vExpert 2017 Announcements

Congratulations to those who have been recognised as vExperts and will be joining the group for the 2nd half of 2017!

https://blogs.vmware.com/vmtn/2017/08/vexpert-2017-second-half-announcement.html

Also congratulations to existing vExperts who have been recognised as experts in the 2 sub categories – NSX and vSAN!

https://blogs.vmware.com/vmtn/2017/08/vexpert-nsx-2017-award-announcement.html

https://blogs.vmware.com/vmtn/2017/08/vexpert-2017-vsan-announcement.html

 

I’m fortunate enough to be once again considered as a vSAN vExpert for this year! =)

VMware sells off vCloud Air to OVH

Hmm…. so that was an interesting announcement from VMware last week!….. although if I’m honest it makes perfect sense!

OVH Group announcing it’s intent to acquire the vCloud Air Business from VMware: https://www.vmware.com/radius/vmware-cloud-air-evolves/

Last year when VMware announced their tie up with AWS – vCloud on AWS – many had already started wondering what that partnership would do to VMware’s own cloud offering. The talking point was made more real when VMware also announced their Cross-Cloud Architecture which would allow a customer to choose which cloud platform to deploy their workloads onto – all from a single common operating environment. Then to make things worse, VMware announced VMware Cloud Foundation on IBM Cloud (or what was Softlayer)… an SDDC stack running VMware goodies on IBM Cloud compute!

That triple whammy pretty much made everyone think that vCloud Air’s time was up!!

I had a number of discussions at VMworld Europe last year where we talked about whether VMware would just shut down vCloud Air, or would they migrate it all onto AWS. Although the general consensus was that maybe they would sell off/spin off that part of their business – after all, VMware is a software business and vCloud Air was always seen as a ‘weird’ sibling…. not to mention that it competed against all it’s vCAN (VSPP) partners who were offering their own cloud services built on VMware technology!

I guess there’s no shame in what VMware are doing, Cisco, Dell and HP tried and failed to do what Amazon and Google are doing well at… although surprisingly Microsoft have managed to get Azure up and running well!

In a way, VMware are getting rid of what they probably saw as a hefty investment on infrastructure and hosting for little returns (I doubt there were many customers using vCloud Air to justify the expense of keeping it). Makes more sense to sell it to an existing cloud provider who knows how to sell Public Cloud services and IaaS! Although, I kind of have to wonder what OVH will do given VMware hosted vCloud Air in Equinix/Telstra data centres around the world….. guessing they’ll run down the contract with those providers and bring it all back in house!

In my opinion, selling off vCloud Air is probably a smart move….. VMware’s vision is to enable a customer to run “Any Application on Any Cloud, accessed by Any Device”, and it was going to be difficult to be Cloud-Agnostic if they owned a Public Cloud service! The whole Cross-Cloud Architecture would have produced a conflict of interest if they kept vCloud Air…. now that they’re shot of it, they can concentrate on pushing out their vCloud stack onto Azure and maybe even GCP given that they’re well on their way with the AWS partnership. Why try and beat them at their own game? It’s far easier to embrace them and partner!!

VMware are positioning themselves to be the broker of cloud services…. a single management point that allows end users to decide which public cloud is best for their workloads! In a way it’s a clever move, firstly because it puts the decision-making back with the end user, and secondly it now means that VMware can state that it’s the only virtualisation company that doesn’t tie you into a single cloud vendor (much like how Microsoft tries to ram Azure down the throat of Hyper-V customers).

Interesting times ahead……

Opinion Piece on VMware Licensing

So over the past few months I’ve been seeing a lot of customers within the Public Sector and Education looking at transitioning off VMware vSphere and onto Microsoft Hyper-V! With tightening budgets or even budget cuts, IT admins in these industries are looking for quick wins in slashing their IT bills and many see dropping VMware for the ‘free’ Microsoft hypervisor as an obvious choice!

The problem is, you can argue about VM densities per host, resource scheduling, live migrations, DR, and other technical aspects of why vSphere trumps Hyper-V…. However, the reply is always the same…. “Well Hyper-V is Good Enough for our environment…. and it’s Free!!”

