vthistle.com

You are here: Home / Archives for vmware

VMware Horizon View & LetsEncrypt

By

As most tech people, I like to build, destroy, rebuild and repeat. It’s what we do, its how we learn to do things. One of my latest deep-dives has been into Horizon View 7.X. A few years ago, I went down this path as well, and I bought a cert so that I could go through the setup.

Enter LetsEncrypt – Let’s Encrypt is a free, automated, and open certificate authority (CA), run for the public’s benefit. They provide certificates with a lifetime of 90 days and renewing a certificate is done within a couple of minutes, which is perfect for testing and home labs.

I started researching how I could use the LetsEncrypt certs with Horizon View and I couldn’t find much. Before we dive into how we make this happen, I first want to start out by saying using LetsEncrypt with Windows isn’t the simplest thing to do, So I used a CentOS Linux box – Super Small footprint for a cert generator. I’m not a Linux expert, so using and getting to know CentOS was also a learning experience.

So, in this article, I will go through the steps to get the cert, as well as applying them to Horizon View.

Installing LetsEncrypt

As mentioned above, I am using a CentOS machine to obtain the certs.

  • Log into the CentOS machine as root
  • First, we have to install and enable the EPEL repository
    • sudo yum install epel-release
  • Now, we can install certbot – certbot is just an application that goes out and gets the certs
    • sudo yum install certbot

Now that we have Certbot configured, we can now move on to Request the Certificate

Request a Certificate

*Note: change the items in red to match your needs

  1. Run the following command on your Linux box.
    • certbot certonly –manual –email xxxx@gmail.com -d server.vthistle.net –rsa-key-size 2048
  2. Agree to the ToS
  3. Decide if you want to share your email with LetsEncrypt
  4. Answer the question about “Are you ok with your IP being logged” as the IP requesting the cert
  5. Create a page on a web sever with the challenge key to prove you are in ownership of the site

  6. When the request has been validated, you will see a “CONGRATULATIONS“
  7. Browse to /etc/letsencrypt/live/site.domain.com/
    1. You will find the following files:
      • cert.pem —-> Server Certificate
      • chain.pem —> Root and Intermediate Certs
      • fullchaim.pem –> Server, intermediate and root chain
      • privkey.pem —> Private key for Server Certificate

Convert PEM to PFX with Private Key

  1. Copy the files listed above from your Linux box to a windows box and use OpenSSL
  2. Run: openssl.exe pkc12 -export -out view.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem
  3. You will then copy your “view.pfx” file that you can use on your Horizon View Server

Adding the new Cert to the Connection/Security Servers

  1. The process to replace the certs on the Connection Server and Security Servers are the same: open MMC.exe -> File -> Add/Remove Snap-in… -> Select Certificates -> Add:
  2. Change the “friendly name” of the default certificate to something other than vdm
  3. Go through the import wizard and ensure you check the box to “Mark this key as exportable“
  4. Change the “Friendly Name” to vdm and restart the “VMware View Connection Server” service

Complete – Your View Connection Server is now using you 90 day LetsEncrypt certificate. 

NFS 4.1 – Synology – VMware

By

I was recently studying for my VMware 6.5 Delta Cert and realized NFS 4.1 was on the blueprint. I don’t do much (if any) NFS at customers sites – so I wanted to upgrade my lab from NFS 3 to 4.1. have a small homelab, which consists of the following gear: 2 Intel NUCs, Synology 713+ and a Iomega PX300D. I run NFS off of the Synology, mostly because I was lazy and didnt want to setup iSCSI.

To enable NFS 4.1 on the Synology, I had to update some config files.  *From Synology Support – Do this at your own risk! :

  1. Enable SSH from Control Panel |  Terminal and SNMP
  2. Connect to the Synology using your favorite SSH utility
  3. cd /usr/syno/etc/rc.sysv
  4. sudo vi S83nfsd.sh
  5. Go to line 91 (in my case) – go to “/usr/sbin/nfsd $N” and add “-V 4.1”
    1. Finished product will be: “/usr/sbin/nfsd $N -V 4.1”
  6. Save the file and Exit.
  7. Restart the NFS Service: sudo ./S83nfsd.sh restart
  8. Verify NFS 4.1 is now enabled
  9. In the vSphere Web Client: Unmount the NFS datastore & remount as NFS 4.1
  10. Disable SSH on your Synology

Complete!

Horizon View 7.2 – Help Desk

By

I have been a fan of VMware Horizon View since I was introduced to it back in the 5.x days. There was something about the simplicity of its components. One thing I thought Horizon View was missing was a feature that Citrix has had in XenApp/XenDesktop, in Citrix Director since the early 7.X days. There hasn’t been a good way to see what is going on with a users session. Sure, you could use vRops, but it wasn’t real time.

