Building Clouds Blog

Deployment–PDT Workflow.xml 1004 now available

Rob Willis (MSFT) — Wed, 22 May 2013 20:51:39 GMT

Release 1004 of the Workflow.xml file for the PowerShell Deployment Toolkit is now available on the TechNet Gallery here.

Release 1004 addresses the following issues:

SharePoint Foundation 2010 fails to install when PowerShell execution policy is set to restricted - PowerShell execution policy is now set to RemoteSigned as necessary for installation of SharePoint 2010 Foundation to complete for the Service Manager SharePoint Web Parts Server role.
SQL Server 2012 cluster completion fails when a product key is provided - the PID switch is now only provided for cluster preparation, not cluster completion.
SQL Server 2012 firewall rules are set with incorrect path – the path to the SQL executable is corrected.
Media validation fails on the System Center 2012 SP1 Management Packs – updated the size validation for the new version of the Windows Server MP.
Added integration to install Virtual Machine Manager console on Data Protection Manager server when both components are included in a deployment – to allow VM mobility uninterrupted data protection to be enabled.
Some PowerShell debug entries were incomplete.
Windows Server 2012 evaluation ISO download fails – the download has been removed from Workflow.xml, this now needs to be manually downloaded.

No other changes were made to PDT – existing *.ps1 and Variable.xml files can be used with the updated Workflow.xml.

Application Management – Using Linux in Service Templates

Kurt Scherer [MSFT] — Mon, 20 May 2013 17:50:00 GMT

For various reasons, Linux is commonplace in large environments. Deploying VMs running Linux with VMM is a useful feature but there can be some confusion around how to do it. In this post, I’ll be going through preparation of Linux images and deployment of Linux in service templates.

Linux Preparation

There’s a bit of necessary preparation that must be done to a disk image containing a Linux installation prior to its use in a template. As such, I wanted to take a moment to discuss what must be done. For the operating system, VMM supports Red Hat, SUSE, CentOS, and Ubuntu. Obviously, if you have other products in your environment that interact with your VMs, you should check the supported OSs for those products. I’m going to go through a quick example of preparing a VHD for Linux using Ubuntu Server 12.04 LTS. Now, Ubuntu Server 12.04 LTS has the Hyper-V Integration Services already installed, so we don’t have to worry about that piece. If you’re using an OS that doesn’t have the Hyper-V Integration Services, you’ll need to install those. I downloaded the Ubuntu “64-bit PC (AMD64) server install CD” ISO and created a new VM in Hyper-V, choosing to boot from that ISO image. I don’t want to spend a lot of time walking through the Linux installation, as this will vary by distribution. Suffice it to say that I chose all the defaults except for username/password, as they have no defaults. It’s probably a good idea to run an update after installation.

Once the OS install has completed, the next task is to install the VMM guest additions (assuming Hyper-V Integration Services are already installed). On the VMM machine, navigate to %ProgramFiles%\Microsoft System Center 2012\Virtual Machine Manager\agents\Linux and you’ll find 3 files: an install script and two tarballs. It’s important to use the correct versions for your VMM server and using the files in this directory will do this. Grab the install script and the appropriate package for your architecture (the *.x64.tar, in our case), and copy those to the Linux VM. I use a disk image for this purpose. You can create a disk image, add a 10MB FAT partition, and then place the files in that disk image. This way, you can add this disk image to the Linux VM to install the guest additions. However you choose to get the files onto the Linux VM, the next step is the installation, which should require nothing more than running the installation script:

Once the VMM guest additions have been installed, the image preparation is complete and you can shutdown the machine. After shutdown, add the disk image for the machine into the VMM Library, and you’re all set to deploy Linux VMs. Make sure that you remember the username/password for a privileged account (for simplicity, I’m using root, but you probably don’t want to use root in your environment).

Linux LAMP

There are probably thousands of guides on the internet on how to setup a LAMP server in Linux. In fact, some distros have single installation packages for this. It’s common and it’s easy, so it’s a good candidate for a basic service template deployment. First, I create a simple VM template using the disk image:

Give the template some kind of name:

Configure any hardware settings, you’ll probably want to connect the network card:

In the Operating System configuration, select the Linux option:

Now, specify which distribution and version:

Provide a computer name and DNS name for the machine:

Provide the root password or select a Run As account:

Now comes the scripts to add. Each command will be passed to the shell, but make sure no command requires interaction.

For a simple LAMP server configuration, we can rely on the package manager for installation.

The command we want to run are as follows:

# Disable interactive prompts (MySQL password prompt) export DEBIAN_FRONTEND=nointeractive # Run update apt-get update -y # Install PHP apt-get install php5 -y # Install MySQL apt-get install mysql-server -y # Install Apache2 apt-get install apache2 –y

This is a simple example and shouldn't really be used for a production environment, but the basic process should be clear. At this point, we can deploy this template and have our own Linux LAMP VM.

Linux Distributed Database Cluster

Distributed databases are a popular way to store information. Some of the more popular names like Dynamo and GFS are propietary technologies, so I’ll be using an open-source database called Riak. This is an exmaple that would need to be adjusted for production environments, but should showcase the concepts without getting too far into details.

When Linux configurations become significantly complicated, scripts will need to execute based on some kind of logic. So, we’ll create our disk image in the same way, but we’ll add a script. This script will perform the configuration steps for us.

So, before installing the VMM additions and shutting the VM down, edit a new file at /root/install.sh whose content will be:

# Disable interactive promptsexport DEBIAN_FRONTEND=nointeractive # Authorize the apt-key curl http://apt.basho.com/gpg/basho.apt.key | sudo apt-key add - # Add repo source echo deb http://apt.basho.com $(lsb_release -sc) main > /etc/apt/sources.list.d/basho.list # Update repos apt-get update -y # Install Riak apt-get install riak -y # Update the configuration with IP address IP=`ip addr show dev eth0 | grep '.*\..*\..*\..*' | awk '{print $2}' | sed 's|/.*||g'` sed -i "s|-name riak@127\.0\.0\.1|-name riak@$IP" /etc/riak/vm.args /usr/sbin/riak start if [ "$1" = $HOSTNAME ]; then # Joining existing cluster MASTER=`nslookup $HOSTNAME | grep 'Address: [0-9]' | awk '{print $1}'` /usr/sbin/riak-admin cluster join riak@$MASTER /usr/sbin/riak-admin cluster plan /usr/sbin/riak-admin cluster commit fi

Shutdown the VM and copy the disk as before and we'll make a template to deploy this. First, we’ll create a blank service template:

This will bring up the Service Template Designer, and we’ll choose Blank:

Now, drag and drop the VM Template to the canvas to create a new tier twice:

Edit the properties of the first tier and let’s change the computer name to linuxcluster01 (and the DNS name), and then change the second tier’s computer name (and the DNS name) to linuxcluster##. The ‘##’ will allow VMM to assign the next available computer name numerically (linuxcluster02, linuxcluster03…) at deployment. If we leave the second tier hard-coded, it cannot be scaled-out. Also, you’ll want to change the disk to the new disk we created (you must remove the existing disk before adding the new disk).

On the second tier’s General properties, we’ll set a few things. First, set the order to ‘2’ instead of 1, so that we’re certain this tier will always be deployed after the first. Next, select ‘This machine tier can be scaled out’ and set the maximum instance count to whatever you see fit. You can also choose to create an availability set for this tier, which will prefer VMs in this teir to be deployed to different hosts when possible.

The last step is configuration. In the properties of each tier, select OS Configuration and remove the existing scripts. On each node add only the script we created and the name of the first node (which will be passed to the script):

Now, our template can be deployed!

Hopefully, you’ve learned a few things concerning capabilities of Linux in service templates that you can apply to your own environment.

Hyper-V Host Network Settings through VMM PowerShell (Part 3)

Kandavel KR — Mon, 20 May 2013 11:14:30 GMT

In Part 1 and Part 2 of this series I detailed the steps required to deploy BMC (Bare Metal Deploy) and configure the physical network adapter settings using Logical Networks and Logical Switches created in VMM. In this post, I will provide an overview of the necessary steps to configure the physical network adapter settings, create virtual switches and virtual network adapters using Logical Switches, and VM Networks created in VMM through PowerShell.