Yes, Hyper-V is good enough as a hypervisor… and yes it’s free…. but when you have a large estate, the density ratio impacts the amount of servers you need to buy and you still need to invest in System Center with Virtual Machine Manager (SCVMM) if you want to effectively manage a cluster of Hyper-V hosts.

Unfortunately, I’m now of the impression that VMware advocates can no longer keep using the same argument when doing comparisons between vSphere and other hypervisors…. IT admins just don’t care any more…. “if the hypervisor is free and can virtualise my servers, then that’s the one I’m going for!!”

Anyways, I ended up sitting down and writing an opinion piece for SearchVMware.com on this topic….. you can view it here:

http://searchvmware.techtarget.com/opinion/Could-market-saturation-push-VMware-to-make-vSphere-Standard-free

VMware NSX – IOChain and how packets are processed within the kernel

During a meeting with a client when I was going over how packets are processed within the IOChain between a VM and a vSwitch, I was asked a question that stumped me…. what happens at Slot 3?

It’s common knowledge that the first 4 and last 3 slots in the IOchain are reserved for VMware and slots 4-12 are reserved for 3rd parties where services are inserted (or traffic redirected).

During my discussions I’ve only ever spoken about Slots 0-2 and 4-12…..

After much digging around and questioning the NSBU SEs, I was told that there was no real answer apart from it’s probably a VMware reserved slot for future use. =)

It’s also worth noting that Slot 15 used to be classed as a “reserved slot for future use” but is now intended to be used for Distributed Network Encryption when it becomes available (makes sense that encryption is the last thing that happens on the IOChain for packets leaving a VM, and decryption being the first for packets entering the VM).

Anyways, decided it’s probably worth blogging about IOChain slots. =)

 

So when a VM connects to a Logical switch there are several security services that each packet transverses which are implemented as IOChains processed within the vSphere kernel.

Slot 0: DVFilter – the Distibuted Virtual Filter monitors ingress/egress traffic on the protected vNIC and performs stateless filtering and ACL.

Slot 1: vmware-swsec – the Switch Security module learns the VMs IP/MAC address and captures any DHCP Ack or ARP broadcasts from the VM, redirecting the request to the NSX Controller – this is the ARP suppression feature. This slot is also where NSX IP Spoofguard is implemented.

Slot 2: vmware-sfw – this is where the NSX Distributed Firewall resides and where DFW rules are stored and enforced (so firewall rule and connection tables).

Slot 3: reserved for future use by VMware

Slot 4-12: 3rd party services – this is where traffic is redirected to 3rd party service appliances

Slot 13-14: reserved for future use by VMware

Slot 15: Distributed Network Encryption (when it becomes available)

vSphere 6.5 Product Interoperability – brain fade moment!

So it’s probably worth reminding everyone that there are still VMware products that are not yet supported on vSphere 6.5!

I unfortunately found out the hard way when I broke my work’s demo environment (or at least half of it).

Now even though I’ve blogged about compatibility issues previously eating too many mince pies and drinking too much bucks fizz over the Christmas and New Year festivities has obviously taken its toll on my grey matter, and coming back to work in the new year I decided it would be a nice idea to upgrade a part of my works demo environment to vSphere 6.5 so that we can use it to demo to customers!

The problem was I upgraded the part of the lab running NSX and when I got to the point of trying to push the NSX VIBs onto the ESXi hosts (when preparing the hosts to join the NSX cluster), it was having none of it and failing! After several unsuccessful attempts, it slowly dawned on me that NSX was one of those ‘unsupported’ products that doesn’t work with vSphere 6.5…..

Damn…..

Fortunately I didn’t destroy my old vCenter Server 6.0u2 appliance so was able to roll back by re-installing the ESXi hosts with 6.0.

