John Howard - Senior Program Manager in the Hyper-V team at Microsoft : Articles

Hyper-V: MAC Address allocation and apparent network issues MAC collisions can cause

jhoward — Wed, 16 Jul 2008 06:02:00 GMT

In a physical only world, you don’t usually have to worry about MAC addresses that much as each NIC vendor carves off a MAC address from their ranges which have been allocated to them. However, in a virtual environment, you have to be a little more careful, particularly if you are using dynamic MAC address assignment. This post looks at how Hyper-V allocates dynamic MAC addresses and some potential problems you can face. So often it can be the last thing people think to check, but can be the root cause of otherwise unexplained network oddities.

Here’s a screenshot of a typical MAC collision problem – pings sometimes work, sometimes fail – and this is all on a local isolated network.

To start the walkthrough, I have a base install of Windows Server 2008 on a server with a single physical NIC – against best practice, but it serves fine for demonstration. I have already installed the RTM update (KB950050) to the server, but have not yet added the Hyper-V role. Let’s look at an output of “ipconfig /all”. You can see that the MAC address of the physical NIC is 00-13-20-F5-F8-7D and I’m obtaining an IP address from a DHCP server on the private test network I’m using.

Now let’s use Server Manager to enable the Hyper-V role. Note that Server Manager allows you to create an external virtual network switch during role enabling, but I am choosing not to do this. Let’s see what has happened in the registry after the Hyper-V role is enabled. Specifically, I’m looking at two keys which have been created under HKLM\Software\Microsoft\Windows\NT\CurrentVersion\Virtualization, as-yet unpopulated: MinimumMacAddress and MaximumMacAddress, plus another key in the worker node, CurrentMacAddress – again as-yet unpopulated. (The astute walking through this in front of a machine will notice that CurrentMacAddress also appears in the Virtualization node. That key is not used though.)

Next, I’m going to create my first virtual machine. As I haven’t created any virtual network switches yet, I’ll leave the network disconnected. I don’t need a hard disk. Also, I’m deliberately choosing not to start it. Let’s see what’s happened in the registry. MinimumMacAddress and MaximumMacAddress have been populated with 00-15-5d-c8-6a-00 and 00-15-5d-c8-6a-ff respectively – a range of 256 possible MAC addresses.

So where did this range come from? The first three bytes are the Microsoft IEEE Organizationally Unique Identifier, 00-15-5D which we use in Hyper-V. The next two bytes, C8-6A are derived from the lowest two octects of an IPv4 address on the server (the first IP address as NICs are enumerated). If you look at the second screenshot in this post, the IPv4 address on the only NIC on this server was 192.168.200.106. In Hex, this is “C0.A8.C8.6A”. The last two octets or bytes are C8 and 6A. The last byte of the address range is automatically generated with a minimum 00 and maximum FF.

You can probably now realize, that while this algorithm will work for many people, it may not necessarily be perfect and cause MAC address range clashes. To cope with multiple Hyper-V enabled servers, you would need to ensure address ranges are managed at a higher level across those servers, such as the use of SCVMM.

Let’s go back to the virtual machine I created. By default, when a virtual machine is created, it is allocated a dynamic MAC address. This can of course be changed in the settings for the virtual machine. Here’s the setting for the blank virtual machine. Notice that it’s set to Dynamic and the MAC address in the “Static” boxes show 00-00-00-00-00-00

Now I’m going to start the Virtual Machine and open the settings. Although some settings cannot be changed while a virtual machine is running (including changing static/dynamic MAC, or the static MAC itself), notice that the boxes under the static MAC address radio button are now populated with the first MAC address in the range defined in the registry: 00-15-5D-C8-6A-00.

Now for a bit of fun (and to make the walkthrough a bit simpler), let’s change the registry so that the maximum MAC address is 00-15-5D-C8-6A-02. (I’ll also do a reboot just to make sure the change takes effect) This change means that we are limited to three possible dynamically assigned MAC addresses, the last octet being 00 (in use by the “Blank” VM), 01 or 02.

Now, I’m going to create another virtual machine named 6A-01 and power it on, then create a third virtual machine named 6A-02 and power that on too. Let’s look at the settings for each of these while all three virtual machines are running. As expected 6A-01 has a MAC address ending 6A-01 and 6A-02 has a MAC address ending 6A-02. That’s why we have the “CurrentMacAddress” registry key to track what MAC address to assign to VMs in turn.

