If you have not yet seen or heard about 3 serious security vulnerabilities (Spectre and Meltdown) that become public last week then you need to be across them fast (CVE-2017-5715, 5753 and 5754). They represent the largest and widest ranging computing ecosystem security problem that I’ve seen in a long time, and have had a response across the entire enterprise and consumer computing industry as a result. One of the issues (Meltdown) is Intel specific, the other issues impact multiple CPU architectures (Intel, ARM, AMD, Power etc). Although patches for some products have been released already the full solutions are expected to take some time to resolve. All of the major IT vendors have given response to the issues their top priority. This article will contain key links to information that you need to know to prepare and determine the risk for your particular environment.

There are three specific variants for the issues:

The starting point should be the industry created site to aggregate the research data for these issues – https://spectreattack.com/.

Then you should review the specific academic research papers and documentation:

There have been performance concerns with regards to the fixes and RedHat has done some specific research on this and it is available – https://access.redhat.com/articles/3307751.

Final Word

As you can see from the research and various papers and advisories that are available the security vulnerabilities are wide ranging and required and industry wide response. The security research, discovery, coordination and patching of these problems has been cross industry and covers consumer and enterprise systems. This is no small undertaking and all industry participants have been working together on the response. This is a good example of industry participants working together to resolve customer issues. There will no doubt be many lessons to be learned coming out of this and this will make for interesting reading and research for years to come.

This post first appeared on the Long White Virtual Clouds blog at longwhiteclouds.com. By Michael Webster +. Copyright © 2012 – 2018 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

Security is in our DNA at Nutanix. A significant proportion of our business is from sectors of industry that care deeply about security, including Federal Government, State Government, Local Government, Financial Services, Healthcare, Retail and more. This is why we build in security as an automated part of every configuration and deployment and by default it is on, and it is continuously monitored for compliance against the security baselines and Security Technical Implementation Guides. Unlike some vendors in the HCI space Nutanix doesn’t just have a single STIG, we apply multiple STIG’s, automatically, and continuously verify against them. But what is this STIG anyway?

The description of what STIG’s are is available on the Defense Information Systems Agency, Information Assurance Support Environment web site and I quote:

“The Security Technical Implementation Guides (STIGs) are the configuration standards for DOD IA and IA-enabled devices/systems. Since 1998, DISA has played a critical role enhancing the security posture of DoD’s security systems by providing the Security Technical Implementation Guides (STIGs). The STIGs contain technical guidance to “lock down” information systems/software that might otherwise be vulnerable to a malicious computer attack.”

Not only are these used by the US Federal Government and Department of Defense however, they are also the security configuration standard for many industries that are concerned about security. They can be incredibly comprehensive and run to many hundreds of pages of configuration details. Often each item in a STIG needs to be evaluated independently and the combinations of security settings needs to be tested to ensure they apply the correct hardening, but also do not break the required functionality.

When Nutanix decided to develop our STIG frameworks we decided to do everything in machine readable format to make it easy to maintain, and so that our software could automatically configure itself to a hardened standard. Nutanix automates the regular health-checking of the applied STIG, and if it’s not compliant, will reapply the baseline settings. Once the system is deployed it is hardened, it remains so after deployment, reducing the risk of mis-configurations by system admins. This saves our customers from all the manual configuration and potentially months of testing that comes with a manual process. Reducing latency, from deployment to production ready hardened system, is important when you want to have security as well as agility and lower cost of ownership.

Each component of the Nutanix Enterprise Cloud Platform is covered by the relevant STIG’s. This includes Nutanix AHV, as well as the Nutanix Controller VM, Prism Central VM(s) etc.

Let’s first cover the Nutanix Controller VM, Nutanix AHV Hypervisor and Prism Central VM’s. The base STIG that covers all of these main components is the Linux OS SRG or STIG (AHV/AOS up to 5.5). Prior to AHV/AOS 5.5 Nutanix had a more comprehensive custom STIG implementation than standard RedHat Linux v6 due to our user space design. From AHV/AOS 5.5+, Nutanix implements the RedHat Linux v7 STIG, these can be found under the Unix/Linux STIG Index and on the Nutanix Support Portal.

Next the individual components within the above Nutanix components are also covered by individual STIG’s or SRG’s. These include things such as Webserver’s – Apache, Application Server’s – Tomcat (Application Server SRG), and Java/JRE.

A full list of the available STIG’s from A – Z is available here. Sunset product STIG’s and SRG’s are available here.

If you are running VMware as a hypervisor on top of Nutanix you should evaluate the VMware Specific STIG’s, covering vCenter and vSphere. For a Windows vCenter Server you will need to apply the Windows STIG in addition to the vCenter STIG. For the vCenter Database you will need to apply the Windows or Linux STIG, in addition to the database STIG. All STIG’s would need to be applied correctly and tested. Be aware not all VMware products are covered by STIG’s, and not all products comply with the relevant STIG’s. You should seek specific advice from VMware if you have any concerns. If you are running Microsoft Hyper-V on top of Nutanix you should evaluate the Microsoft Windows STIG’s.

Final Word

In the age of increased cyber attacks and data breaches security is critical. You can choose to have manual hardening process and significant testing effort, or you can choose the Nutanix approach with automation, continuous compliance testing and reporting. Vendors should provide secured systems by default so it doesn’t take months to get to a production standard. This is the Nutanix philosophy.

This post first appeared on the Long White Virtual Clouds blog at longwhiteclouds.com. By Michael Webster +. Copyright © 2012 – 2017 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

This week I had the ultimate privilege of attending the first Nutanix .Next Conference and present some of the work I’ve been doing, along with a great customer case study and talk to many partners and customers. The conference was a sell out with more than 1000 attendees, not bad for a first user conference. From the moment I arrived till the moment I left I constantly had the feeling of how lucky we are to be part of the Nutanix team and ecosystem, and how thankful I am to be able to make an positive impact on our customers. The conference was refreshing in many ways compared to other big conferences I’ve attended, firstly due to the unscripted and passionate nature of the keynote, the customer stories, live on stage and video recorded, and the live demos that caused many OMG moments among everyone who saw them. I think the customers that grabbed a selfie during the keynote with Dheeraj Pandey, Nutanix CEO, set the scene. Ultimately the whole conference was about the Customer and Partners, and how they have been positively impacted. This is why every breakout session had a customer presenting their stories as well. This article is the first of what will cover the highlights and key announcements from the conference.

Firstly I would like to thank Polo, Director of IT Infrastructure from Kellogg. He and I presented a break out session titled “Run Your Databases on Nutanix – What Are You Waiting For?”. Customers have been running critical databases on Nutanix for some time, and it’s always great to hear from a customer that is doing it. Polo told a very powerful story of how Kellogg is using Nutanix technology to deliver faster to their business and achieve their mission of enriching the lives of everyone as a result. Kellogg has deployed Nutanix NX8150 Appliances for SAP and Oracle workloads among other things.  The NX8150’s are a great choice for large database platforms and applications. The Dell XC 730xd-24 is the equivalent platform for customers that wish to run on the Dell hardware.

One of the ways the .Next conference demonstrated it’s all about customers is that Nutanix supports customer choice. Choice in terms of hardware, choice in terms of hypervisor, and choice in terms of cloud platform or execution runtime. Essentially Nutanix vision is to provide a simple application fabric that makes the infrastructure invisible and let customers focus on the applications and business value. This application fabric is delivered by Nutanix Acropolis, and the simplified management is provided by Nutanix PRISM. The two combined form the Nutanix Xtreme Computing Platform.

Some of the new features will be available in future releases of Nutanix OS (NOS), but Acropolis Hypervisor is available right now, as is cloud connect to AWS, and Azure Pack integration with Microsoft Azure. There is no reason why VMware vCloud Air and the the vCloud Network will not be added in future depending on customer demand. In the future customers will have the ability to change hypervisors, or clouds, with the click of a button and seamlessly run multi-hypervisor environments. I see this as a very powerful feature for allowing customer experimentation, as well as giving them the power to change as and when required if it meets their business requirements. This also provides great encouragement for all parties to continue innovating rapidly and providing the most customer value.