 

Anyways, the products still not supported are:

  • VMware NSX
  • VMware Integrated OpenStack
  • vCloud Director for Service Providers
  • vRealize Infrastructure Navigator
  • Horizon Air Hybrid-Mode
  • vCloud Networking and Security
  • vRealize Hyperic
  • vRealize Networking Insight

 

Definitely worth keeping an eye on this VMware KB: Important information before upgrading to vSphere 6.5 (2147548)

And if you do end up upgrading to vSphere 6.5, then make sure you follow the recommended upgrade sequence in this VMware KB: Update sequence for vSphere 6.5 and its compatible VMware products (2147289)

MTI/IDG Whitepaper

My company – MTI Techology – recently undertook an engagement with IDG to produce a whitepaper highlighting how VMware NSX could be used to address Security, Automation and Innovation within the Financial market.

TBH, the whitepaper can apply to any market who are experiencing the same business challenges!

http://www.idgconnect.com/view_abstract/41130/security-automation-innovation-steps-drive-success-financial-services

EDIT: Forgot to mention that you need to sign up for a free account in order to download the whitepaper. =)

Network Virtualisation – The Answer to Data Centre Security

I’m always being asked to write something high-level about NSX, and for a techie I’ve always struggled to keep technology out of these types of articles.

As MTI are sponsoring and exhibiting at ESRM tomorrow, I was asked at the last minute whether I would like to write an article for ESRM’s blog regarding what MTI will be talking about on their stand.

Anyways, with such late notice I hope I’ve done NSX and MTI justice….

http://www.whitehallmedia.co.uk/esrm/uncategorized/network-virtualisation-answer-data-centre-security/

Enterprise Security & Risk Management – 30th Nov 2016, Victoria London

So my company is sponsoring the Enterprise Security & Risk Management event at Victoria Park Plaza Hotel, London this coming Wednesday.

As such, I’ve been asked to attend with some of my security colleagues to help spread the NSX love… =)

Not many people are aware that MTI Technology has both a Data Centre and Security business unit, which means we are clearly positioned as a Solutions Provider that can sell you tin (storage/servers/networks), virtualise your workloads and also secure your critical data!

As one of VMware’s NSX Focused Partners in the UK, we are able to offer the full network virtualisation and security package! Whether it’s just using NSX to offer micro-segmentation and automation of network & security policies, or whether you require deeper packet inspection with the likes of Palo Alto or Trend Deep Security.

Anyways, if anyone’s in attendance at the ESRM event on Wednesday, then drop by the MTI stand to say hi and find out more about what we do, which vendors we work with and also why we all love NSX! =P

Oh, and we’re also giving away a Sonos Play 1 Wireless Speaker as a raffle prize! =)

VMworld 2016 Europe – Sessions

After the past 3 years of attending VMworld in Barcelona and packing my schedule full of sessions causing me to run between sessions and grab lunch on the go, I swore to myself that this year I would be more selective with my sessions so that I’m not rushing around like a headless chicken…..

…. Unfortunately I’ve failed in my scheduling prowess….. when the Schedule Builder was released, I pretty much went through the whole content catalog and selected all the interesting sessions I wanted to attend, and basically ended up with another packed out calendar!! >_<”

Dammit… why are there sooo many interesting sessions at VMworld and sooo little time to schedule them all in! I remember watching at least a dozen video replays of sessions I couldn’t attend last year…. I’m now trying to work out whether to attend the sessions in real life or just watch a virtual replay post-VMworld!

Given my hectic schedule…. I wouldn’t be surprised if I end up in the Top 10 yet again in the VMworld attendee game (shame there aren’t any prizes).

I’ve got a packed out PEX day, including trying to fit in my VCP6-DCV Delta exam in the morning….. Best have a quiet Sunday night!

Anyways, if you’re going to VMworld then you’ll find me in these sessions!

