HP Virtual Connect Flex-10 for the HP C7000 BladeSystem is a fantastic piece of kit. It essentially allows you to ‘chop up’ 10 GBit of bandwidth in to  1-4 FLEX NICs. This was great news to VMware admins as it provided an effective way to present dedicated bandwidth. Virtual machine, Storage (iSCSI/NFS), vMotion, Fault Tolerance and even the Service Console could all be allocated bandwidth out of the 10Gbit as required. Here’s a Flex-10 Video.

This was a great feature and created a greater amount of flexibility with VMware, with just one draw back. A 2Gbit NIC assigned for vMotion traffic will get just that, up to 2Gbit. If utilisation is at say, 20% on other FLEX NICs, the bandwidth of our vMotion FLEX NIC will not ‘balloon’ automatically to take advantage of the spare bandwidth available.

Network I/O Control adds more flexibility

VMware ESX/ESXi 4.1 changed all of this with the introduction of Network I/O Control (or NIOC as some call it). We are now able to prioritise traffic at the vNetwork Distributed Switch eliminating the need to carve up the 10Gbit NIC in the first place, creating even more flexibility in our virtual environments.

In the image above you can see that the total network bandwidth capacity is 20Gbit and that Network I/O Control is enabled. The shares value’s can now be tweaked to dynamically look after our traffic and contention.

To save my ageing fingers, the image above and this quote are from the technical whitepaper on vSphere 4.1 Networking.

For example, assume we have a 10GbE link, with virtual-machine traffic set to 100 shares, vMotion traffic set to 50 shares, and VMware FT logging traffic set to 50 shares. If virtual-machine traffic and vMotion traffic are both contending for the 10GbE link, then the virtual-machine traffic (100 shares) will get 67% (6.7Gbps) of the link, and vMotion (50 shares) will get 33% (3.3Gbps) of the link. If we have all three of these traffic types active and contending for the link, then virtual-machine traffic (100 shares) will get 50% (5Gbps), vMotion (50 shares) will get 25% (2.5Gbps), and VMware FT logging (50 shares) will get 25% (2.5Gbps). If no other traffic types are contending for the link at that moment, then each traffic type can consume the entire link (or up to the host limit, if set).

So to me it is clear that the best method to associate bandwidth to VMware using Flex-10 would be to present 10Gbit FLEX NICs and using the shares and limits within vSphere to mould the bandwidth in to shape.

Would be interested to hear anyone else’s thoughts on this as I haven’t had chance to benchmark speed tests yet.

Download and install Ubuntu Linux

• Download Ubuntu from here – I went for the 64bit version.
• Installation is pretty basic.
• If you’re not using DHCP, set an IP address in System > Preferences > Network Connections.
• Once installed login to your desktop and head to Applications > Accessories > Terminal.

Install squid-cache proxy

• Install squid. In the terminal window type: sudo aptitude install squid squid-common and press enter.
• Set the permissions. Still in terminal: sudo chown -R proxy:proxy /var/log/squid/ && sudo chown proxy:proxy /etc/squid/squid.conf

Basic squid-cache configuration

• Let’s begin configuration: sudo nano /etc/squid/squid.conf
• There are few key things you will probably want to configure.
  • The “acl” access options. These allow or deny specific subnets access to the proxy/internet.
  • The “webmaster” contact email. This will set the webmaster email on the default squid (denied/not found) page and also ensure any issue reports are sent to the correct address.
  • The cache_dir options. Here we can specify the cache location, amount of cache to hold, and some subdirectory size settings.

To search within nano, the easy to use text editor in Ubuntu, use CTRL+W, as shown on the bottom bar in the editor.

Setting the acl access options

Search for acl all or use CTRL+V and CTRL+Y to scroll forward and back. Add or remove the networks you would like to enable squid-cache for. I added 192.168.0.0/24 and 192.168.123.0/24.

By default the access list localhost is allowed. If you opt to use localnet or another access list of your own you will need to scroll down a few lines and allow it using “http_access allow youraclname”.

Setting the webmaster contact email

Do a search for cache_mgr and add in the webmaster email address there. Scroll down a few lines and enable mail_program mail by uncommenting (deleting) the # in front of it.

Changing where to store the cache files

Do a search for cache_dir ufs. You will find a line similar to this cache_dir ufs /var/spool/squid 10000 16 256.