Now speaking of the Nutanix Acropolis Hypervisor. This is really a cut down and security hardened fork of the popular KVM hypervisor. Nutanix has added some special source around DISA STIG implementation and security hardening for multiple security frameworks, and also continuous security compliance enforcement and reporting (implementation to fully hardened for production in 30 seconds, not 12 months). We’ve also taken the IO path out of the kernel to improve performance. Yes, thats right. While other players are trying to stuff as much as possible into the kernel (bad idea, who wants a bloated kernel), we’re taking it out. It works a lot better that way. As a result we can provide as good as makes no difference equivalent performance across all the hypervisors we support, including the Acropolis Hypervisor. This is just another way we’re providing customer choice. Acropolis Hypervisor is included in the price of all Nutanix OS Editions, and is provided completely free of charge in unsupported form as Nutanix Community Edition.

During the .Next Conference Dell has announced they will support the Nutanix Acropolis Hypervisor and new appliance varieties from Q3. One of the appliances they are introducing is the XC430, which is a short depth appliance suitable for military use and environments that are space constrained. You can read more about the Dell Announcements.

So how is Acropolis Hypervisor being used by customers? Here is a video from one of the customers using it in production today (It’s been available since Jan 2015).

https://www.youtube.com/watch?v=bzB3Hik-z-w

Another great story from a customers that I’ve been involved with is Nintendo North America. They are using the Nutanix Acropolis Hypervisor and the REST API’s to provide completely end to end automated deployment of production and dev/test environment refreshes from production for Oracle EBS and Oracle RAC. A single completely integrated end to end application environment can be provisioned within minutes, with all applications, packages and supporting monitoring systems and identities updated. Nintendo really put the Xtreme into the Nutanix Xtreme Computing Platform. What’s more, due to the intelligence in the Nutanix platform that I like to call Data Avoidance, creating multiple test environments does not consume any additional storage space. Before Nutanix creating a single refreshed copy of a production environment would take in the order of 10 days and consume many TB of storage.

In addition to Kellogg, Nintendo and many others I also had the pleasure of talking to the team from Empire Life. They migrated from Mainframe to Nutanix and have improved their performance and manageability greatly as a result. Cost savings of up to 65%, 16:1 reduction in rack footprint in their datacenters. Kellogg migrated off HPUX to Nutanix and Nintendo migrated from IBM pSeries to Nutanix. All of these environments are running mission critical systems for these customers. Regardless if your migrating from traditional Unix or Mainframe, or from physical Linux or windows, or from an existing virtual platform, Nutanix is solutions that can help you do it successfully. It is a well proven path running business critical applications on Nutanix, as our existing customers have shown.

Before you watch the keynote announcements there is one more powerful customer story that a customer shared during the opening of the conference. The customer was Corporate Services Corp. They are running Virtual Desktops, Unified Comms and soon Oracle on Nutanix platforms. During the sales process while our SVP’s of Sales and Product Management were in Philly the customer had a critical outage on their existing SAN and Compute platforms. Within 65 hours of the call being placed to Nutanix regarding the SAN problem they had the necessary equipment delivered and their systems migrated to the new Nutanix platform and off the SAN. Next time you’re thinking about what a migration project from one SAN to another looks like, or implementing three tier architecture, just think about this story.

Then of course there is things like this tweet below and other examples such as a national US retail giant upgrading 11 clusters, 142 hosts running more than 3000 VM’s during weekday lunch time. This is now common place with Nutanix customers.

Found @idiomatically upgrading his Nutanix cluster located in Brisbane Australia from the hotel lobby in Miami USA pic.twitter.com/9yvc6rg7Bt

— Cameron Stockwell (@ccstockwell) June 12, 2015

Here is the video of the keynote announcements from the .Next Conference. For more videos be sure to check out the Nutanix You Tube Channel.

https://www.youtube.com/watch?v=xgMNntngDeA

Final Word

This article mainly reflected on the aspects of the Nutanix .Next conference related to business critical applications as this is the area that my team and I are directly involved with. But of course everything from VDI, NFV, Unified Comms and more is run on Nutanix. Nutanix is providing invisible infrastructure so customers have choice, and so customers can spend more time delivering business value, more time with their families, rather than managing infrastructure. For all of the customers and partners that attended the first .Next I hope you enjoyed it. I look forward to seeing even more people next year at the Wynn in Vegas. That’s a wrap!

—

This post first appeared on the Long White Virtual Clouds blog at longwhiteclouds.com. By Michael Webster +. Copyright © 2012 – 2015 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

vSphere 6 includes a new certificate authority that issues certificates for all of the different components within your environment to ensure communications are secure. If you want to use VMCA as a Subordinate CA from an Enterprise CA in your environment you need to change the VMCA Root Certificate on the Platform Services Controller (PSC) prior to installing vCenter or adding any new components to the environment. This article covers the steps in brief assuming you have a Windows based PSC and a Windows Enterprise CA (based on Windows 2012 R2).

The following assumes you are executing these commands from a Windows Platform Services Controller with vSphere 6.0. Note: Anywhere you see a single dash on this page it should be two dashes without a space – -. You may get errors if you just copy the text from this page.

Back up and edit “C:\Program Files\VMware\vCenter Server\vmcad\certool.cfg”, the default looks like this:

Country = US
Name= Acme
Organization = AcmeOrg
OrgUnit = AcmeOrg Engineering
State = California
Locality = Palo Alto
IPAddress = 127.0.0.1
Email = email@acme.com
Hostname = server.acme.com

“C:\Program Files\VMware\vCenter Server\vmcad\certool” –initcsr –privkey=privatekey.pem –pubkey=publickey.pem –csrfile=myrequest.csr

Submit the request to your CA, if you’re using a Windows CA (for example 2012 R2), you may be able to use the web interface or the command line tools. Ensure the certificate request is submitted as a Subordinate Certificate Authority request. For the web certificate submission use http://<YourCA>/CertSrv.  In most enterprise environments you would likely send the request to your security team or the team that manages the PKI environment.

When your request is approved download the certificate and certificate chain in base 64 encoded format. Download the Root CA Cert also in base 64 encoded format.

Now we have to create the combined VMCA and Root CA certificate chain file in pem format. To do this we copy the VMCA certificate and then the Root CA certificate to a new file.

For example:

type vmcacert.crt >> vmcaroot.pem
type rootcacert.crt >>vmcaroot.pem

This creates the combined pem file with both the VMCA Certificate and the Root CA certificate.

Your should now stop all services and start only those services to do with certificate management:

“C:\Program Files\VMware\vCenter Server\bin\service-control” –stop –all
“C:\Program Files\VMware\vCenter Server\bin\service-control” –start VMWareAfdService
“C:\Program Files\VMware\vCenter Server\bin\service-control” –start VMWareDirectoryService
“C:\Program Files\VMware\vCenter Server\bin\service-control” –start VMWareCertificateService

Now you add the new root VMCA certificate to the Platform Services Controller.

“C:\Program Files\VMware\vCenter Server\vmcad\certool” –rootca –cert=vmcaroot.pem –privkey=privatekey.pem

If you’ve done everything right you should get a message saying Status: Success

Now you can start all of the services again.

“C:\Program Files\VMware\vCenter Server\bin\service-control” –start –all

Note: For those wondering, yes the W in the service names is capital. Whoever wrote these service names didn’t talk to the marketing department about the capatalisation standards.

To verify the new root cert has been applied correctly run the following command:

“C:\Program Files\VMware\vCenter Server\vmcad\certool” –getrootca

If you want to remove the original root certificate then you will have to refresh the Security Token Service (STS) Root Certificate, and replace the VMware Directory Service Certificate.

Final Word

Now your VMCA as part of your PSC will issue certificates with the correct certificate chain and be trusted by any members of your domain. The communications between the components in your VMware vSphere 6 environment will be secure, and you shouldn’t get those annoying warning messages popping up.

—

This post first appeared on the Long White Virtual Clouds blog at longwhiteclouds.com. By Michael Webster +. Copyright © 2012 – 2015 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

VMware has announced that it will turn off TPS in upcoming version of it’s hypervisor ESXi and vCloud Air hybrid cloud service. This is due to a security bug, considered a very rare possibility and only exploitable in very controlled and largely misconfigured environments.  TPS also known as Transparent Page Sharing is a memory management technique that allows multiple VM’s to share a read only copy of the same memory page. When a VM needs to update or write to a page a new copy is created. The idea is that if there are many VM’s with similar memory pages on the same physical host server it will de-duplicate the pages and only store one copy. The result is that you can run more VM’s per physical server while still achieving very good performance.