If you are not familiar with the concepts of networking in VMM, you can read more on TechNet.

The Solution through the PowerShell Approach:

The PowerShell approach is very handy and reusable – especially when many servers need to be provisioned in the offline mode in an automated way. This post features tips on using the networking Cmdlets in VMM, leveraging the new networking features such as Logical Switch, Uplink port profile and Virtual port profile.

Before using the PowerShell, make sure you setup the Hyper-V host (through BMC deployment or other mechanism you follow to install OS) and the host is added to VMM for managing.

Here are the network pre-requisites to setup in VMM before the network setting is applied on to the Hyper-V host:

Create one or more Logical Networks to map to the NICs on bare-metal servers.
Create one or more Logical Switches that encompass the following networking capabilities and properties to be assigned to the NICs on hyper-v host servers.

Extensions (not discussed in this post).
Uplink (Contains Uplink Mode for NIC Teaming and one or more Uplink Port Profiles for specifying the NIC teaming mode, load balancing algorithm and the network sites it applies to).
Virtual Port (Contains one or more virtual port classifications for assigning it to various virtual network adapter workloads based on the bandwidth requirement).

Here are the basic steps to follow in setting the physical and virtual network adapter settings onto Hyper-V host:

1. Import “Virtual Machine Manager” Powershell module if not loaded

If (!(Get-Module VirtualMachineManager)) {Import-Module VirtualMachineManager}

2. Initialize the variable required for the Cmdlet: (Note: Replace values to match your environment)

$ComputerName = "DCMRR25OSD19N28" #Hyper-V Host Computer

$LSwitch1 = "LSForBMC" #Logical Switch Name

$NativeUPP1 = "UPPForBMC" #Uplink Port Profile Name

3. Get VMM Objects for the following items:

Logical Switch for setting Virtual Switch with NIC teamed physical adapters
Native Uplink Port Profile and Profile Set for setting NIC team in physical NIC
Port Classification for QoS setting in Virtual NIC

$LogicalSwitch1 = Get-SCLogicalSwitch -Name $LSwitch1

$NativeUplinkPortProfile1 = Get-SCNativeUplinkPortProfile -name $NativeUPP1

$UplinkPortProfileSet1 = Get-SCUplinkPortProfileSet | where { $_.NativeUplinkPortProfile.Name -eq $NativeUPP1 }

4. Get VMM Objects for the following items:

Port Classification to be used for Host Management virtual network adapter
Port Classification to be used for Cluster virtual network adapter
Port Classification to be used for Live Migration virtual network adapter

$PortClassificationHost = Get-SCPortClassification -Name "Host management"

$PortClassificationCluster = Get-SCPortClassification -Name "Host Cluster Workload"

$PortClassificationLive = Get-SCPortClassification -Name "Live migration workload"

5. Get VMM Objects for the following items:

VM Network to be used for Host Management virtual network adapter
VM Network to be used for Cluster virtual network adapter
VM Network to be used for Live Migration virtual network adapter

$VMNetworkHost = Get-SCVMNetwork -Name "VMNForHost"

$VMNetworkCluster = Get-SCVMNetwork -Name "VMNForCluster"

$VMNetworkLive = Get-SCVMNetwork -Name "VMNForLive"

6. Get Subnet and Static IP Pool for the virtual NIC setting

$VMSubnet = Get-SCVMSubnet -VMNetwork $VMNetworkHost -Name "HostvNICSubnet"

$ipV4Pool = Get-SCStaticIPAddressPool -Name "HostvNICIPPool"

7. Get the Hyper-V host computer object in VMM

$VMHost = Get-SCVMHost -ComputerName $ComputerName

8. Create new GUID for submitting the VMM Cmdlets in group as job:

$Jguid=[System.Guid]::Newguid().ToString()

9. Initialize Array variable to hold physical network adapter settings:

$HostNetworkAdapter=@()

10. Get all physical network adapter objects on the Hyper-V host

$VMHostNetworkAdapter=get-scvmhostnetworkadapter -VMHost $VMHost

11. Read through and select the physical network adapters and set the Uplink port profile setting for teaming those adapters.

$VMHostNetworkAdapter | ForEach-Object {

if($_.ConnectionName -eq "Ethernet 3")

{

$HostNetworkAdapter += $_

Set-SCVMHostNetworkAdapter -VMHostNetworkAdapter $_ -UplinkPortProfileSet $UplinkPortProfileSet1 -JobGroup $Jguid

}

if($_.ConnectionName -eq "Ethernet 4")

{

$HostNetworkAdapter += $_

Set-SCVMHostNetworkAdapter -VMHostNetworkAdapter $_ -UplinkPortProfileSet $UplinkPortProfileSet1 -JobGroup $Jguid

}

Sample Output for $HostNetworkAdapter:

$HostNetworkAdapter | fl name, connectionname, uplinkportprofileset

Name : HP NC362i Integrated DP Gigabit Server Adapter #3
ConnectionName : Ethernet 3
UplinkPortProfileSet : UPPForBMC_c0f09141-f140-4931-a7d3-90ec6607a3b8

Name : HP NC362i Integrated DP Gigabit Server Adapter #4
ConnectionName : Ethernet 4
UplinkPortProfileSet : UPPForBMC_c0f09141-f140-4931-a7d3-90ec6607a3b8

12. Check virtual switch setting on the Hyper-V host and set/add the teamed adapters to it

$HostVirtualNetwork=Get-SCVirtualNetwork -Name $LSwitch1

if($HostVirtualNetwork -eq $null)

{

New-SCVirtualNetwork -VMHost $VMHost -LogicalSwitch $LogicalSwitch1 -VMHostNetworkAdapters $HostNetworkAdapter -JobGroup $Jguid

}

else

{

$HostNetworkAdapter+=$HostVirtualNetwork.VMHostNetworkAdapters

Set-SCVirtualNetwork -VirtualNetwork $HostVirtualNetwork -LogicalSwitch $LogicalSwitch1 -VMHostNetworkAdapters $HostNetworkAdapter -JobGroup $Jguid

}

13. Create the required virtual NICs using VM Network and IP Pool settings

New-SCVirtualNetworkAdapter -VMHost $VMHost -Name "LSForBMC6" -VMNetwork $VMNetworkCluster -LogicalSwitch $LogicalSwitch1 -VMSubnet $VMSubnet -IPv4AddressType "Static" -IPv4AddressPool $ipV4Pool -PortClassification $PortClassificationCluster -JobGroup $Jguid

New-SCVirtualNetworkAdapter -VMHost $VMHost -Name "LSForBMC7" -VMNetwork $VMNetworkLive -LogicalSwitch $LogicalSwitch1 -VMSubnet $VMSubnet -IPv4AddressType "Static" -IPv4AddressPool $ipV4Pool -PortClassification $PortClassificationLive -JobGroup $Jguid

14. Apply the new network settings on the Hyper-V host through the VMM job

Set-SCVMHost -VMHost $VMHost -JobGroup $Jguid -RunAsynchronously

15. Check the VMM Job output for the completion of Job and also check the target Hyper-V host for the correct

network settings

- Select properties for the Hyper-V host and check under “Virtual Switches” for the correct network settings for virtual switch and virtual network adapters

- Also, you can verify using the VMM PowerShell Cmdlet:

Check virtual switch on Hyper-V host:

PS C:\> get-scvirtualnetwork -VMHost $VMHost | fl name, logicalnetworks, logicalswitch, vmhostnetworkadapters

Name                  : LSForBMC
LogicalNetworks       : {LNForBMC}
LogicalSwitch         : LSForBMC
VMHostNetworkAdapters : {HP NC362i Integrated DP Gigabit Server Adapter #3, HP NC362i Integrated DP Gigabit Server Adapter #4}

Check virtual network adapters on Hyper-V host:

PS C:\> get-scvirtualnetworkadapter -vmhost $VMHost | fl name, logicalswitch,virtualnetwork, vmnetwork,portclassification

Name               : LSForBMC6
LogicalSwitch      : LSForBMC
VirtualNetwork     : LSForBMC
VMNetwork          : VMNForBMC
PortClassification : Host Cluster Workload

Name               : LSForBMC7
LogicalSwitch      : LSForBMC
VirtualNetwork     : LSForBMC
VMNetwork          : VMNForBMC
PortClassification : Live migration workload

Summary

Use the above Cmdlets as reference and make sure the hard coded values are replaced to match the environment.

