand their on-premise infrastructure to add capacities on demand, as well as SMBs or workgroups wanting a fully outsourced infrastructure, are investigating cloud computing. Many of today’s solutions have issues like proprietary application platforms that require redevelopment time to function off-premise, inability to move to another provider if SLAs aren’t met, and long lead times to move or set up new environments. This presentation is based on an actual customer experience utilizing VMware’s vCloud.

For customers, vCloud delivers peace of mind in knowing the services they get from hosting/service providers for disaster recovery, test and dev or just simple infrastructure on demand will be reliable, flexible, and secure. This presentation will analyze the core security and reliability components and demonstrate the security of the vCloud with an actual customer application failing the business defined Service Level Agreement (SLA) for the application due to security vulnerability, and the application migrating to the service provider environment to meet the SLA by mitigating the vulnerability.

Proposed agenda:
• security consideration for cloud environment
• how to preserve a consistent security policy regardless of hosting it on premise, or hosted by a cloud partner?
• how do define SLA for security?
• how to evaluate the security offering by a cloud partner?

Improved cloud interoperability using virtualization management standards - VM2706

This session will discuss the latest developments in virtualization management standards and how they can be used to provide improved cloud computing interoperability. It will cover the latest virtualization management standards activities within the Distributed Management Task Force (DMTF) that are being developed within its VMAN initiative. This includes updates and demonstrations of usage of Open Virtualization Format (OVF) for cloud portability. This session will also give a review of current implementations of these standards in various vendor offerings.

Introducing the VMware vCenter Suite: Managing Service Levels Across Dynamic IT Infrastructure - VM3235

VMware’s goal is to bring a new level of simplicity to managing IT, bringing greater efficiency, control and flexibility to IT operations than ever before. This session will highlight VMware’s vision for managing applications and IT services across dynamic infrastructure in the datacenter, including creation of the private cloud. It will highlight key enabling technologies for managing IT as a service, and will also provide an overview of the vCenter Suite of solutions that can help IT evolve toward a service-centric management model and reduce the cost and complexity of managing IT infrastructure.

Introduction to Redwood - Unknown

Sven Huisman posted that he notice this session but I can't find it in the catalog. However I can't see any Technology Preview sessions so maybe that's why. Sven quoted the session as ... "VMware will be releasing and end-to-end solution for setting up internal and external clouds. In this session, product management will drill into the specifics of that offering. The first half of this presentation will introduce the scope and composition of the release; the second half will dive into specific technologies behind the cloud."

As more session details become available I will update cloud related ones back into this post.

See you at the sessions!

Rodos

Having been writing on cloud for nearly a year now I just stumbled across a new VMware cloud thinker on twitter of all places.

Jian Zhen is the Director of Cloud Solutions at VMware and has been in the role for 4 months, starting in March.

Jian has a personal blog http://www.zhen.org/ (a bit like all of us) where he has been posting some great thoughts on Cloud.

The recent entries have been a four part series on "The Thousand Faces of Cloud Computing" which have been broken down into

• Differing Definitions
• Users
• Business Benefits
• Architecture Characteristics

I like the fact that he is using the same terms that I am using like "Elastic".

Rodos, tell me something about vShield Zones! Well read on if you want a quick low down.

The reason for this post is that I knew vShield Zones was released on June 10. As I am doing the planning on a huge deployment I wondered if vShield Zones could be used to provide some extra security layers, but I really have little idea of what it actually is, its benefits and limitations. A quick search of the Internet did not bring up any real details apart from marketing materials, not even Yellow-Bricks. If Duncan has not written anything on this then I am afraid I was on my own, so I hit the documentation.

So here you have it, my notes, questions and thoughts on VMware vShield Zones. Its not a deep analysis, more of a dump of my reading notes. I figured best to know what it is and any limitations before doing a download and running it up in a lab!

Links

• Product Page - http://www.vmware.com/products/vshield-zones/
• Documentation - http://www.vmware.com/support/pubs/vsz_pubs.html
• VMworld Session - Unifying the internal cloud while maintaining network trust separation for security and privacy with VMware vShield Zones http://www.vmworld.com/docs/DOC-2952
• VMTN Community Security & VMware vShield Zones - http://communities.vmware.com/community/vmtn/general/security
• Other products - http://www.reflexsystems.com/

The few blog posts that have been made

• Review of VMworld Session - http://blog.virtualarchitect.nl/2009/03/dc13-vmware-vshield-zones/
• Blog Tip - http://blog.core-it.com.au/?p=545

Background

VMware acquired Blue Lane Technologies (http://www.bluelane.com/) in October 2008. For the details read over the VMware acquires Blue Lane and VMware goes deeper into Security world posts at virtualization.info.