Can you guess though at this point what would happen though if I create another virtual machine and power it on? I don’t have any MAC addresses left in my available range and all MAC addresses are currently in use.

Did you guess correctly? Let’s now power off the very first virtual machine (“Blank”) I created with MAC address 6A-00, and then try to run through the New Virtual Machine Wizard again with my “No MAC Addresses Available In Range” virtual machine. Try to guess what will happen at the end.

The virtual machine starts successfully and now has a duplicate MAC address to the first virtual machine I created, ‘Blank’:

Last quiz question: What would happen then if I tried to start “Blank” – will it start or not? After all, it has already been allocated a MAC address ending 6A-00.

Actually, we will detect this as you can see above and stop the virtual machine from powering on. So in some ways, on a single Hyper-V enabled server, we’re relatively immune to duplicate MAC addresses across virtual machines running on a single server. However, due to the algorithm for choosing the ranges of MAC addresses, while relatively safe, there is no guarantee of being unique across an entire network. And of course, chances are that you will want packets from or to virtual machines on a Hyper-V server to “hit” the physical network.

So hopefully that gives you a better idea why it is important to manage MAC addresses across multiple servers in a virtual machine environment. While the walkthrough above was specific to Hyper-V, the same types of issues could arise in Virtual Server.

Cheers,
John.

Deploying Windows Vista SP1 with "slipstreamed" Hyper-V RTM. Part 3.

jhoward — Thu, 03 Jul 2008 17:32:00 GMT

The first two parts of this mini-series dealt with deploying Windows Server 2008 – either as the root partition with the RTM Hyper-V role enabled, or as a child partition (virtual machine) with the Hyper-V RTM Integration Services installed. This third part covers an additional step for using the same technique for deploying Windows Vista SP1.

The Windows Vista SP1 Integration Services for Hyper-V RTM are in a different KB and included in vmguest.iso which holds the Integration Services in Hyper-V. Currently, there isn’t a separate download available, but you can extract it really easily if you have a Windows Server 2008 machine up and running with the Hyper-V role enabled. There are a number of tools available to extract from ISOs, but let’s do this a slightly different way by using a virtual machine itself – remember that ISOs can be mounted in virtual machines directly.

Below is a Windows Server 2008 virtual machine with vmguest.iso mounted in its virtual CD/DVD device. (vmguest.iso resides on the parent partition file system under \windows\system32\language). Notice that there are a couple of .MSU packages under \support\amd64 and \support\x86. We need two files for KB950214:

\support\amd64\Windows6.0-KB950214-x64.msu and
\support\x86\Windows6.0-KB950214-x86.msu

I’ve taken a copy of these across to the WDS server to work on. I can use the same process as for the first part in this series to insert the package into a Windows Vista SP1 Business x64 WIM. You’ll probably want to add KB950214 (unpublished) for the Hyper-V RTM Integration Services and KB952627 for the Vista SP1 Hyper-V RTM Management Tools. The latter is available as a separate download from the links below, and is not present on vmguest.iso

Please also take careful note of the warning I put in my first post in this series about the /s: parameter to pkgmgr

Remember to use an elevated Windows PE Tools Command Prompt for the packaging steps and choose the right architecture MSU for the WIM you are updating! Now you just need to make sure that WIM is present in WDS and deploy a virtual machine (or indeed a physical machine).

Cheers,
John.

Deploying Windows Server 2008 with "slipstreamed" Hyper-V RTM. Part 2.

jhoward — Mon, 30 Jun 2008 18:29:00 GMT

This continues on from last week's post to show the changes needed to enable the "slipstreamed" Hyper-V RTM role at the time of operating system deployment. To start with, follow the steps from part 1 to add KB950050 to each of the images in the WIM file for Windows Server 2008. Then create an unattended installation file: Open Windows System Image Manager from the AIK tools to open the WIM file from Windows Server 2008 x64. When asked, select the appropriate image in the WIM and generate a catalog file.

Then in the Answer File area, create a new answer file:

In the Windows Image area, verify you have KB950050 present under "Update":

Expand the Foundation node, right click on the Foundation-Package and select "Add to Answer File":

Select the Foundation Package in the Answer File.

Examine the properties in the top right pane. Scan down to Windows Features Selections and toggle Microsoft-Hyper-V and Microsoft-Hyper-V-Management-Clients to Enabled. (If preparing an answer file for server core, just toggle Microsoft-Hyper-V).