In my next post I will focus on automating the storage management through Virtual Machine Manager.

Application Management – Underused Template Settings

Kurt Scherer [MSFT] — Fri, 17 May 2013 20:56:00 GMT

This blog post marks the start of a new series on advanced features of Templates in Virtual Machine Manager. Most of the features I’ll be showing are lesser-known and scenario-specific, but I hope they will aid users in accomplishing tasks. In this first post, I’ll be discussing the use of Organization Units when deploying VMs to a domain.

OUs in VM Templates

A common best practice for simplification of VM deployments from VMM is to avoid the use of complicated GPOs. For an Active Directory environment that already has GPOs in place, it would be useful to have certain OU containers dedicated to VMs deployed by VMM. This way, the administrator can enforce the “no complicated GPOs” paradigm.

Within VMM, a VM can be configured to join a domain upon creation by using a VM template. In the OS portion of the VM Template, there is a section for domain configuration, as depicted on the right.

During deployment, the VM will join the specified domain using the credentials provided. Under the covers, VMM generates an Answer File that contains certain information and attaches it to the VM during completion of the Windows installation (since the disk image containing the OS should have had the Sysprep tool run).

If we need more advanced options like a specific OU, there are PowerShell cmdlets for performing these operations.

The cmdlet we’ll need is Set-SCVMTemplate. I’ll assume we already have a VM template we want to adjust called “Domain” as depicted in the figure:

Now, we’ll want an elevated console on which to run a few simple commands. First, we’ll import the module containing the necessary cmdlets:

Import-Module VirtualMachineManager;

Next, we’ll define the OU container which will contain the VM:

$ou = "OU=VMs,DC=contoso,DC=com";

Notice the formatting of the string. Although the string is not case-sensitive, ensure to use commas and not semi-colons to separate the fields. Next, we get the template object using the Get-SCVMTemplate cmdlet:

$template = Get-SCVMTemplate | where {$_.Name -eq "Domain"};

The string "Domain" is simply the name of the template. Now we set the OU:

Set-SCVMTemplate -VMTemplate $template -DomainJoinOrganizationalUnit $ou;

And that's it. Obviously, these commands could be combined rather than using the temporary variables but I’m aiming for readability.

UI Visibility

The problem now is the lack of visibility for this setting in the UI. To fix this, we’ll use custom properties. First, we’ll create a new Custom Property in VMM. First, we’ll bring up the properties of the VM template and choose to Manage Custom Properties.

In the next window, we see a drop-down selector:

The concept of managing custom properties can be a bit confusing. When managing these properties, we’re not changing our VM Template, we’re adjusting the global settings for custom properties. By selecting Virtual Machine Template as the object type, I’m adding a custom property that will be available to all VM Templates. Next, I’m going to add a property called OU. Now I choose to create a property and name it:
Now, I add this property to the VM Template object:

And we’ll see this property appear in the list:

We could type something in the box if we wanted, but we’ll do that later. Back to the main screen, we can now add this property to the view by right-clicking the columns:

Now, we can populate this field for all VM templates in PowerShell using the Set-SCCustomPropertyValue cmdlet:

Get-SCVMTemplate | %{ Set-SCCustomPropertyValue -InputObject $_ -CustomProperty $(Get-SCCustomProperty -Name "OU") -Value $_.DomainJoinOrganizationalUnit };

Back in the UI, this value has now been populated:

To keep this info always in sync, you might consider adding this line of PowerShell to an scheduled task queue on the VMM server.

OUs in Service Templates

Now, if you’re using service templates, you might wonder how this can be applied to a tier and how to parameterize it. It’s important to realize that VM templates placed into service templates are copied by value and no reference is made to the original. So, if you set a domain OU in the VM template and add it to a service template, the value of the OU will be copied but changing it proves a little more difficult (changes in the original VM template will not propagate to the service).

It’s important to understand that a VM tier in a service template corresponds to a VM template, although this relationship is not exactly exposed to the UI. So, let’s say we have a service template with two tiers and both tiers have VMs that need to join a domain with a particular OU. It might look something like this:

I created an empty service template and added the VM template we created earlier twice. Because these VM tiers are linked to VM templates, viewing the Custom Properties section of the tier properties shows the OU we set earlier. This value is purely aesthetic; we can’t change the OU by adjusting this custom property.

If we added the earlier bit of PowerShell to the scheduled tasks, this custom property will be updated if we change the DomainJoinOrganizationUnit property for the VM template that’s linked by this tier. We’ll save this service template as “Demo” with a Release “V1” and we’ll adjust it in PowerShell:

$service_template = Get-SCServiceTemplate | where {$_.Name -eq "Demo" -and $_.Release –eq “V1”};

This service template will have a list of tiers and we’ll get the tier we want (although this could be done with a foreach clause):

$tier = $service_template.ComputerTierTemplates | where {$_.Name -like "*Tier 1"};

The VM template that is linked can now be retrieved:

$vm_template = $tier.VMTemplate;

Once you have the template object, the OU can be updated as before. You’ll have to rerun the script to propagate the custom property before you’ll see the change reflected in the UI. If you need even more flexibility (say, a service setting for the OU property), you’ll need to consider deploying service templates completely outside of the UI and setting this value at deployment time with a script as this property cannot be a service setting.

That’s all for now, stay tuned for upcoming posts in this series.

I have a Surface RT and going away for a few days, now what??? I have a MSDN subscription :-)

Anders Ravnholt MSFT — Thu, 16 May 2013 22:59:00 GMT

I know many of you have seen the super cool blog post where my fellow team members build a private cloud out of their new Surface Pros. It was a cool idea and people really loved the video.

The cool thing about the Surface Pro is that it’s a normal PC and you can run any regular PC program (Silverlight, Java, Live Writer), as well as many other programs.

The problem:

I have not bought a Surface Pro yet (my mistake), but I do have a surface RT. I’m really happy with my Surface RT, but it has some limitations that prevent me from doing certain things on it. I recognized this the other day when I was planning on working while away on a trip – but I didn’t want to bring my PC.

Here is what I could not do from my Surface RT:

Use live writer (the program I’m using to publish this post)
Use Java (this is necessary for several websites I use on a regular basis)
Use Silverlight

The Solution:

I started thinking about how I could solve this problem – and then I remembered that I have a MSDN subscription.

With MSDN you get the following every month in Windows Azure:

The Scenario:

I want to build a Windows machine running in Windows Azure, which I can connect to from my Surface RT.

In this first blog post, I will do the setup and configuration

In the second blog post, I will walk you through how the gold image can be uploaded to Azure

I want to run the following programs in my gold image

Java
Silverlight
Windows Livewriter

Just for the fun of this blog post, all of it is written on the Windows machine already running in Azure from my Surface RT (except a few steps), and wanted to capture my learning's in this blog post.

The challenge

I have been using Windows Azure for a while and started to use a windows 2012 server to connect to form my Surface. One thing that started to irritate me was the entire configuration I needed to do every time. I just wanted to create a gold image that I could use every time I provision a Windows machine.

So in order to get my own image, I need to do the following:

I need to sign up for Windows Azure (covered in this post)
I need to install App. controller and configure Azure (covered in this post)
I need to build my own image (covered in this post)
I need to move my image to windows Azure from my PC (covered in the next post)
I need to provision the VM based on my image in Azure (covered in the next post)
I need to connect to the Windows machine using Surface RT and configure it to sync settings based on my windows ID (covered in the next post)

Pre-requisites:

MSDN subscription with access to Azure
AD Domain for App controller
Computer running Windows 8 / 2012 with Hyper-V enabled.