TPS has for a long time been used as a competitive advantage by VMware over all of the other hypervisors. But realistically it hasn’t been in wide use by most customers for some time (since ESX 3.5) as the amount of RAM per host has increased, because of the use of large memory pages (2MB instead of 4KB) in Nehalem and above processors, and because most customers don’t want to run their systems at 100% utilization so that they can handle bursts of activity. When using large pages TPS only kicked in when systems were over 96% memory utilization, at which point large pages would be broken down into small pages that could be shared. However this has been a popular technique with service providers and with virtual desktop environments, and in some test and development environments, where over commitment of memory may have been acceptable.

The security problem was found by recent research that leverages Transparent Page Sharing (TPS) to gain unauthorized access to data under certain highly controlled conditions. The research demonstrated that by forcing a flush and reload of cache memory, it is possible to measure memory timings to try and determine an AES encryption key in use on another virtual machine running on the same physical processor of the host server, if Transparent Page Sharing is enabled. This is effectively a VM escape, where code executed within one VM can break the hypervisor isolation and read data from another VM’s memory. Certainly not a good situation if said VM contains credit card data, as we’ve already had enough breaches recently. The conditions under which this could be exploited would be rare in the real world, especially as most environments don’t use TPS actively, even if it is enabled. Even so, I believe in being secure by default, and even though the number of conditions that have to simultaneous by true for this to be exploited would be very rare, if this were exploited the impact could be high. So I believe that VMware is taking the right approach to this research by disabling TPS.

I have been a proponent for leaving TPS enabled in the past, even though a few others have previously recommended it be disabled for performance reasons. My argument was that TPS is a good safety net if all else fails, even if during normal operations it is not used. Also performance was never proven to be a factor. I put this argument in my article Blueprint for Successful Large Scale Oracle Virtualization on vSphere when an EMC paper recommended disabling TPS. To quote that article “Disabling TPS can have disastrous consequences, including causing additional host swapping, which can result in extremely poor performance, much worse than disabling it could ever possibly gain.” So this begs the question, now that it’s being disable by VMware what impact will it have?

Without TPS you will have to have much more conservative memory usage per host. If you business requirements dictate, you will have to be able to sustain maintenance and failure without causing memory overcommitment. If there is a failure or maintenance that causes temporary or prolonged overcommitment of memory you will have a lot more guest OS swapping, due to ballooning, and also host swapping may occur, which would greatly impact performance. Memory swapping is the enemy of performance, and this also adds significantly to poor performance on shared storage if it occurs. But this is possibly better than the alternative security bug.

If you have an existing VMware vSphere environment this will mean you need to evaluate the level of resource usage you have today, your standard operating procedures for maintenance, and the settings of VMware HA Admission Control for failure. If you don’t have sufficient available memory to operate your environment in the case of failure or maintenance, then you may need to upgrade the amount of RAM per host or purchase additional hosts. With any additional hosts you’d need additional licenses. Frank Denneman has a good take on the capacity planning implications in his article here.

TPS will be disabled by default from the following VMware vSphere Releases:

• ESXi 5.5 Update release – Q1 2015
• ESXi 5.1 Update release – Q4 2014
• ESXi 5.0 Update release – Q1 2015
• The next major version of ESXi

VMware’s official statement on this problem is contained within KB 2080735 Security considerations and disallowing inter-Virtual Machine Transparent Page Sharing. This KB also contains the steps to disable TPS on older versions of VMware vSphere that will not be covered by patches.

If you want to check whether you have TPS enabled or not on your existing versions, and if you want to disable it you can use the following PowerCLI examples (explicitly provided without any warranty, use at your own risk):

Check if TPS is Enabled on all hosts connected to a vCenter Server, Mem.ShareScanGHz returns > 0 if enabled.

Connect-VIServer <YourvCenter>
Get-VMHost –State Connected | Get-AdvancedSetting –Name Mem.ShareScanGHz | Format-Table –Property Entity,Name,Value -AutoSize
Disconnect-VIServer

Disable TPS on all hosts connected to a vCenter Server by setting Mem.ShareScanGHz = 0, check the setting has been applied correctly

Connect-VIServer <YourvCenter>
Get-VMHost –State Connected | Get-AdvancedSetting –Name Mem.ShareScanGHz | Set-AdvancedSetting –Value 0
Get-VMHost –State Connected | Get-AdvancedSetting –Name Mem.ShareScanGHz | Format-Table –Property Entity,Name,Value -AutoSize
Disconnect-VIServer

So if TPS is vulnerable to data leakage and VM escape attacks what about the recently announced Project Fargo, AKA VMFork? VMFork allows a running VM to be quiesced and rapidly cloned by using a similar copy on write technique to share a read only copy of the parent VM memory, and sharing the parent VM’s read only disk, with updates being written to a delta disk. This allows a VM to be cloned and get up and running on the network with it’s own personality in a matter of a few seconds, with the VM memory and disk effectively being deduped at the same time. This doesn’t just have applicability to VDI environments, but web server environments, Dev and Test environments and many other use cases. I’m sure VMware won’t let VMFork out in the wild until issues such as the VM escape bug with TPS are addressed. Kit Colbert, VMware CTO for End User Computing, has said to me that VMFork is much more secure than TPS, so it may not suffer from the same problems.

VMware is not alone with a VM escape vulnerability being discovered. There was also a security bug made public regarding the Xen hypervisor that allowed a VMescape, where code executed within one VM could escape the encapsulation of the hypervisor to a neighbour VM or dom0. This is covered at the VUPEN Vulnerability Research Team’s blog site.

Final Word

Nothing is fully secure. You can never guarantee that your system isn’t vulnerable to attack. All you can do is take appropriate measures to reduce the risk of attack, implement technical controls and monitoring and auditing processes. Implement separation of duties, least privilege access, and role based access controls. Implement the guidelines that make sense based on your business requirements from the VMware and other vendors hardening guides. Comply with the security standards for your industry / company that make sense. Stay on top of critical security patches and implement them as soon as practicable, especially for any environments containing public facing or highly secure systems.

—

This post first appeared on the Long White Virtual Clouds blog at longwhiteclouds.com. By Michael Webster +. Copyright © 2012 – 2014 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

If you thought Ebola was deadly to humans wait till you get a load of the latest security issue impacting the world wide web and most everything connected to it including potentially your phone, lights, servers and the list goes on (excluding Windows systems). If Heart Bleed wasn’t bad enough at the start of the year the new Shell Shock bug certainly is. It is what I would term the Mother of All Bugs (MOAB). It impacts almost all Unix, Linux and Mac systems and allows a remote attacker to execute arbitrary code and potentially steal your data, credit cards and other information. So how serious is this? Well the NIST CVE Alert Rating on this is a 10 for severity, and a low for complexity to exploit (read my 7yr old could exploit this bug). So basically the worst possible kind. Oh, but wait, there’s more…

According to this article, there are already worms exploiting this bug. So the impact could be wide spread for the vulnerable systems. I would expect most major vendors to come out with security advisories very promptly for this, after they have assessed their systems. For those of you running VMware, they have posted a blog here, and an advisory here. As things stand if you’re running VMware tools on top of Windows, such as vCenter for example, then you are not vulnerable. Also ESXi is not vulnerable as it uses ash shell via BusyBox instead of Bash. However any virtual appliances may well be vulnerable, including the vCenter Server Appliance. I would recommend keeping and eye on VMware KB 2090740 for the latest updates. For home users, lock up your networks tight and try to prevent anyone getting in the virtual front door, until such time as there are widely available fixes.

This bug highlights the importance of keeping patches up to date and staying across the alerts from the likes of NIST. Be aware of this bug and get patched and protected as soon as you can. Not everyone has a vaccine for this one yet, but hopefully it’s not far away. This bug could cause a lot of change to the way systems are designed, implemented and secured. What’s to say another bug of this nature isn’t just around the corner? Better to be prepared.

Final Word

This is probably one of the highest impact and most wide spread bugs with the highest severity that I’ve seen in over 20 years in IT (reminds me of the original internet worm). As the Internet of Things (IOT) spreads bugs of a similar nature will have a much wider impact and much more sever consequences. Security of your systems is going to become an ever more serious issue and this is why Micro Segmentation, and using technologies such as VMware NSX and vCloud Networking and Security will become so important. In addition to more intelligent firewalls, such as from Palo Alto Networks. As much as we give Microsoft a hard time over security and patches, neither Heart Bleed and Shell Shock impacted Windows systems.