Now close the answer file by right-clicking at the top-most node in the Answer File tree view and save the file to disk. (Of course, you can use an existing answer file which has additional configuration already put in place).

If you take a peek at the XML file which is created, in the unattend\servicing section, you’ll notice the selections for Hyper-V (This is the XML for a full installation. For server core, Microsoft Hyper-V Management Clients should not be present).

Now to add the image(s) from the WIM to WDS and allow unattended installation using the answer file we just created. I happened to give it a “Root:” prefix to distinguish it from the other images I deploy to virtual machines. Once added, right click and select properties. Check the “Allow image to install in unattended mode”.

Click Select File to browse to the XML file you created. And that’s pretty much it. Just PXE boot a server and the Hyper-V RTM role will be present and enabled when installation completes.

Cheers,
John.

Deploying Windows Server 2008 with "slipstreamed" Hyper-V RTM. Part 1.

jhoward — Fri, 27 Jun 2008 04:33:00 GMT

This article walks through updating an WDS infrastructure such that Hyper-V RTM bits are “slipstreamed” into the operating system installation. Given that Hyper-V has reached RTM (release to manufacturing), it was time to refresh my test deployment environment in my office anyway. I have an entirely private network segment here with its own domain controller and WDS server. I use this environment extensively for quickly deploying test operating system installations to both physical and virtual machines. (It’s also helpful as I can get full dedicated gigabit networking – something which I can’t get from corporate services here at Microsoft – this alone almost halves the overall installation time :) )

There are a few resources you need to refer to start with:

1. Mikes posts on servicing from which I’m borrowing many of these instructions

2. The download for KB950049 x64 – This is the Hyper-V RTM bits for Windows Server 2008

3. The install.wim from Windows Server 2008 x64 RTM media. The WIM is present in the sources directory of the media.

4. The boot.wim from Windows Server 2008 x64 RTM media (for preparing the WDS server – outside the scope of this post)

5. The Automated Installation Toolkit (AIK) for Windows Vista SP1 and Windows Server 2008

6. KB928636 to provide more information on extracting an MSU

The first step is to expand the MSU into a directory by entering the following command “expand –F:* <pathtomsu> <folder>”

There are four files created. Windows6.0-KB950050-x64.cab is the file we are going to add to our master image. We need to now see what the list of images is in the WIM file. For the purposes of this walkthrough, I’m using Windows Server 2008 en-us x64 Volume License media which has six images in it.

From an elevated AIK Tools command prompt: enter imagex /info <pathtoWIM>

In order, the images are: Standard Full, Enterprise Full, Datacentre full, Standard core, Enterprise Core, Datacentre Core. To perform the update, you need a directory for a mount point. In my case, e:\mount.

For each of the images which are relevant to you, execute the following commands from an elevated AIK Tools Prompt:

imagex /mountrw <WIM> <WIM Image Index> e:\mount
start /w pkgmgr /ip /m:e:\950050\Windows6.0-KB950050-x64.cab /o:e:\mount;e:\mount\windows /s:%temp% (see note below)
imagex /unmount /commit e:\mount

CAUTION: This procedure appears to hit a bug in the servicing engine and may not work correctly if you have previously run pkgmgr and have some stale files left over in the directory specified by the /s: parameter. It would be safer to either create a new blank directory and use that as the parameter value for /s:, or ensure that you completely remove the contents of %temp% before running the command. You may wish to add /l:<kbnumber>.txt as another parameter to the pkgmgr command, and look at the output log file <kbnumber>.txt.txt generated. It should be obvious if you are seeing servicing trying to match to an incorrect KB number.

Note that the second and third steps can take a little while to complete.

Now we need to add those images to the WDS server. For this walkthrough, I’m going to add an image group called “Hyper-V RTM Windows Server 2008 Images”. From administrative tools, start Windows Deployment Services, navigate down to Install Images, right click and add an image group entering the appropriate name.

Once the image group is created, right-click on it and select Add Install Image. Use the wizard to walk through adding all the available images. I’m just using the default names for this walkthrough, but rename them as appropriate.

At this point, you’re pretty much set.

Before we can use WDS, you also need to have prepared the boot images on the WDS server if you haven’t already. I’d already previously added both x86 and x64 architectures. (Lots of information on this can be found in WDS documentation).

So let’s PXE boot a physical server and install Windows Server 2008 Enterprise edition with Hyper-V RTM installed in the image. (I’m using an HP iLO on a Proliant DL380 G5 if you're wondering).