Sounds fun, right? Let’s get started.

I need to sign up for Windows Azure

With my MSDN I get:

1500 hours of compute hours

90 Gb/month

With this, I have been able to run two small machines in Azure without even getting close to the limit. This, of course, depends on what you do and what you enable, which will be at your own risk and cost.

Here is how you can sign up with windows Azure if you have a MSDN subscription:

Go to http://msdn.microsoft.com/en-us

Select Access benefits

Select ”Activate Windows Azure”

When you sign up, make sure it says Windows Azure MSDN

You will be asked for a credit card when activating the subscription. You will only be charged if you use more than you allocated budget.

NOTE: Any charges that you may encounter in connection with signing up will be at your own risk and cost.

Go to https://manage.windowsazure.com and sign in with your Microsoft account (same as you use for your MSDN)

I need to install App. controller and connect to windows Azure

App Controller is a tool that can be used to manage multiple clouds from one console.

App controller can connect to different cloud environments such as VMM and Windows Azure.

An App Controller installation consists of the following features:

One App Controller server
- App Controller server hosts a website console for access by using a supported browser.
A SQL Server database
Windows PowerShell cmdlets

All these applications can be down loaded from the MSDN download page using the MSDN download area.

Steps to install App. Controller can be found here:

http://technet.microsoft.com/en-us/library/gg696046.aspx

Once you have App Controller running following the guidance above, you can sign into App. controller

Configure connection to Azure using certificates:

On the server where App. controller web server is running follow these steps:

First you need to create a Management Certificate:

To create your own self-signed management certificates, open a Visual Studio command prompt and execute the following command:

makecert -sky exchange -r -n "CN=<CertificateName>" -pe -a sha1 -len 2048 -ss My "<CertificateName>.cer"

E.g. makecert -sky exchange -r -n "CN=WinAzure" -pe -a sha1 -len 2048 -ss My "c:\temp\WinAzure.cer"

http://msdn.microsoft.com/library/gg551722.aspx

Create a Service Certificate for Windows Azure

http://msdn.microsoft.com/en-us/library/gg432987.aspx

I used Create a personal Information Exchange Certificate > To Export a .pfx file by using Certificate Manager and place in c:\temp on the App. Controller server

Login to Windows Azure Portal: https://manage.windowsazure.com from App. controller server
Select “Settings”

Select Manage Certificates

Select “Upload from the bottom of the screen”
Select “Browse”
Go to c:\temp
Select the *.cer file and click “Ok“
Once the certificate is uploaded, select “Subscription ID” in the column and cut this to the clipboard.

Connect App. controller to Azure subscription

On the App. Controller server start App controller console as Administrator if not already started
In the App. controller console select Settings > Subscriptions and click “Add”
- Give the connection a name
- Paste the subscription ID from the clipboard
- Click browse and go to c:\temp and select the pfx file
- Give the password used when exporting the file from Cert manager
- Click “OK”.
Click “Ok“
Select “Library“
Select the newly created Azure subscription
Click “Create storage”
Give the storage account a name E.g. azurestoragexyz
Select “West US” for Region and click “Ok”
Select the newly created storage account and select “Create container”
Give the container a name and click “Ok“

Build my own Windows 2012 image

We need to create our own image with Windows update and our programs pre-installed. For virtual images running in Azure, there are a few rules that needs to be followed in order for the image to function correctly. These rules are:

Only vhd files can be uploaded and used (VHDX will not work)
The image has to be syspreped
Only fix-sized images will work.

As long as these three rules are kept in mind, you should be ok.

In order to create our own image we will do the following:

Download Windows 2012 ISO image from MSDN as well as get a product key and place this image on the server running Windows 2012 Hyper-V
Start Hyper-v Manager on the Windows 2012 server
Select New > Virtual Machine under “Action Menu”

Click Next
Give the Virtual Machine a name, e.g. Windows2012Base
Select a location for the VM if needed and click ”Next”
Assign Memory and click “Next” (Does not need to be more than 1024)
Select a network that has connection to the internet and click “Next” (We need internet in order to use windows update)
Under Virtual Disk Select Attach a virtual hard disk later and click “Next”
Click Finish to create the VM
Select New > Hard Disk under “Action Menu“

Select VHD and click “Next”
Select “Fixed size“
Specify the name e.g. windows2012base
Give the location where the VM was placed earlier e.g. D:\VMs\Virtual Machines\Windows2012Base, click “Next”
Set size to approx. 30 Gb and click “Finish”
Select VM created earlier in Hyper-V manager and right click and select “Settings“
Select IDE Controller 0 > Hard Drive and click “Add“
Click “Browse” and go to the location where the VHD was created
Click on “DVD Drive” under IDE Controller 1
Select Image file
Browse to the location where the Windows2012 ISO file is located (Downloaded from MSDN earlier)
Click “OK“

Start the VM
Double Click on the VM to connect to the console
Select language and keyboard, Click next
Click “Install now”
Paste the license key from MSDN into the field and click next

TIP: You can use paste from clipboard > Type Clipboard text

Select Windows Server with GUI, click “Next”
Accept license and click “Next”
Select “Custom: Install..”
Click “Next”, after some time the VM will reboot a few times after installing the files
Specify Password
Click “Finish “
Wait for the installation to finish
Login as Administrator
Go to “Control Panel” > “System and Security” > “System“
Select Remote settings
Select “Allow remote connections to this computer”, uncheck “Allow connections only from…” and click “Ok “

Start Windows update
Select check for updates
Install recommended updates and restart
After restart run Windows update once more and install any updates missing, restart if needed
Install Java from here: http://www.java.com/en/download/win8.jsp?locale=en
Install Silverlight form here: http://www.microsoft.com/getsilverlight/get-started/install/default.aspx
Install Live Writer from here: http://g.live.com/1rewlive5-web/en/wlsetup-web.exe
Start a command prompt as Admin
Go to c:\windows\system32\sysprep (cd c:\windows\system32\sysprep)
run sysprep.exe
Select the following options:

Click “Ok” and sysprep will start, when done, the VM will shutdown.
Open explorer and go to the directory where the VM vhd is located.
Copy the VHD from the Hyper-v server to the App. Controller server. e.g c:\vhdstore
Share the folder e.g. c:\vhdstore on the App Controller server

In the next post I’ll explain how you can upload the VHD to Azure, provision a Windows 2012 server to run in Azure, and access it from a Surface RT to write a blog post.

Stay tuned.

Automation–Orchestrator Architecture and Runbook Deployment Process

Charles Joy [MSFT] — Thu, 16 May 2013 17:01:00 GMT

Hello Readers and Viewers!

Today’s post will not have a video, but it will have some very popular and hopefully informative information about some “Best Practices” around Orchestrator Architecture and Runbook Deployment.

For those of you that have been following me for the past three or so years, this information may look very familiar. Well, that is because this is a “refresh” of the old “Opalis Architecture & Workflow Deployment Process ‘Best Practice Guide’” created and published back in November 2010.

To date, this information (available previously as .DOCX and .PDF) has been downloaded over 2200 times! This is why I believe it deserves that refresh and promotion to an actual blog post here on Building Clouds!

Let’s begin…

Orchestrator Architecture

Orchestrator Architecture Notes

Network Connectivity between the Database(s) and connected Runbook Servers should never exceed 30ms for an optimal state of 10ms with zero packet loss.
Network Connectivity between connected Runbook Servers and the Managed Devices they perform work on can have a higher latency value, but standard network traffic rules still apply.
- Example: For large VHD file migrations between sites, try using FTP, instead of SMB file copy over the network.
Connectivity and Runbook Execution between “Primary” and “Remote” Production sites can be achieved via the available REST Based oData Web Service.
By default the maximum concurrent Runbook Instances is set to 50 – this is an extremely “safe limit” based on legacy settings. This limit can be expanded based on need and infrastructure capability. For more information about increasing this maximum, reference this TechNet Article.
Click here for more information about “How to Configure the Orchestration Console Web Site or the Web Service for Load Balancing”.
The following are great resources as well (from the TechNet Library): Orchestrator Architecture, Deploying System Center 2012 – Orchestrator, Administering System Center 2012 – Orchestrator, and Orchestrator (main landing page)

Runbook Deployment Process

A standard Software Development Lifecycle Process can be implemented/followed as far as Dev/Test to Production promotion is concerned. The following is an example process.