—

This post first appeared on the Long White Virtual Clouds blog at longwhiteclouds.com. By Michael Webster +. Copyright © 2012 – 2014 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

Another year has flown by, and what a year it was, and now we’re in a new year and I’m a year older and hopefully a little wiser, we never learn less. The great thing about being in the IT industry and especially being involved with Virtualization, Cloud and Software Defined Datacenters, there is always so a lot to learn and things are changing at an ever faster pace. All the time the economics and customers benefits are rapidly increasing all the time. I mean we don’t just do things because they are cool and technically interesting, there has to be an ROI for our customers, partners and customers organizations. It was great for me to personally be involved in revolutionizing many customers economics of delivering IT infrastructure and applications services throughout 2013, especially with the many Unix to VMware migration projects I was involved with. So this article will reflect on some of the highlights of 2013.

Firstly and most importantly I would like to thank all of you for taking the time to visit my blog and being part of the discussion, longwhiteclouds.com was viewed over 310,000 times during 2013. This is a big jump on the 2012 numbers. You can see the full 2013 report and number crunching thanks to jetpack in my Long White Virtual Clouds 2013 Year In Blogging Annual Report. It’s your feedback and being able to make a valuable contribution to the VMware and virtualization / cloud community that keeps me going. Here is a photo of the Long White Cloud (although a physical one) taken from the top of my street.

A very big thank you to my sponsors for supporting me and enabling me to bring you this content. Some sponsors have come and gone but Unitrends in particular has stuck with me pretty much all year. I want to thank them for their contribution to the VMware and virtualization community. I would also like to thank Cloud Physics for their ongoing support of the VMware community and for sponsoring this blog. Other sponsors throughout the year, which I also thank for their contributions are Nutanix (you’ll be reading a lot more about them this year), and Veeam. There are many other organisations that sponsor peer blogs in the virtualization and cloud community and I’d like to thank them for supporting the community that has been built up. Even though there were only 310K views on longwhiteclouds.com my sponsors received close to 500K impressions.

2013 Year in Review – Highlights

There were a number of highlights throughout the year but here are some that I think were the most memorable.

In early 2013 longwhiteclouds.com was voted by you into the list of Top Virtualization Blogs on vSphere-Land.com. It’s first entry into the list was in the top 25 (#21) out of 243 blogs that you voted from. Thank you so much for your support and I hope to do better next time around. Eric Siebert of vSphere-Land.com has recently released a history of the top blog voting over the years, it’s worth a read.

I was fortunate during 2013 to attend a number of conference events around the world including VMware PEX, HP Discover, VMworld, and vForum’s. At VMware’s Partner Exchange (PEX) I was involved in presenting bootcamps on virtualizing Business Critical Application, and also on the VCDX panels, which I qualified as a panelist for VCDX-DCV. I was very fortunate to be invited to attend HP Discover, which I wrote about in my articles Discovering HP Technology in Las Vegas and HP Discover 2013 Las Vegas Wrap Up. It was a great event and I and the other bloggers enjoyed it very much.

VMworld US was very special this year being the 10th annual event, it was also where we definitely bought back the Monster VM’s and Business Critical Apps in a big way and in the context of a Software Defined Datacenter.  You can see a recording of the VMworld Monster VM Design Panel VAPP4679, which was voted in the top 10 sessions of VMworld. Definitely a great highlight of 2013 to get one of my sessions into the top 10 at VMworld. Big thanks to my co-presenters (also VCDX) who made it happen – Frank Denneman, Andrew Mitchell, Mostafa Khalil and Mark Achtemichuk. This theme of Monster VM’s continued at VMworld in Barcelona and the vForums, where I was joined there by Melvin the Monster VM.

Above are a selection of some of the photos from this years VMworld and vForum events. From left to right. 1. Nutanix VCDX Cluster (we’ll be growing the size of this cluster shortly). 2. Melvin Monster VM with GeekFest DJ. 3. Melvin Monster VM Twins with John Troyer interview. 4. Melvin Monster VM running on a Nutanix block with Bas Raayman. 5. Melvin Monster VM with Cormac Hogan, Ken Werneburg and I. 6. Melvin Monster VM with Martin Casado and Paul Strong.

2013 was the year that Apps loved VMware even more, even low latency apps, business critical apps on VMware exploded with even more monstrous VM’s, and HPC. This was largely because of the release of vSphere 5.5. vSphere 5.5 has been an incredibly solid release and a great platform for all types of business critical apps. Amongst the highlights of vSphere 5.5 we see Record Breaking Network Performance, Microsoft Failover Clustering Enhancements and Jumbo VMDK’s.

During the past year Unix to VMware migrations have become much more common and in 2014 this momentum is likely to continue and gain even more pace. It’s no surprise that Unix system revenues continue to decline by double digit percentages. The economics of migrating Unix applications to VMware and Hyperconverged platforms such as the Nutanix Virtual Computing Platform make total sense. The Intel / x86 platforms have matured to the point where you do not have to compromise on availability, performance or service levels for the most demanding applications.

I continued my campaign of Fighting the FUD around Oracle Support and Licensing in a vSphere environment. I wrote a number of articles that can be found on my Oracle Page. This is a resource for you if you want to know anything about virtualizing Oracle Databases on vSphere. The articles include some very good stories from the field from both customers and partners. It definitely makes for interesting reading.

Late in 2012 based on frustation with the complexity and effort involved in improving security in vSphere environments with SSL Certificates I kicked off a project with VSS Labs, a VMware partner based in Singapore, to provide a solution. The goal, which the solution achieved, was to provide better vSphere platform security for the masses at an affordable price. This involved a complete SSL Certificate lifecycle and compliance tool, which turned into vCert Manager. vCert Manager went GA during 2013 and VSS Labs had a booth at VMworld. The solution provides a simple and automated way of keeping all the SSL certificates in a VMware environment up to date, including integration directly with the Certificate Authorities, as well as reporting on ongoing compliance. It also understands VMware concepts such as Lockdown Mode, Maintenance Mode and Auto Deploy. The demo VSS Labs showed at VMworld is included in my article VMworld USA 2013 by the Numbers.

VMware and SAP were shaking up enterprise apps during 2013 with their announcements around not only running SAP ERP applications in VMware clouds (public/private/hybrid), but also running HANA in VMware clouds, and putting ERP and HANA software on the VMware price book in a pay as you grow by the month subscription licensing model. The subscription based licensing model along really changes the game for enterprise software and especially for it’s consumption in cloud environments. Although these announcements were made in 2013 not all of the component pieces are yet in place. But when everything is delivered it will be one heck of a powerful combination. Throughout 2014 you’ll also see how SAP can be levered in Hyperconverged environments, including on the Nutanix Virtual Computing Platform. So watch this space.

At VMworld USA 2013 we saw Cloud morphed into SDDC. After a few years of experimentation with Cloud VMware decided that it’s for service providers and for enterprises what is actually needed is a Software Defined Datacenter, and all the declarative, automated, policy driven goodness that goes with it, while allowing for hybrid cloud models at the same time. This was the inspiration for my article titled vCloud Director is Dead, Long Live vCloud Director. There are still a lot of use cases for vCloud Director and at the moment vCloud Director is a great way of enabling components of the Software Defined Datacenter vision, while the other components are bedded down a bit more and become more mature. VMware’s NSX, which was a real highlight of VMworld will also play a big part in the SDDC vision of the future. Abstract, Pool, Automate all with service and policy defined up front and easily consumable.

Converged become Hyperconverged, even for business critical apps. Over the last few years there has been a lot of talk about converged infrastructure. Some vendors did a better job of it than others. Some completely missed the boat all together and instead of converged just delivered pre-assembled. It’s not the same thing. Even so, throughout 2013 Hyperconverged technologies, such as the Nutanix Virtual Computing Platform, which combine compute and storage into a single and simple solution, really started to accelerate. There are other solutions in the Hyperconverged category but Nutanix is clearly the leader in this space. Next year this market will go supersonic. Primarily driven not by just convergence of different components, but by the sheer radical simplicity of deploying, managing and scaling the platforms.

Instead of a hodge-podge of pre-certified and pre-assembled components, you get one beautifully elegant, completely integrated solution in a single small package, which is still flexible and capable. This is not only going to go supersonic next year (more so than it did this year), it’s going to swallow business critical apps, including Unix systems. It’s not however going to replace all of the scale up platforms, as they will still be needed for a percentage of workloads, but anything that can work on a scale out platform virtualized computing platform (majority of systems) will be fair game. The units of scale will also keep increasing.

