Hi Guys, Just a quick update on ISA server, damn i hate it!
Just so you know, in ISA server, a network object is quite a _strange_ object, basically in ISA a network object and its rules only apply if the network object is an actual interface on the ISA server itself, if its a remote network (so lets say for example, you have a network 10.10.10.0/24 that exists behind a PIX that is on the same network as your ISA server, you should use a computer set object, not a network object)
Cisco IOS content Filtering (Subscription Based)
Hi Guys
Today I wanted to talk about a feature called Cisco IOS Content Filter, this extremely handy feature is available on all ISR routers and some 880 Series routers running At least Advanced Security or Advanced IP Services and with IOS 12.4T.
The feature basically provides a way to do URL filtering. But when doubled with a Trend Micro Subscription available on the router, filters dynamically. So every time you get a HTTP web page, for example, google.com, the site is checked against Trend Micro's URL database and categorized into one of several categories (News, Blog, Social, or pornography, illegal drug use, etc.) It will also categorize the sites "Reputation" (Example: adware site, phising site) and report that back. Based on this info the page can be blocked and a log message produced on your router.
The database is centrally located at trend micro, every time you make a URL request the request is checked against Trend Micro's service and then the category/reputation are returned to your router.
You can even block advertisements with it!
You can manually set sites as part of a white list and a black list too if you so desire, and choose a "failover mode" which basically means if it fails to get the reputation/category because TRPS is down or something else is wrong should it allow or fail.
The whole thing is configured in the IOS router. A 30 day trial is available so you can test it to see how well it is going to work for you.
With all this in mind, Let's talk about how you go ahead and configure it!
First thing, there is a few steps you need to do before you just dive in and do the configuration
DON"T JUST READ MY CONFIG EXAMPLE: READ THIS PART FIRST
--------------------------------------------------------------------------
1. Login to your router and execute show diag
You will find:
Slot 0:
C2801 2FE 4SLOT Mainboard Port adapter, 4 ports
Port adapter is analyzed
Port adapter insertion time 5w0d ago
EEPROM contents at hardware discovery:
MAC Address block size : 34
Product (FRU) Number : CISCO28XX
Version Identifier : VN/A
Processor type : 86
Chassis Serial Number : FXXXXXXX
Take a note of your chassis serial number and product number.
Next, head on over to:
http://www.cisco.com/go/license/
Login with your CCO username and password.
Next, go to:
"Click here for available licenses"
scroll down until you see:
Cisco IOS Content Filtering Service Demo License
Click on the link, fill in your details and the chassis serial and product number you noted down earlier.
You will receive an email, that's all you need to do for the trial license, you don't need to install any license on your router: your router identifies itself to trend when it goes to get the updates and this identity is checked against the chassis serial number and product number trend has registered in it's database.
OK good, now that's done here is the next step.
Is your router directly connected to the internet with a public IP address? Good.
enable IP http server on it with the following command:
ip http server
enable it for secure server too
ip http secure-server
you might also need to enable the http server to use an authentication method, the easiest way is probably local.
ip http authentication local
browse to your router via https:// and make sure a webpage does respond. Be careful that none of your outside access-lists are blocking HTTPS access, you will need it for this step. Make sure you know the username.
Ok, with that done, go to this URL:
http://www.cisco.com/en/US/products/ps5854/products_configuration_example09186a0080816c23.shtml
Scroll down until you see
AV Firewall Device Provisioning
Put in the public IP of your router and click submit, you will be asked for your username and password to the router. What this is doing in this stage is installing the PKI certificate used by the Cisco router to communicate securely to Trend Micro's reputation/category database.
Hopefully you receive a successful message and we are ready to start the configuration!
First, login to your router and ping the following hostname:
ping trps.trendmicro.com
Take the IP address that is returned by this and configure it as a static host entry on your router. Note that if you don't have DNS turned on on your router (so the above command fails to resolve the hostname) pinging from your desktop PC is O.K. too, just execute the following:
config t
ip host trps.trendmicro.com
Once that's done, make sure you can ping trps.trendmicro.com from your router.
Next, ensure the clock on your router is accurate:
PeterCCIE18371#show clock
13:36:46.610 UTC Wed Feb 9 2011
This is important so that the certificate is shown as valid.
Next, enter the following configuration:
conf t
parameter-map type trend-global global-param-map
server trps.trendmicro.com
This configures the site where the router will obtain its updates.