One or more “Dev/Test” Runbook Designers Develop and Test Runbooks outside of Production (possibly in “Dev/Test Pods”).
Developed, Tested and “Sanitized” Runbook Exports to be Promoted are submitted via a Change Control System as a Change Request to a CAB (or a resource where yes/no decisions can be made based on design, process, impact, etc.)
- NOTE: “Sanitized” refers to the need for “Dev/Test” “Global Settings/Connections” to be removed from subsequent exports of the Runbooks to be promoted.
As a part of the Approval Process, the “Sanitized” Runbook file is imported into a Production Staging Environment (that mimics Production). Here, it is tested against a “Production Like” infrastructure.
- NOTE: If changes are required, the Runbook should be sent back to Dev/Test and resubmitted for approval.
Upon Approval of the Change Request to Promote the Developed and Tested Runbook to Production, the file should be “Checked In” to a Source Control System (TFS is recommended). During this time, the existing Production Environment Runbooks should also be Exported to a file and “Checked In” to the Source Control System.
Once the current environment has been backed up, and the newly Approved Runbooks have been stored, they can be scheduled for deployment (Import) to the Primary and Remote Production Environment(s).
- NOTE: It is critical that if more than one Production Environment (Remote or otherwise) exists that each one of them is backed up and updated at the same time, to keep the environments in sync.

Runbook Deployment Process Notes

“*.ois_export” files should be treated as “Managed Code” and should be “Checked In / Out” from a Source Control System outside Orchestrator (TFS is recommended).
Orchestrator DOES NOT have automatic “rollback” or version history built-in. These processes are manual and require storage and management of the “*.ois_export” file generated during the change process.
Global Settings/Connections are in fact global and are a part of each export, regardless of Runbook usage. It is important to be mindful of what is being exported and imported at any given time. It is advised that a “Cleanup” Orchestrator Instance is created/used to “Sanitize” the Runbooks coming from the “Dev/Test Pods”.
Runbook Changes (once implementation is in “steady-state”) should not occur often enough for the above process to be cumbersome. Because “*.ois_export” files should be treated as “Managed Code”, a Change Control Process should not be out of the question for any organization. In fact, it significantly decreases negative impact on the Orchestrator environment(s).
It depends on the organization, but inclusion of ALL the Runbooks (regardless of which target environment they will execute against) may be desired in the “GOLD copy” for the Production Runbooks. Alternatively, the “GOLD copy” Production Runbooks could be broken up by “Target Execution Environment”.
The above Architecture and Runbook Deployment Process can be applied to any size Implementation. The number of Runbook Servers, Databases, Remote Environments, Dev/Test Pods, etc. can scale as desired.

Since the old CodePlex version of this documentation was such a hit, I decided to make all the documentation available as a TechNet Gallery Contribution as well!

Click here for the TechNet Gallery Contribution for this Documentation!

For more information and tips/tricks about Orchestrating Service Manager, be sure to watch for blog posts in the Automation Track and IT Service Management Track!

enJOY!

Automation-Executing a PowerShell v3 (Parallel Execution) Script in System Center Orchestrator 2012

Jim Britt [MSFT] — Tue, 14 May 2013 18:25:00 GMT

Hello readers! I have a post that I think will be very interesting to those of you who have wanted to execute PowerShell v3 through Orchestrator and have had issues. The core of Orchestrator (if you didn’t already know) was built around an x86 PowerShell base for execution of PowerShell. Meaning, by default if you fired up the Orchestrator Designer, built a quick and dirty Runbook to execute some PowerShell in the “Run.Net” activity that comes with the foundation activities, you would be executing that PowerShell with PowerShell v2 and in an x86 runspace. Some of the newer activities that have been bolted on to integration packs (such as the VMM Integration Pack) have provided a PowerShell activity that provides you the ability to fire off some x64 native code and even better on the server that has the PowerShell modules you need, etc.

Well, with the introduction of PowerShell v3 and some of the coolness around parallel execution using workflow, it started us thinking about how we may combine some parallel execution in Orchestrator leveraging PowerShell v3 and x64. This post starts with an overview of a PowerShell v3 script written to execute in parallel and finishes off with how you would integrate this example into Orchestrator. The integration method, by the way, doesn’t limit you to only PowerShell v3, but at this point this method is the only way to get v3 working that we’ve found.

Let’s Start with a Dissection of the Example Script

First step in this example is to provide the script we are using in our demo environment internally (SCDEMO) and give some introduction to that. This PowerShell script is used to “warm up” our IIS sites in our SCDEMO Clouds for demonstration purposes. Essentially, we want to ensure that the IIS site is immediately available when we navigate to it for demonstrations to customers. To do this, we have a URL warm up PowerShell script that is triggered as a component in our provisioning Runbook that kicks off and continues with providing access to a provisioned cloud. We initially configured this as a script to allow for parallel execution against 1 – N clouds (ex: 1 – 200) and ran on a schedule. This script executes in parallel rather than synchronous to allow us to execute the URL warm up against 200 machines (all at once in parallel) in roughly 60 seconds or so, rather than ~60 seconds * 200 URLs synchronously. This buys us speed that we need when we are setting up a demo for a customer. We opted to change this to a single execution script against a single URL but the example still holds true for a scheduled process. The next few sections concentrate on the chunks of the script and what they are doing.

Parameters to Get Us Started

So this section starts off by providing us the ability to either use defaults or take in parameters. Obviously I set my script up to use defaults that work for me. Knock yourself out customizing this for your own needs.

Param

(

[parameter(Mandatory=$false,Position=0,HelpMessage=”Specify a base name to use ex: BlogEngine")]

[String]

$ServerBaseName=("BlogEngine"),

[parameter(Mandatory=$false,Position=1,HelpMessage=”Specify the number of digits ex: 0000")]

[String]

$ServerDigits=("0000"),

[parameter(Mandatory=$false,Position=2,HelpMessage=”Specify the domain name to use ex: .foo.com")]

[String]

$ServerDomain=(".contoso.com"),

[parameter(Mandatory=$false,Position=4,HelpMessage=”Specify the number of the server to start with.")]

[Int]

$ServerStart=(1),

[parameter(Mandatory=$false,Position=3,HelpMessage=”Specify the number of the server to end with.")]

[Int]

$ServerEnd=(50)

)

This script takes in as parameters

$ServerBaseName: We have an array of machines (explained later) that all start with a base machine name such as “BlogEngine”. We build the array with this base name and a series of numbers also explained next. Basically, we end up with server names such as “BlogEngine0001, BlogEngine0002, BlogEngine0003, you get the idea”
$ServerDigits: This is another array building variable to allow us to go out to “4 zeros” and allow the zeros to be padding such as 0001, 0002….0010, etc.
$ServerDomain: This provides us the “FQDN” part of our server URL
$ServerStart:This is another array building variable. This value is where you want to start in your series of servers using the 0000 + 1 essentially to get 0001, 0000 + 10 would be of course 0010, etc.
$ServerEnd: This value is the last server number in your list of servers. So if you supplied 50 in this example, BlogEngine0050 would be the last server in the series.

Build the Array of Servers

Next, we need to build our array of servers from the parameters we have. We start with initializing the $Servers array using the “@()” to essentially be an empty array ready to receive data. Then we take those parameters in a ForEach-Object loop to build our our array list of servers.