As I have both x86 and x64 boot images installed on the WDS server, I select my architecture. In this case, x64 is what I want as Hyper-V is not present as a role in Windows Server 2008 x86 SKUs.

Run through Windows setup as normal.

Once installation has completed and you log on, you will notice that KB950050 now appears out of the box as installed under Control Panel, Programs and Features, Installed Updates.

We still need to enable the Hyper-V role. Just use Server Manager on the Add roles button in Initial Configuration Tasks, walk through the wizard and reboot. Hyper-V Manager will then be present under administrative tools.

And, of course, you can use exactly the same mechanism to install Virtual Machines, the Windows Server 2008 x86 or Windows Vista SP1 x64 or x86 management tools (KB952627). Just add the right package to the right WIM. It’s really that simple. There is a gotcha here for Vista SP1 virtual machines which I’ll cover in a separate post soon. Also, there’s one follow up post I’ll do which shows you how to deploy Windows Server 2008 with Hyper-V RTM from WDS and get the Hyper-V role enabled at the same time, saving even more time on the overall installation.

Here’s a Virtual Machine being installed from the WDS server. And the real beauty of this – I will have all the right components already installed in the virtual machine once installation completes. No need to use the Actions/Insert Integration Services Setup Disk and run setup in the virtual machine.

Cheers,
John.

Hyper-V: What are the uses for different types of virtual networks?

jhoward — Wed, 18 Jun 2008 02:57:00 GMT

If you followed yesterdays post explaining the basics of networking in Hyper-V, you may be wondering what the different types of virtual networks are, when you should use them, and how they look in terms of traffic flow.

When you open Virtual Network Manager from Hyper-V Manager, there are three types of virtual network which can be created: External, Internal and Private. There is also a fourth type which can only be created through WMI and doesn’t have an official name, but I’ll call it a “Dedicated” virtual network (thanks Jake who came up with the suggestion!). Let’s look at each type, and when it is appropriate to use them.

External

External virtual networks are used where you want to allow communications between

Virtual machine to virtual machine on the same physical server
Virtual machine to parent partition (and visa-versa)
Virtual machine to externally located servers (and visa-versa)
(Optional) Parent partition to externally located servers (and visa-versa)

Internal

Internal virtual networks are used where you want to allow communications between

Virtual machine to virtual machine on the same physical server
Virtual machine to parent partition (and visa-versa)

In a block diagram, an internal network is an external network without the binding to a physical NIC. An internal network would commonly be used to build a test environment where you need network connectivity into the virtual machines from the parent partition itself.

Private

Private virtual networks are used where you want to allow communications between

Virtual machine to virtual machine on the same physical server

In a block diagram, a private network is an internal network without a virtual NIC in the parent partition. A private network would commonly be used where you need complete isolation of virtual machines from external and parent partition traffic. DMZ workloads running on a leg of a tri-homed firewall, or an isolated test domain are examples where this type of network may be useful.

Dedicated

Dedicated networks are in some ways one of the most useful type of virtual network where you dedicate a physical NIC for use just by virtual machines. They allow communication between:

Virtual machine to virtual machine on the same physical server
Virtual machine to externally located servers (and visa-versa)

Note that the parent partition is unable to use a dedicated virtual network for its own communication. You would normally have a second physical NIC for use by the parent partition, as was discussed yesterday. In a block diagram, a dedicated network is an external network without a virtual NIC in the parent partition.

Note that you can achieve something functionally identical to a dedicated network by creating an external virtual network, and unbinding the protocols from the newly created virtual NIC in the parent partition. However, I would personally recommend you deploy a dedicated virtual network “correctly” to avoid accidental changing of bindings on the virtual NIC, or to avoid confusion as to what is present in the network adapters control panel applet. (And before you ask, I don’t have a sample script to create a dedicated virtual network yet. A post for another day).

Cheers,
John.

Hows Windows stores passwords and how passwords can be attacked

jhoward — Mon, 21 Nov 2005 17:44:00 GMT

I was forwarded this by a colleague last week and found it interesting reading. It's a short article written by Jesper Johannson and published last month up on TechNet. It raises many good questions, many of which arise on a frequent basis, but after IT Forum last week, I can kind of now understand why the AD administrators here in Microsoft use smart cards and seperate accounts for elevated privileges to perform almost all administrative functions. It was amusing when Brian, one of these administrators pulled out a bunch of some 24 different smartcards, just to perform his day job, and the mild panic he had when one of them went walkies - turned out he'd been using it as a bookmark. Just shows you everyone's human :-)

You can read Jespers article here.

