Author: lenzker

#VMware #Horizon App Volumes: Hints (for Performance and Packaging)

lenzker

Two weeks ago I had the pleasure to spent 4 days on problematic Applications within an App Volumes environment of a customer. The best thing that can happen to me as an infrastructure guy is to work on building AppStack with guys who know how to package and therefore troubleshoot those applications. Bringing together the knowledge from multiple domains helped us to fix the problems that we had so far with App Volumes.

Common issues we have been faced with:

  1. During the AppStack provisioning process an Application was not able to get installed
  2. (Crappy) Applications put user-data-files into C:\Windows
  3. Start-Up Performance of applications was really really slow (factor 20x slower)
  4. A mounted AppStack leads to a repair of Office-components

One of the common problems I have seen with App Volumes in the past. The infrastructure can be designed and delivered by an Infrastructure guy -> As soon as we talk about applications. We or more correct the organization that is planning to create AppStacks needs application packaging expertise.

So let’s make it quick. I will give you some hints how some of your problems might get solved.

Read more →

Using #VMware’s Unified Access Gateway (UAG) for internal #Horizon 7 connections – Design Discussion

lenzker

Over the last months I gathered more and more experience about VMware’s secure Linux appliance  that allows secure access to a virtual Desktop (and more) over an unsecure network (e.g.) the Internet: Unified Access Gateway (UAG).

Keep in mind the UAG is not just a replacement for the old Windows based Security Sever, it is also  offering much more functionality (Edge Services for Airwatch / Workspace One, reverse proxy, 2nd-factor authentication integration, etc.).

There might be use cases where we want to design our horizon environment in a way that we use the UAGs not just for external unsecure access, but internally as well.

Examples:

  • Offering access to internal users coming from a not so trust-worthy site/location (including a second-factor authentication for those users). // Access restricted via Firewalls/ACLs
  • Constraints to always use tunneled connections (because of network-simplicity or security constraints).

Read more →

vCenter Server Appliance Migration fails at 50%: shutting down source machine

lenzker

I love the vCenter Server Appliance. The migration works pretty well. Still from time to time I stumble across minor problems (which until now were always quite easy to workaround/fix).

One of this migration ‘issues’ I was faced with recently at a customers site.

We migrated a vCenter against an ESXi host which was using a distributed switch and the corresponding portgroup as a target network.

Since we add the virtual network adapter directly on the ESXi host to the distributed switch we need to have an ephemeral portgroup (otherwise only the vCenter could add the VMs network adapter to this portgroup).

The general process of the migration look like the following.

  • Deploy a new and empty vCenter Server appliance and connect it to the network
  • A temporary IP-address is given to this vCenter Server appliance
  • All relevant data of the source windows based vCenter Server is exported and transferrred over the network to the new vCenter Server appliance
  • When the whole data-set is transferred, shutdown the original vCenter and give the new vCSA the network identity of the original vCenter

Unfortunately the last step was not working properly. After a certain amount of time (and coffee) the migration process has stuck at 50% – Shutting down source machine

Read more →

Migration of the #Horizon View Composer to another machine (including a database migration from Oracle / Microsoft)

lenzker

Within the vSphere world we have currently one goal regarding our vCenter. Migrate it from a Windows based installation to the vCenter Server Appliance (vCSA).

The doing of this migration is pretty straight forward and works pretty well (e.g. here). But since we will shutdown the original vCenter VM based on Windows afterwards we need to make sure how to deal with applications that were running besides the vCenter.

We need to migrate them as well. Especially in case of the Horizon View Composer we need to do some proper planning, otherwise our linked-clones (which require the composer) cannot be created and maintained anymore (refresh, rebalance, recompose (R-R-R) operations).

Doing that migration is quite straight-forward. But we need to do some specific and not very well known tasks before we can do all of the steps.

Goal: Migrate the vCenter to the vCSA and get rid of all currently used Oracle Databases within the VMware vSphere & Horizon environment.

  1. Define a Maintenance windows and make sure no further Horizon View maintenance operations takes place (R-R-R).
  2. Backup the Horizon Composer Database with the included View backup mechanism.
  3. Create Windows Server for the Composer (compvm)
  4. Create a Database for the Composer and the corresponding ODBC connection.
  5. Restore the Backup on the compvm
  6. Repoint Horizon within the View Admin to the new Composer
  7. Test Maintenance Operations
  8. Clean up old databases.

Read more →

#vBeers Munich – Post #VMworld edition 26th October 2017

lenzker

###UPDATE: 26th October it is

The majority has decided. We will meet on the 26th October at around 6PM. Please enter your / any name in the doodle so that I can make a proper reservation.

DOODLE

####

After the success of the first #vBeers I have organized in Munich, I want to meet up with friends & community geeks who are interested in virtualization & beer/drinks.

Since I moderate from time to time the (famous) #beer2b in the center of Munich, I realized that a lot of useful input/information/thinking can come up as soon as you talk to other people in the field in a relaxed atmosphere. This will be the second edition of #vBeers in Munich. We had a group of 10-12 people at our first gathering. Let’s see if we can keep up with the number.