Now the big moment, in command exec mode (not config mode) execute:
trm register
here's an example of a succesful registration:
PeterCCIE18371#trm register
Translating "trps.trendmicro.com"...domain server (192.231.203.132) (192.231.203.3)
Processing registration request
Please run 'show ip trm subscription status' to get more info
PeterCCIE18371#show ip trm subscription status
Package Name: Security & Productivity (Trial)
------------------------------------------------
Status: Active
Status Update Time: 13:38:51 UTC Wed Feb 9 2011
Expiration-Date: Wed Mar 9 08:00:00 2011
Last Req Status: Processed response successfully
Last Req Sent Time: 13:38:49 UTC Wed Feb 9 2011
Woo! it has succesfully registered! Now we begin to do our config for each of the categories/websites.
The first thing we should do is modify a few default parameters:
parameter-map type urlfpolicy trend trend-URLFiltering-Params
max-request 2147483647
max-resp-pak 1000
allow-mode on
block-page message "Blocked Page"
This is my configuration, block-page message chooses your message to be shown on blocked pages. You can also do block-page redirect if you want to send people to a certain webpage should they try and get to a restricted site. Max-request and max-resp-pak are both fine tuning the http request/response parameters and you can safely ignore these and leave them default. I have just modified mine to try and speed thing's up a bit.
allow-mode on or off control's what happens when the trend micro site cannot be contacted, should you just be allowed to browse or not? mode on means you can always browse, mode off obviously means you cannot.
The next step is to configure some class-maps to define what categories/reputations you want to block.
enter:
conf t
class-map type urlfilter trend match-any block_category
match url category ?
when you press the question mark you will be given a list of categories that the trend system can match against. Enter one category per line, then simply enter another match url category command to add more categories.
Once your done with that, set another class-map up for reputation, here's an example of one I have configured:
class-map type urlfilter trend match-any block_reputation
match url reputation ADWARE
match url reputation DIALER
match url reputation PHISHING
match url reputation SPYWARE
Once you have done that, you need to configure a class-map that matches HTTP traffic so we can inspect it later.
class-map type inspect match-all http-class
match protocol http
Next, we need to create our policy-map which contains our class maps for url filtering we just configured above.
policy-map type inspect urlfilter TrendURLFiltering_Policy
parameter type urlfpolicy trend trend-URLFiltering-Params
The command listed above defines your policy and then says that the trend-URLFiltering-Params parameter map we mentioned above should apply to this URL filtering policy. So you could configure diffirent parameters and indeed diffirent policies for diffirent interfaces/VLAN's should you so desire (but because this is policy-based config you could do all sorts of funky things that are beyond the scope of this article. But just as an example you could say never inspect traffic from a particular IP Address no matter what, or for example you could only apply this URL filtering to your guest wireless subnet.)
next we define what we want to do with each of our traffic types:
class type urlfilter trend block_reputation
reset
log
class type urlfilter trend block_category
reset
log
as you can see in this example, we are blocking and resetting any sites that fit into the categories I listed above.
OK, so far so good, next we need to define a normal zone-security policy. Zone-Security is a whole topic in and of itself. In this example I am giving below I am just allowing all traffic through, this is PROBABLY NOT A GOOD IDEA! But zone-security is a totally seperate topic and I know some of you just want to see this content filtering work. So for the sake of this article I have allowed all traffic which is probably not something you would want to do in production.
OK. Here goes:
policy-map type inspect firewall_policy
class type inspect http-class
inspect
service-policy urlfilter TrendURLFiltering_Policy
class class-default
pass
So, in this configuration I am saying match all http traffic and inside that http traffic apply the TrendURLFiltering policy. Then I have a class class-default which allows all traffic.
Next, you need to define some security zone members:
zone security inside
zone security outside
In my example, we have a very simple network of inside and outside.
Next, we define a security policy for when inside zones talk to outside zones:
zone-pair security insideoutside source inside destination outside
service-policy type inspect firewall_policy
I also then created a outsidein zone-pair to allow the return traffic, I will show the config for that here but I am not going to explain it because if you don't get what I am doing here you should not put this on a production network.
policy-map type inspect outside_in
class class-default
pass
zone-pair security outsidein source outside destination inside
service-policy type inspect outside_in
Ugh, let's pretend we did not see that.
Ok, once this is done. you just need to make each of your interfaces members of the zones:
on your outside int
int fa0/0 <(replace fa0/0 with your outside int)
zone-member security outside
!
int fa0/1 <(replace fa0/1 with your inside int)
zone-member security inside
!
Done! You should now have URL filtering. if you have log turned on if you visit a common website like cnn.com you should note advertisements being blocked if you used my reputation map listed above. A great way to test is to add news to your category filter class-map shown above and visit http://news.com.au, it should be blocked.
