Windows Server Customer Engineering : Virtualization

Deployment Security Designs for Forefront IAG/UAG Virtual Appliances

morello — Wed, 13 Aug 2008 19:34:00 GMT

One of the most compelling capabilities being added in IAG SP2 (which will also be available in UAG) is the 'virtual appliance' installation option. A virtual appliance is a preconfigured, ready to use Virtual Machine that already has Windows Server and IAG / UAG installed. Microsoft will build the VHD and make it available for customers to download. Customers will then take the Virtual Hard Drive (VHD) and drop it into a child partition on a Hyper-V host. At this point, the VM would function like a classic IAG installation, with all the normal features and capabilities customers have come to expect. The reason we've added this capability in IAG is to give customers options for how they want to deploy IAG in their networks. For many customers, the pre-tuned, dedicated hardware appliances available from our partners are a great option that fit in well with their overall management methodology. For other customers, they prefer a more standardized hardware platform in their datacenters and thus the virtual appliance on Hyper-V is preferred. Note that it's not a question of which is 'better'; the two options allow customers to chose the solution that best fits their environment.

For customers looking at deploying the virtual appliance, a common question is what is the best way to provide a secure virtualization environment for the IAG/UAG VM? There are three primary design options to choose from. Again, it's not a question of what option is best; rather, customers should look at each model and decide which best aligns with their management approach.

Option 1: Classic Physical Appliance

It may seem strange to list a physical appliance as an option here, but arguably the dedicated physical appliance is the most hardened configuration out of the box. The reason for this is that the OEM appliance vendors take Windows Server and IAG and really mold the entire hardware platform around them. In doing so, they reduce the attack surface of the machine by disabling services not critical to IAG, ensure necessary updates are installed, and then put that image on top of a hardware platform designed for them. Because IAG is built on top of Windows Server, it's possible for a customer to take many of the same software steps the OEMs do, but the benefit of the appliance is that it's all been done and tested for you. For customers looking for the most secure out of the box experience with IAG, physical appliances provide some unique benefits.

Pros: minimal configuration; pre-hardened operating system; hardware designed specifically for remote access gateway
Cons: limited hardware choice; potentially non-standard device and software configuration in an otherwise rationalized datacenter

Option 2: VM on Dedicated Hardware

While one of the key benefits of virtualization is the ability to run multiple operating systems simultaneously on the same physical hardware, it's by no means a requirement that a Hyper-V machine have more than 1 child partition. In other words, it's fully supported to run a Hyper-V system with only a single child. Why would you do this? If you want to have the manageability benefits of virtualization, but have workloads that can scale up and maximize an entire physical server, this approach is an effective model for getting the best of both worlds. Particularly when you use the Server Core option of Windows Server 2008 to run the parent partition, you have very minimal overhead incurred by doing so. In fact, key Microsoft web sites like TechNet and MSDN use this exact model in their production environments. When you think about this model for hosting IAG, the benefits are that you don't have concerns about resource contention between VMs (though Hyper-V has resource management controls available) and you don't have to worry about sharing the remote access gateway physical platform with any other workloads. Because Hyper-V supports the same huge catalog of server hardware that Windows Server 2008 does, you have great flexibility in what the physical layer looks like. Whether you prefer 1U, 2U, blades, and regardless of OEM, you'll be able to easily integrate the Hyper-V host and its IAG child partition into your existing datacenter. Finally, because you can use whatever hardware you prefer, it's easy to place the server wherever it needs to go within your network. For example, it is often easier to provision a new blade into the DMZ network to host IAG than it is to securely route traffic from the DMZ to a larger virtualization system in the internal network.