What does it do?

You can think of vShield as providing firewalls inside your ESX hosts. Each host runs one or more vShields which is a VM (provided as an OVF) which acts as a bridge between the real network and your Virtual Machines. These numerous vShield machines are all managed by a central vShield Manager (also provided as an OVF, one per vCenter Server).

The vShield creates two zones, one protected and the other unprotected. The traffic enters the protected zone from the unprotected zone. As it crosses the zones the vShield performs traffic analysis, discovery and stateful firewall protection.

For each vSwitch with a pNIC you will need to deploy a separate vShield to create a protected zone off it.

The Virtual Machines protected by a vShield all sit within a port group so they can freely talk to each other within the zone, the port group has Promiscuous Mode turned on.

The vShield Virtual Machine itself has three vNICs. One is for the management interface to talk to the vShield Manager. The second is for the portgroup of the protected machines and the third for the portgroup of the unprotected machines.

Here is what it looks like logically in a slide from the VMworld session.



You can see in the right hand side there are two port groups on the vSwitch that has the pNics, one is the management port group and the other is the un-protected port group. The vShield has a vNIC into each of these, it then acts as the bridge/firewall into the isolated vSwitch that contains the protected port group where the protected virtual machines will now live.

Stateful Firewall Protection (VM Wall)

You create firewall rules based on traffic direction, application protocols and ports and specific source-to-destination parameters. Rules are placed at the DataCenter or the Cluster level.

Rules can be Layer 4 or Layer 2/Layer 3. Layer 2/Layer rules which govern things such as ICMP, ARP etc are enforced at the datacenter level only.

Traffic Analysis (VM Flow)

By inspecting each passing packet the vShields gathers information which is aggregated into the vShield Manager. This then becomes a forensic tool to detect services, examine inbound and outbound sessions and forms an easy way to create VM Wall access rules.

You can view the statistics at either the DataCenter, Cluster, vShield instance or individual Virtual Machine level. It shows the last seven days but you can select a date range. You can drill down through the data.

Virtual Machine Discovery

vShield builds an inventory of Virtual Machines showing the operating systems, applications (ports) and open ports on each virtual machine. Discovery is either continuous, run on demand or run on a schedule. Periodic discovery conflicts with continuous discovery and scheduling a periodic terminates the continuous one and does not re-enable it.

User Interface

You interact with the Manager via a web interface or a CLI. There is also a vSphere Client plug-in. The user authentication is different for the web and CLI interfaces and neither is integrated with vCenter Server or a central authentication system such as LDAP. For vShield Manager you can have different roles and rights, these are created and maintain within vShield Manager and there is no integration with vCenter Server. The CLI has either a Basic (read-only) or a Privileged mode.

What does it Cost?

vShield Zones is included in the Advanced, Enterprise and Enterprise Plus editions of vSphere 4.

Notes and Limitations

• By default any machine in a vShield zone can not be vMotioned. This is because it on a vSwitch that is not connected to a pNIC and hence VMotion assumes its connected to a virtual intranet. If you build the environment so that all the ESX hosts have the right vShields and port group names you can allow VMotion. If you use the automatic deployment it should be setup this way. However to do this you need to go and hack the vpxd.cfg file for vCenter Server and change the setting for VMonVirtualIntranet. My issue with this is its an all or nothing setting. What if you actually do have a vSwitch that is isolated to do some testing or something, a VM on it may now get VMotioned, you will need to remember to go and turn VMotion off for any of those VMs which are exceptions. I can see someone forgetting this detail and things getting screwy.
• As Layer 2/Layer rules are enforced at the datacenter level only I suspect that if you have two Clusters in a DataCenter you can’t have one which will allow ICMP and the other not, which could be a real annoying limitation.
• You can backup the data from the vShield Manager to a remote SFTP or FTP server. This can be done manually or scheduled. It creates a unique filename per backup.
• Updates are done via downloading them to your PC and then uploading them to the vShield Manager. The vShield Manager updates all the vShield instances. It looks like reboots are required for updates of the vShields which I imagine would cause a network outage.
• It does work with normal vSwitches and vNetwork Distributed Switches. However for vNDS you have to set everything up manually, it can’t auto deploy itself.
• If you want to keep your vSwitch names the same as they were before you implemented vShield you will need to deploy manually and move to a temporary vNDS and then recreate the protected group with the original name.
• There are a few references to Blue Lane in the documentation. In the CLI reference there were 31 commands which are listed and then in the description it says “Deprecated. Do not use.”
• You can delete all previously recorded Flows but there is nothing in the documentation about rollup or archiving. What type of rollup does it do on the statistics gathered? Can you change the settings?
• You need to disable HA and DRS on the vShields which is easy to do and makes sense.
• It does note like Distributed Power Management (DPM), see the release notes.
• You can’t have two datacenters with the same name within your vCenter Server.
• The default user account for the vShield Manager user interface is not linked to the default CLI user account for a vShield Zones virtual machine. These accounts are managed separately. Also, the default CLI user account is unique to each vShield Zones virtual machine.