I hope this helped someone out there! If anyone wants an article on zone-security. Please respond in the comment section below! I will endeavor to write a good one.
Today I wanted to talk about a feature called Cisco IOS Content Filter, this extremely handy feature is available on all ISR routers and some 880 Series routers running At least Advanced Security or Advanced IP Services and with IOS 12.4T.
The feature basically provides a way to do URL filtering. But when doubled with a Trend Micro Subscription available on the router, filters dynamically. So every time you get a HTTP web page, for example, google.com, the site is checked against Trend Micro's URL database and categorized into one of several categories (News, Blog, Social, or pornography, illegal drug use, etc.) It will also categorize the sites "Reputation" (Example: adware site, phising site) and report that back. Based on this info the page can be blocked and a log message produced on your router.
The database is centrally located at trend micro, every time you make a URL request the request is checked against Trend Micro's service and then the category/reputation are returned to your router.
You can even block advertisements with it!
You can manually set sites as part of a white list and a black list too if you so desire, and choose a "failover mode" which basically means if it fails to get the reputation/category because TRPS is down or something else is wrong should it allow or fail.
The whole thing is configured in the IOS router. A 30 day trial is available so you can test it to see how well it is going to work for you.
With all this in mind, Let's talk about how you go ahead and configure it!
First thing, there is a few steps you need to do before you just dive in and do the configuration
DON"T JUST READ MY CONFIG EXAMPLE: READ THIS PART FIRST
--------------------------------------------------------------------------
1. Login to your router and execute show diag
You will find:
Slot 0:
C2801 2FE 4SLOT Mainboard Port adapter, 4 ports
Port adapter is analyzed
Port adapter insertion time 5w0d ago
EEPROM contents at hardware discovery:
MAC Address block size : 34
Product (FRU) Number : CISCO28XX
Version Identifier : VN/A
Processor type : 86
Chassis Serial Number : FXXXXXXX
Take a note of your chassis serial number and product number.
Next, head on over to:
http://www.cisco.com/go/license/
Login with your CCO username and password.
Next, go to:
"Click here for available licenses"
scroll down until you see:
Cisco IOS Content Filtering Service Demo License
Click on the link, fill in your details and the chassis serial and product number you noted down earlier.
You will receive an email, that's all you need to do for the trial license, you don't need to install any license on your router: your router identifies itself to trend when it goes to get the updates and this identity is checked against the chassis serial number and product number trend has registered in it's database.
OK good, now that's done here is the next step.
Is your router directly connected to the internet with a public IP address? Good.
enable IP http server on it with the following command:
ip http server
enable it for secure server too
ip http secure-server
you might also need to enable the http server to use an authentication method, the easiest way is probably local.
ip http authentication local
browse to your router via https:// and make sure a webpage does respond. Be careful that none of your outside access-lists are blocking HTTPS access, you will need it for this step. Make sure you know the username.
Ok, with that done, go to this URL:
http://www.cisco.com/en/US/products/ps5854/products_configuration_example09186a0080816c23.shtml
Scroll down until you see
AV Firewall Device Provisioning
Put in the public IP of your router and click submit, you will be asked for your username and password to the router. What this is doing in this stage is installing the PKI certificate used by the Cisco router to communicate securely to Trend Micro's reputation/category database.
Hopefully you receive a successful message and we are ready to start the configuration!
First, login to your router and ping the following hostname:
ping trps.trendmicro.com
Take the IP address that is returned by this and configure it as a static host entry on your router. Note that if you don't have DNS turned on on your router (so the above command fails to resolve the hostname) pinging from your desktop PC is O.K. too, just execute the following:
config t
ip host trps.trendmicro.com
Once that's done, make sure you can ping trps.trendmicro.com from your router.
Next, ensure the clock on your router is accurate:
PeterCCIE18371#show clock
13:36:46.610 UTC Wed Feb 9 2011
This is important so that the certificate is shown as valid.
Next, enter the following configuration:
conf t
parameter-map type trend-global global-param-map
server trps.trendmicro.com
This configures the site where the router will obtain its updates.