If you don’t believe me here’s proof. Melvin Monster VM running on a Nutanix 3450 block in my lab :).

With all these trends and opportunities it’s no wonder that I joined Nutanix as an employee in late November 2013. The opportunities around virtualizing business critical apps and Unix to VMware migrations on the Nutanix Virtual Computing Platform are monstrous. You’ll see a lot more discussion on the architectural considerations as we move into 2014 and I begin to publish reference architectures and white papers on it. Till then you can review my Nutanix articles here and here.

Late in 2013 I had the pleasure of being invited to join other industry experts, such as futurist Paul Saffo and one of VMware’s CTO’s,  in a Google Plus Hangout on the Future of IT. If you didn’t catch the event you can watch the recording on YouTube. Check out my article on this here. This looks at a lot further out than just 2014. But I think you’ll agree there is some interesting things on the horizon.

There are still some unanswered questions about 2013, such as, was it the year of the desktop? Was 2013 the year of flash storage? Well the jury is still out on that. But if 2013 wasn’t either of those things you can be sure that 2014 has a good chance of being both. I would predict both will become pervasive in 2014. End User Computing and Mobility and Flash Storage. Brining flash closer to applications, through Hyperconvergence (i.e. Nutanix) most likely, or through other means. Both support each other, and both are dependant on each other for economies of scale. Again, watch this space.

Final Word 

Last but my no means least I have to look back over 2013 and be thankful that I have a wonderful wife and family that support everything I do. If it wasn’t for their support I would not be able to continue this blog or contribute to the community at large. They put up with my late nights and with my travel schedule. Speaking of which I was only in my home country of New Zealand for 10 weeks during 2013. 2014 will be much more balanced. You know the saying happy wife, happy life, well it’s true. Here is a photo taken shortly after my return from VMworld Barcelona. Thanks to Shiv Diddee, one of VMware’s Super TAM’s from the UAE for the Dubai T-Shirts they made me very popular and we’re getting good use out of them. From left to right, Sebastian (6), Bradley (3), Susanne, Benjamin (1). We’re expecting our 4th boy in April 2014.

—

This post appeared on the Long White Virtual Clouds blog at longwhiteclouds.com, by Michael Webster +. Copyright © 2014 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

If you’re upgrading from vSphere 5.1 to vSphere 5.5 and you ARE NOT using Custom CA SSL Certificates then you might run into an error. The error will be encountered during the upgrade of SSO, and specifically the Lookup Service, and only occurs in specific conditions, such as when using the default VMware Self-Signed Certificates. If you run into this problem your upgrade process will roll back, but leave behind some upgrade files that need to be cleaned up. This article will briefly touch on the recommended solution to this problem.

Many of you will recall the many articles that I wrote regarding updating the default self-signed SSL Certificates in vSphere 5.0 and 5.1 to Custom CA Certificates. If you haven’t seen these articles and you’re interested in SSL Security you can check out Updating CA SSL Certificates in vSphere 5.1 and Updating CA SSL Certificates in vSphere 5. To make the process of updating certificates easier VMware created the VMware Certificate Automation Tool and VMware Partner VSS Labs created vCert Manager.  If you’re using CA Signed Certificates for your SSL communications between the various vCenter components then you won’t strike the problem I described above. So now might be a good time to review my previous articles and/or use one of the automation solutions that are available.

This issue during the upgrade from vCenter 5.1 to vCenter 5.5 is described in the VMware KB Article – Upgrade from vSphere 5.1 to vSphere 5.5 rolls back after importing Lookup Service data (2060511). You will likely see an error such as “Warning 25000. Please verify that the SSL certificate for your vCenter Single Sign-On 5.1 SSL is not expired. If it did expire, please replace it with a valid certificate before upgrading to vCenter Single Sign-On 5.5.” or the vCenter Upgrade will simply fail and roll back. In the vim-sso-msi.log you will see an error message like the following:

“Action 10:06:03: PostInstallScripts. Importing Lookupservice data…
CustomAction DoUpdateAndMigrateTasks returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)”

As described in the VMware KB this issue does not affect you if:

• You are using custom certificates (recommended)
• You are using the vCenter Server Virtual Appliance (only applies to the Windows version of vCenter Server)
• You are performing a fresh install of vCenter Server 5.5
• You are upgrading from:
  • vCenter Server 5.0
  • vCenter Server 4.x
  • a fresh install of vCenter Server 5.1 Update 1a or later

For the recommended fix please refer to the VMware KB – Upgrade from vSphere 5.1 to vSphere 5.5 rolls back after importing Lookup Service data (2060511). The fix will require modifying the Windows Registry. Before any upgrade of vCenter is attempted it is recommended that you take a backup and potentially have a snapshot in place for the vCenter Database and the vCenter Server system itself so you have a point you can roll back to. This should be standard practice in most VMware environments, as should testing the upgrade process, as should upgrading test environments and management environments before upgrading production. Given that this impacts environments that have self-signed certificates it has the potential to impact a large number of customers, however as it only impacts customers upgrading from vCenter 5.1 prior to version Update 1a to vCenter 5.5, the number of impacted customers is reduced.

Final Word

The easiest way to get around this problem if you’re using vCenter 5.1 would be to either run through the registry fix described in the KB article. Upgrading to vCenter 5.1 U1b will not correct the issue as it doesn’t correct the certificate. You may also choose to completely rebuild your vCenter with a fresh install of vCenter 5.5 against your existing database. Alternatively you may choose to update your vCenter Server to use CA Signed Certificates, which will also improve the security of your critical management infrastructure. Regardless of the option you choose make sure you have a backup of the vCenter Database and vCenter so you can roll back if needed.

—

This post first appeared on the Long White Virtual Clouds blog at longwhiteclouds.com, by Michael Webster +. Copyright © 2013 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

VSS Labs will be showcasing its latest offerings at the New Innovator Pavilion at Booth 2035 at VMworld USA 2013. The two offerings include it’s globally successful and VMware exclusive Cloud Migration Portal and it’s new SSL Certificate lifecycle management product vCert Manager. Lets have a look at what these two products are all about to give you a glimpse of what you might find out at their booth at VMworld USA.

Cloud Migration Portal Takes The Manual Out of Migrating To The Cloud

Automated migration of workloads from physical to virtual, virtual to virtual and now a new prototype that shows the automated migration from Amazon’s AWS to VMware’s vCHS.  VSS Labs will be showing an early prototype of a solution to fully automate migration of workloads from Amazon’s AWS (Amazon Web Services) to VMware’s new vCHS offering – VMware vCloud Hybrid Services. This prototype is expected to be fully integrated into the VSS Labs Cloud Migration Portal (CMP) by Q4, 2013. CMP is a fully automated solution that manages and automates large scale any to VMware vSphere environment migration projects. It has deep integration with the VMware stack and cuts down migration times by a factor of 5x or more. VMware has exclusively licensed CMP from VSS Labs for use at no charge by its partners, clients and internal professional services organizations and has used this with great success in a number of migration projects now. This latest addition will no doubt create huge value for the burgeoning interest in vCHS.

VSS Labs Brings You The Big Red Easy Button for VMware SSL Certificate Lifecycle Management

VSS Labs have just announced the GA release of vCert Manager, their fully automated lifecycle management solution for managing SSL certificates in a VMware environment. This is the culmination of almost a full years development, testing and feedback in a collaborative way with many of the worlds largest organisations and the VMware community.

Security and compliance requirements now force VMware’s large customers including the largest banks to implement trusted SSL Certificates and they can’t use the default self-signed certs that ship with off the shelf products any longer. Moreover, all US government organizations will be required to have certificates of greater than 2048 bit strength by the end of 2013. vCert Manager provides an automated solution to these issues and can scale from handling small environments to those containing dozens of vCenters and thousands of hosts.

The GA release of vCert Manager follows an extensive beta program that VSS Labs ran with a number of large enterprises and incorporates several features and enhancements that resulted from feedback from this program. vCert Manager 1.0 includes the ability to update and manage SSL certificates for vCenter Server (including multi-located SSO and other vCenter components), ESX/ESXi host certificate, with the ability to automatically change revoked certificates, do bulk certificate import, export of certificate signing requests, early warning and replacement of expired certificates and a number of other features. Derek Seaman covered the vCert Manager capabilities well in his article VMware SSL Pain? vCert Manager to the Rescue.