In my example the first part is the squid filesystem type and location. 10000 is the storage in MBytes, the default is 100. 16 and 256 are the number of Level1 and Level2 directories. Read more on cache_dir here.

Testing the configuration

Important: Whenever changes are made to the squid.conf or any other squid configuration file the squid daemon must be restarted.

From terminal: sudo service squid restart

Once you have restarted squid open up your browser and change your proxy settings to the IP address of your squid box with port 3128. Open up a random website you know wouldn’t resolve e.g http://www.squid.rox/ to test the proxy is running. You should get an error like Generated Tue, 24 Aug 2010 16:55:49 GMT by squid (squid/2.7.STABLE7). Next open up a few valid websites to build up the squid cache.

Validating the caching is working

Switch back to your Ubuntu Linux Squid (Squid-cache) box and open up a terminal. If you changed your cache_dir location like I did then do sudo ls -laFo /var/spool/squid/ else, substitute the path for yours.

There you have it – a basic squid-cache (squid) proxy setup running on Ubuntu Linux.

Have a nice day!

On Saturday 21st August at 13:00 I sat down to take my VCP exam for the second time, after failing just 9 days before.

I was nervous yet confident. The same feeling I had before. This is what scared me the most. The difference this time was that I had prepared. I was ready to pass this thing and pass it good I did, with a rather pleasing score of 456 in just under 45 mins.

The wrong approach

I made a stupid mistake. By studying mainly configuration maximums after being advised time and again a that the exam would be made up almost entirely of these questions, I had tunnelled my vision of the exam. I didn’t study other areas such as Guided Consolidation, NFS, etc… all of which are on the vSphere 4.1 Exam Blueprint.

Failing the exam with a score of 255 wounded me. I was so shocked by the grade that I actually called VMware’s Education department to double check that my answers had transmitted across properly.

Never one to let failure drag me down I made it my mission to pass the exam 7 days later, the minimum time to wait before a re-book.

A better approach

I went back to the drawing board. I thought to myself, instead of learning what others advised will be on the exam i’ll just learn everything.

The 7 days wait until I could re-book the exam gave me a window of time to study and redeem myself. Here’s how I did it.

• Print out the vSphere 4.1 Exam Blueprint. Highlight each of the areas once completed. Study this thing daily. It’s what will be on the exam.
• Practice in the labs. There’s a great open source NFS/iSCSI solution called Openfiler. Team this with VMware Workstation and ESXi and you have a lightweight easy to deploy lab.
• Mock exams. VMware University and SLOG have some good free VCP mock exams. Use these as a guide… when you’re getting 90%+ every time on these it doesn’t necessarily mean you’re ready.
• Study regularly. Keeping the information flowing works well for me, everybody is different. I studied every night for at least 2 hours over the 7 days gap. I think you could study and pass the VCP exam in 2 weeks if you wanted it badly enough, but don’t rush.

Simon Long (@SimonLong_) has a great post where he links out to study material directly from the exam blueprint. Some links are 4.0 but at the moment a lot still of these are relevant. Check them out here.

Gregg Robertson (@GreggRobertson5) has this post and this post which could be of help.

Conclusion

Passing the VCP isn’t easy but it is far from impossible. If you follow this guide, studying and understanding everything in the exam blueprint, and you will pass.

Good luck!

Active Directory
The parameter is incorrect.
The transfer of the current Operations Master could not be performed.

The Fix

Download the Windows 2003 Support Tools (here) and install to your 2003 DC.

Once installed open up a cmd prompt and change to c:\program files (x86)\Support Tools\ and run ntdsutil.

Enter the following commands changing JKS-DC01 to your target (2008R2 in my case) server name.

Select “Yes” when a popup box asks if you would like to transfer the role.

A stream of text relating to your domain configuration will whizz past and all being well you’ll be presented with a prompt “fsmo maintenance:”.

Type Q, press enter.

Type Q again, press enter.

Next we check that all FSMO roles are transfered across with netdom query fsmo.

It isn’t good practice to keep all your eggs in one basket but this is ideal for migration.

Microsoft SQL Server 2005 Setup

An installation package for the product Microsoft SQL Server Native Client cannot be found. Try the installation again using a valid copy of the installation package ‘sqlncli_x64.msi’.

