Cheng's Random Thoughts on System Management : Network

VMM Network Location and Network Tag

Cheng Wei — Fri, 08 May 2009 23:14:00 GMT

Hello there!

Today I got a guest poster, my colleague, David Armour. David is a senior program manager responsible for SCVMM 2008's Networking feature. Based on the questions he has seen on the Technet SCVMM forum, he wanted to post this information out to help clarify the concepts and usage of Network Location and Network Tag in SCVMM.

Here is the post in David's words:
=============================================

When you specify a template or VM’s network connection requirements, you can supply a Network Location and a Network Tag. You have undoubtedly seen this screen:

What do these things mean and how are they used?

Network Location and Network Tag are used when placing a VM on the host - the VM's connection requirements are checked against the networking capabilities provided by the host. This helps you place the VM onto a host that can provide the network connection requirements of the VM. When you set the requirements in the VM, you select from a list network locations and tags which the hosts provide. So for example if your VM should be in your DMZ, you can select the DMZ network as the network location.

In most cases, the Network Location is determined on the host using the Windows Network Location Awareness (NLA) feature. Windows determines a name for the network based on the DNS settings for the network. You can learn more about how the Windows Network Location Awareness (NLA) feature works here: http://msdn.microsoft.com/en-us/library/ms740558(VS.85).aspx.

Sometimes VMM cannot determine the Network Location from NLA. This happens with loopback adapters since they are not participating in a network and on ESX servers since OS on these hosts does not have the NLA feature. In these cases you can manually add the network location. You can do this by going to the host properties. On the Hardware tab, find the loopback adapter. Check the "Override discovered network location" checkbox and type a name for the network location.

We just covered Network Location, now let’s look at the Network Tag.

The Network Tag provides you with another property to set up applicability when placing a VM on a host. You can use the network tag on the Hosts’ virtual networks to differentiate networks on some other criteria than just network location, such as on the VLAN or network throughput or security (IPSec for example). This is a custom tag that you create. The network tag is set on the host’s Virtual Network and the VM/Template can then select this tag in its network connection requirements. To set the Network Tag on a Host’s Virtual Network, go to the host properties. On the networking tab, find your Virtual Network. You will find the Network Tag under the Virtual Network name.

Once you have set up the Network Location and Network Tags on your hosts, each unique Network Tag and Network Location will show up in the combo boxes under the VM/Template's connection requirements.

Thanks,

David

=============================================

Hope this helps and thanks for reading!

Cheng

Got a "Bad Gateway"?

Cheng Wei — Tue, 14 Apr 2009 19:41:00 GMT

Greetings, folks!

Hope you had a great Easter on last Sunday, if you celebrate that holiday! My kids certainly enjoyed hunting eggs in a typical Seattle drizzling Saturday morning. J

This blog entry is for folks who use or plan to use VMM to manage VMware ESX hosts.

If this is your first time adding your ESX host to VMM, and your ESX hosts are added into VMM by using DNS name (instead of IP address), and your network environment with Internet proxy is not made aware of VMware host DNS names, you may see error similar to below:

Error (2891)

VMM cannot complete the …. action on the vmm-esx1.scvmm.contoso.com server because of the error: The remote server returned an error: (502) Bad Gateway.

(Unknown error (0x194))

This issue may occur when:

· To turn your ESX host from “OK(Limited)” state to “OK” state (to get your ESX host in full management mode), you are providing root user credentials and attempting to retrieve the certificate and SSH key from the ESX host to approve.

· You may also run into the same error when attempting to perform a live migration (VMotion) for a VM hosted by an ESX host from VMM admin console.

The cause of this issue is due to the DNS resolution (or proxy configuration) on your VMM server:

· VMM uses web services to communicate to VMware Virtual Center and ESX hosts.

· Proxies are generally configured to permit pass-through of local DNS names.

· In some cases, when the proxy is not configured for a DNS name, the web service connection may fail.

Following are some simple options to resolve this issue:

· SOLUTION 1: Include VMWare host DNS names in the internet proxy configuration.

· SOLUTION 2: Add dns hosts to the proxy configuration of Internet Explorer

· SOLUTION 3: Create a file "vmmservice.exe.config" in the same location as vmmservice.exe (by default, it’s installed under this directory: %ProgramFiles%\Program Files\Microsoft System Center Virtual Machine Manager 2008\bin\) with contents similar to the following. Note: you will need to bounce the VMM server service (restart “Virtual Machine Manager” service from services.mcs) for it to pick up the new proxy configuration).

<system.net>

</bypasslist>

</defaultProxy>

</system.net>

</configuration>

On the extreme side, you could also completely turn off the proxy on your VMM server by applying the following config file:

<system.net>

</defaultProxy>

</system.net>

</configuration>

Hope this helps and thanks for reading!