Now the big moment, in command exec mode (not config mode) execute:
trm register
here's an example of a succesful registration:
PeterCCIE18371#trm register
Translating "trps.trendmicro.com"...domain server (192.231.203.132) (192.231.203.3)
Processing registration request
Please run 'show ip trm subscription status' to get more info
PeterCCIE18371#show ip trm subscription status
Package Name: Security & Productivity (Trial)
------------------------------------------------
Status: Active
Status Update Time: 13:38:51 UTC Wed Feb 9 2011
Expiration-Date: Wed Mar 9 08:00:00 2011
Last Req Status: Processed response successfully
Last Req Sent Time: 13:38:49 UTC Wed Feb 9 2011
Woo! it has succesfully registered! Now we begin to do our config for each of the categories/websites.
The first thing we should do is modify a few default parameters:
parameter-map type urlfpolicy trend trend-URLFiltering-Params
max-request 2147483647
max-resp-pak 1000
allow-mode on
block-page message "Blocked Page"
This is my configuration, block-page message chooses your message to be shown on blocked pages. You can also do block-page redirect if you want to send people to a certain webpage should they try and get to a restricted site. Max-request and max-resp-pak are both fine tuning the http request/response parameters and you can safely ignore these and leave them default. I have just modified mine to try and speed thing's up a bit.
allow-mode on or off control's what happens when the trend micro site cannot be contacted, should you just be allowed to browse or not? mode on means you can always browse, mode off obviously means you cannot.
The next step is to configure some class-maps to define what categories/reputations you want to block.
enter:
conf t
class-map type urlfilter trend match-any block_category
match url category ?
when you press the question mark you will be given a list of categories that the trend system can match against. Enter one category per line, then simply enter another match url category command to add more categories.
Once your done with that, set another class-map up for reputation, here's an example of one I have configured:
class-map type urlfilter trend match-any block_reputation
match url reputation ADWARE
match url reputation DIALER
match url reputation PHISHING
match url reputation SPYWARE
Once you have done that, you need to configure a class-map that matches HTTP traffic so we can inspect it later.
class-map type inspect match-all http-class
match protocol http
Next, we need to create our policy-map which contains our class maps for url filtering we just configured above.
policy-map type inspect urlfilter TrendURLFiltering_Policy
parameter type urlfpolicy trend trend-URLFiltering-Params
The command listed above defines your policy and then says that the trend-URLFiltering-Params parameter map we mentioned above should apply to this URL filtering policy. So you could configure diffirent parameters and indeed diffirent policies for diffirent interfaces/VLAN's should you so desire (but because this is policy-based config you could do all sorts of funky things that are beyond the scope of this article. But just as an example you could say never inspect traffic from a particular IP Address no matter what, or for example you could only apply this URL filtering to your guest wireless subnet.)
next we define what we want to do with each of our traffic types:
class type urlfilter trend block_reputation
reset
log
class type urlfilter trend block_category
reset
log
as you can see in this example, we are blocking and resetting any sites that fit into the categories I listed above.
OK, so far so good, next we need to define a normal zone-security policy. Zone-Security is a whole topic in and of itself. In this example I am giving below I am just allowing all traffic through, this is PROBABLY NOT A GOOD IDEA! But zone-security is a totally seperate topic and I know some of you just want to see this content filtering work. So for the sake of this article I have allowed all traffic which is probably not something you would want to do in production.
OK. Here goes:
policy-map type inspect firewall_policy
class type inspect http-class
inspect
service-policy urlfilter TrendURLFiltering_Policy
class class-default
pass
So, in this configuration I am saying match all http traffic and inside that http traffic apply the TrendURLFiltering policy. Then I have a class class-default which allows all traffic.
Next, you need to define some security zone members:
zone security inside
zone security outside
In my example, we have a very simple network of inside and outside.
Next, we define a security policy for when inside zones talk to outside zones:
zone-pair security insideoutside source inside destination outside
service-policy type inspect firewall_policy
I also then created a outsidein zone-pair to allow the return traffic, I will show the config for that here but I am not going to explain it because if you don't get what I am doing here you should not put this on a production network.
policy-map type inspect outside_in
class class-default
pass
zone-pair security outsidein source outside destination inside
service-policy type inspect outside_in
Ugh, let's pretend we did not see that.
Ok, once this is done. you just need to make each of your interfaces members of the zones:
on your outside int
int fa0/0 <(replace fa0/0 with your outside int)
zone-member security outside
!
int fa0/1 <(replace fa0/1 with your inside int)
zone-member security inside
!
Done! You should now have URL filtering. if you have log turned on if you visit a common website like cnn.com you should note advertisements being blocked if you used my reputation map listed above. A great way to test is to add news to your category filter class-map shown above and visit http://news.com.au, it should be blocked.
I hope this helped someone out there! If anyone wants an article on zone-security. Please respond in the comment section below! I will endeavor to write a good one.