Tuesday 18th October:

  • VMware NSX-Deep Dive [NET9152]
  • The Practical Path to NSX [NET8675]
  • What’s New with vSphere [INF8375]
  • Reference Design for SDDC with NSX and vSphere: Part 1 [NET7857R]
  • Reference Design for SDDC with NSX and vSphere: Part 2 [NET7858R]

Wednesday 19th October:

  • Monitoring and Troubleshooting NSX with vRealize Network Insight (Arkin) [NET8241]
  • vSphere Client Roadmap: Host Client, HTML5 Client, and Web Client [INF8172]
  • Operational Best Practices for VMware NSX [NET7865]
  • What’s New with vCenter Server [INF9944]
  • VMware Cloud Foundation Architecture Deep Dive [SDDC8481]

Thursday 20th October:

  • Virtual Volumes Technical Deep Dive [STO7645]
  • Enhanced Disaster Recovery with NSX and Site Recovery Manager [NET7760]
  • Simplifying Disaster Recovery in 2016 using VSAN, NSX and SRM [STO7802]
  • Introducing VMware Cloud Foundation [SDDC8618]

Sessions down for post-VMworld viewing:

  • Software-Defined Storage at VMware Primer [STO7650]
  • Virtual SAN Technical Deep Dive and What’s New [STO8246]
  • Hot Topics in VMware Research [CTO9406]
  • Tech Preview: Enhanced VM Availability Leveraging vCenter and Partner Hardware Integration [INF8020]
  • Discover What’s New in Workspace ONE and AirWatch [EUC3908-C]
  • VSAN Vision: The Future of HCI [STO9424]
  • vSphere Encryption Deep Dive: Technology Preview [INF8856]
  • VMware Cloud Foundation on Public Clouds: A Technical Deep-Dive [INF7849]

It’s strange that Chad Sakac is no longer presenting his session (The Edge is Still Bleeding: A face-melting technical smorgasbord of all things Converged, Hyper-Converged, Cloud Native & Software Defined [SDDC9462-SPO]) – he’s been replaced by Tom O’Reilly….. such a shame as he’s a great presenter! At least Vaughn Stewart is back this year (Best Practices for All-Flash Data Reduction Arrays with VMware vSphere [INF9455-SPO])!

As you can see, my sessions are heavily skewed towards NSX, and that’s because MTI are a VMware NSX Focus Partner in UK and I’m always after more material to use within my NSX presentation decks. Not to mention that NSX is a focused product from VMware this year (how many times have I said that now in my blogs?)….

Roll on VMworld 2016!

VMworld 2016 US – Day 2 General Session Overview

One of the issues with working and having a young family is you end up doing a full days work and going home to a baby who wants loads of attention who then doesn’t let you sleep because she’s teething….. Yup, the joys of being a parent…. but I wouldn’t give it up for anything!!

So this blog comes a few days late because I didn’t have much time to finish watching the replay of Tuesday General Session and write a blog due to already mentioned circumstances. =)

Tuesdays’ General Session replay is now available here:

So Monday was all about the transformation of the data centre, making it cloud friendly and able to support workloads wherever they’re deployed (so Any Cloud).

Tuesdays’ session was more around the End Users experience, Any Application on Any Device and I have to admit that I thought Sanjay Poonen’s demo of Workspace ONE was pretty awesome – I’ve not seen a full demo of the products capabilities but I was struck by how much you could do with the suite of products and how integrated it all was – Infrastructure, VDI, Mobile Device Management, Identity Management, Security…… Control yet Choice!!

We’ve all seen the demos of AirWatch integration, how single sign on has been implemented, we’ve seen the demos of Horizon View on tablets, etc…. what I’ve not seen before was how security could be implemented to prevent unauthorised data being published…. like the conditional-access demo of how financial data taken from a spreadsheet in Office 365 was blocked from being copied into Twitter (which was an unmanaged application). What was even more impressive was the NSX integration to use conditional-access policies (ie changes to firewall rules for a particular group of people) to prevent data being presented in a dashboard depending on whether the user is accessing it inside the corporate firewall or externally.

And I was impressed with the VMware Trustpoint demo of endpoint visibility and management, looked very simple to use to implement endpoint security.

Finally, VMware introduced a brand new technology that represents the next phase of their digital workspace vision – VMware Unified Endpoint Management (UEM) – a new architecture that brings app, desktop and mobile management together with next-gen security and identity interwoven throughout, delivering a simpler but more secure digital workspace!