$Servers=@()

$ServerStart..$ServerEnd| ForEach-Object {$Servers += "$ServerBaseName" + $_.ToString("$ServerDigits") + "$ServerDomain"}

If we used 1 as our $ServerStart and 4 as our $ServerEnd the above would basically build a list that would look a lot like the below

BlogEngine0001.contoso.com
BlogEngine0002.contoso.com
BlogEngine0003.contoso.com
BlogEngine0004.contoso.com

Next We Kick off the Fun and Execute the Workflow

I’ve put a “Try” and “Catch” just for completeness here. Technically this could be executed without those. Notice the SilentlyContinue as well which is allowing us to continue without throwing errors. We’ll capture them anyway in a couple of steps from now. The execution of the workflow happens with the Invoke-URLRequest with the required parameters following. In this case we are sending it the name of the servers (Serverlist) using our array we built ($Servers). Also, we kick this off twice because if a URL was “asleep” we kick this process of again to ensure it “woke up”.

try {

$WakeUp = Invoke-URLRequest -Serverlist $Servers -ErrorAction SilentlyContinue

$FinalResults = Invoke-URLRequest -Serverlist $Servers -ErrorAction SilentlyContinue

}

catch {}

Main Workflow Function

Our main workflow function takes in as a parameter the server list we built (mentioned above) and as output it provides the status of the URL state. If you notice, there is also a ForEach -Parallel statement which indicates that anything that is being processed in this workflow function, will do so in parallel (instead of synchronously). Another note is that $Workflow:myoutput is being used here to gather data within this workflow function and allow it to be updated within the ForEach loop and returned to the main calling script.

workflow Invoke-URLRequest

{

param([parameter(Mandatory=$True)][String[]] $Serverlist)

$myoutput=@()

ForEach -Parallel ($server in $Serverlist)

{

$Result = Invoke-WebRequest -Uri "$server" -UseDefaultCredentials -TimeoutSec 30 -UseBasicParsing

if (($Result -ne $Null) -and ($Result.links[1].href -match "syndication")){ $Alive = $True } Else { $Alive = $False }

$Workflow:myoutput += $server + ":" + $Alive

}

Return $myoutput

}

Key points from the above piece of code

Parallel execution so each server we have in our list will execute at exactly the same time and return to the calling main part of the script when done
For our use – we’re searching for the word “syndication” since that is a word that should show up on the main site. For you it would be different.
We’re setting a value of “$True” to “$Alive” here so we can leverage that data later on. Anything that is showing “$False” will be displayed as an issue.
$MyOutput will store the ServerURL:$True or ServerURL:$False for each URL you pass it

Example
BlogEngine0001.contoso.com:$True
BlogEngine0002.contoso.com:$True
BlogEngine0003.contoso.com:$True
BlogEngine0004.contoso.com:$False

Build Array for Failure Data

Since this script is returning failures only when it executes, we need to build a final array of machines that failed so we can leverage this data for alerting in Orchestrator. The below essentially pulls any server name that didn’t return a “$True” value for being online and adds it to a failure array. Then outputs the final results into a $OutputResults variable.

$Failed=@()

ForEach ($Server in $Servers){

if ($FinalResults -notcontains $Server + ":True")

{

$Failed += $Server

}

$OutputResults = $null

if (!$Failed) {$OutputResults = "None"} else {$Failed}

$OutputResults

The Complete Script

For your viewing pleasure, I’ve provided the complete script below. This script will also live on the TechNet Gallery as a downloadable option for those that just want to borrow anything from it to build their own parallel v3 PowerShell script. Download the script from TechNet Gallery PowerShell v3 Parallel Execution Workflow Script for URL WarmUp to ensure you don’t have to deal with “copy / paste” issues.

Param

(

[parameter(Mandatory=$false,Position=0,HelpMessage=”Specify a base name to use ex: BlogEngine")]

[String]

$ServerBaseName=("BlogEngine"),

[parameter(Mandatory=$false,Position=1,HelpMessage=”Specify the number of digits ex: 0000")]

[String]

$ServerDigits=("0000"),

[parameter(Mandatory=$false,Position=2,HelpMessage=”Specify the domain name to use ex: .foo.com")]

[String]

$ServerDomain=(".contoso.com"),

[parameter(Mandatory=$false,Position=4,HelpMessage=”Specify the number of the server to start with.")]

[Int]

$ServerStart=(1),

[parameter(Mandatory=$false,Position=3,HelpMessage=”Specify the number of the server to end with.")]

[Int]

$ServerEnd=(50)

)

workflow Invoke-URLRequest

{

param([parameter(Mandatory=$True)][String[]] $Serverlist)

$myoutput=@()

ForEach -Parallel ($server in $Serverlist)

{

$Result = Invoke-WebRequest -Uri "$server" -UseDefaultCredentials -TimeoutSec 30 -UseBasicParsing

if (($Result -ne $Null) -and ($Result.links[1].href -match "syndication")){ $Alive = $True } Else { $Alive = $False }

$Workflow:myoutput += $server + ":" + $Alive

}

Return $myoutput

}

$Servers=@()

$ServerStart..$ServerEnd| ForEach-Object {$Servers += "$ServerBaseName" + $_.ToString("$ServerDigits") + "$ServerDomain"}

try {

$WakeUp = Invoke-URLRequest -Serverlist $Servers -ErrorAction SilentlyContinue

$FinalResults = Invoke-URLRequest -Serverlist $Servers -ErrorAction SilentlyContinue

}

catch {}

$Failed=@()

ForEach ($Server in $Servers){

if ($FinalResults -notcontains $Server + ":True")

{

$Failed += $Server

}

$OutputResults = $null

if (!$Failed) {$OutputResults = "None"} else {$Failed}

$OutputResults

Integration With Orchestrator

Now that I’ve gone through this script in a bit of detail to give you an idea of “what is doing what”, how do we get it integrated into Orchestrator to leverage in your IT process automation?

Basic Runbook Example

To keep this simple, I’ll illustrate 2 activities

Simple initiate activity (no parameters just something to stub out the process)
Note This could contain all the published data you want to send to the “Warm Up BlogEngine URL” activity
Warm Up BlogEngine URL activity (Run Program) shown next

PowerShell and Run Program to allow for PowerShell v3 execution

Below we basically call PowerShell directly via the Command execution option in a Run Program activity using a CMD.EXE /c switch.

Expanded view (by right clicking on the command window and left clicking Expand)

Breaking this down we are doing the following:

Computer: We’re using Published Data for the value of the current Runbook Server that is executing this Runbook. This is important since the script needs to exist on this server (and all Runbook Servers that will be leveraged).
Command: What we are actually executing here
- CMD.exe /c to execute a command window
- A “|” or pipe to add a command to run
- We’re using a variable to define the PowerShell exe location (Example: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe)
- -c .\scriptfile.PS1 to indicate we are going to execute a dot sourced script from the current working directory
- Providing the required parameters for our PowerShell script (ServerStart and ServerEnd)
Working Folder: We are also using a variable here to specify location of scripts (Example: c:\Scripts)

Essentially the above is in the format of the below.

cmd.exe /c | powershell.exe -c .\scriptfile.ps1 -ServerStart 1 -ServerEnd 200

Handling Failures

As a final piece to this, I said above that we are capturing what machines have a “$False” for "$Alive”. Since we may want to do something with that piece of information, one way to control flow is with a Link condition following the activity.

To throw an error and also continue on, we can specify (on the red link shown above) that when Pure Output from the Run Program activity does not contain None, let’s do something special. That something special in our case is sending an email with the names of servers that are having an issue. In your case it could be a different action and set of results of course.

Supporting URLs for PowerShell Workflow

In case you want to read up more on PowerShell Workflow in v3 I’m providing a handful of links below.

Use PowerShell Workflow to Ping Computers in Parallel: http://blogs.technet.com/b/heyscriptingguy/archive/2012/11/20/use-powershell-workflow-to-ping-computers-in-parallel.aspx
PowerShell Workflows: The Basics: http://blogs.technet.com/b/heyscriptingguy/archive/2012/12/26/powershell-workflows-the-basics.aspx
Writing a Script Workflow: http://technet.microsoft.com/en-us/library/jj574157.aspx
TechNet Gallery Location for Script: PowerShell v3 Parallel Execution Workflow Script for URL WarmUp

That does it for this post. If you have any questions, don’t hesitate to comment below. Also, in the spirit of this blog and keeping this as an open discussion, feel free to post other options that have worked for you.