One of the best things about vCert Manager is that VSS Labs will be providing a FREE limited edition for home lab use. If you want to use vCert Manager in a home lab you’ll be able to get a license to use it on up to 1 vCenter and 5 hosts. If you’re a VMware vExpert there is a special edition license for you that will allow you to use vCert Manaer on up to 2 vCenters and 10 hosts. This is a great way for VSS Labs to show its support for the VMware Community that was so instrumental in the development of the vCert Manager solution.

Where can I get it!? 

To learn more about both these offerings or to request for an evaluation version, go to www.vsslabs.com, or contact Luisa Juaton deGuzman using the form at the bottom of this post.

Final Word

To make large scale cloud migration and secure management of the environments afterward possible you need great automation tools. VSS Labs and VMware bring you such levels of automation. It’s great to see the two companies working together in partnership to deliver such great value to customers. If you are going to VMworld USA I would strongly encourage you to check out the new Innovator Pavilion at Booth 2035 and stop by the VSS Labs area to get a full demo of both of these products. Remember if you want to request an evaluation or find out more about the products above from VSS Labs you can use the contact form below. Don’t forget to check out Derek Seaman article on vCert Manager – VMware SSL Pain? vCert Manager to the Rescue.

—

This post first appeared on the Long White Virtual Clouds blog at longwhiteclouds.com, by Michael Webster +. Copyright © 2013 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

This week I’m brining you this article from my hotel in Shanghai, I’m in China to present Unix to VMware Migration workshops. Last week I made the treck to Las Vegas like around another 12,000 people for the annual HP Discover US Event (June 11th – 13th).  This was my first time to HP Discover and I was very grateful to HP and Ivy Worldwide for making this opportunity possible. HP Discover is not like any other IT event that I’ve been to and HP certainly know how to put on a magnificent show. Almost all of the Sands Expo Center at the Venetian was taken up by the exhibition stands of different HP divisions with the remainder for Sponsors. In terms of number of attendees it’s around half the size of VMworld, but lacks nothing in terms of spectacle. The big themes of the event were aimed around creating a better enterprise and HP’s slogan for the event was “Build a Better Enterprise Together”. So the big themes in the order of my interest were Big Data, Software Defined Networking, Software Defined Storage, Converged Infrastructure and Moonshot. I will briefly cover what I consider the highlights in this article.

Just to give you an appreciation for the size of this event here is a photo that shows a fraction of the show floor at the Sands Expo Center at the Venetian Las Vegas:

Day 1 Event Opening Keynote

Kevin Bacon opened up the event by describing the concept of the 6 degrees of separation and the 6 degrees of Kevin Bacon, which was an internet sensation for some time. He quickly then explained the explosive growth of data (Big Data) and how the world is creating more data every day than was created prior to 2003. My first thought was it must be good to be in the storage business. Here is a photo of Kevin on Stage with some of the data statistics. With the explosive growth of social networking it’s more like 4.7 degrees of separation according to Bacon’s presentation.

Meg Whitman, HP CEO, then took the stage and continued to explain the significance of Big Data and HP’s overall strategies, including sharing a compelling case study from NASCAR. NASCAR are using HP Big Data, Software and Hardware solutions to make NASCAR and even more intense experience and to monitor and adapt their business in real time. Brining the fans closer to the action and taking in feeds from video, voice and social media. Meg also spoke about the transition from the Mainframe world to the client server world and now how the world is changing again in another revolutionary step to a mobile, social and real time business environment. I know from first hand experience how the new paradigm is taking shape. Traditional Mainframe and Unix platforms are being aggressively migrated to industry standard servers running VMware vSphere and applications are being rewritten to adapt to the cloud and mobile era. HP’s argument is that this new era requires a revolution in server infrastructure and this is where their Moonshot Servers come in.

Moonshot servers are ultra compact and need less power than that of a 60w light bulb. HP.com, which receives more than 3million visitors per day is running on 12 Moonshot servers consuming approximately 720W of power. HP believes this will save the Internet due to estimations 10million servers are required in the next few years, data is doubling every six months, and every million servers not only requires a huge investment in datacenters but also requires an entirely new power plant to be built. The Moonshot servers not only consume less power, but they also cost a lot less and consume significantly less space. In the day 2 keynote we heard that currently you can get 450 Moonshot servers per rack, which is set to increase to 1800 servers per rack in the future. The Moonshot servers run one of three different CPU options, ARM, low powered Intel or Nvidia GPU. Future versions will also be suitable for virtualization, which will open up a all new possibilities for hosting and cloud environments to scale dynamically. By my estimations you can already get approx 3072 Virtual Machines with 2 vCPU and 8GB RAM per rack, if not more, if you’re running VMware vSphere on blade infrastructure. So some more number crunching will be required on Moonshot.

So taking a lot of power requirements out of the servers is great, but my overriding question is what about the storage that is needed to power these monster clusters and the huge amount of data growth. Storage has traditionally consumed a low of space and power. The storage side of the equation wasn’t covered during the keynote presentation, and this shouldn’t detract from the overall achievements of the Moonshot platform for the niche applications that it can be used for currently. One thing is for sure the advances in flash based storage will greatly help with power consumption and performance per watt, more on HP Storage later.

HP’s message during the keynote really showed they are trying to be all things to all people (mission impossible?). They seem to be trying to beat the likes of IBM, and to a certain extent Oracle, at their own game. They want to partner with their customers to build a better enterprise together, which is the right approach in my opinion and a good goal. Some of the products and solutions presented come across as little ‘me too’ without real innovation. Only time will tell if they can actually pull off the aim of being the best company to provide a solution to every problem, execution will be key. There is still duplication and lack of integration between solutions and offerings that will need to be sorted out.

Here are a couple of the key images from Meg Whitman’s keynote presentation:

Day 2 Keynote

The day 2 keynote was all about the technology. HP showcased Servers, Storage, Networking, Software and Services. What I found very interesting from the day 2 keynote was how little attention was paid to the traditional Unix systems. However all the attention is going towards what HP term Industry Standard Servers and even their Business Critical / Mission Critical x86, such as the DL980’s. I guess this is acknowledgment of a well established trend away from Unix platforms. One of the coolest products shown during this keynote from a server perspective was a very compact ROBO server termed ‘baby’s first datacenter in a box’. I think this could actually be a hit, I know my kids already have their first datacenters, but the real use case is for remote office / branch office where you don’t want to have a computer cupboard anymore. The small server was very compact and also very quiet. Moonshot and the roadmap of the platform and it’s results were interesting to see from a revolutionary server platform perspective as I mentioned also from the day 1 keynote. The Gen 8 Servers got a good showing and there were some impressive industry leading benchmarks published during the event such as the VMMark results where HP Gen 8 servers took the lead powered by Fusion-io.

I missed the morning Storage Press Conference due to a conflicting appointment but there was plenty of storage as part of the day 2 keynote. The key storage platform announcements from my perspective were the all flash 3Par array, the 7450, and what HP is doing in the software defined storage space. Overall the strategy isn’t quite complete and the vision is good but some components aren’t quite there yet technically. But they will be before too long. The good thing about the 3Par 7450 is that it leverages the same 3Par architecture so can leverage the same management tools and software capabilities as the other arrays. It’s performance from the benchmarks discussed were pretty good – 554K IOPS at 4KB IO Size and 0.7ms latency for random read. This was from a fully populated system. This isn’t quite as fast as some competing storage systems, but you need to consider the platform includes all the other capabilities of 3Par including all the replication support etc. 3Par has good scalability in the platform, includes a lot of features as standard, but still lacks a few high end capabilities that some competitors bring to the table (more on this later). As a comparison I can get 187K random read IOPS at 0.5ms latency from a single VM connected into one of my vSphere hosts from a single Fusion-io ioDrive2 card, but of course this doesn’t have the features of a full 3Par array, such as replication etc. 3Par does seem to be gaining ground though with 1500 new customers and over $1billion in revenue in 2012. Plus they have the switch to 3Par guarantee (provided you’re not using thin provisioning or dedupe already) that you’ll get 2 x the VM density.