Pros: great choice in hardware; can use existing organization standards for hardware and operating system images; with Server Core, very low overhead for parent partition; great flexibility in network placement
Cons: may require greater setup effort to configure hardware and parent partition operating system

Option 3: VM on Existing Virtualization Environment

For customers that already have a Hyper-V environment, they may wish to simply add the IAG VM to the existing hosts. This is particularly true if a customer has already invested in building a highly reliable, well tuned hosting environment, using tools like Failover Clustering. In these cases, there's no problem with running IAG in a child partition on an existing physical server already running other VMs. So long as the traffic is properly routed to the VM, IAG can function perfectly well in such a configuration. However, when sharing physical resources with other child partitions, it's particularly important to allocate sufficient capability to the IAG VM. This should be done both by allocating enough memory and CPU capability to VM, as well as ensuring that Hyper-V prioritizes requests through the IAG VM appropriately. Additionally, there are significant performance and security benefits to dedicating physical network adapters solely to the IAG VM, rather than sharing them with other VMs. Having dedicated NICs ensures that IAG will not need to compete for network IO and simplifies the routing of remote access traffic to and from the VM.

Pros: efficiency of reusing existing investments in Hyper-V physical platform, such as Failover Clustering
Cons: more planning required to ensure sufficient resources for IAG child partition; potentially more complex network routing needs if the existing environment does not already receive traffic from internet hosts

Virtual appliances are all about customer choice; providing you with the right options for security and placement while allowing you to chose your own hardware platform or reuse one you already have. There's no right choice that applies to all situations, so think about your environment and goals, and chose the option that fits your network best.

Thinking Thru Building a Virtualized Datacenter

allenstew — Tue, 29 Jan 2008 03:33:17 GMT

In most if not all enterprise customers most technology areas are driven by various teams responsible for a technology area. Some enterprise customers have more integrated technology teams then others. So how does this affect the common approach today of infusing virtualization into datacenters and building out a virtualization utility/service? To date this task has been assigned to a virtualization team or a virtualization expert in most companies folks that understand the virtualization technology well. This is reflective of the disruptive nature of the virtualization technology initially and companies reacted by creating teams to work on Virtualization. The virtualization projects started out small with Test/Development environments and expanded into production then into full blown virtualized datacenter projects.

So of course the datacenter existed long before the project to create a virtualization utility/service with various technology and process areas. Some will say the datacenter was lumbering along (no offense to present datacenter operations managers) with various issues and challenges and that virtualization is going to cure all the ills of the datacenters. I am a virtualization person and I love the virtualization technology and I happen to believe that virtualization capabilities have the potential to change how we build and use capabilities in the datacenter and beyond. Ok with that said without reference architecture of these new datacenters where virtualization is a key pillar we may miss some opportunities to completely realize all of the potential across datacenter service areas.

A Virtualization datacenter project should seek to review present datacenter capabilities determine gaps, leverage existing capabilities and redesign others that do not fully leverage or hinder the virtualization effort. What are some of the areas that have to be taken into account when embarking on this journey to build a virtualized datacenter? Well let's look at some of the services that a present day datacenter offers:

Power and Cooling
Systems/Service Management
Backup services
Disaster Recovery services
Security Services
Capacity services
Storage services
Equipment Provisioning
- Servers
- Network devices
- Storage
- Backup devices
Compliance services

So it is pretty clear that today's datacenters offer a range of complex services and you thought all it did was keep servers from being homeless. So a project to infuse virtualization as a core pillar has to seek to understand how virtualization impacts the various datacenters areas. I know what people are thinking, I already have virtual machines in production so this is a mute point. There is some production virtualization but very few projects that have truly looked at all of the datacenter areas and designed the area to fully leverage virtualization. This is an opportunity for datacenter architects and datacenter service owners to think and rethink how virtualization can affect some of the service areas in the datacenter. This exercise will help unlock potential that relooking at some of the services with virtualization capability in mind will provide. Some core areas to start are Storage and Business continuity areas that receive a lot of interest especially from the Virtualization community but have very little architecture patterns and practices. I look forward to your comments on this and experiences' looking deeper at datacenter services that Virtualization affects.

