In one of my recent VDI projects I was working with Symantec Endpoint Protection as the choice of AV solution. When I started working on the project I was not able to find much information on the exact steps required for me to design and implement a Horizon View solution with Symantec Endpoint protection. I worked my way across the design and implementation by reading various whitepapers both by VMware and Symantec.

This prompted me to work on a series of blog articles which covers the Symantec SEP integration with Horizon View , I would attempt and complete it in a 3 Part series. I want to give due attention to each step and provide enough information for anyone who would need a reference on this topic which is why I will be separating it in 3 parts.

In the first part I would discuss the various components and the architecture for this solution.

How SEP Works?

SEP client needs to be installed on each client virtual machines in case of Horizon View VMs this will be installed as part of the desktop base image. The individual clients will protect the virtual computers. The SEP clients would report to the available Symantec End Point Protection Manager and get content updates from the internal LiveUpdate Administrator.

In order to optimize the performance following are the available features in SEP.

• Virtual image exception: White list files from standard virtual machine image to optimize scanning.
• Shared Insight cache (Security Virtual Appliance) : Shares scans results centrally across virtual clients to reduce bandwidth and latency
• Resource leveling: Randomizes scan and update schedules to prevent resource utilization spikes.
• Offline image scanning: Finds threats even in offline virtual machine images.

Components of this solution

• VMware Horizon View 5.2
• VMware vCloud® Networking and Security 5.1 (vShield Manager , vShield Endpoint)
• VMware vSphere 5.x
• Symantec SEP 12.1.2 (Symantec Endpoint Protection Manager,Live Update Administrator , Security Virtual Appliance , Virtual Image Exception Tool, ClientSideClonePrepTool)

Logical Architecture

The basic architecture of the Symantec Endpoint protection is same as the reference architecture for AV solutions integrated with vShield for VMware View , there are two other AV providers who have a similar offering Mcaffe MOVE and Trend Micro End Point Security

Communication Flow

The communication flow for SEP is described above , major role to reduce load for the scans are played by the Symantec Virtual Appliance which integrates with the vShield framework and provide a shared insights cache. The VIE or the Virtual Image Exception tool does white listing of files and makes sure that only the files which are changed get scanned hence reducing AV storms.

In the next two parts I will cover

• Implementation details for all the components
• Configuration details

During the course of this project I started looking at some of the global trends that we see in these focus areas (Virtualization and Cloud Computing) however I also looked at Big Data , the results were very interesting. The data that I used for this technology trend analysis was based on the results that google has over the past few years of search trends for these technologies.

The trends that I saw and compared may not be directly related to the adoption of the technologies , but it gives a fair idea about the interest in these areas. Lets look at some of the trends below.

Legends used

Virtualization Trends

As you can see above the interest in Virtualization started around 2006 end and gained momentum and peaked in year 2010. In the year 2006 VMware released it’s new Hypervizor VI 3.0 aka ESX 3.0 which had a fundamental shift in the VMware’s core Virtualization product over the earlier ESX 2.0 , this may be a coincidence but we can always try to make sense out of correlated events and here the data indicates and supports the theory that this product was really a market changer and generated a lot of acceptability in the market. Post 2010 we can see a steady decline.

I was also interested in knowing the market segmentation and looked at how this trend mapped to regional interests.Now here it gets quite interesting , this is the final interest rankings you can see above over the five years of data analysis , the interest ratios has changed over the years for example if you see the trend in early years 2005-2007 United States was leading the pack. But current data indicates it’s the Indian Subcontinent with the most interest what does that indicate, again if we want to manipulate this data that means there is a business opportunity and a growth which can be tapped in this market.

Cloud Computing Trends

This data is in the lines of the recent use or overuse of cloud computing words and all the tech companies providing some kind of cloud technology and offering to it’s customer base. XaaS is the best way to describe this fill X with whatever you like I – IT , S – Software , P-Platform , B-Backup and so on. As we can see the whole cloud game started around mid of 2007  and picked up by late 2011 and early 2012 since then it has been on decline but still above the Virtualization trends , I blame the overuse of cloud terminology for this. Also starting end 2011 and early 2012 many companies started to move in the direction of adoption for the cloud technologies. However the decline is alarming with such a rapid pace.

The market segmentation of this have really surprised me , however again we need to consider that this is not a data which is based on the adoption of the technology. Similar to the Virtualization data this has trends which puts the Indian Subcontinent on top , however can we use this to depict the sentiments and customer requirements? In my experience of consulting from last 5 years working in the Indian subcontinent I can relate to this data and can say that there is a definite increase in the interest however if this can translate to the same volume in business have to be seen.