Till next time,

Happy Automating!

Go Social with Building Clouds!
Building Clouds blog
Private Cloud Architecture Facebook page
Private Cloud Architecture Twitter account
Building Clouds Twitter account
Private Cloud Architecture LinkedIn Group
Building Clouds Google+ Community
Cloud TechNet forums
TechNet Cloud and Datacenter Solutions Site
Cloud and Datacenter Solutions on the TechNet Wiki

Secure the Private Cloud with Hyper-V PowerShell - Part 2

Thomas W Shinder - MSFT — Tue, 14 May 2013 16:12:00 GMT

In our first blog of this series, Using PowerShell to Protect Your Private Cloud Infrastructure, we defined the essential characteristics of cloud computing, briefly discussed some cloud security challenges, and started exploring network protection by using platform capabilities in Windows Server 2012. The first network security scenario we described covered protection against eavesdropping attacks by leveraging the SMB Encryption feature available in Windows Server 2012. In this blog, we will discuss how to protect a private cloud infrastructure against rogue services.

Scenario 2 – Protecting against rogue services

As described in the paper Leveraging Windows Server 2012 Capabilities to Address Private Cloud Security Concerns – Part 2, you need to be concerned about protecting tenants against rogue services that could interrupt their workload. Because network isolation is a fundamental requirement for a private cloud, many times this concern is already mitigated for cross-tenant communication; however, traffic within the same tenant network is still vulnerable to this type of attack if nothing is done.

Traffic that belongs to the same tenant network can initially be viewed as “trusted”; however, as a security professional you should never trust any traffic, even if it comes from the your own corporate network. The risk that an internal threat will provision a service that will affect the entire tenant’s network is something that should be addressed from the private cloud infrastructure perspective. One classic example of potential network disruption is a rogue DHCP server that sends leases for bogus IP addresses on the tenant’s network.

One great new feature in Windows Server 2012 that can be used to mitigate this scenario is DHCP Guard. The Hyper-V Virtual Switch can use this feature to block DHCP offers from virtual machines that were not authorized to distribute IP addresses.

Note This is a feature of the Hyper-V Virtual Switch, so don’t get confused when we say “authorized.” This is not the same as DHCP Authorization in Active Directory. DHCP Guard does not need Active Directory, and it is implemented on the virtual switch level.

To demonstrate this scenario, we will use the configuration that follows.

Scenario definition: Contoso, Ltd. has a cloud infrastructure, and as part of the security policy for their private cloud they need to prevent rogue DHCP servers from distributing IP addresses on their network.

Scenario constraint: The plan is to implement this capability throughout the entire cloud infrastructure, but for now they are going to deploy only on the Financial Tenant virtual machine (the Red virtual machine in the previous image).

To use DHCP Guard, you need to select the virtual machines that must have this feature enabled. You can use the Get-VM command to visualize all your virtual machiness as shown here:

Tip In a multitenant environment, you might want to use a name suffix that can identify the tenant. For example, “[Finance] Windows 8”. This will help you query the virtual machine’s name by using the command Get-VM *finance*.

It is important to note that the DHCP Guard feature is disabled by default, which means that every virtual machine you create will have this functionality disabled. You can use the command Get-VMNetworkAdapter to obtain this information shown here:

You can retrieve information about only this setting by using Get-VMNetworkAdapter –VMName RogueDHCP | Format-List DHCPGuard. The result of this command is shown here.

In a private cloud infrastructure, you (as an administrator) should be aware of which virtual machines will be provisioned to be a DHCP server (which in almost all cases is likely to be none of them because tenants should not be providing infrastructure services). Therefore, the correct assumption is that all virtual machines should have this feature on except the ones that will act as a DHCP server.

Unfortunately, it is not possible to change the default setting in Hyper-V to force all virtual machines that you create to have DHCP Guard enabled. You need to create the virtual machine and then use the following command to enable it.

In this blog of a three-part series, we discussed a scenario where the private cloud administrator wants to protect his cloud infrastructure against rogue DHCP attacks. The next blog in this series will discuss protection against MAC Spoofing and Router Advertisement attacks.

See you next time!

~Yuri Diogenes, senior technical writer, SCD iX Solutions Group
Twitter: @YuriDiogenes

Tom Shinder
tomsh@microsoft.com
Principal Knowledge Engineer, SCD iX Solutions Group
Follow me on Twitter: http://twitter.com/tshinder
Facebook: http://www.facebook.com/tshinder

Windows Azure Virtual Networks and IKE Versions

Thomas W Shinder - MSFT — Mon, 13 May 2013 15:55:00 GMT

Have you heard about Windows Azure Infrastructure Services? If not, then you’re in for a treat! Windows Azure Infrastructure Services enable you to put your virtual machines in the cloud. There are a lot of reasons why you might want to do this. Maybe your datacenter is at capacity and you need to stand up new service. No problem! Put those virtual machines in the Windows Azure Infrastructure Services cloud. Maybe you host a public facing service and you want to move the public facing components out of the corporate network and into the cloud. Windows Azure Infrastructure Services can help you with that too.

My team is working on a project called “Hybrid IT Infrastructure Solution for Enterprise IT” and the focus is on what the IT Pro needs to think about before moving services into a IaaS cloud solution like Windows Azure Infrastructure Services. Issues around authentication, authorization, account management, security, performance, availability and networking will be covered in a collection of documents.

Of course, in order for us to provide you the information you need, and help you avoid any potential issues, we have to build out a solution using an application that runs on the hybrid IT infrastructure. The document set will include the results of our findings so that you can more efficiently move applications and services into the Azure Infrastructure Services cloud.

In this article, Yuri Diogenes, who is doing the engineering work on this project, shares with you some findings from when he was trying to connect to an Azure Virtual Network that hosts the virtual machines for the public side of our solution. I think you’ll find the discussion interesting and it give you some insight into discovery and troubleshooting for a specific issue in Azure Infrastructure Services. Think of us a “customer zero” where we find things out and help you avoid potential problems! Enjoy! –Tom.

Almost a month ago I wrote this post about an attempt I made to establish a site to site VPN connection between a TMG firewall and a Windows Azure Virtual Network and the conclusion was that you need a public IP address on your edge device in order for the connection to be successful.

Note:
TMG is not supported for the on premises side of the site to site connection to Windows Azure Virtual Networks. Due to some peculiarities of our test environment, we were forced to use TMG for our early testing.

With that learning in mind, I got a valid public IP address and now I’m ready to rock! It should be straightforward now that I have all the steps in mind and know how it works. Using the same lab environment (but now with TMG having a public IP address I faced a different issue. The tunnel between Azure and TMG connected for a couple of seconds (from the Azure Portal perspective) and then it dropped. This was a consistent pattern, so it was not a one-off transient situation.