Allen Stewart

Principal Program Manager

Windows Server Group

Virtualization IT Administration Model

allenstew — Thu, 05 Jul 2007 00:26:15 GMT

Allen Stewart from the Windows Server Division (WinCat) team. I spend a lot of time with companies that are deploying a virtualized architecture for Datacenters and Branch offices. Some of the technologies leveraged in these scenarios, capacity planning tools, workload migration technologies, P2V, V2V, High Availability, virtualization management, virtual machine backup/snapshots and service oriented management. While the technologies are well understood one thing has been pretty fluid is the administration model for the virtualized environment. Lets dive in there does not seem to be a consistent model some companies have taken the approach of keeping things the same way as the physical environment, others have created a virtualization group and assigned them the task of managing the virtual world. I understand both schools of thought, the virtual world should not change the administration model, or the virtual world is so disruptive and demands new skills, approaches that we need a group directed at the technology. So what I am really interested in is the administration model that will win out and your thoughts on the topic because this should drive flexible administration models in virtualization products.

So in the centralized approach Tier 1 and Tier 2 have complete rights to the environment and handle activities like VM creation from templates, deleting VM'S, starting/stopping, workload migration. The Engineering team handles, virtualization product evaluation, environment build out, creating standard VM builds/templates.

Tier 1 Support – Initial call support and case management

Tier 2 Support- Escalation deep troubleshooting

Windows Server Engineering/Dedicated Virtualization Team – Escalation deep troubleshooting/environment design changes.

Certain environments like branch offices and test/dev labs may dedicate a different model where Virtualization tasks and activities are delegated to business units or IT in branch offices. I am not going to cover the scenario where there is decentralized IT and each business unit does their own engineering (that to me still looks like the model above abet more political). In the branch office scenario you can still manage centrally but in the case where you have an IT person in the branch this forces delegation of activities. In this case it seems the activities that get delegated the most are the same as Tier 1 and Tier 2 personnel. So this starts to look and feel like the Active Directory Organization Unit delegation model a person is able to handle virtualization tasks in single or multiple sites with the central IT group having complete access. Please send in comments on how your virtualization environment is structured and any ideas you have on how you feel the administration model should be structured. My next blog will cover virtualization administration roles another fun topic on this path, thought being do we create specific in box roles or just leave it completely, flexible. Also, next in that path is assigning roles to tasks in the new Virtual Datacenters.

Allen Stewart

Principal Program Manager

Windows Server Division

The Datacenter Dynamic or Otherwise

allenstew — Tue, 01 May 2007 14:01:19 GMT

Allen Stewart from the WinCat team I focus on the Datacenter from an Architecture standpoint across many technologies and I have expertise in Virtualization Technologies as well. Service Oriented Applications, Real Time Infrastructure. Service Oriented Infrastructure is all new buzz words to describe various application and infrastructure design approaches for the datacenter. Add the various Virtualization technologies: Hardware, Application, Storage, Network, Presentation and Virtualization management into the mix of technologies for someone looking at changing, implementing or redesigning a datacenter it is an exciting time.

In today's datacenter are we just adding technologies to solve today's problems or are we retrofitting the datacenter one disruptive technology at a time? Take for instance Hardware Virtualization (I will not preach about all of the benefits we know them well) it changes the way we provision, manage and allocate resources in the datacenter. As I work with customers it becomes apparent in some cases that Virtualization has been deployed without looking at things like what is the over arching impact to various datacenter services. Take for instance what is the Storage Architecture required to support the Virtual environment especially as virtualization makes workloads portable between servers. In addition, what are the types of servers we should be purchasing there are various camps blades, larger multiple core machines with Virtualization as the partitioning technology that allows the best server asset utilization. What are the management/security requirements for the virtualized world are they so different then the physical world?

