Infrastructure Planning and Design

This is a quick heads up for some important guides that should be on every system integrators table.

The Infrastructure Planning and Design guides from Microsoft http://www.microsoft.com/en-us/download/details.aspx?id=732

The planning phase on a project is the most important one.

The reason for that, is that you must ensure what the customer actually want to do, and how to meet the requirements. Let’s take the System Center components for example.
Although you can ramble on and install Operations Manager on a single server, this is unlikely very clever to do.

Things to consider prior to deployment:

·         What infrastructure is in place prior to the deployment?

·         Do you have to purchase additional hardware components to meet the requirements?

·         Will this lead to some change management?

·         Who’s involved in this project?

·         Will it involve down time for some (or all) of the production?

·         ETA?

This is just a few points to mention in this context, but the list could go on and on and on.

Read the different guides that are related to the projects you’re working with, and make sure you have considered the most important pitfalls.
Statistically, 8 of 10 IT projects are failing beyond recognition. If you read through the Infrastructure Planning and Design guides, you should be one step closer to a successful project.

Understanding the Service-concept in VMM 2012

For those of you that have tested and played around with VMM 2012, may be aware of the new concept of services. VMM 2012 inherited the great possibility to create VM templates from VMM 2008 R2, and has taken this a bit further in 2012.

When you create a VM template in VMM 2012, you can define the following configuration:

·         Hardware Configuration (HW Profile)

·         OS Configuration (OS Profile)

·         Application Configuration (Application Profile)

·         SQL Server Configuration (SQL Profile)

It`s worth to pay attention to that if you`re touching the Roles/Features in the OS profile, or/and the Application Profile/SQL Profile, you will get a message when you deploy your VM, that it need to be deployed as a service, since it contains additional configuration (not only the HW profile with a reference to a vhd, networking, CPU`s, RAM, and the OS profile with admin password, domain information, time zone, and license key).

If you choose to continue, these options will be ignored.

So, let`s move over to the Service Templates.

In VMM 2012, you can create a service, which is a logical grouping of VMs that you can manage as a single entity.

You can either create a single-tier service, or a multi-tier service.

Explanations:

A single-tier service contains a VM with ‘additional’ configuration. Like Application configuration, OS roles and features, SQL deployment/DACPAC`s, web apps, and so on. You can create a single-tier service, and scale it out. We will come back to the scaling later in this article.

A multi-tier service contains more than one VM. For example, you can deploy one SQL server tier, one Server App-V tier, and two Web App tier. These VMs will together define the service, and be their own little ecosystem.

It`s worth to mention that some people think that the service deployment is suited for other types of deployments. You can, technically deploy your Domain Controller, Remote Desktop Server, VPN server, and whatever server you`d like through this feature, but that is not what it`s meant for, unless it`s all a part of an application on the top, which you intend to scale out. Let me try to explain.

With VMM 2012, you`re able to manage the lifecycle of your applications. But remember that each and every application has some sort of software dependencies, some sort of manual input and requirements. So the service deployment and ‘scale-out’ is not suited for every application.

You can add, sort, and manage the underlying hardware in the Fabric in VMM 2012. In these days, the word Fabric is the new term of ‘infrastructure’. VMM 2012 gives you the opportunity to create a Private Cloud, which is primarily an Infrastructure – as a Service offering. With the Service deployment-feature, you`re actually able to provide your users with Software as a Service. But I will stress again, the scale-out purpose is meant for stateless application. Talking about stateless applications, this is particularly well for applications distributed with Server App-V. You can save the state of the application and reapply that state to the “new” VM. The new drag-and-drop Service Template Designer makes it easy to visually position VMs that comprise a service. (BTW: When you scale-in a service in VMM 2012, you`re in fact – deleting the VM).

Next blog: Example of a scale-out scenario.

Explaining the difference between the Web Role and the Worker Role.

Today, I spoke with mr David Platt. Yeah, the software legend.

This week is all about Windows Azure, SQL Azure, and AppFabric.

David Platt is a guy who knows how to explain things. Even the most complex scenario may end up with a simple metaphor, with a laughing audience.

Here`s an example.

“When you go to the store to buy a fish, you are welcomed by a nice pretty lady. She takes the order, and handles it back to the person who cut the fish. This pretty lady does not know anything about how you cut a fish. And the person, who is cutting the fish, does not know anything about customer service. So to clarify it for you. The nice pretty lady is the Web Role, looking good, and is visible and accessible for the customer. The person who cuts the fish, is the Worker Role. He/she does not have to be good looking at all, but needs to know what he/she`s doing to get the process done.”

I`m really looking forward to the rest of this week, and we already agreed today that the VMRole should not be considered as an IaaS. (So it should not be any misunderstandings about this point by know, since THE software legend himself stated this. J )

VMRole and Azure Connect (still not IaaS)

I`ve been playing around for a while.

It`s blue, and it`s called ‘Azure’.