Big Data Trends

Everything is Big about Big Data as of now , this is the hot cake and a technology where the most interest is at this moment. What is remarkable is with in 1 year the trends here have surpassed the Virtualization and Cloud Computing trends. This is also very evident in the recent industry announcements in this segment , few of the notable companies doing lot of work are below.

Pivotal : VMware and EMC’s Spin off
Oracle
IBM

The interest trends are similar to the ones above and again to my surprise it’s the Indian Subcontinent leading the interest levels , however the Big Data movement is still in it’s nascent phase. I believe this is one area which will be lead by the more mature market to start with and then slowly as happens with most of technology areas will spread to emerging markets.

Future Trends

When I looked at some forecasting or future trends it seems that Virtualization trends are going to stable going forward , Cloud Computing will be at decline but with not so much fast pace and Big Data will become Bigger.

Hopefully I can use some of these insights when discussing future data center strategies with my customers and can be helpful for others as well.

For me personally this is the first year where I applied to be considered for the program,I had contributed to the community
through participating in the VMware communities and also recently through my blog.

However I feel that this is just a start for me and I have a long way to go to make sure that I keep contributing to the larger
interest of community. After all sharing is the best way of learning.

Congrats to all the fellow new and returning vExperts. The complete list is available here http://blogs.vmware.com/vmtn/2013/05/vexpert-2013-awardees-announced.html

“Congratulations on passing the VMware Certified Advanced Professional 5 – Data Center Administration exam! You will receive an email notification from certification@vmware.com once your certification status has been confirmed and added to your VMware Education Transcript (allow one week).”

This year I have had a very hectic work schedule with many responsibilities in VMware Professional Services team , although I quite liked the challenge and the work I did it had a toll on my personal goal for 2013. This is my first certification in 2013 and I hope that I finish the rest which I am targeting this year. Now enough of the rant lets see what is the exam has in store for you and how can you effectively prepare.

Exam Overview

The total time for this exam is 225 minutes. Candidates who take the VCAP5-DCA exam in a country where English is not a primary language will have an additional 30 minutes added to the exam time. This time extension is automatic, no additional action is required from the candidate.

This one has 26 lab questions that you have to complete and each question can have multiple parts. There is partial credit so read each question (and its parts) thoroughly! Passing score for the exam is 300.

In terms of what is covered in the exam you can refer to the  blueprint from VMware:
http://mylearn.vmware.com/register.cfm?course=139202

Exam Experience

This was a tough exam just in the sheer amount of tasks you are asked to do in a short amount of time. If you are not a Virtualization Consultant a Virtualization Administrator then you should have plenty of lab time. The exam touches each and every section of the blueprint so don’t miss any section and any module of vSphere to do practice on. There is a help in the exam with the pdf documents which you can refer , however it can be very slow and can eat up your precious time. So unless you need to refer the doc please don’t do so.

There is a jump box vm which has all of your vSphere clients, remote desktop connections, SSH, and other connectivity tools. Additionally, the vSphere documentation set is on this VM. Familiarize yourself with the tools on this VM when you start and I would also recommend opening connections to all your important sources. This will save you time later on!

Thankfully I didn’t have any interface crashes this time , however I had a problem with my VUM environment.

This was my third Advanced Administration exam on VMware starting from VI3 , vSphere4 and now on vSphere 5 , and I feel the exam environment has come a long way and so do the complexity of the tasks.

Overall I enjoyed the exam and thought it was true test of some one’s knowledge of vSphere. It’s definitely a potboiler to the finish, but I really liked how well the live lab format worked and the way you can structure the tasks around a scenario. This exam will leave you mentally and physically tired so be well prepared and relaxed.

Tips and Tricks

Know each way (PowerCLI, command line, GUI) to do a task on the blueprint, but also have your preferred way.If you are not a powercli guy then make sure that you know the GUI very well.

One of the things that I used for the exam was to scan the questions initially then mark them up if they are in the same category , this has helped a lot. For example I got around 5 tasks which were logically related to each other and finished them in one go rather than going as per the questions.

The scanning also helps you to figure out which questions to attempt first based on your comfort level, which builds confidence in the exam.

Last but not the least know what your doing , if you don’t know a certain question don’t waste time and skip to the next question.

Resources

You will find some usual suspects below , they have done awesome job for this exam and will be great resource for your exam preparation.