VCP Rants - DRS, DRS Clusters, Maintanence Mode
--- VCP RANT ---
Hey guys, here comes a VCP rant!
This post assumes you already have some knowledge of VMotion in VMWARE, just a super quick refresher on VMotion: Vmotion allows one ESX Server running a Guest VM to "migrate" the Guest VM over to another ESX server with a very very small amount of downtime, it does this by using shared storage and copying the memory from one ESX server to the "target" ESX server, this allows you migrate a VM from one machine to another so that you can perform maintance on a physical host without causing any downtime. When configured correctly vmotion results in essentially no downtime when migrating a host.
OK, so today I am going to talk a little bit about clusters in ESX, a cluster in ESX is essentially a grouping of ESX/ESXi hosts in Vcenter, you would normally group together hosts that run the same CPU. The reason for this is that a DRS cluster uses lots of features such as Vmware HA and VMOTION (more on that later) that assume that all the hosts in the DRS cluster have compatible CPU's (same brand of CPU, same family of CPU)
OK, so hopefully I have explained a Cluster a little bit, now when you create a cluster, your asked if you want to enable the hosts for DRS, and given an option for the "automation level" between fully automated, partially automated and manual, just what the heck is that all about?
First of all, DRS stands for Dynamic Resource Scheduling, it serves two purposes:
1. Whenever a new VM is started, DRS chooses an appropriate ESX server to run the VM on based on CPU load, memory etc. being utilized by each of the hosts. This is called intelligent placement
2. Based on usage and load across the ESXi hosts, DRS will either recommend or execute Vmotion changes on the vm's to more evenly distribute the load amongst the available ESX hosts.
When you first setup DRS, you will be given three options, fully automated, partially automated and manual.
Manual
---------
Manual requires an administrator to make and approve any changes DRS recommends, this includes the placement of newly started VM's, when you start a VM with manual mode a dialog box will pop up showing recommendations on which hosts the vcenter server thinks you should run the VM on based on resource usage across the hosts. Each option will also be given a "priority" with higher priority being more recommended. DRS will also suggest migrations to you (find them under the DRS tab) but will never execute them without your permission.
Partially Automated
----
This works almost exactly the same as manual mode but when a VM is started a host is chosen automatically without any administrator intervention.
Fully Automated
-----
Fully automated will both start VM's on the DRS recommended hosts and execute certain DRS recommendations, the recommendations it will execute depends on the level of automation you select when you select fully automated, these range from aggressive to conservative, there are 5 options available, which is no coincidence, because each recommendation by DRS is given a "stars" rating, with 5 being a high recommendation, the level of automation you choose selects what "star" level of recommendation is executed.
So, now lets talk briefly about maintanence mode.
If your anything like me, you have sometimes right-clicked a host in ESXi and noticed "enter maintanence mode" and wondered just what the heck that is, and how it works. Maybe, like me you have been lambasted by one of your VMWARE coworkers who has got upset at you for "not entering maintance mode first" on an ESXI host before shutting it down.
So what does it actually do? Maintanence mode prevents an ESXi host from being picked by DRS to run any new VM's, no VM's will be allowed to startup on a host that has entered maintanence mode. Also, every VM that is currently running on the host will be given a five star recommendation to be migrated off, the idea being that all the VM's can be migrated off so you can run the maintence, like a patch perhaps, hence the term maintanence mode.
I hope this explains that part.
Now finally, it's worth talking about DRS rules, you can override individual virtual machines DRS levels, for example you might decide that there is a critical VM that you don't want to move between hosts in the cluster unless you do it manually, you could set the DRS level for that individual VM to manual or even disable completely (although thats not recommended.)
DRS rules also allow you to do things like set VM affinity or anti-affinity, this allows you to say "Make sure these two VM's try not to run on the same ESX host" or "always run these VM's on the same ESX host"
Why might that be useful? Consider an example of an exchange server with two hub transport machines for redundancy, if your DRS moves both the Hub Transport VM's to the same ESXi Host you now have a physical single point of failure for your hub transport servers, this might not be what you had in mind :p
By setting affinity you can prevent these VM's from running together. Ofcourse these rules are overwritten if the rules would actually take the VM down, for example, in our previous scenario if you lost all your ESXi hosts except for one, VMware HA would still allow both the Exchange hub transports to be run on the same host, even though thats less than optimal, its probably better than not running them at all!
I hope i helped someone out there!
Hey guys, here comes a VCP rant!