As you see there are lots of things to think about and incorporate. I have been working with customers architecting Virtualization solutions with Microsoft Virtualization technologies and have taken various architectural approaches. I look forward to hearing your comments and sharing some design decisions with you from various customer scenarios. Here are some areas for us to explore:

Patch Management in the Virtualized datacenter

Capacity planning in the Virtualized datacenter

Storage architecture in the Virtualized datacenter

Business Continuity in the Virtualized datacenter

Configuration management in the Virtualized datacenter

Allen Stewart

Principal Program Manager

Windows Server Division

Microsoft Virtualization and Interoperability

allenstew — Tue, 19 Dec 2006 08:06:00 GMT

As many of you know from announcements we have made that Microsoft continues to enhance our support for non Microsoft operating systems on our Virtualization stack. Thru our partnership with XenSource and now Novell (SUSE) the Linux operating system support is being enhanced to keep up with advancements taking place on the Microsoft Virtualization stack. Some enhancements include supporting synthetic devices on Linux as a part of Windows Server Virtualization release. That will enable Linux to take advantage of our new hardware sharing architecture (VSP/VSC). I would be negligent to mention our current support In Virtual Server for Linux with additions for Redhat and SUSE distros. We have a number of major customers leveraging our Linux support in Virtual Server 2005 R2 in production deployments that span the range of industries. I have personally worked with a number of customers on those projects. So look for alot more posts on my virtualization activities moving forward.

Thanks

Allen Stewart

Windows Server Division Customer Advisory Team

System Center Virtual Machine Manager (Carmine)

allenstew — Tue, 08 Aug 2006 06:45:00 GMT

Microsoft has just released Beta 1 of System Center Virtual Machine Manager. This product is Microsoft's answer to Virtual Machine Lifecycle Management. I will not discuss all of the features as the System Center Development Team will be discussing that is detail on their blog. I will be lurking in the System Center Virtual Machine Manager newsgroup and answering technical questions and engaged deeply with customers that are a part of the System Center Virtual Machine Manager Technology Adoption Program. I will concentrate over the next few blogs on discussing a reference architecture for building a Virtual Machine Hosting Utility based on Microsoft Virtualization technologies: Virtual Server 2005 R2 SP1 and System Center Virtual Machine Manager. With the release of System Center Virtual Machine Manager it gives customers the capability of creating resource pools of Virtual Server 2005, Virtual Server 2005 R2 and Virtual Server 2005 R2 SP1 hosts managing the hosts as a single pool of resources. This allows the resources to be leveraged as a whole, take deployment for instance creating and deploying a new Virtual Machine within the resource pool. Instead of the administrator deciding what host to place the new Virtual Machine on System Center Virtual Machine Manager can rank and rate the Virtual Server hosts in the resource pool based on the current performance of the Virtual Server hosts and the performance needs of the new Virtual machine (intelligent placement) managing the resource pool as a whole. So think of this from a hosting viewpoint customers can now deploy resource pools in datacenters for production virtual machine hosting and resource pools for Development and test labs. I am working on a Visio that lays out a architecture that visually represents this approach. I will post the next few blogs based on this type of architecture.

Allen Stewart

Program Manager

Customer Advisory Team

Windows Server Division

Windows Server Virtualization and System Center Virtual Machine Manager

allenstew — Mon, 29 May 2006 07:54:00 GMT

Ok, so I am sure all interested in virtualization have heard about the demo of the next generation Microsoft Server Virtualization platform at WinHEC 2006. The demo gave a brief look at some of the newest features like multi-processor 64bit virtual machines and the ability to hot add memory and network devices. Also at WinHec the System Center Virtual Machine Manager was shown for the first time, showcased was the single console built on top of Powershell for managing thousands of Virtual Machines. In addition, Microsoft announced intention to acquire Softricity as well. So Microsoft is making a strong investment in all forms of Virtualization: Hardware, Applications, Operating System (See Bob Muglia announcement from MMS 2006). The holistic approach will create a solid solution base for virtualization architectures in Enterprise environments. The Virtualization scenarios targeted are:

Server Consolidation

Business Continuity Management

Test and Development

Dynamic Datacenter

The real question becomes as we remove the Virtualization performance tax what are the next generation Virtualization scenarios? I have a Chalk talk at TechEd 2006 to discuss virtualization architecture and scenarios. In my position it is my job to understand what customers are doing with virtulization technologies. I spend alot of my time architecting very interesting solutions for customers that are pushing Microsoft virtulization technologies. I am intested in seeing what you think the next generation scenarios are.

Allen Stewart

Program Manager

Windows Server Division