My VCAP5 DCA Study Guide : http://thinkingloudoncloud.com/certification/vcap5-dca-study-guide/

Chris Wahl : http://wahlnetwork.com/2012/07/02/the-vcap5-dca-study-sheet/
Jason Langer : http://www.virtuallanger.com/vcap-dca-5/
Josh Coen: http://www.valcolabs.com/vcap5-dca/
ProfesionalVMware : Definitely watch/listen to all of the episodes to help prepare: http://professionalvmware.com/brownbags/

Final Thoughts

I am a very happy man today , however you have to have patience for the exam result as it takes minimum three weeks. The next logical step for me will be to start preparing for my VCDX , but we all know it’s easier said than done

All the IP and hostname details mentioned here are for references only and you will have to replace this with the real IP and hostname in your infrastructure.

Prerequisites

IP Details:

Primary Ace Management IP : 10.68.200.10

Secondary Ace Management IP: 10.68.200.11

Default Gateway IP: 10.68.200.1

Load Balancing Algorithm based on: Least Connections

VIP: 10.68.200.25 <This is the Virtual IP which maps to the View connection servers in the ACE farm>

VIP Service Port: 443 (https)

Source NAT IP: 10.68.200.24

Health Monitoring:

Service Port of the connection view server port 443

Keepalive Mechanism: HTTP GET /favicon.ico

Keepalive / Health Check: Every 2 seconds

Keepalive Timeout: 2 seconds

Real servers IP are defined in ACE:

View Connection server 1: 10.68.200.15

View Connection server 2:  10.68.200.16

View Connection server 3: 10.68.200.17

Host Names of the Real servers defined in the cisco Ace:

View Connection server 1: viewcs1.thinkingloudoncloud.com

View Connection server 2: viewcs2.thinkingloudoncloud.com

View Connection server 3: viewcs3.thinkingloudoncloud.com

Server farm Name defined in Cisco ACE:  THINKINGLOUDONCLOUD_VIEW_FARM

Configurations

You have to perform the following configuration steps on the CISCO ACE console in the Admin context:

Configure the Cisco ACE interfaces. The ACE can be configured with port channels (recommended) or on a per-interface basis:

interface port-channel 100

switchport trunk allowed vlan 15,5

port-channel load-balance src-dst-port

no shutdown

interface gigabitEthernet 1/1

channel-group 100

no shut

interface gigabitEthernet 1/2

channel-group 100

no shut

interface gigabitEthernet 1/3

channel-group 100

no shut

interface gigabitEthernet 1/4

channel-group 100

no shut

Configure IP addresses on the interface and configure Default route (management interface)

interface vlan 15

description Management Vlan

ip address 10.68.200.10 255.255.255.0

access-group input EVERYONE

service-policy input remote_mgmt_allow_policy

service-policy input MGMT

no shutdown

interface vlan 5

description client-server-vlan

ip address 10.68.200.2 255.255.255.240

nat-pool 1 10.68.200.3 10.68.200.3 netmask 255.255.255.240 pat

service-policy input VIEW-SLB-MULTI

no shutdown

ip route 0.0.0.0 0.0.0.0 10.68.200.1

Configure the Remote Management Access:

To access the Cisco ACE remotely using Telnet, SSH, SNMP, HTTP, or HTTPS; or to allow ICMP access to the Cisco ACE, a service policy must be defined and applied to the interface(s) through which access is to be permitted. The following configuration steps are required:

Configure a class-map of type management:

class-map type management match-any MGMT

2 match protocol xml-https any

4 match protocol icmp any

5 match protocol telnet any

6 match protocol ssh any

7 match protocol http any

8 match protocol https any

9 match protocol snmp any

class-map type management match-any remote_access

2 match protocol xml-https any

3 match protocol icmp any

4 match protocol telnet any

5 match protocol ssh any

6 match protocol http any

7 match protocol https any

8 match protocol snmp any

Configuring the class-map for Virtual IP:

class-map match-all VIEW_SERVER_VIP

2 match virtual-address 10.68.200.25 tcp eq https

Configure a policy-map of type management:

policy-map type management first-match MGMT

class MGMT

permit

policy-map type management first-match remote_mgmt_allow_policy

class remote_access

permit

Configuring the policy-map for load balancing:

policy-map type loadbalance http first-match VIEW_SS

class class-default

serverfarm BLRKECCS_FARM

policy-map multi-match VIEW-SLB-MULTI

class VIEW_SERVER_VIP

loadbalance vip inservice

loadbalance policy VIEW_SS

loadbalance vip icmp-reply

nat dynamic 1 vlan 5

IP Access through the Cisco ACE:

Interface VLANs must be configured for Layer-3 connectivity through the Cisco ACE. Service policies for load balancing, security, and management access to Cisco ACE are also applied at the interface VLAN level.

