Posts

It’s a common practice to replace self-signed certificates, that are used in several VMware products, with CA signed certificates. I did this in my lab for my vCenter Server Appliance and my VMware Update Manager. While I was working with vRealize Orchestrator I noticed, that it is also using self-signed certificates (what else?). For completeness, I decided to replace the self-signed certificates with CA signed.

My lab environment

1. VMware vSphere 5.5 environment running a vCenter Server appliance (already using CA signed certificates)
2. vRealize Orchestrator Appliance 5.5.2 (not version 5.5.2.1,  because I had problems with this release)
3. Microsoft Windows CA running on a Windows 2012 R2 Standard server

You don’t need a Microsoft Windows CA. You can use any other CA. There is no need to use a special vendor. I use a windows-based CA in my lab, so the screenshots reflect this fact. The way how certificates are replaced differs between vRealize Orchestrator Appliance and the windows-based standalone or vCenter Server embedded version. If you use the in the vCenter Server embedded or Standalone Orchestrator check Derek Seamans VMware vSphere 5.5 SSL Toolkit. I used the Orchestrator appliance.

The clock is ticking… Current VCP5-DCVs who need to recertify their VCP can do this until 30. November 2014 by passing the VCP5-DCV Delta exam (VCP550D). The exam can booked online via Pearson VUE and it’s delivered as an online exam. This means, that you don’t have to visit a Pearson VUE test center to take the exam. The costs for the exam are 90,- € plus taxes (in my case ~ 107 €).

While preparing for a VMware vSphere 5.5 update at a customer of mine, I stumbled over VMware KB2085618 (ESXi host cannot initiate vMotion or enable services and reports the error: Heap globalCartel-1 already at its maximum size.Cannot expand.). I checked the HP AMS version in the latest HP custom ESXi image and found out, that version hp-ams-esx-550.10.0.0-18.1198610 is included (source). Unfortunately the bug is not fixed in 10.0.0, but it’s fixed in 10.0.1 (source).

This is not a brand new issue and it’s well discussed in the VMTN. After applying the ESXi 5.5.0 U2 patches from 15. October 2014, you may notice the following symptoms:

• Some Citrix NetScaler VMs with e1000 vNICs loses network connectivity
• You can’t access the VM console after applying the patches

VMware has released a couple of patches in October:

• ESXi550-201410101-SG (esx-base)
• ESXi550-201410401-BG (esx-base)
• ESXi550-201410402-BG (misc-drivers)
• ESXi550-201410403-BG (sata-ahci)
• ESXi550-201410404-BG (xhci-xhci)
• ESXi550-201410405-BG (tools-light)
• ESXi550-201410406-BG (net-vmxnet3)

More specifically, it’s the patch ESXi550-201410401-BG that is causing the problem. It is reported that the patch ESXi510-201410401-BG is also cause problems. VMware has published a KB article under the the KB2092809. Citrix has also published a KB article under the ID CTX200278. The VMware KB2092809 includes a workaround. You have to add the line

This tweet from @JuniperNetworks has really inspired me yesterday. I liked Junipers Firefly Perimeter (vSRX) from the first day. I like the idea behind this product (yes, I like everything that can be run as a VM…). But yesterday Juniper has go one better.

Introducing the vMX – the industry's only carrier class virtualized router: http://t.co/2lgXaQ1cjh #networkunlocked pic.twitter.com/V8zWvpRXoA

— HPE Networking (@HPE_Networking) November 6, 2014

Juniper Networks announced yesterday a virtualized and carrier-grade version of their MX Series 3D router. The Juniper Networks vMX is a virtual MX Series 3D Universal Edge Router and it’s optimized to run on x86 hardware. Juniper vMX can run on all major Hypervisors, including VMware ESXi and KVM. It was also mentioned, that vMX can be run in Docker containers or on bare-metal.

On October 28 2014 HP has published HP 3PAR OS 3.2.1 MU1, the first maintenance update for HP 3PAR OS 3.2.1. Beside some fixes, HP enabled in-line deduplication (Thin Deduplication) on all the systems with 3PAR GEN4 ASIC (StoreServ 7000 and 10000). Thin Deduplication does not require any license! It’s included in the base license and every customer can use it without spending money for it.

Thin Deduplication

In-line deduplication is awesome, congrats to HP for making this possible. Deduplication on primary storage is nothing new, but the way how HP 3PAR doing it, is really cool. It’s not a post-process, like NetApps deduplication technology. With HP 3PAR, deduplication happens when data enters the array. I took this figure from a HP whitepaper. It shows in a simple way what enables HP 3PAR to do in-line deduplication: The 3PAR GEN4 ASIC (Who has criticised 3PAR for using custom ASICs…?). Thin Deduplication is in line with the other 3PAR thin technologies.

Today I was at a customers site. My attention was initially directed on a vCOps deployment. vCOps is a good startpoint if you need a quick overview over a vSphere environment. Unfortunately vCOps wasn’t working any more. The license was expired and the login page wasn’t accessable, but the admin login page was workingI restarted the vApp but this doesn’t solve the problem. The customer owns a VMware vSphere with Operations Management Enterprise Plus license and it would be a shame, if he wouldn’t use vCOps in his environment (> 15 hosts).

The Juniper Networks Certification Program (JNCP) consists of different tracks, which enable you to demonstrate your skills with Juniper products and technologies in the areas most pertinent to your job function and experience. There are three main areas:

• Junos
• Support
• Product and Technology

The Junos area consists of three tracks:

• Service Provider Routing and Switching
• Enterprise Routing and Switching
• Junos Security

The “Service Provider Routing and Switching” track focuses on service provider and telecommunication (M-, MX-Series, Routing with OSPF, BGP, MPLS etc.), the “Enterprise Routing and Switching” on enterprise routing and switching in LAN and WAN (EX-Series, MX-Series, Spanning-Tree, VLANs, Routing etc.) and the “Junos Security” track is focused on the Juniper Security products (SRX-Series, Routing, Firewall, VPN etc.). All three tracks have the Juniper Networks Certified Associate - Junos (JNCIA-Junos) as a prerequisite. This is an entry-level certification and it covers the following objectives:

Today I changed the SCSI controller type for my Windows VMs in my lab from LSI SAS to PVSCSI. Because the VMs were installed with LSI SAS, I used the procedure described in VMware KB1010398 (Configuring disks to use VMware Paravirtual SCSI (PVSCSI) adapters) to change the SCSI controller type. The main problem is, that Windows doesn’t have a driver for the PVSCSI installed. You can force the installation of the driver using this procedure (taken from KB1010398):

This morning I discovered a tweet from Derek Seaman in my timeline, that caught my attention.

Doing a #VCDX design? Take note of TPS being disabled in all future ESXi releases. http://t.co/qRXlABIJSs

— DΞRΞK SΞAMAN (@vDerekS) October 17, 2014

TPS stands for Transparent Page Sharing and it’s one of VMware memory management technologies. VMware ESX(i) uses four different technologies to manage host and guest memory resources (check VMware KB2017642 for more information). The preference increases from TPS to swapping.