I wanted to test the new VMRole feature together with Azure Connect.

Here are the various setups I have tested:

1)      SharePoint installed on VMRole – connected with On-Premise SQL server

2)      Self-Service-Portal (v.1) on VMRole – connected with On-Premise servers

3)      LOB application connected with On-Premise SQL server

Before I get started, I just want to be clear that Windows Azure – even with VMRole and Azure Connect, should not be considered as an IaaS solution. It`s just a simplified way to move your existing applications to Azure. Think of VMRole as another way to build and deploy your applications.

Because there are some requirements for this role.

1)      You need to install the Windows Azure Integration Services

2)      You should sysprep your VM before moving it to Azure

3)      Size the VM properly – including RAM and disk size (you will only get one partition up there. The additional partition is dedicated for ‘Azure-stuffs’)

Ok, with those requirements, - or limitations in mind. What can we get out of it?

Oh, I almost forgot. If you have logged into the windows.azure.com portal after you have migrated one or two VMs, you have probably noticed some options there. It is called ‘Reboot’, and ‘Reimage’. It does what it says. So remember that you`re uploading a so called ‘base image’. This image could be reimaged by Azure. Meaning that every modification you do to your VMs, would be lost whenever the reimage-process starts. That’s Azure`s way to keep your VM clean, healthy, and to fix the instance if it fails.

http://msdn.microsoft.com/en-us/library/gg466230.aspx

“An instance can be rebooted any number of times. Windows persists all data across reboots. When you reimage a server instance, it is re-created from the image, and any state that you have not explicitly persisted is lost. Data that is written to the local storage resource directory is persisted when a server instance is reimaged; however, this data may be lost in the event of a transient failure in Windows Azure that requires your server instance to be moved to different hardware.”

So if we have to consider our roles in Windows Azure as stateless, what could be preferred to run there as far as an IT-pro concern?

-Nothing, really. It`s still a Platform – as a Service solution.

But with the ‘stateless’ in mind, I tested some ‘stateless’ applications up there.

And this is the part where the skill of an IT-pro is relevant when it comes to Windows Azure.

1.       I deployed a VM in Hyper-V, joined it to my lab domain, installed The Windows Azure Integration Services, and also the applications needed.

2.       I uploaded the image to Azure (added the –skipverify option to the cmd)

3.       Created and deployed a new hosted service in Windows Azure, and enabled it for Remote Desktop

After the VM was uploaded, I needed to connect it to my on-premise servers.

1.       I installed Azure Connect on the VM in Azure

2.       I installed Azure Connect on the On-Premise domain controller

3.       I installed Azure Connect on the other necessary servers On-Premise

4.       Created a group in Windows Azure, and linked those VMs.

(To make this possible, you have to logon to the Azure portal and download Azure Connect token on every server that should connect to each other)

I should also mention that using Azure Connect made me to brush off my IPv6 skills. Yes, it communicates on IPv6. So to make it real smooth, I setup my lab to support IPv6 (Domain Name System Services, and created AAAA-records for the servers intended for this scenario, and added rules to the Windows Firewall).

The SharePoint scenario and LOB scenario had one thing in common. It was really slow.

Since my lab is located in Norway, the closest Azure Datacenter is located in Amsterdam. (I also tried the datacenter in Ireland). The ping latency was about 600-700ms. And for SQL-communication which operates in real time, it appeared to be very slow. But it worked.

Using the Self Service Portal appeared to be faster, since it only initiates the job from the portal, down to the server on-premise. I created a VM from Windows Azure, and was able to connect to it afterwards.

The moral here is that when you get the possibility to Remote Desktop onto a VM with full access – and even can connect it to your network, you really need to know the platform you`re dealing with.

You may be tempted to think that this would open the door to use Azure as an extension of your network. To confuse you even more – it could. But only for applications, not infrastructure.  

Cheers,

The Integration Services (Hyper-V Architecture part 3)

As I mentioned in my last post: When you install the IC, the VMs will be presented with some services:

·         Operating System Shutdown

·         Data Exchange

·         Heartbeat

·         Backup (Volume Snapshot)

·         Time Synchronization

·         Synthetic Devices (IDE, SCSI, Networking, mouse, video) (Not covered in this post)

As you can see, the IC provides more services than just the synthetic devices, and let`s take a closer look at each of the above.

·         Operating System Shutdown

With this enabled, the VM would be shut down from Hyper-V Manager when you select the ‘Shot down’ button. In other words, this would allow you to shut down the VM as you were logged into the console and issued the shutdown command. This is not the same as the ‘Turn off’ button in Hyper-V Manager. (In Norway, we actually call this the ‘Swedish button’..)

·         Data Exchange

This is the service that provides a way to exchange management data (FQDN, OsName, OsBuildNumber, OsMajorVersion, OsMinorVersion ++) between the Hyper-V host and the VM. The WMI can be called to use this information, and this one gives you the opportunity to use PowerShell to build management capabilities based on the obtainable result.

