Pages

Tuesday, May 19, 2015

Force10 VLT Proxy Gateway - how to find remote MAC addresses

Dell# show cam mac stack-unit 0 port-set 0
VlanId     Mac Address      Region    Interface
4094   ff:ff:ff:ff:ff:ff   STATIC      00001
0      ff:ff:ff:ff:ff:ff   STATIC      00001
0      00:10:18:ff:ff:ff   STATIC      Invalid
0      5c:f9:dd:ef:1b:02   LOCAL_DA    00001

4094   5c:f9:dd:ef:1b:02   LOCAL_DA    00001

Monday, May 18, 2015

QLogic / Broadcom CNA valid naming

Let’s be clear…QL did NOT buy Broadcom.  They bought Broadcom’s CNA product technology.  Broadcom still exists and still sells Ethernet NICs…NOT CNA…basic NICs (5719/20, etc.) that do not have HW offload functionality.

QL also bought all of BROCADE’s FC adapter technology (Brocade 8xx series).

Both have been rebranded.

We can continue to use the Broadcom name or at least “BRCM” as in “Qlogic BRCM578xx Family” .

Alternatively, as long as you are providing clear product name identification to differentiate between QL legacy and QL-BRCM families, we should be OK…but everyone needs to be more specific moving forward.

Valid naming could include:

Broadcom 57xxx based products:
·         QL 578xx,
·         QL 57810/57840,
·         Broadcom 578xx or 57810
·         BRCM 578xx or 57810
·         QL BRCM 578xx, etc.
·         Etc.
QLogic Legacy Products:
·         QL 82xx or QL8262
·         QL QMe82xx etc.
·         Etc.
BROCADE based products:
·         QL 815/825
·         Brocade 815/825
·         QL Brocade 815/825

·         Etc.

Wednesday, May 13, 2015

IT Operations definition

IT Operations is responsible for the smooth functioning of the infrastructure and operational environments that support application deployment to internal and external customers, including the network infrastructure; server and device management; computer operations; IT infrastructure library (ITIL) management; and help desk services for an organization. 

Full article here.

Saturday, May 9, 2015

vSphere VSAN: Notes From The Field and VMware Support

VMware vSAN 5.5 (and now 6.0) is a software-defined storage solution developed by VMware and integrated into the kernel of its premier virtualization platform, allowing for the creation and management of shared object-based storage using the local solid-state and spinning media in the physical host servers themselves.

Note that vSAN is not the same animal as VMware’s vSphere Storage Appliance (vSA), though the underlying value proposition is the same. The two are implemented and managed very differently. vSA is now end-of-life/availability, though still supported through 2018. vSAN has been integrated directly into the kernel, so it is there whether you use it or not, and no longer requires the deployment of controller appliances. Storage appears as a single unified ‘datastore’ across all hosts in the cluster and is managed entirely through vCenter’s web client.

vSAN is licensed separately from vSphere but in the same familiar fashion, on a per socket basis. When you enable vSAN on the cluster you are initially allowed a 60-day evaluation period but must assign a proper license to the cluster before this evaluation period expires.

The purpose of this email is to provide notes from both field deployments and from working with VMware support.

General notes:

1.       All hosts should be configured to report to a syslog server
2.       All hosts should be configured to synchronize their time to the same valid time source
3.       The minimum number of hosts supported in a vSAN cluster is three
4.       The maximum number of hosts supported in a vSAN cluster is thirty-two (in 5.5)
5.       The maximum number of VMs per host is currently limited to 100 (in 5.5)
6.       The maximum number of VMS per datastore to be protected by HA is 2048.*
7.       The sweet-spot for cluster sizing is up-to sixteen hosts.

*This is important since vSAN storage appears as a single ‘datastore’.

On the host side:

1.       vSAN hosts must be comprised of certified controllers and disks

Note: Make sure and verify that the controller and disks in-use in the design appear on the VMware HCL! This is key to the supportability of the solution and must be followed. Note that the controller must support pass-through or pseudo-pass-through disk access modes, furthermore the controller must have sufficient queue depth. A minimum depth of 256 is required for vSAN (5.5), though a higher queue depth (>512) is recommended.