This post assumes you already have some knowledge of VMotion in VMWARE, just a super quick refresher on VMotion: Vmotion allows one ESX Server running a Guest VM to "migrate" the Guest VM over to another ESX server with a very very small amount of downtime, it does this by using shared storage and copying the memory from one ESX server to the "target" ESX server, this allows you migrate a VM from one machine to another so that you can perform maintance on a physical host without causing any downtime. When configured correctly vmotion results in essentially no downtime when migrating a host.
OK, so today I am going to talk a little bit about clusters in ESX, a cluster in ESX is essentially a grouping of ESX/ESXi hosts in Vcenter, you would normally group together hosts that run the same CPU. The reason for this is that a DRS cluster uses lots of features such as Vmware HA and VMOTION (more on that later) that assume that all the hosts in the DRS cluster have compatible CPU's (same brand of CPU, same family of CPU)
OK, so hopefully I have explained a Cluster a little bit, now when you create a cluster, your asked if you want to enable the hosts for DRS, and given an option for the "automation level" between fully automated, partially automated and manual, just what the heck is that all about?
First of all, DRS stands for Dynamic Resource Scheduling, it serves two purposes:
1. Whenever a new VM is started, DRS chooses an appropriate ESX server to run the VM on based on CPU load, memory etc. being utilized by each of the hosts. This is called intelligent placement
2. Based on usage and load across the ESXi hosts, DRS will either recommend or execute Vmotion changes on the vm's to more evenly distribute the load amongst the available ESX hosts.
When you first setup DRS, you will be given three options, fully automated, partially automated and manual.
Manual
---------
Manual requires an administrator to make and approve any changes DRS recommends, this includes the placement of newly started VM's, when you start a VM with manual mode a dialog box will pop up showing recommendations on which hosts the vcenter server thinks you should run the VM on based on resource usage across the hosts. Each option will also be given a "priority" with higher priority being more recommended. DRS will also suggest migrations to you (find them under the DRS tab) but will never execute them without your permission.
Partially Automated
----
This works almost exactly the same as manual mode but when a VM is started a host is chosen automatically without any administrator intervention.
Fully Automated
-----
Fully automated will both start VM's on the DRS recommended hosts and execute certain DRS recommendations, the recommendations it will execute depends on the level of automation you select when you select fully automated, these range from aggressive to conservative, there are 5 options available, which is no coincidence, because each recommendation by DRS is given a "stars" rating, with 5 being a high recommendation, the level of automation you choose selects what "star" level of recommendation is executed.
So, now lets talk briefly about maintanence mode.
If your anything like me, you have sometimes right-clicked a host in ESXi and noticed "enter maintanence mode" and wondered just what the heck that is, and how it works. Maybe, like me you have been lambasted by one of your VMWARE coworkers who has got upset at you for "not entering maintance mode first" on an ESXI host before shutting it down.
So what does it actually do? Maintanence mode prevents an ESXi host from being picked by DRS to run any new VM's, no VM's will be allowed to startup on a host that has entered maintanence mode. Also, every VM that is currently running on the host will be given a five star recommendation to be migrated off, the idea being that all the VM's can be migrated off so you can run the maintence, like a patch perhaps, hence the term maintanence mode.
I hope this explains that part.
Now finally, it's worth talking about DRS rules, you can override individual virtual machines DRS levels, for example you might decide that there is a critical VM that you don't want to move between hosts in the cluster unless you do it manually, you could set the DRS level for that individual VM to manual or even disable completely (although thats not recommended.)
DRS rules also allow you to do things like set VM affinity or anti-affinity, this allows you to say "Make sure these two VM's try not to run on the same ESX host" or "always run these VM's on the same ESX host"
Why might that be useful? Consider an example of an exchange server with two hub transport machines for redundancy, if your DRS moves both the Hub Transport VM's to the same ESXi Host you now have a physical single point of failure for your hub transport servers, this might not be what you had in mind :p
By setting affinity you can prevent these VM's from running together. Ofcourse these rules are overwritten if the rules would actually take the VM down, for example, in our previous scenario if you lost all your ESXi hosts except for one, VMware HA would still allow both the Exchange hub transports to be run on the same host, even though thats less than optimal, its probably better than not running them at all!
I hope i helped someone out there!
VCP related studies - Memory in VMWARE reservations, limits and memory overcommit.
Hey Guys
--------------- VCP Rant -------------------------------
I might have to rename this blog to VCPRants soon enough :) I am busy chasing my VCP or VMWare certified Professional,
Cisco Guys, let me tell you that your highly likely to run into Vmware sooner than you think. The new UC on UCS stratergy from cisco means that all unified communications products will soon be running under VMWare.