With VMware Horizon View 7.2, VMware has added what it calls “Help Desk”

Now, before I go much further with this post, you should know that VMware has only enabled this AMAZING feature for Horizon licensing, Advanced and Enterprise. If you remember, they did the same thing when they introduced “Instant Clones”, which made sense because most use cases for Instant Clones would be seen in larger environments. With the Help Desk tool, this is something even the smallest Horizon View environment could see a huge benefit from. Ok, I will stop venting, I don’t make those decisions.

So, lets look at how to access the tool, as well as a few features.

How to Access:

  1. You can access the Help Desk tool by connecting to your access link: https://<FQDN>/helpdesk | You will be prompted to login with your credentials.
  2. Open the Horizon View Admin Page, and click Help Desk – Using this method will automatically sign you in with the credentials you signed into the admin page with

Features

  • Entitlements: I’ve seen in numerous environment where users are individually entitled to pools and applications. The Help Desk tool can quickly show you what a user is entitled to. 
  • Sessions Stats: Yes, you can now see session stats!
    • You can see how many sessions a user has open.You can click on the session and see the stats about that session. Note: If a user is logged into a desktop, you can also offer remote assistance from the tool.

Hopefully VMware decides to open this up to the Standard licensing in the upcoming versions.

Enjoy!

Nutanix – Data Protection to Remote Site- ESXi

By

Mike Dent (the “doctor”) over at Etherbacon did a great walk through on how to setup Data Protection when utilizing the Acropolis Hypervisor. I wanted to go walk through how to setup Data Protection when you are using ESXi as the hypervisor, and how to failover to another Nutanix Cluster (remote site).

 

  1. Setup the “Remote Site” in Prism.
    1. Prism | Data Protection
    2. Click on “Remote Site”
    3. Fill in the remote site name – I typically use “SiteName-DR” and remote cluster IP Address
    4. On the settings page, you are given the options for Bandwidth Throttling, compression and mappings. You will notice when utilizing ESXi, you are not given the option for Network Mapping. Once complete, click “save”.
  2. Create Protection Domain
    1. Click on “Protection Domain” and select “Async DR”
    2. Enter a Protection Domain Name – 
    3. On the Entities page, select the virtual machines you would like to protect. Two things to note on this page.  A). Make sure when you select your VM’s to scroll down 0n the screen and click “Protect Entities”. B) I would recommend installing Nutanix Guest Tools on the virtual machines that you machines if you are utilizing “application consistent snapshots” – NGT is a little more efficient when it comes to taking the snap of the VM – otherwise it will use the VMware Tools to snap the VM.
    4. On the Schedule Page, you can create the schedule for your Protection Domain. Currently (as of 01/27/2015) the shortest amount of time between snaps is 1 hour. Because we want to send this protection domain to our remote site, be sure to put a check mark in the remote site box. On the Retention Policy side of the box, select how many snaps you would like to keep local and how many you want on the remote side. 

 

Once configured a snapshot will be taken. You will also notice after the initial snapshot has been taken the replication to DR will begin.

Failover to DR

At some point, you will want/need to fail over to your DR environment. To do so, using ESXi, complete the following steps.

  1. Select “Data Protection” on the menu screen
  2. Select the Data Protection group you would like to migrate to the remote site | Click Migrate
    • Note: If this was a “TRUE” DR situation, you would log into the DR Cluster and click “Activate” – this will used the last snapshot available on the Remote Cluster
  3. Since Nutanix allows you to replicate to multiple sites, you can now choose which site you would like to migrate the VM to. 
  4. Once you click migrate, it will take a snapshot and replicate it to DR and bring up the VM at the DR Site. You will notice that the machines you migrated will now show up as “orphaned” in vCenter. This is expected.
  5. To bring the machine into production at DR, you will need to change the Network port group to the port group used at DR.
  6. To bring the machine back to Production, log into the DR cluster, Data Protection and select the Data Protection Group. You can now follow steps 2 and 3 from this section

When the DR situation is complete and you have migrated back to the production site, you will again notice that the VM is now orphaned at the DR site. At this point, since it has been migrated back to production, you can delete the orphaned VM.

The below video will show how to migrate a VM from one site to a remote site, and then back.

In this walk through, we have completed the following items:

  • Created a Remote Site under Data Protection
  • Protected Virtual Machines
  • Created a DR Schedule
  • Failed over to the Remote Site
  • Failed back to Production

#vExpert2017 Announcement

By

vExpert

The vExpert title is given to individuals who have contributed to the VMware community over the past year. The title is awarded to individuals for their commitment to sharing knowledge and passion for VMware technology.

The official VMware announcement is located here.

I am honored and humbled to say I am a vExpert in 2017 for a second year in a row.

I’d also like to congratulate all of the vExperts for 2017. Especially my eGroup colleague’s Jirah Cox and Mike Dent. You guys push me to learn more and more every day and I couldn’t ask for better guys to work with!

I encourage you to follow #vExpert on your favorite social channels.

2017 has started off great for recognition for eGroup engineers. The same group that were selected as VMware vExpert were also selected as Nutanix Technical Champions for 2017. #NutanixNTC

I look forward to the year ahead for both of these great communities!

-Dave