2.       You can have multiple disk groups per host
3.       A disk group is made up of at-least one SSD and at-least one HDD
4.       A disk group can contain up-to one SSD and up-to seven HDD each
5.       There is a maximum of five disk groups per host
6.       Utilize 10GbE interfaces for the best performance
7.       Dedicate 10GbE interfaces if you can, especially if using Broadcom adapters (see note on Network I/O Control below)
8.       If you do not have 10GbE interfaces, consider physically dedicated 1GbE interfaces for vSAN
9.       SSDs are used for caching – do not count them towards your capacity

10.   When sizing your vSAN cluster, ensure that you take into account the resiliency level (replicas) you intend to support and ensure that your SSD to HDD ratio is at-least 1:10 respectively. SSD capacity should be sized to at-least 10% of the capacity of HDDs in the disk group. An example would be if you are building a disk group of four 1.2TB 10K SAS disks, giving you’re a disk group capacity of 4.8TB, your SSD selection should be at-least 480GB.

11.   Keep in mind that by default 70% of the SSD capacity per disk group will be used as a read cache and 30% will be used as a write buffer. Using SSDs with the right bias (Read or Write Intensive) or a non-bias (Mixed Use) will make a significant difference in performance based on your intended workload so take this into account. For general purpose virtualization, the recommendation would be to use Mixed Use SSDs because of their non/even-bias.

12.   Also note that when sizing your host memory, keep in mind the ideal workload and consolidation ratios you hope to achieve. Given storage is more finite with vSAN clusters, large amounts of physical memory (>256GB) are certainly supported but may be underutilized in many environments. Keep in mind that IF you are sizing a host with 512GB or more of physical memory, the embedded SD cards are not supported and ESXi must be installed on physical media.

On the virtualization side:

1.       Both the standard and distributed virtual switches are supported.
2.       Use of the web client is required. You cannot configure vSAN using the thick client.
3.       Use of vCenter is also required. This will need to be taken into consideration on green field deployments. You will need to format one of the HDD disks on the first host and create a local datastore, install vCenter and configure it, configure vSAN and then use storage vMotion to move the VM to the new vSAN storage. Once storage vMotion is complete, you can then remove the ‘legacy’ datastore and move the disk into the vSAN disk group.

4.       vSAN storage is presented as a single common ‘datastore’ but the utilization and expression of the objects (VMs) on that store are controlled through storage policies. vSAN storage policies must be defined as they control the resiliency level (FTT, number of replicas) and other tuning parameters.

5.       When configuring HA for use with vSAN, choose ‘Power Off’ as your isolation response.
6.       When configuring HA for use with vSAN, ensure that your ‘host failures to tolerate’ setting aligns with your vSAN availability strategy and settings.
7.       vSAN does NOT (in 5.5) support FT, DPM, Storage DRS or Storage I/O Control.
8.       vSAN does support Network I/O Control and if you are using Intel adapters and the distributed virtual switch, the recommendation would be to enable and configure it for optimal performance.

Note: DO NOT enable Network IO Control (in 5.5, with or without vSAN) with Broadcom adapters! http://kb.vmware.com/kb/2065183

On the (physical and virtual) networking side:

1.       Layer-2 Multicase IS required for vSAN.
2.       It is a recommended practice to create a separate, segregated, VMkernel for vSAN data
3.       The VMkernel interface created for vSAN can utilize private IP space
4.       At-least one VLAN per vSAN cluster. vSAN clusters should NOT share the same broadcast domain

5.       It is a recommended practice to create two VLANs per vSAN cluster for maximum performance. It is however not supported to have a VMkernel for vSAN active on more than one NIC, therefore the recommendation is to set this up similarly to iSCSI. It is key that each separate VMkernel have its own IP subnet.

a.       VMkernel called vSAN0 attached to VLAN 92 with IP 192.168.92.10 and vmnic1 as active and vmnic3 as standby.*
b.      VMkernel called vSAN1 attached to VLAN 93 with IP 192.168.93.10 and vmnic3 as active and vmnic1 as standby.*

Note: Because of the Active/Standby (as opposed to Active/Unused) and the use of two different subnets, these physical switch ports must be configured as trunks and be tagged for both VLANs.