With this in mind, I wanted to make sure I understood VMWare very well, so I can do the best possible job with the next generation UC.
This blog article will be the first in a series on VMWare, these blog posts do assume you at least have some rudimental knowledge on what virtual machines are and a reasonable understanding of what ESX is
----------------------------- End Rant -----------------
Now onto business, this blog article is going to talk about Memory in VMWare.
ESX/ESXi is the only commercially available hypervisor that I am aware of (please leave a comment if you know otherwise!) that supports memory overcommit, or the act of provisioning more memory for virtual machines than a host actually has.
Lets take a quick example, I have an ESX Host, HostMachine, this HostMachine has 4 gig of ram, if i want to create four virtual machines, each assigned 1 gig of ram, without memory overcommit, i could only provision 4 virtual machines (in reality, it would be slightly less than 4 gig of ram available to my virtual machines because of ESX overheads but lets ignore that for a minute.)
With memory overcommit, vmware allows you to overcommit memory, so in our example above , we could create 8 hosts, each with 1 gig of memory assigned and run all 8 of them at the same time. ESX looks after memory usage using three key technologies:
1. Idle Page Reclamation
this technology reclaims any idle pages in memory and allows other virtual machines to use them
2. Transparent Page sharing
if two virtual machines have the exact same memory contents in a particular memory page, this single page will be shared amongst both the virtual machines (lets say for example, two virtual machines running the exact same version of windows, probably quite a few bits of memory that are going to contain exactly the same information)
3. Ballooning
This feature relies on vmware tools being installed on the guest OS, but allows Vmware to tell the vmware tools driver on the guest OS to start grabbing memory, it can then return that memory to the ESX host and the ESX host can then allocate it to other virtual machines in a process called "inflation", memory can be returned when not needed using a process called, you guessed it: deflation.
My favorite tech of the above is definitely ballooning, what a brilliant idea.
Ok, so now you know how VMWare can share and overcommit memory, what about controlling access to memory, after all, memory is a finite resource. Plus what happens when there is simply no other memory available?
Well VMware uses swap file memory, much like windows, in the event that no physical memory is actually available. This .vswp extension file sits by default in the same directory as all the other files for the vmware machine. Its size is the same size as the memory allocated to the virtual machine, so in our example above the machines would have 1 gig swap files. This file is used as a last resort should there litreally be no other memory available to be used even with the three technologies mentioned above.
But Disk is slow! Incredibly slow compared to ram, up to 800,000 times slower. So how can you ensure your important mission critical virtual machines can be allocated REAL physical RAM rather than being paged onto this swap file? The answer in VMWARE is reservations and limits.
Go to Edit Settings under your virtual machine then to resources, then memory. You will see you can set reservations and limits, by default the settings are
reservations: 0 MB
Limit: Unlimited
Reservations control how much physical RAM _must_ be available to the Virtual machine before it will even be allowed to turn on. This ensures that the machine has an acceptable amount of memory available before it will boot. it also ensures that no other virtual machines can en-roach upon this memory. So for our example, lets say of our four virtual machines one of them is our ARC Attendant Console server, its mission critical so we want to ensure it gets at least 512 MB of physical RAM, we set the reservation to 512.
Limit controls how much of the memory assigned to the virtual machine can actually be physical memory. So for example, if on our ARC server we decided that the machine needed no more than 768 MB of memory, but might occasionally burst to 1 gig, we could set the limit to 768. THis means that once the virtual machine is using 768 meg of physical memory, any additional memory it needs over and above this to its configured memory limit (1 gig) will be stored on the swap file.
So Reservation guarantees that the virtual machine will be allocated at LEAST that amount of physical memory, the limit sets a limit to how much physical ram the virtual machine can have before it has to start using swap file and the configured memory is how much memory the OS can actually use.
I hope this helps a studying VCP out there!
--------------- VCP Rant -------------------------------
I might have to rename this blog to VCPRants soon enough :) I am busy chasing my VCP or VMWare certified Professional,
Cisco Guys, let me tell you that your highly likely to run into Vmware sooner than you think. The new UC on UCS stratergy from cisco means that all unified communications products will soon be running under VMWare.
With this in mind, I wanted to make sure I understood VMWare very well, so I can do the best possible job with the next generation UC.
This blog article will be the first in a series on VMWare, these blog posts do assume you at least have some rudimental knowledge on what virtual machines are and a reasonable understanding of what ESX is
----------------------------- End Rant -----------------
Now onto business, this blog article is going to talk about Memory in VMWare.