Cheers,

Cheng

NIC teaming and VMM

Cheng Wei — Thu, 26 Feb 2009 23:14:00 GMT

Greetings folks,

NIC Teaming, also called “Load Balancing and Fail-Over” (LBFO) or “Link Aggregation” or “IEEE 802.1AX-2008”, groups multiple interfaces to provide fault tolerance and load balancing for Network Interface Cards (NIC) connecting Windows Server to the network. This aggregation combines the individual capacity of multiple interface cards to form a high performance virtual link so the failure of an individual port or adapter does not cause a loss of connectivity. Below is a picture from Wikipedia.org on how a typical NIC teaming looks like:

The Microsoft support position on NIC teaming for Windows Server 2008 (deployed either in a physical environment or virtualized environment with Hyper-V) is that hardware and driver support is provided by the hardware manufacturer as outlined in KB Article 254101.

Alex, one of our test engineers, spent some time researching Broadcom Advanced Control Suite (BACS) version 11.6.10 with Broadcom Advanced Server Program (BASP) NICs, and found out that he could actually make NIC teaming work with his Hyper-V hosts and have VMM manage the BASP NICs.

Here is the blog he posted for what he has experimented and his step-by-step notes on how he made it work for him.

http://blogs.technet.com/apb/archive/2009/02/25/using-vmm-to-manage-you-hyper-v-nic-teams-created-with-bacs.aspx

Hope this is useful information for you!

Enjoy your reading,

Cheng

All about refreshers ...

Cheng Wei — Thu, 02 Oct 2008 02:19:00 GMT

If you have been using VMM for a while, you’ve probably figured out that we use various “refreshers” to pull data from the hosts and VMs that we manage. When deploying VMM in various sized environments, depending on the perf/scale requirements, you might need to tweak the refresher schedule to achieve the best performance.

So, to help you understand what’s happening “under the hood”, here are the refreshers we use in SCVMM 2008 product. Please note, that not all refreshers are customizable.

Host Refresher: Runs every 30mins on every host (with time lags) and updates host properties. It also updates disk/SAN and host network (NIC / virtual switch) information. It does not check any VM related properties or perf counters on hosts. Can be manually triggered on the UI or through cmdlet.

VM Refreshers: Two types

VM Heavy Refresher: Runs every 30mins on every Host and also runs whenever a VM is clicked on (or when you call refresh-vm cmdlet). It updates all VM properties, resource pools, clustering information for this VM and snapshots. But it does not update VM performance counter info.

VM Light Refresher: Runs every 2mins on every Host that is currently in the VMM database. This refresher does the following:

- Checks the host state (to see if the agent is running or the agent is down) and virtualization software status

- Syncs the state of a VM

- Marks VMs as missing

- Imports new VMs created outside of VMM (When VMM detects a new VM created on the virtualization platform, we import it into VMM and kick off the heavy refresher for the new VMs)

Cluster Refresher: Runs every 30mins and refreshes all cluster properties (including bringing in newly added nodes or taking our removed nodes). Can be manually triggered on the UI or through cmdlet.

Library Refresher: Runs on user configurable schedule (increment by 1 hour interval and can be turned off completely) and updates the library shares info and library objects. Can be manually triggered on the UI or through cmdlet.

Perf Refresher: Runs every 9 minutes on a host or whenever there is any state changing operation on the VM (i.e. start/stop/save/etc.). It collects perf counter information of both the host and all the VM’s on a given host.

VirtualCenter Refresher: Runs every 30mins and refreshes VC properties, ESX hosts and resource pools that are managed by this VC. Can be manually triggered on the UI or through cmdlet.

User Role Refresher: Runs every 30mins and updates user role properties.

PRO Tip Refresher: Runs every 30secs. It looks for PRO specific alerts in OpsMgr and reconciles the PRO tips in our DB against the data that is brought back from OpsMgr. This refresher cannot be manually triggered.

Thanks for reading and hope this is useful,

Cheng

SCVMM and Network Ports We Use for Communication

Cheng Wei — Mon, 30 Jun 2008 23:29:00 GMT

More than often, deploying SCVMM server and managing VM hosts require coordination with your network admins. One of the frequently asked questions is "What ports should I ask my network guy to open for me in order to allow SCVMM server to talk to the hosts?". For a tightly controlled enterprise data center, this question will come up for sure. By default, everything is blocked. Ports are only open (or exempted) per request and with good justifications.

Other times when a host failed to be added or the host agent goes into a "Not Responding" state, if you cannot afford to turn off the firewall, you might be scratching your head to try figuring out what port needs to be open and what needs not.

So, to make our SCVMM admin's job easier, here is the list of TCP/IP ports SCVMM needs to talk to various system components:

VMM Server exceptions needed:

80 (HTTP, WS-MAN)
443 (HTTPS, BITS)
8100 (WCF Connections to PowerShell or Admin Console)

SQL Server

1433 (Remote SQL instance connection)
1434 (SQL browser service) - only needed for initial setup

Host / Library

80 (HTTP, WS-MAN)
443 (HTTPS, BITS)
3389 (RDP)
2179 (VMConnect on Hyper-V hosts for single-class console view)
5900 (VMRC on Virtual Server hosts)

VMware VirtualCenter server

443 (HTTPS for calling VI Web Services APIs)

VMware ESX hosts

443 (HTTPS for calling VI Web Services APIs)
22 (SSH for SFTP files to/from ESX hosts) - this is only used for ESX host version 3.0 and 3.5 (not needed for 3.5i)

Hope this helps.

Thanks for reading,

Cheng