Forms Based Authentication and RPC/HTTP over single IP using ISA 2004

jhoward — Tue, 14 Jun 2005 13:41:00 GMT

You would think that this would be something fairly simple to do.... Well, think again, unless you know. In the scenario I was trying to get working, there are essentially three servers involved - a domain controller running Windows Server 2003, a single Exchange 2003 Server and an ISA 2004 Server.

The goal is to allows users to access the Exchange Server remotely, both via Outlook Web Access and through RPC/HTTP using Outlook 2003.

When you publish OWA (I'm not using a FE/BE [Front-End/Back-End] configuration - just a single Exchange Server) through ISA 2004, the principle is to create a new web listener running on port 443 (SSL) on the ISA Server. You configure the web listener to use forms based authentication (FBA) and forward the requests back to your Exchange Server. I had this going fine without a manual in sight ;-)

However, when it comes to a configuration where you have a single IP address externally, and want to publish RPC/HTTPS also on port 443, you have a problem. You cannot, in ISA 2004, have a web-listener running in both FBA mode and basic authentication.

I was puzzling about this last week, and came close to solving the problem. There wasn't much information I could find out there on the Internet, so my thoughts were to use Basic Authentication on the web listener, and proxy the FBA through another listener. I never quite got there until I found the article below, but the general principle was right.

This article by Tom Schinder "ISA Server 2004: Supporting Both Basic and Forms-based Authentication with a single External IP Address and Web Listener". This article goes through a step-by-step configuration and worked perfectly for me. Lots of screenshots to make it dead obvious what you need to do. The workaround is astonishingly simple in concept, yet resolves what should be such a simple thing to do.

...so here's a small part of my ISA configuration showing it configured

...and here's my OWA (with a few bits disguised - afterall, you wouldn't expect me to publicise my inbox contents or external domain name would you??? :-) )

Now for that XBox theme..... When's the XBox 360 theme coming out then, Eileen.

PKI and Certificate Management Information in Windows Server 2003

jhoward — Wed, 02 Feb 2005 22:16:00 GMT

While on the subject of Certificates/Encryption/IPSec/PKI in general yesterday, I was looking around for some good information on how PKI works to post up. One white paper which stuck-out from the pile was published in December last year (so it's reasonably up to date) by David B. Cross and Avi Ben-Menahem entitled "Key Archival and Management in Windows Server 2003". Now this isn't exactly going to be a best seller, but I found it very easy to read and understand, so all kudos to David & Ali. Joking aside, it is crucial to pay consideration to this subject if you are planning to implement or already have implemented a certificate authority within your organisation.

For further info on PKI in general, this link is a good starting point. The home page for Cryptography on Technet is here and information on EFS (Encrypting File System) in XP and Windows Server 2003 can be found here. Otherwise my colleague Steve Lamb will be able fill in the gaps.

IIS 7.0 - a first look

jhoward — Wed, 02 Feb 2005 16:42:00 GMT

I saw several demonstrations of an early cut of IIS 7 when I was over in Redmond a couple of weeks ago. Again it's Longhorn timeframe material, so much can change and there's little concrete information publicly available. Remember we're way before pre-beta product. One particular demonstration though was fabulous - the power and manageability of the revised architecture is truly awesome. However, at this stage, NDA sadly prevents me from providing more info :-(

However, it looks like Danielle and Nelson Ruest at FTPOnline have had a sneak preview and an interview direct with the product team. Have a read of their article to get a feel for where IIS may be heading.

Active Directory Federation Services (ADFS) - Presentation & White Paper

jhoward — Tue, 16 Nov 2004 00:45:00 GMT

I'm blogging while sitting listening to John Craddock and Sally Storey presenting one of the all-day pre-conference seminars "Stretching Directory Boundaries Cross Platform Identity Management, Authentication and Security" at the Microsoft IT Forum in Copenhagen. On screen as I write is a fantastic demonstration of ADFS (Active Directory Federation Services) which is due to be included in the R2 release of Windows 2003 server some time next year.

This is a fantastically powerful mechanism to allow cross-organisation information sharing. This type of federation is still way in its infancy. However. for a good overview, see the White Paper Active Directory Federation Services: A Path to Federated Identity and Access Management on the Microsoft web-site.