To understand fencing in vCloud Director you really need to understand the basic network concepts in vCloud director. vCloud director has three kind of networks

External Network: This is basically a portgroup on a standard vSwitch, Distributed vSwitch or Nexus1000. This is where you get “into” the cloud. The external network is a network where you physically have allocated a vlan and an IP segment. The IP segment can either be public internet ip addresses or private ip addresses. In our case we are using the private subnet “10.10.10.0/24″ When you define your External Network you have to define this IP segment gateway and subnet mask. Besides that you define a “static IP pool”. This pool is addresses vCloud director can manage and use for vShield edge devices and virtual machines.

Organisation network: An organisation network is a network only available to the organisation it is deployed to. This network is automatically created in vCloud Director and you don’t need to manually create the portgroup in vSphere. The Organisation network can either be 1) direct connected to an external connected (in this case we use 10.10.10.0/24) 2) routed connected with a vShield edge device (in this case a vShield edge device will have an IP on the external network example: 10.10.10.20 and another ip address on the organisation network – for instanse 192.168.0.1) or 3) no connection to an external network.

vApp network: a vApp network available to only virtual machines in the same vApp. This network is automatically created when defining it. The vApp network can either be 1) routed connected to the organisation network or 2) no connection to organisation network.

If you need more information on vCloud network concepts check out Duncans great two series post on the matter: vcd network post 1 |  vcd network post 2

Fencing in vCloud Director

Option 1:

You can do fencing in vCloud director in two ways. When looking at the GUI it would seem only one. But you can actually do fencing without putting a vApp into “Fence vApp” mode. An example of this. Look at the following two screenshots. I am building a vApp that is connected to my organisation network. That means I am using my organisation IP addresses for all virtual machines in the vApp. (10.10.10.0/24). In the first screenshot I have not selected the “Fence vApp” checkmark. In the second I have selected it.

The first one is direct connected to the organisation network – and in this option I have no way of running with duplicate IP and MAC for my virtual machines. After selecting the “Fence vApp” checkmark you should notice that it changes connection type to “Fenced” and you will see NAT and FIREWALL enabled. In this case we can now copy the vApp without customization and run it serveral times with the same IP and MAC addresses.

One thing to notice about this way of doing fencing is that you can only use the “Fence” button on organisation networks. NOT on vApp networks. This will give a situation where a vShield Edge will be deployed where the internal and external interface has the same IP subnet(10.10.10.0/24), and the edge does proxy-arp and NAT 

This option is probably the first one you would go to because you acutally see the “Fence” option inside vCloud Director. The truth is though, that you can do fencing without ever setting that option. And you would probably do option 2 instead.

Option 2: 

When looking at option1 we see that the vShield edge device is the one making sure we can do the fencing. In vCloud director when we create “vApp” network we can choose to make it “routed” to an organisation network. To do “manually” fencing you would create a vApp network when creating your vApp. This vApp you would connect with a routed connection to the External network. In our case we would get a “vApp” network with IP 192.168.2.0/24 with a vShield Edge Device connected and on the other side of the vShield edge you would have the 10.10.10.0/24 network. 

Look at screenshot 2 and 3. This is what happens when you copy a vApp and don’t customize it. The vApp network will be the exact same. The only difference is the external IP address of the vShield Edge device. This means that you can use the external address to get “into” your vApps virtual machine with a simple NAT rule.

Summary

Fencing can be done in two ways. Both use the vShield Edge Device.

Option 1: Use the “Fence” option and use your organisation IP range directly on your fenced virtual machines. (same inside and outside IP range 10.10.10.0/24)

Option 2: Create a vApp network and make it “routed”. In this case you have one internal IP segment192.168.0.0/24 and one external IP segment 10.10.10.0/24)

The test is 3hours and 45minutes, but because my native language is not english I got an extra 30 minutes to complete it. So totally 4hours and 15minutes. It is a long test and I guess you will need all of the time.