ESX/ESXi is the only commercially available hypervisor that I am aware of (please leave a comment if you know otherwise!) that supports memory overcommit, or the act of provisioning more memory for virtual machines than a host actually has.
Lets take a quick example, I have an ESX Host, HostMachine, this HostMachine has 4 gig of ram, if i want to create four virtual machines, each assigned 1 gig of ram, without memory overcommit, i could only provision 4 virtual machines (in reality, it would be slightly less than 4 gig of ram available to my virtual machines because of ESX overheads but lets ignore that for a minute.)
With memory overcommit, vmware allows you to overcommit memory, so in our example above , we could create 8 hosts, each with 1 gig of memory assigned and run all 8 of them at the same time. ESX looks after memory usage using three key technologies:
1. Idle Page Reclamation
this technology reclaims any idle pages in memory and allows other virtual machines to use them
2. Transparent Page sharing
if two virtual machines have the exact same memory contents in a particular memory page, this single page will be shared amongst both the virtual machines (lets say for example, two virtual machines running the exact same version of windows, probably quite a few bits of memory that are going to contain exactly the same information)
3. Ballooning
This feature relies on vmware tools being installed on the guest OS, but allows Vmware to tell the vmware tools driver on the guest OS to start grabbing memory, it can then return that memory to the ESX host and the ESX host can then allocate it to other virtual machines in a process called "inflation", memory can be returned when not needed using a process called, you guessed it: deflation.
My favorite tech of the above is definitely ballooning, what a brilliant idea.
Ok, so now you know how VMWare can share and overcommit memory, what about controlling access to memory, after all, memory is a finite resource. Plus what happens when there is simply no other memory available?
Well VMware uses swap file memory, much like windows, in the event that no physical memory is actually available. This .vswp extension file sits by default in the same directory as all the other files for the vmware machine. Its size is the same size as the memory allocated to the virtual machine, so in our example above the machines would have 1 gig swap files. This file is used as a last resort should there litreally be no other memory available to be used even with the three technologies mentioned above.
But Disk is slow! Incredibly slow compared to ram, up to 800,000 times slower. So how can you ensure your important mission critical virtual machines can be allocated REAL physical RAM rather than being paged onto this swap file? The answer in VMWARE is reservations and limits.
Go to Edit Settings under your virtual machine then to resources, then memory. You will see you can set reservations and limits, by default the settings are
reservations: 0 MB
Limit: Unlimited
Reservations control how much physical RAM _must_ be available to the Virtual machine before it will even be allowed to turn on. This ensures that the machine has an acceptable amount of memory available before it will boot. it also ensures that no other virtual machines can en-roach upon this memory. So for our example, lets say of our four virtual machines one of them is our ARC Attendant Console server, its mission critical so we want to ensure it gets at least 512 MB of physical RAM, we set the reservation to 512.
Limit controls how much of the memory assigned to the virtual machine can actually be physical memory. So for example, if on our ARC server we decided that the machine needed no more than 768 MB of memory, but might occasionally burst to 1 gig, we could set the limit to 768. THis means that once the virtual machine is using 768 meg of physical memory, any additional memory it needs over and above this to its configured memory limit (1 gig) will be stored on the swap file.
So Reservation guarantees that the virtual machine will be allocated at LEAST that amount of physical memory, the limit sets a limit to how much physical ram the virtual machine can have before it has to start using swap file and the configured memory is how much memory the OS can actually use.
I hope this helps a studying VCP out there!
Important new section of Unity Connection 8.5 readme
Synchronizing Connection and Exchange Mailboxes (Single Inbox)
You can configure Connection to synchronize voice messages between Connection mailboxes and the corresponding Exchange mailboxes. When single inbox is enabled for a user, all voice messages, including those sent from Cisco ViewMail for Microsoft Outlook, are first stored in Connection and are immediately replicated to the Exchange mailbox for the recipient. Voice messages appear in the Outlook inbox for the user, alongside email and faxes, and also appear in the Connection mailbox for the user.
For Connection 8.5(1), single inbox will support only Exchange 2010. Support will be added for Exchange 2003 in the first quarter of calendar year 2011, and support for Exchange 2007 will be added in the second quarter of calendar year 2011. When support for a version of Exchange is added, the "Unified Messaging Requirements: Synchronizing Connection and Exchange Mailboxes (Single Inbox) (Connection 8.5 and Later Only)" section in the System Requirements for Cisco Unity Connection Release 8.x will be updated with that information.
Subscribe to:
Posts (Atom)