·         Heartbeat

This is the service that reports the state of health for the VM to the host. It is indicating if the VM is ‘alive’, and enables management agents to take actions based on the status of the VM.

·         Time Synchronization

This is the setting for the system clock. It keeps the VMs clock synchronized with the system clock of the Hyper-V host. You may find it useful to disable this service when the time (in a virtual environment) is different than the host time.  Also note that a physical machine has a battery-operated clock from which it gets its initial time when it is booted (unlike a virtual machine). So the VM would always get its initial time from the Hyper-V host regardless of the setting.  When the VM is up and running, and you are disabling this service, further synchronizations are disabled as well.

·         Backup (Volume Snapshot)

When you are using backup features that are dependent on Volume Shadow Copy Services (VSS), you need this one enabled. The result of unchecking this service would place the VM offline before a VSS backup is taken.

Some details about the Integration Components/Integration Services (Hyper-V Architecture part 2)

When an operating system is supported for Hyper-V, it means that it supports the Integration Components/Integration Services.

This is an optimization technique for a guest operating system to make it aware of virtual machine environments and to shape its behavior when it is running in a virtual environment. There are some important and great benefits with the IC. The VSC (Virtual Service Client) is a synthetic device that resides in a child partition. When you install the IC you also install the VSC that makes the VM able to communicate over the VMBus – with the VSP (Virtual Service Provider).

The VSP provides the needed support for those synthetic devices in the parent partition requested by the VSC, in the child partitions. In other words: the VSP is how the VMs gains access to the physical devices on the parent.

IC does not require changes to the OS, and help to reduce the overhead of certain operating system functions such as disk access and memory management.

The Integration Components supports the following services:

1)      (IDE, NIC, SCSI, mouse, video) Synthetic devices

2)      Time Synchronization

3)      Data Exchange

4)      Volume Shadow Copy Service

5)      OS Shutdown

6)      Heartbeat

What if the IC is not installed?

VMs without IC installed (so called ‘legacy guests’) do not have the access to the VMBus or VSCs. In other words,  there is no support for synthetic devices. This affects performance, and will result in a software emulation of hardware device drivers in the operating system to the parent partition. Back to performance: VMs without IC installed, would perform at a much lower level than the VMs with IC installed. Software emulation of hardware devices may require thousands of instructions, compared to a few instructions directly in the hardware.

In addition: the IC is included in the distribution of Windows Server 2008 R2 and Windows 7, so there is no need to install the IC separately after the deployment in Hyper-V.

What about the VMBus? (Hyper-V Architecture part 1)

Very often, people ask questions about the vCPU, and Virtual Networks in the Hyper-V forum.

And when it comes to vCPU, I often refer to Brian Ehlert‘s great contribution here: http://social.technet.microsoft.com/wiki/contents/articles/hyper-v-concepts-vcpu.aspx where he covers many questions and answers.

But to understand Hyper-V in general, I think it‘s important to know the architecture.

Hyper-V is a microkernelized hypervisor (not a monolithic where the various hardware device drivers are part of the hypervisor) where only the functions that are absolutely required to share the hardware among the virtual machines are contained in the hypervisor.

The reason why Hyper-V supports all the various OS and HW device, is that the parent partition runs Windows Server OS.

Hyper-V requires a parent, a root partition running Windows Server 2008 R2 x64 (Hyper-V 2008 R2 is not a Windows Server, but runs a Windows kernel). The virtualization ‘stack’ runs in the parent partition and has the required direct access to all the hardware devices in order to share them among the child partitions (VMs). When you install the Hyper-V role in Windows Server 2008 R2, you cause the hypervisor to be installed between the physical hardware and the Windows kernel at system boot time. This turns the Windows installation into this special guest – the parent. The parent is still the boss when it comes to access to the hardware, but are responsible to provide additional services to the other partitions (child partitions/VMs).

How does the parent and child partitions communicate?

The VMbus is a communication mechanism (high-speed memory) used for interpartition communication and device enumeration on systems with multiple active virtualized partitions. If you do not install the Hyper-V role, the VMBus is not used for anything. But when the Hyper-V role is installed, the VMBus are responsible for communication between parent/child with the IC installed.

Remember that child partitions do not have direct access to the physical hardware on the host. They are only presented with virtual views (synthetic devices). The synthetic devices take advantages when IC is installed for storage, networking, graphics and input subsystem. The IC is a very special virtualization-aware implementation, which utilizes the VMBus directly, and bypasses any device emulation layer.

VMs make requests to the virtual devices and these requests are redirected via the VMBus to the devices in the parent partition, which handles the actual requests. It`s important to have supported VMs with the IC installed to have this access to the HW through the VMBus. The parent partition use VPS (Virtual Service Provider) and the VMs use VSC (Virtual Service Client) when communicating through VMBus.