6.       The current recommended practice from VMware is to avoid the use of Jumbo Frames with vSAN

Jumbo Frames are officially supported however there was an issue discovered with jumbo frames and multicast, which vSAN makes extensive use of, in vSphere 5.5 update 2. Not sure if this has been fixed in update 3 or not but something to be aware of. The consensus from VMware support is that jumbo frames does not make a significant difference in performance with vSAN. You may utilize Jumbo Frames elsewhere in the environment, however the VMkernel(s) for vSAN should be configured for the default 1500.

7.       IP HASH link aggregation is supported by vSAN but keep in mind that since traffic will be flowing to and from the same IPs, it is unlikely that you will drive the link utilization desired using this method.

8.       For our physical switches, the same quick configuration guides for EqualLogic can be used as reference, the cabling recommendations are the same, however do not enable DCB or iSCSI optimization. You may also need to create additional VLANs and provision switch ports as trunks instead of access (tagged instead of untagged) depending on your host and cluster design.


5.5 Reference:








6.0 Reference:

What’s New in vSAN 6.0?

Configuration Maximums for vSphere 6:

VMware Virtual SAN 6.0 Design and Sizing Guide:

Hope this helps!


Wednesday, April 29, 2015

ESXi dell-configuration-vib for use with ImageBuilder

As of ESXi 6.0 release, we are now providing an offline bundle.zip containing our custom image.


As for ESXi 5.5 and earlier, the only way to do this would be to utilize VMware’s Image Builder and create your own customized offline bundle.

Here’s a whitepaper that goes through the procedure:


Here’s a youtube video that goes through the process:


Cheers,

Jim White
Senior ProSupport Engineer – Virtualization
Certifications: VCP 3 / 4 / 5, LPIC-3 Core, LPIC-3 Virtualization
Dell | Enterprise Solutions
Phone  1-800-945-3355  Option  1  Ext  723-8649
Office Hours | 8:30 am - 5:30 pm (CST) Monday - Friday

Customer feedback | How am I doing?  Please contact my manager: Scott_Stout@dell.com

OS Windows Security Hardening

The best practice is to avoid “manual by document OS hardening” at all cost, especially with the latest Windows 2012 and 2012 R2 OSs. From my experience each company usually creates its own hardening guidance/procedures in accordance with  Microsoft’s Baseline Server Hardening: https://technet.microsoft.com/en-us/library/cc526440.aspx. However, I personally do not recommend  manual Server hardening, because IT could follow to non-standard (and sometimes unsupported) settings which are picked from outdated hardening guides, and it can cause the server to misbehave, result into breakdown of various operating system related components and failure of critical applications. I always advice my customers to use these two tools (urls are below) for ‘hardening’ Windows Server 2012/2012-R2. Any other method to harden the server might result in unforeseen results.

The SCW tool has server roles templates, but some templates for some server roles would need to be downloaded and configured separately.
Example: By default, the SCW does not include support for the TMG 2010 role nor TMG Enterprise Management Server (EMS) role. To support these roles, download and install TMGRolesForSCW.exe included in the TMG 2010 Tools and Software Development Kit (SDK), available here.

Sincerely,
Andrei Vassiliev
Systems Integration Consultant – “Microsoft Infrastructure Services Team”
Dell | Consulting & Systems Integration
lync +1 512 723-8974
Customer feedback | How am I doing? Please contact my manager Tim_Alvey@Dell.com


Monday, April 27, 2015

MXL -- Can't ping management IP when MXL is installed in Fabric A

Thanks to all of you who responded to this problem I presented on Wednesday.  I’m not sure if anyone provided a solution that is consistent with the resolution we used, but here’s a brief summary that I shared with the customer.  You could very well encounter this problem in the future and you could spend hours working on the MXL when in its actually a problem with the CMC.  After spending several hours trouble-shooting with two different TAC engineers, they escalated to a Master Engineer who was quite confident he knew what the fix would be and sure enough it worked.  Note that we were trying to ping the management IP and the customer was using only a LOM for Fabric A.  No mezz cards were installed.