The overall felling of the test was good. The questions were reasonable written. The VMware certification can be proud of it. The exam focuses on the design part of vSphere and you need to answer some technical questions, most questions were design related though.

One advice I would give to anyone who is going to take the test. You need to know  Constraints, Requirements, Risks and Assumptions. Know their definitions in your sleep. Know how to distinguish them!

Most questions are multiple choice. But you will also get some where you have to use the built in design tool to create a diagram for a specific customer case. And you will have questions where you need to fit things from row a to row b.

To prepare for the test you will need to look at the blueprint. The test is very true to the blueprint. If you are experienced with VMware it will be a big help. 

Time management is a concern. The design questions and fit row a and b can easily take up some time. Use the feature to flag for later review and go back to the questions you are unsure of at the end.

I don’t know how my exam went. When doing the beta exam you will have to wait 8 weeks to find out. Hopefully I did good.

VMworld US (San Francisco) August 27-30

VMworld Europe (Barcelona) October 9-11

I hope to see a lot of our partners and students in Barcelona.

VMware has just released a VSA Deep Dive document a must read if you are considering this solution. 

Some of the ESXi requirements for VSA is:

• Host must be installed with ESXi 5.0
• It must be a greenfield deployment. No existing virtual machines running
• ESXi and vCenter server must have the same gateway address. They need to be on the same subnet
• 4 – 6 or 8 spindles is supported

ESX 4.x

When removing a LUN from an ESX 4.x host you will need to use the “esxcli” commands. kb 1015084 

ESX 5

When removing from ESX 5 things have gotten a lot easier. Now you can do most from the vSphere Client. Check out the following kb 2004605 

The give away here is: Never just remove a LUN from the SAN that the ESX host has access to. Even though you have removed all virtual machines and nothing is running on it. Before doing anything on the storage array, you will need to detach the LUN from the ESX host.

Eric sloof and me. This guy used to have a six disk iomega!

Prior to vSphere 5 vMotion traffic would only use one physical network adaptor. It did not help to add multiple adaptors and change load balancing to IP Hash and bond the physical nisc in an etherchannel. That meant the only way to increase vMotion throughput was to upgrade from 1Gb to 10Gb Ethernet! Not a plausible solution for everyone.

Configuration

In order to use this new feature you need to configure multiple vmkernel adaptors for vMotion. Actually you will need to configure one for each physical adaptor connected to the vSwitch.

In my example I want to use two physical adapters for vMotion (vmnic1 and vmnic2). First I create a new vSwitch and create two vmkernel adaptors for vMotion. The vmkernel ip addresses are in the same subnet.

After creating the two vmkernel interfaces on the vSwitch we need to set “vMotion1” active on vmnic1 and standby on vmnic2. We will then set the “vMotion2” interface active on vmnic2 and standby on vmnic1.

Now you have 2Gb of throughput for your vMotion network. If you need more throughput just add more physical nics and create extra vmkernel interfaces.

Verifying it is working

To verify you have set it up correctly and you are using multiple nics for vMotion traffic do the following:

1. Select your ESXi host in the vCenter inventory.

2. Select the performance tab

3. Select advanced

4. Select “chart options”

5. Then create a graph with “network” realtime and choose the nics you are using for vMotion. Either choose “data transmit rate” or “data receive rate” – make the graph stacked.

6. Start a vMotion and check that every nic is loaded.

Here is a screenshot of my enviroment. Look at the end of the graph. A vMotion is saturating three 1Gb adaptors!

1. New to VMware (no courses, no certifications) – Attend the 5 day “Install Configure Manage” course. Then do the test

2. Already VCP3 – Take the 2 day “vSphere 5 Whats New” course. Then do the test

3. Already VCP4 – Go directly to the VCP5 test. No courses required. (until 29 Feb. 2012)

At Arrow ECS Denmark we are having the first course in Aarhus September 12 (still a few seats left) and in Copenhagen September 19 (few seats left)

If you want to be among the first participants on the course. Write an e-mail to training@arrowecs.dk

I will personally be the instructor on both courses.