access-list EVERYONE line 8 extended permit icmp any any

access-list EVERYONE line 16 extended permit ip any any

Health Monitor / Probe configuration for the server-farm:

probe http VIEW_SS_HTTP

interval 2

passdetect interval 2

request method get url /favicon.ico

expect status 200 200

Defining the Real Servers in the Cisco ACE:

rserver host viewcs1.thinkingloudoncloud.com

ip address 10.68.200.15

inservice

rserver host viewcs2.thinkingloudoncloud.com

ip address 10.68.200.16

inservice

rserver host viewcs3.thinkingloudoncloud.com

ip address 10.68.200.17

inservice

Configuring the Server-farm group:

serverfarm host THINKINGLOUDONCLOUD_VIEW_FARM

predictor leastconns slowstart 300

probe VIEW_SS_HTTPS

rserver viewcs1.thinkingloudoncloud.com 443

inservice

rserver viewcs2.thinkingloudoncloud.com 443

inservice

rserver viewcs3.thinkingloudoncloud.com 443

inservice

Redundancy/High Availability

To maximize application and infrastructure availability, the Cisco ACE 4710 appliance takes advantage of all four gigabit Ethernet interfaces. These interfaces can be port-channeled together to create one logical connection between the Cisco ACE 4710 appliance and connected to Cisco Catalyst Series Switches. Trunked VLANs can be used to carry client/server messaging, management traffic and fault tolerance (FT) communication.

The FT configuration consists of three pieces. This includes the FT interface VLAN, FT

Peer and FT group. The FT interface VLAN, is a designated VLAN between the two Cisco ACE 4710 appliances. All FT traffic is sent over this VLAN including:

• ACE redundancy protocol packets
• Heart Beats
• Configuration sync packets
• State replication packets
  

The Cisco ACE 4710 appliance will use the gigabit Ethernet interfaces in the event of a link failure. As a result of using port channeling, no FT state will change unless all four gigabit Ethernet interfaces go down.

To provide high availability and redundancy, the Cisco ACE appliance can be set up and configured in a redundant mode.

The following is a sample configuration which can be used:

Configure Fault Tolerance interface

!

ft interface vlan 43

ip address 10.5.43.1 255.255.255.0

peer ip address 10.5.43.2 255.255.255.0

no shutdown

!

Configure FT peer

!

ft peer 1

ft-interface vlan 43

heartbeat interval 200

heartbeat count 20

ft-interface vlan 43

!

Create a fault tolerant group

!

ft group 1

peer 1

priority 120

preempt

associate-context admin

inservice

!

ft group 2

peer 1

priority 120

associate-context VIEW

inservice

The config details in the article above is just the sample of what can be done from the configurations perspective on the CISCO ACE device and how to approach. However the Networking details, hostnames are all fictional. I strongly recommend for anybody attempting the CISCO ACE configuration to go through CISCO’s official documentation and discuss the overall design and configuration with the Customer’s network team. This concludes the series of Load balancing VMware View with Cisco ACE. Thanks for reading and hopefully this is of help.

In the View setup there were users who will access the view setup from LAN and there were remote users, for such scenarios you need to use the VMware View connection server with Replica server for LAN users and for remote users you need to have VMware View Security servers which will pass the remote connections to the View Connections servers. Generally the View security servers will be place in a DMZ setup.

Below is the logical Architecture diagram for this scenario.

As you can see in the diagram there is load balancing requirement in both LAN and Remote(WAN) scenarios , which means you need two load balancers for each use case LAN and WAN.

Let’s look at one of the scenarios in more detail; I am taking the LAN use case for further discussion in this article.

So, let me take you through some of the basic concepts and prerequisites of the configuration.

What is that we are trying to load balance here and why is this important?

We are doing load balancing for VMware View Connection servers which acts as a VDI broker between the Client and the Virtual Desktop, each connection server in the farm is responsible for these connections. So the use case for the load balancers apart from making sure that the load is evenly distributed to the connections servers is also to act as a failover components in case one of the connection servers is not available.

So how does the traffic flow from the View Client to the Virtual Desktop?

A View Client establishes an HTTPS connection to the View Connection Servers for the sake of initial authentication, pool association/entitlement, and View Agent VM association. The second phase connection is still between the View Client and the View Connection Server. The second phase connection uses an encapsulated RDP-in-HTTP or RDP-in-HTTPS session to the View Connection Server, which then “proxies” the RDP session to the View Agent VM.

Below are the references taken from the View 5.1 Architecture Planning Guide on the traffic flow.

The above traffic flow is without Security servers.

The above traffic flow is with Security servers.

Now let’s have a look at my physical design for the local LAN uses case.