Next up came networking with HP claiming #2 position to Cisco and bigger than the next 5 network vendors combined in terms of revenue . Really the #1 or #2 spot would go to VMware if it were purely on number of ports (if you include physical and virtual ports), but the comparison was based on revenue. I’ve always liked the HP datacenter switches since I first used them more than 10 years ago. They’ve always been easy to manage, very feature rich, and lightning fast. This year they introduced a number of enhancements to flex fabric where a single 11900 switch could support 92 C-Class Servers. HP was also flexing the SDN muscle touting 40 OpenFlow switches and 20M installed ports. I was particularly interested in HP’s announcements around the 5900V virtual switch for VMware vSphere. I thought this would be a serious play against the Cisco Nexus 1000v. Unfortunately all it does is bypass the hypervisor networking stack and implement the VM networking on a physical switch. This not only adds latency to traffic that would otherwise pass between VM’s on the same host, it doesn’t allow the performance of in-hypervisor security modules, and it means you’re locked into the physical HP network hardware stack, which greatly reduces your flexibility. At least with the VMware Distributed Switch or the Cisco Nexus 1000v you can use any hardware switches you like, including HP’s.

HP covered their new converged and open Cloud offering based on OpenStack briefly.  But unfortunately they forgot to mention that it’s not even compatible with HP’s other Cloud service, which is offered by HP Enterprise Services, called the HP ES VPC. Compatibility between the two clouds is coming in the future apparently. In the meantime HP ES VPC Cloud runs on VMware vSphere and the new HP Converged Cloud runs on OpenStack. This seems similar to the IBM OpenStack Cloud that was announced recently and adds additional competition to the other offerings in the cloud market.

Big Data was big news at HP Discover and during the day 2 keynote we got to dig a little deeper into HP’s Big Data solution called HAVEn. HAVEn is an acronym that stands for Hadoop Autonomy Vertica Enterprise Security for n applications. It’s a platform that can integrate many different types and streams of data, both structured and unstructured, and analyse them in near real time. It was especially interesting to review the NASCAR case study again to see how they are using real time big data analytics from all sorts of different data feeds, including social networking, to make business decisions and improve their business. The HP Discover event itself was also using HAVEn to measure sentiment and influence and other factors around the event to gain insight into what was going on, which is a great demonstration of the platforms real world capabilities. I’ll show you a photo of the HAVEn implementation for HP Discover below.

The most interesting aspect for me was the way that Autonomy could take unstructured data and make sense of it, giving it context, while Vertica could analyse structured data at lightning speeds. But what sort of data? Well it’s not just limited to social networking and business data but also other relevant and important data. The HAVEn platform can take huge amount of data from different sources and correlate them all. The types of data HP described was machine data, such as sensors, logs and system metrics, business data such as from CRM systems, and human information such as voice feeds and video. Another real life example HP gave during the keynote is how the Venetian|Palazzo Casino Hotel used the HP HAVEn platform to monitor all the gaming systems, Casino gaming floor and identify possible issues in real time, including integration with all the camera systems etc. They gave a demonstration of how HAVEn could be used to solve a system performance issue, but to be honest this demo really missed the mark as it didn’t demonstrate HP’s unique capabilities. VMware vCenter Operations could have done the same thing and a lot more quickly for the use case HP presented. However if they had integrated the demo system with data from the call center voice recordings and online social networking to determine severity and trends before it became a major issue, and then solve the problem, it would have been much more relevant. Given recent media events it was hard to avoid comparing what HAVEn could do to what had come out about PRISM. No comment either way was forthcoming from HP, which is not surprising. The ability to scale your big data systems up and down and make testing them efficiently lends itself to good virtualization use cases. There is a lot of work going into optimizing VMware vSphere environments to run Hadoop and there is no reason why HAVEn couldn’t run just as well in a virtual environment, provided you design it properly and test and verify it to make sure it’s working to your requirements. It will be interesting to see how this technology develops in the future. But the electronic big brother is already watching you. So you can’t assume any privacy for any information you make available online. Just assume that anything you say or do on the Internet could be on the front page of the news or someone’s blog tomorrow.

Here are some of the key slides from the day 2 keynote:

Here is a photo of the HAVEn system that was monitoring HP Discover. You might notice that I made a bit of an impact on day 2. I was the major influencer for pretty much all of day 2.

Coffee Talks

One of the best parts of being invited to be a blogger at HP Discover was the coffee talks that were arranged so that we could meet all the key executives and subject matter experts for the different areas across HP. This allowed us to drill down on key points not covered during the keynotes. Below I’ll give you some very brief highlights from each of the coffee talks.

Big Data and HAVEn (Hadoop, Autonomy, Vertica, Enterprise Security for n applications)

Machine info, business info, human info, correlated and available in one place providing context and support for real time decision making. Examples include determining from voice calls caller sentiment (if they are likely to stop doing business with you) and whether they are lying, allows offers and decisions to be made in real time to prevent lost customers and improve customer experience. Take data from camera feeds to determine in real time if someone is cheating (Casino for example) or if there is a health concern or possible security event, such as a door opened at the wrong time of day. This technology could be described to be similar to a number of scientific discoveries. It has the potential to do immense good but also could be used and abused for the wrong reasons. It also gives hackers a high value target. If you hack the big data systems you potentially have access to every piece of important data all in one place and correlated between many sources. The security and privacy of the data is a great concern, and not just access to the raw data but also the search results across the data. We discussed how HAVEn could be used to make systems more secure by providing context based security such as location data, and detecting duress in someones voice. There is massive data growth being driven by machine data, such as seas of sensors and massive telemetry data, and human information, such as voice and video data.

Mobile Apps

The overall conclusion from the Mobile Apps coffee talk was that if you really want to take advantage of mobile and give a good user experience then you need to completely rewrite your apps and you can’t really leverage your existing investments. I don’t agree with this and I think you should be able to take a hybrid approach that gets even greater value out of your existing apps while making your business much easier and more responsive to your customers using a mobile and social online strategy. HP’s argument was that you mobilise transactions, you don’t mobilise applications.

HP gave an example of Mary K cosmetics where 20% of agents are joining the business because of how easy the mobile app is to use and the support across any device. Having the mobile app has massively boosted Mary K’s business. The App supported 240K contractors. This example was impressive and quite compelling. Really shows the benefits of developing purpose built mobile apps can have a positive impact for the right transactions and interactions.

We did have an interesting discussion on security and the death of the password in favor of multi-factor authentication. There are a number of problems with traditional password security and verification (remembering many different passwords is one such challenge) and I think it is high time it was replaced by multi-factor means of verifying identity. Only time will tell how this plays out. But contextual security will be important also, such as determining your location and authenticity of your identify based on usual location, usual usage patterns, and the usual devices you use in addition to traditional factors for authentication.

Storage

We spent a bit of time going through the 3Par storage system architecture and especially the details of the new 3Par 7450 All Flash Array. I like the way the 3Par architecture is highly parallelised. This makes it great at handling lots of random IO’s, which is very normal for virtualized environments. HP covered the new Peer Persistence feature in the 3Par system, which will allow 3Par to attain the VMware vMSC certification for deployment in stretched cluster environments (similar to what HP P4000 system can do now). HP wasn’t sure how long the VMware vMSC certification process would take, but it is underway. There were a couple of gotchas with this new Peer Persistence feature such as you must implement a uniform storage access configuration and each LUN is active/passive not active/active across sites. The uniform storage access is much more complex to implement and maintain and doubles the number of paths zoned to each host. This effectively halves the maximum number of LUNs you can have configured per host as you need redundant paths to each array at each site. The LUNs being only active for read / write at one site is also not ideal as any VM’s executing on the opposite site will have additional latency for all their storage accesses back to the primary site for the LUN. 3Par Peer Persistence is trying to compete against EMC VPLEX and other vMSC solutions (such as NetApp), but it’s not quite on par yet due to no support for SRM on top of the stretched cluster (unless using hypervisor based replication), and the lack of support for active / active read/write LUNs and non-uniform storage access. All in all though if you had an existing 3Par implementation and wanted to have a stretched cluster between two active datacenters (provided they are within the distance limitations <10ms) then you could now do it. Many 3Par customers I spoke to were very interested in this new enhanced feature, which also includes provision for a witness, they were also very happy with the performance and manageability of their existing 3Par systems. Most 3Par customers like the fact that they can start with an entry level 3Par and grow it as their needs increase while keeping consistency of management platforms.

Networking

There was quite a bit of discussion around network management and monitoring and using OpenFlow combined with Blueprinting to roll out applications on top of virtual networks. The blueprinting capabilities, which basically allow you to deploy an application anywhere and have it’s networking automatically configured, are very compelling. This was however limited to OpenFlow based networks.