Since VMworld US and VMworld Europe has been passed and we worked out most of the news, I am pretty sure we will find great topics for further discussions.

virtmeetsbiergarten

###Update

WHEN? 26th October (Vote here). Please use your name/ email so that I can do a proper reservation.

WHERE? Augustiner Keller (Arnulfstr. 52, 80335 München)

Löwenbräu Keller (Nymphenburger Str 2 – München) – 18:30

IMPORTANT: If you want to come it would be great if you sign yourself up in the doodle mentioned so I can make sure we have enough space/seats for our meet-up.

Sponsored? Nope ;-( (BYOW – Bring your own wallet)

I deliver a NSX course to selected VMware Partner in Unterschleißheim. Therefore I hope to convince some of my participants to show up as well ;-)

 

Screen Shot 2016-05-06 at 10.14.24

 

PLEASE PUT YOURSELF INTO THE DOODLE SO THAT I CAN MAKE A PROPER RESERVATION.

DOODLE

Lenzker’s #VMware #Horizon Guide (Implementation): Restrict Internet Access To Specific Users

lenzker

Sometimes I really love the #vCommunity – Just kidding: I love them all of the time. I was confronted with a scenario where only certain users of a Horizon environment should be allowed to access their own Desktop via the Internet.

In general you have certain options to do some kind of restrictions:

  • Using Tags on the Connection Server and Create Desktop Pools that only allow the usage by Users coming from a tagged Connection Server
  • Using VMware vIDM (Identity Manager) and create conditonal access rules. This will work, but will also create some new overhead to implement vIDM in a high-available fashion.

Fortuneatly the EUC-Champion Slack Community came up with another idea I haven’t really heard about before (The feature was introduced with Horizon 7). Thx Sven and Joe for your help here.

Read more →

#VMworld 2017: Las Vegas in 198 seconds (Video) – Personal Insights

lenzker

Some of you know that I like doing some movies of tech-events/VMworld  after I have visited it. It has only been a few days since a fantastic VMworld in Las Vegas has been finished.

Once again I met fantastic people to talk about current products and issues within the usage of technology. Fantastic sessions like the NSX community leader summit and the EUC Champion Meet-Up gave me an opportunity to meet even more brilliant people out there in the field.

Maybe this video can serve for some of you as a nice memory. So please take the short time and have a look ;-) I am looking forward to any kind of feedback.

 

I hope to see most of you again next year and if we haven’t met! It’s time to change that!

#VMworld US 2017: End User Computing / VDI, announcements and releases

lenzker

During (and around) VMworld 2017 VMware has lifted many of their products to a new level to enable their customer a better and more agile software-defined datacenter than ever. Besides their datacenter portfolio VMware is pushing their vision of a digital workspace in the end-user computing field much further.

Horizon + Airwatch -> Workspace One try to combine all relevant subjects within the EUC field (Identities, Desktops, Applications, Devices, Policies, … ) within one single solution.

The following post summarize the EUC announcements within VMware’s current and upcoming products.

Read more →

#VMworld US 2017: Datacenter and Cloud products, announcements and releases

lenzker

During (and around) the general session at VMworld 2017 (US) VMware has talked about their idea how the future infrastructure within a public and private cloud can be managed.

For friends of VMware ‘s existing products hoping for any kind of bigger announcement the general session might have been a little bit disappointing. VMware’s focus are cloud services and how to manage/operate the private & public cloud.

To make you aware of all kind of changes / new releases within the current product portfolio and the new I tried to summarize key elements of the new products or releases surrounding the #VMworld conference. If new products show up or will be announced over the next days I will keep it updated.

A summary about EUC products and announcement will be created on day 2 of #VMworld 2017.
Read more →

Lenzker’s #VMware #Horizon Guide (Implementation): Access Layer #NSX Load Balanced Unified Access Gateway

lenzker

The following section shows you how to make use of VMware’s Unified Access Gateway (UAG) Appliance to give the enduser access into our virtual Desktop / Remote hosted Applications over an unsecure network like the Internet.

When we are creating this access we have multiple options.

  • Using a VPN to ‘tunnel’ into the secure cooperate network environment and connect further to the Horizon View environment.
  • Placing a Windows Server in the DMZ and installing/configuring the Horizon View Security Server and make it public accessible.
  • Placing the virtual Unified Access Gateway in the DMZ and installing/configuring the Horizon View Security Server and make it public accessible.

What is the / my recommendation nowadays? Go with the Unified Access Gateway. Why?

  1. It is a general opinion within Security experts that a Windows, even if it’s hardened, offers more attack potentials than a hardened minimal linux.
  2. Using the Windows based security server creates a 1:1 relationship between the Security Server and the Connection Server, therefore it takes away some access flexibility.
  3. The UAG is getting more and more features to integrate other solutions like specific Airwatch functionality
  4. You can make use of the UDP based Blast Extreme Protocol Adaptive Transport protocol that gives you a better remote/user experience even if you are connecting over a lossy network
  5. It is much easier to operate than the first Access Point versions VMware has made GA a few years ago ;-)

One important aspect of the UAG is that you need to know about the packet-flow between the Horizon Client and the Desktop. You will be dependant on the networking and security guys. Make sure you are able to clearly articulate the requirements and what is going to happen. If you can tell the flow, the other people will be able to help you much better.

Read more →