The problem is a known issue and the Master Engineer said they have not been able to debug the root cause, so the what was provided is really a preventative work around.  BTW, we also did a factory reset on the MXL and configured it from scratch while inserted in Fabric A but this didn’t work.  The only solution that worked was to use the rack rest command on the CMC.  Before executing the rack reset command, TAC collected several logs in an attempt to determine the root cause.


Summary for the Customer:
-------------------------------------
Re: Dell TAC Case 910245438 – Cannot access management IP of MXL when installed in Fabric Slots A1 or B1

The problem as reported to us yesterday has been resolved on the M1000e chassis in question, but I look forward to the customer confirming this at your earliest convenience by moving the MXLs back into Fabric slots A1 and A2.  Please also confirm that the CMC is configured as expected since we did an upgrade and a re-configuration.  I left the MXLs installed in the B1/B2 fabric slots and the B22s installed in the A1/A2 slots since this is how I found them when we started trouble shooting this morning (Thursday, April 23) and wasn’t sure if I would impact any ongoing traffic testing traversing Fabric A1/A2.  Before leaving this evening, I moved the MXLs from Slots C1 /C2 to B1/B2 to A1/A2 and was able to successfully ping the management IP addresses (10.26.17.240/241) with each move.  If there is any problem please contact me immediately.

Resolution:

The problem was resolved by running a rack reset command and then reconfiguring the CMC.  Our Dell support staff advises that this is a one-time event on a M1000e chassis and it can easily be prevented for any subsequent deployments of the M1000e chassis.

Additional notes:

The MXLs were upgraded from firmware Release 9.4 to 9.6.
The CMC was upgraded to 5.01.
These upgrades should have no effect on the capabilities of the CMC or the MXLs in context of the testing being performed by Robert and Tommy, but I recommend moving the MXLs to 9.7 in the not too distant future since OpenFlow 1.3 is supported on 9.7 while OpenFlow 1.0 is supported on 9.6.  Although 9.7 was released earlier this year, we would like to see a few more weeks of field exposure before recommending DirecTV move to this release.

Bill Tozer
Network Systems Engineer

Office: 805-498-2959
Mobile: 805-490-7409

Dell | Enterprise Solutions, Networking


Description: Dell Logo


From: Tozer, Bill
Sent: Wednesday, April 22, 2015 4:59 PM
To: Cereijo, Manny; WW Networking Domain; Arrata, William
Subject: RE: MXL -- Can't ping management IP when MXL is installed in Fabric A

Thanks Manny,

I’ll try that when I’m on site tomorrow morning.

Bill

From: Cereijo, Manny
Sent: Wednesday, April 22, 2015 4:57 PM
To: Tozer, Bill; WW Networking Domain; Arrata, William
Subject: RE: MXL -- Can't ping management IP when MXL is installed in Fabric A

Dell - Internal Use - Confidential
Bill,

Is the MXL connecting to the same management network when in Fabric A, B and C?
Can they connect to the MXL via the CMC? Try to SSH or telnet to the CMC, then connect to the MXL with the connect switch-a1 command.

Manny

From: Tozer, Bill
Sent: Wednesday, April 22, 2015 7:48 PM
To: WW Networking Domain; Arrata, William
Subject: MXL -- Can't ping management IP when MXL is installed in Fabric A

Has anyone seen any issues with not being able to ping the management IP (or access via SSH) of an MXL when installed in Fabric A?  My customer has reported that everything works fine when the MXL is installed in Fabric B or C, but when the MXL is moved to Fabric A, they can no longer connect to it.

Midplane Version of the M1000e is 1.1
Release of the MXL is 9.4, but we will be upgrading it to Release 9.7 ASAP and opening a support case.

Bill Tozer
Network Systems Engineer

Office: 805-498-2959
Mobile: 805-490-7409

Dell | Enterprise Solutions, Networking