UPDATE : This post and vShield Zones was discussed in the VMTN Podcast #52 which you can listen to, skip to 48:20.

Some Cisco Unified Computing System (UCS) linkage goodness.

This page will always be a work in progress as I will update it as I come across useful resources. If you have a useful resource drop in a comment with the details. If you want an easy page to remember or bookmark a permanent link is http://haywood.org/ucs/.

Links

• Cisco UCS entry page for public information
  • Data Sheets
  • B-Series Models
  • Cisco UCS B250 M1 Extended Memory Blade Server
  • Cisco UCS B200 M1 Blade Server
  • C-Series Models
  • Cisco UCS C250 M1 Extended-Memory Rack-Mount Server
  • Cisco UCS C210 M1 General-Purpose Rack-Mount Server
  • Cisco UCS C200 M1 High-Density Rack-Mount Server
• Cisco UCS entry page for product documentation, CCO login required.
• UCS Partner Resource Center (restricted access)
• Ciscowiki - Category:Cisco UCS Manager
• Cisco NetPro Forums - Data Center:Unfied Computing
• UCS Dictionary of TLAs and terms
• Interactive 3D Model
• Firmware downloads, CCO login required.
• BMC Solutions for Cisco Unified Computing System - little information available at the moment

Documentation

I am not known for being a tin fan, give me some half decent hardware to run VMware and I am usually happy. However with Nehalem (5500) I have started to become interested. After all the 5500 is being touted as great for virtualisation for many reasons.

Aaron Delp did an introduction to memory on Nehalem on Scott Lowe's blog, which is a great read. Aaron does a good job of helping to understand the decisions around memory selection and memory speed.

What I wanted to add was some details about how the situation is different on the Cisco UCS blades, in particular the expanded memory blade, the UCS B250-M1. This blade has the Cisco ASIC memory extension architecture that lets it address up to 4 times the memory of a standard Nehalem processor. This ASIC is called Catalina.

What Catalina does is expand the number of memory sockets that can be connected to each single memory bus. The ASIC is inserted between the processor and the DIMMs on the memory bus, minimizing the electrical load, thus bypassing the control signal limitations of the Nehalem CPU design. Being done at the electrical level its completely transparent to the OS. The BIOS is extended to initialize and monitor the ASIC and to perform error reporting.

In order to increase the number of memory sockets without sacrificing memory bus clock speed, the ASIC adds a small amount of latency to the first word of data fetched. Subsequent data words arrive at the full memory bus speed with no additional delay. The first word delay is in the order of 10% but I have heard from some spies that testing shows this is looking like a non-issue. Its especially a non-issue compared to the constant 10% latency hit and 28% drop in bandwidth you would get if you populated the channels in the normal Nehalem way.

What this means is that with the B250-M1 you can get the best price/performance ratio whilst either having the largest amount of RAM possible with expensive high density DIMMs or a large/medium memory configuration with inexpensive DIMMs.

If you have been watching the UCS space you will have noticed that Cisco Rack servers were recently announced. Low and behold the UCS C250-M1 has the extended memory Catalina ASICs too.

To think of all that talk that UCS was just a bit of tin with some networking hidden inside.

If you want more details on Catalina see the Cisco Extended Memory Whitepaper.

If you have any insights (maybe you are a tin person), drop a note in the comments. These will certainly make some sweet ESX hosts!

Rodos