Using TMG DataPackager with VPN template I gathered the data that I needed to understand what it was going on. When I started to review the IKE Logging this is what I got:

[0]00FC.0638::00/00/0000-00:00:00.000 [user] |Azure_IP|IkeVerifyPacketHeader failed with Windows error 13824(ERROR_IPSEC_IKE_INVALID_HEADER)
[0]00FC.0638::00/00/0000-00:00:00.000 [user] |Azure_IP|IkeVerifyPacketHeader failed with HRESULT 0x80073600(ERROR_IPSEC_IKE_INVALID_HEADER)
[0]00FC.0638::00/00/0000-00:00:00.000 [user] |Azure_IP|IkeVerifyPacketHeader failed with Windows error 13824(ERROR_IPSEC_IKE_INVALID_HEADER)
[0]00FC.0638::00/00/0000-00:00:00.000 [user] |Azure_IP|IkeVerifyPacketHeader failed with HRESULT 0x80073600(ERROR_IPSEC_IKE_INVALID_HEADER)
[0]00FC.0638::00/00/0000-00:00:00.000 [user] |Azure_IP|IkeVerifyPacketHeader failed with Windows error 13824(ERROR_IPSEC_IKE_INVALID_HEADER)
[0]00FC.0638::00/00/0000-00:00:00.000 [user] |Azure_IP|IkeVerifyPacketHeader failed with HRESULT 0x80073600(ERROR_IPSEC_IKE_INVALID_HEADER)
[0]00FC.0638::00/00/0000-00:00:00.000 [user] |Azure_IP|IkeVerifyPacketHeader failed with Windows error 13824(ERROR_IPSEC_IKE_INVALID_HEADER)
[0]00FC.0638::00/00/0000-00:00:00.000 [user] |Azure_IP|IkeVerifyPacketHeader failed with HRESULT 0x80073600(ERROR_IPSEC_IKE_INVALID_HEADER)
[0]00FC.0638::00/00/0000-00:00:00.000 [user] |Azure_IP|IkeVerifyPacketHeader failed with Windows error 13824(ERROR_IPSEC_IKE_INVALID_HEADER)
[0]00FC.0638::00/00/0000-00:00:00.000 [user] |Azure_IP|IkeVerifyPacketHeader failed with HRESULT 0x80073600(ERROR_IPSEC_IKE_INVALID_HEADER)
[0]00FC.0638::00/00/0000-00:00:00.000 [user] |Azure_IP|IkeVerifyPacketHeader failed with Windows error 13824(ERROR_IPSEC_IKE_INVALID_HEADER)
[0]00FC.0638::00/00/0000-00:00:00.000 [user] |Azure_IP|IkeVerifyPacketHeader failed with HRESULT 0x80073600(ERROR_IPSEC_IKE_INVALID_HEADER)
[0]00FC.0638::00/00/0000-00:00:00.000 [user] |Azure_IP|IkeVerifyPacketHeader failed with Windows error 13824(ERROR_IPSEC_IKE_INVALID_HEADER)
[0]00FC.0638::00/00/0000-00:00:00.000 [user] |Azure_IP|IkeVerifyPacketHeader failed with HRESULT 0x80073600(ERROR_IPSEC_IKE_INVALID_HEADER)
[0]00FC.0638::00/00/0000-00:00:00.000 [user] |Azure_IP|IkeVerifyPacketHeader failed with Windows error 13824(ERROR_IPSEC_IKE_INVALID_HEADER)
[0]00FC.0638::00/00/0000-00:00:00.000 [user] |Azure_IP|IkeVerifyPacketHeader failed with HRESULT 0x80073600(ERROR_IPSEC_IKE_INVALID_HEADER)
[0]00FC.0638::00/00/0000-00:00:00.000 [user] |Azure_IP|IkeVerifyPacketHeader failed with Windows error 13824(ERROR_IPSEC_IKE_INVALID_HEADER)
[0]00FC.0638::00/00/0000-00:00:00.000 [user] |Azure_IP|IkeVerifyPacketHeader failed with HRESULT 0x80073600(ERROR_IPSEC_IKE_INVALID_HEADER)
[0]00FC.0480::00/00/0000-00:00:00.000 [ikeext] 0|NULL|IkeRegConfigChangeNotifyCallback invoked
[0]00FC.0480::00/00/0000-00:00:00.000 [ikeext] 0|NULL|Stopping IKE tracing

The “Invalid header” could be something related with the IKE itself, unfortunately researching for this error didn’t help me too much:

Next step: I need to figure out what’s happening on the wire! To do that, I’ll reviewing a network monitor trace for this traffic and found:

A ha! That explains everything. TMG doesn’t work with IKEV2, hence it fails to negotiate the IKEv2 connection with the gateway on the Azure Virtual Network.

But wait a minute, this used to work. What happened? Prior to GA, Windows Azure was using IKEv1. When you are using Windows Azure Gateway you can configure it to use Static Routing or Dynamic Routing (see more info about these definitions here), if you use Dynamic Routing then Azure Gateway for Site to Site will use IKEv2. This document is getting updated to reflect this change that was introduced in GA.

And please remember: TMG is not supported for site to site connectivity on Azure and now that Dynamic Routing require IKEV2, TMG is not an option even for testing purpose.

Yuri Diogenes
Senior Technical Writer
Server and Cloud Division Solutions Team

There you go! That’s the great thing about working on these kind of projects. As customer “zero” we take the role of the person who wants to use these services and try to get them working. As we discover how the service works, we also discover things that you’ll want to know so that you’ll be able to plan, design, implement and operate a hybrid cloud in the best and easiest way possible. Stay tuned for more learnings.

HTH,

Tom

Tom Shinder
tomsh@microsoft.com
Knowledge Engineer, SCD iX Solutions Group
Follow me on Twitter: http://twitter.com/tshinder
Facebook: http://www.facebook.com/tshinder

Go Social with Building Clouds!
Building Clouds blog
Private Cloud Architecture Facebook page
Private Cloud Architecture Twitter account
Building Clouds Twitter account
Private Cloud Architecture LinkedIn Group
Cloud TechNet forums
TechNet Cloud and Datacenter Solutions Site
Cloud and Datacenter Solutions on the TechNet Wiki

Deployment-Installing scale out roles with PDT

Rob Willis (MSFT) — Mon, 13 May 2013 15:52:45 GMT

This is the last of three posts that explain how PDT can be configured to deploy a highly available configuration. The first post covered SQL clusters, the second post covered Virtual Machine Manager (VMM) clusters, and this post will cover scale out roles.

Several System Center components offer high availability by having multiple instances of a role, and other components allow scale the same way. During deployment, there are three different methods for installation of multiple instances of a role:

Concurrent – all instances of a role can be installed at the same time. The Orchestrator Runbook Server role is an example of this type of role, although PDT actually treats it as first then additional so that a primary runbook server can be designated.
First then additional – an instance of a role must be installed first, then all additional instances of that role can be installed concurrently. This is typically the case when the first instance of a role creates a database. The Operations Manager Management Server role is an example of this type of role.
Sequential – all instances of a role must be installed sequentially. This is typically because each installation of the role restarts the SQL instance that it is using. The Data Protection Manager Server role is an example of this type of role.

PDT has the ability to install scale out roles for all components – you simply need to list the instances of those roles in the <Roles> section of Variable.xml, using the correct role name. Role names are as follows:

Orchestrator (first then additional):

First role – System Center 2012 SP1 Orchestrator Primary Runbook Server
Additional roles - System Center 2012 SP1 Orchestrator Standby Runbook Server

Service Provider Foundation (first then additional):

First role – System Center 2012 SP1 Service Provider Foundation Server
Additional roles - System Center 2012 SP1 Service Provider Foundation Additional Server

App Controller (first then additional):

First role – System Center 2012 SP1 App Controller Server
Additional roles - System Center 2012 SP1 App Controller Additional Server

Operations Manager (first then additional):

First role – System Center 2012 SP1 Operations Manager Management Server
Additional roles - System Center 2012 SP1 Operations Manager Additional Management Server

Service Manager (first then additional):

First role – System Center 2012 SP1 Service Manager Management Server
Additional roles - System Center 2012 SP1 Service Manager Additional Management Server

Data Protection Manager (sequential):

All roles – System Center 2012 SP1 Data Protection Manager Server

PDT pre-deployment validation will validate that all roles have dependent roles in the deployment – for example, if you are installed an Operations Manager Additional Management Server you will also need an Operations Manager Management Server. Pre-deployment validation will also validate that there are an appropriate number of instances of roles – for example, all “first role” roles above can only have a single instance, where all other roles above can have multiple instances.

Note that high availability of Service Provider Foundation and App Controller roles also requires a load balancer – PDT does not install or configure load balancing, that is required as a manual post-deployment step.

Go Social with Building Clouds!
Building Clouds blog
Private Cloud Architecture Facebook page
Private Cloud Architecture Twitter account
Building Clouds Twitter account
Private Cloud Architecture LinkedIn Group
Cloud TechNet forums
TechNet Cloud and Datacenter Solutions Site
Cloud and Datacenter Solutions on the TechNet Wiki