I was interested in how the networking hardware was going to be made better to support the new Software Defined Networks, Network Overlays and Network Virtualization technologies. But unfortunately there appears to be nothing in the pipeline to build mechanisms into network hardware to reduce the overheads associated with network layer virtualization or overlay technologies, nor increased MTU sizes, which will increasingly become important as Ethernet reaches large scale 40G and 100G adoption. It appears to be HP’s opinion that =>9K MTU is not required and in fact most people are / should still run 1500. This is in spite of a 10% performance improvement when using Jumbo Frames on 10G links and this performance improvement is only going to increase as the Ethernet bandwidths scale up.

Converged Cloud

HP launched what they call their Converged Cloud, this cloud equals OpenStack. It isn’t currently compatible with HP Enterprise Services VPC cloud offering (note the duplication and lack of integration I mentioned earlier), which is based on vSphere. You can’t migrate between the two different HP clouds, but this will apparently be changing in the future. This appears to be a play in competition to RackSpace, Amazon and VMware vHCS. With VMware vHCS customers can easily move their existing workloads from any VMware environment to a hybrid cloud model, and to any of the many Partner’s VMware based clouds easily, without any modifications. This level of operability isn’t yet available with the OpenStack clouds, but no doubt it will be there in the future. OpenStack right now seems very much like the early days of Linux where there are so many different distributions and choices.

Converged Infrastructure

HP’s converged infrastructure should really be called pre-packaged infrastructure rather than converged as it lacks converged management and many operations still require standalone management tools, doesn’t update as an entire platform as one whole, but can potentially scale and change more easily than other converged platforms. Still this makes it every easy for customers to purchase and deploy HP’s technology. This is really HP’s first step to converged infrastructure and they’re working hard to converge the management and lifecycle processes together. It’s still early days yet but vBlock and newer converged offerings such as Nutanix have got the jump on HP and still lead while HP catches up. Some of the people at the conference were liking the HP converged infrastructure to what VMware provides in the vCloud Suite currently. A single SKU to purchase but it’s really a number of products that aren’t really integrated. If you’re an existing HP customer the new converged SKU’s will make purchasing HP technology much easier and much quicker to implement as it comes pre-packaged to your specifications from the factory / distribution. Overall this will decrease your time to market and also decrease your TCO. Once they have the management side of things sorted out it’ll break down the IT silos and also decrease further the operational costs of the infrastructure as you’ll be able to manage the complete platform as one.

Here is a photo of the HP Virtual Convered Infrastructure Rack (right). This is a virtual demo controlled by an HP tablet where they can show you everything about the converged infrastructure platform, but without having to carry around a full implementation. This is rather a great bit of kit. The rack on the left is the actual converged platform based on an entry level solution that can then be easily expanded.

Visited Sponsors Stands

I took some time out to visit some of the sponsor stands at the show and I’m really glad I did. There were some excellent sponsors at the event and I learned quite a lot. Here are some of the highlights from the sponsors at HP Discover.

AVT

AVT is a company that provides a solution that allows customers to migrate OpenVMS, VMS Clusters and Alpha systems to VMware on HP systems without code changes. This means that any existing customers that want to retire their old hardware can do it but without the massive costs associated with redeveloping their application. AVT is the only HP supported solution that allows this type of migration. You can run multiple VAX or Alpha systems per host easily. The main advantages are reduced risk of running on old or retired hardware, prolong the value of your VAX and Alpha software, avoiding costly and complex software migration costs. There is also a good potential for performance improvements when going to the latest generation hardware platforms. The company estimates there are still 500k VAX and Alpha systems in existence and that’s not surprising. So if you do happen to have a VAX or Alpha in your datacenter it would pay to get in touch with AVT.

Fusion-io

It was good to see Fusion-io at HP Discover and especially good to learn about their spectacular performance results (as mentioned earlier). HP along with Fusion-io set some world record VMMark Results, and achieved performance for an Oracle workload against an on ION storage system of 2.2million IOPS and 24GB/s. Fusion-io had the performance demo running live on the show floor and I hope they bring this to VMworld this year as well and run a Virtual Machine benchmark against it on the latest VMware release. To reach this spectacular performance HP and Fusion-io used a Gen 8 DL980 with 6 x dual port 16Gb/s Qlogic HBA’s going via a Brocade 6510 16Gb/s FC switch to 3 x Gen 8 DL380 servers each with 2 x dual port Qlogic 16Gb/s HBA’s and 4 x 2.4TB HP IO Accelerators (Fusion-io Cards), 28.8TB in total. This is a surprisingly small configuration for such a massive performance result. This certainly demonstrates not only the potential of the Fusion-io technology but also of the HP Gen 8 servers also.

TIBCO

I had been getting a lot of requests recently from customers that wanted to virtualize varios types of TIBCO workload including DataSynapse Federator and GridServer. I thought the best way to find out what the support situation was would be to ask TIBCO themselves. I went to the stand and they were extremely helpful. Within a few minutes I was connected to the VP of GridServer and he confirmed that indeed large scale deployments of GridServer were supported on VMware vSphere. Here is what they said:

* Yes, you could run 6000 GridServer engines (or any number), each on a virtual machine, provided the underlying physical infrastructure was sufficient. (This is pretty much what TIBCO DSPG QA lab looks like.)

* Yes, you could have 6000 separate grids, each on its own virtual infrastructure, again provided the underlying physical infrastructure was sufficient.

* You should not attempt to run 600 or 6000 anythings on a single VM.

This last comment is of course common sense. GridServer is Java based so the best practices with regards to Java and Low Latency Workloads on VMware vSphere apply. If you weren’t already aware there is a low latency setting in the VMware vSphere 5.1 Web Client available for those workloads that need low latency.

Mellanox

I went past the Mellanox stand to find out what the latest was from their product lines. I was mainly interested in their Ethernet products. Previously their 10G NIC’s had been quite hard to configure and get working on VMware vSphere and they would show up as phantom NIC’s and sometimes not be available immediately at boot time. This problem has been fixed with the latest firmware and drivers I’ve been told. It was very interesting to see that Mellanox is providing 40GbE and 56GbE card, which includes support for VMware. The 40GbE NIC’s and Switches have a latency of 220ns, compared with 270ns for 10GbE ports.

The Mellanox SX1018 40GbE C Class Blade Switch, which provides 220 ns latency, supports 18 full speed 40GbE ports out of the C Class Chassis. That’s 720Gb/s of low latency bandwidth from a single chasis. I didn’t go into the costs but I’m sure it’s not going to be all that cheap, but certainly impressive from a performance point of view.

Based on what I discussed with Mellanox at their stand I think converged network / storage fabrics are the way of the future with clear leadership in Ethernet over straight FC. When it comes to networking history has shown that Ethernet always wins. With low latency and non-blocking QoS available on high speed Ethernet ports there really is no reason to have traditional FC fabrics and switches if you’re making new investments. 40GbE is here now and 100GbE will probably be available before the end of 2013, at which point 40GbE will start to come down in price.

You can forget about running 40GbE on a Gen 2 PCIe slot. With these sorts of speeds you’re going to have to be running PCIe v3 to get able to get the bandwidth, like you get on the HP Gen 8 servers. With all the advances in networking that are going to be upon us shortly it’s certainly going to make things interesting in the datacenter.

VMware

VMware had a great stand at HP Discover covering Software Defined Datacenter and End User Computing. They were also represented well on various HP stands and other partner stands around the event. Here is a photo of the VMware stand.

Final Word

HP Discover was a great event and I highly recommend it to any current or potential future HP customer. If you can’t make the USA event HP discover is also on in Europe. This year it’s in Barcelona in December. Apart from all the great technology on display at HP Discover one of the highlights was the HP Discover Party on Wednesday night. HP hired out the MGM Grand Arena and had Los Lonely Boys and Santana entertain the conference attendees. This was one awesome show and the entire crowd really enjoyed it. They played all the crowd favourites and HP put on plenty to eat and drink as well. This is one of the best, if not the best, vendor sponsored parties that I’ve ever been to.

I and the other bloggers were also fortunate to get to spend some time with the HP CEO Meg Whitman. Here is a photo of all of us together.

Note: Travel to HP Discover 2013 was paid for by HP; however, no monetary compensation is expected nor received for the content that is written in this blog.

—

This post first appeared on the Long White Virtual Clouds blog at longwhiteclouds.com, by Michael Webster +. Copyright © 2013 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.