It appears that the default SQL Native Client (32bit) packaged with Windows 2003 R2 x64 causes the vCenter 4.1 installation to fail.

The fix for this is to remove the SQL Native Client from Add/Remove Programs and retry the vCenter 4.1 install.

I haven’t tested Windows 2008 or 2008R2 but i’m sure it would resolve if there were any issues.

get-vm MyVM | Get-View | Get-VIObjectByVIView | Update-Tools -NoReboot

Feel free to comment in other methods.

1. The access-list uses an inverted (or wildcard) subnet mask
2. Each VLAN will need it’s own IP address
3. Use “ip routing” instead of “ip default-gateway”
4. Apply the inter-vlan access-list using vlan i.e “ip access-group ACLNAME vlan”
5. Route to the internet using a default ip route

You could also use ip access-group ACLNAME in, or ip access-group ACLNAME out to apply the access-list on inbound or outbound traffic respectively.

Here is a look at the config.

; J8697A Configuration Editor; Created on release #K.14.34

hostname “CoreSw1″
ip access-list extended “ACL_INTERNAL”
10 permit ip 10.111.160.0 0.0.4.255 10.111.169.0 0.0.0.255
20 deny ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
exit
module 1 type J8706A
module 2 type J8702A
trunk B1-B4 Trk1 Trunk
trunk B13-B16 Trk2 Trunk
trunk A1 Trk11 Trunk
trunk A2 Trk12 Trunk
trunk A3 Trk13 Trunk
trunk A4 Trk14 Trunk
trunk A5 Trk15 Trunk
trunk A6 Trk16 Trunk
trunk A7 Trk17 Trunk
trunk A8 Trk18 Trunk
trunk A9 Trk19 Trunk
trunk A10 Trk20 Trunk
trunk A11 Trk21 Trunk
trunk A12 Trk22 Trunk
ip routing
vlan 1
name “Management”
untagged A13-A24,B8-B9,B12,B20-B21
ip address 192.168.0.1 255.255.255.0
tagged Trk1-Trk2,Trk11-Trk22
no untagged B5-B7,B10-B11,B17-B19,B22-B24
exit
vlan 160
name “Curric”
untagged B10
ip address 10.111.160.1 255.255.248.0
tagged Trk1-Trk2,Trk11-Trk22
ip access-group “ACL_INTERNAL” vlan
exit
vlan 169
name “Admin”
ip address 10.111.169.1 255.255.255.0
tagged Trk1-Trk2,Trk11-Trk22
ip access-group “ACL_INTERNAL” vlan
exit
vlan 920
name “WAN”
untagged B24
ip address 10.107.105.2 255.255.252.0
exit
ip route 0.0.0.0 0.0.0.0 10.107.105.1
snmp-server community “public” unrestricted
spanning-tree Trk1 priority 4
spanning-tree Trk2 priority 4
spanning-tree Trk11 priority 4
spanning-tree Trk12 priority 4
spanning-tree Trk13 priority 4
spanning-tree Trk14 priority 4
spanning-tree Trk15 priority 4
spanning-tree Trk16 priority 4
spanning-tree Trk17 priority 4
spanning-tree Trk18 priority 4
spanning-tree Trk19 priority 4
spanning-tree Trk20 priority 4
spanning-tree Trk21 priority 4
spanning-tree Trk22 priority 4
no autorun
password manager
password operator

Search your registry for IEHarden and remove it if it lives in Zone or ZoneMap. Simple.

Here’s what the location will look like but may differ depending on your version of Windows Server:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap

After you remove the keys (about 4) you will have to re-create your user profiles. Not an ideal fix but it works.

I haven’t found an easier way to do this so if anyone has input please share in the comments!

SSH to your OA and run the following:

UPDATE ILO ALL ftp://domain.com/ilo2_ver.bin

This will run through, check the current firmware and update as required. If an update isn’t required or the bay is empty it will skip.

Have a cuppa with the time you saved!

Outlook Web Access re-directs to the URL: https://xxx.yyy.local/owa/auth/logon…l/owa&reason=0

Run these commands in Power Shell to fix.

• Import-Module ServerManager
• Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server,Web-ISAPI-Ext,Web-Digest-Auth,Web-Dyn-Compression,NET-HTTP-Activation,RPC-Over-HTTP-Proxy -Restart