 

Next up was Ray O’Farrell and Kit Colbert to talk about containers…. and how admins can extend management, monitoring and security to containers. It looks like VMware vSphere Integrated Containers will have 2 new features:

  • Admiral – which is a Container Management Portal to allow developers and app teams to manage their repositories and images.
  • Harbor – which is a Container Registry (based on Docker Distribution) which allows developers and app teams to securely store their images including management and access control.

The demo was interesting as it showed the integration between VIC and NSX and how network security can be applied to containers, as well as the integration between VIC and vROps for monitoring of containers. The demo went one step further and showed how vRA was used to automate the deployment of container hosts as well as showing access to the Container Management Portal.

There wasn’t much on Photon Platform that we didn’t already know – VIC allows IT to extend the existing infrastructure to accommodate container-based applications alongside traditional apps, and Photon Platform allows IT to build a complete computing platform solely for containers and cloud-native apps.

 

Next up was the new GM/EVP of Networking and Security to talk about NSX. If I’m honest, I found Rajiv Ramaswami a bit wooden – far different from the charisma of Matin Casado…. which is a shame as the one product everyone should get excited about this year is NSX! I have to agree with Rajiv when he says that “the single greatest infrastructure transformation he has seen” is with Network Virtualisation. Networking is undergoing a huge transformation with vendors and customers looking at transitioning from hardware-centric to software based solutions.

Not much was said about NSX that we didn’t already know….

  • Security – it does Micro-segmentation to allow you to provide fine-grained security to every VM and helps you architect security as an essential part of the data centre
  • Automation – it allows you to automate workload provisioning and cuts down deployment time because network and security can be quickly provisioned in software and attached to VMs (policy-based management)
  • Application Continuity – it enables your applications and data to reside and be accessible anywhere. In addition it can reduce your RTO when integrated into your Disaster Recovery solution.

One thing that was new was the demo of vRealize Network Insight used to create NSX pre-assessment reports. Those of you following the news will know that this has come about from the acquisition of Arkin a few months back. I’ve had a play with the Arkin tool as the VMware NSX SEs in the UK were recommending it as a Network Assessment tool for partners to use when trying to sell NSX (prior to the acquisition and release of vRNI). I really like how it graphs traffic flow and patterns, tracing network traffic between VMs and giving you deeper insight into what goes on inside your virtual environment (ie the East-West traffic flows). The other clever thing is how it is able to carry out flow analytics to provide recommendations for grouping VMs together when planning for micro-segmentation. The only issue is it needs vSphere Distributed Switches!

I quite liked the NSX Planning tool tech preview – how flows can be captured, then analysed and grouped into traffic patterns and security groups. The application map can then be used to create firewall rules based on what the tool discovered. Very clever stuff!

 

 

Finally Yangbing Li talked about Hyper Converged Infrastructure and VSAN. VSAN has come a long way since its launch a few years ago, and I see it as an enterprise-ready storage offering! HCI is a very hot topic this year, customers are now looking at HCI solutions when it comes to new projects or hardware refreshes. Hardware vendors are aware of this and there are so many different types of HCI solutions in the market today! I’ve been involved in a number of discussions with my customers around HCI and EMC/VCE VxRail in particular!

A couple of new features were introduced during the VSAN demo: software-based Encryption and Analytics. The VSAN demo with vRA showed how the performance analytics engine could pro-actively inform users that a VM should be migrated from a VSAN hybrid cluster to an all-flash cluster, and through changing the storage policy in vRA the VM was automatically migrated (in the demos case, the VM was migrated to a public cloud!). What this also underlined was how NSX was also involved in moving the network and security policies as the VM was migrated to the public cloud (although you didn’t see it in the demo). So not only did the demo show the analytics engine working, it also showed how the VMware Cloud Foundation platform could be used.

 

I don’t know if it’s just me, but it seems that everything mentioned during the two keynote sessions always reverted back to network and security, it felt that NSX was underpinning everything (Cross-Cloud Services, Workspace ONE, containers, etc). VMware are putting a lot of emphasis on Cross-Cloud capabilities and how data management and governance will play a key part of cloud consumption. I guess the VMware vision of Any Device, Any Application, Any Cloud really does require something that can govern where data sits and how it’s being consumed!