Presentation v mware view bootcamp series

VMware ViewBootcamp Series

Start Now

PRESENTED BY VMWARE

Table of Contents | VMware View Bootcamp Series

Design Consideration Guidelines for VMware View ........................................................3 by John Dodge, VMware Network Considerations and Best Practices ......................................................................31 by Shannon McFarland, Cisco Storage Deep Dive – Considerations and Best Practices ..............................................55 by Jim Yanick, VMware Optimizing the Base Image for VMware View ..................................................................72 by Todd Dayton, VMware

PCoIP Architectural Overview ................................................................................................95 by Stuart Robinson, Teradici

PCoIP Tuning ................................................................................................................... 108 by Chuck Hirstius, VMware

Delivering Applications ............................................................................................................132 by Heath Doer, VMware Leveraging Security Server for PCoIP ..................................................................................149 by Mark Benson, VMware Automating View with Powershell ........................................................................................163 by Tom Elliot, VMware

VMware View’s Stateless Reference Architecture ...........................................................177 by Mac Binesh, VMware

Additional Resources .................................................................................................................207

PRESENTED BY VMWARE

3

Design Consideration Guidelines for VMware View by John Dodge, VMware

Network Considerations and Best Practices by Shannon McFarland, Cisco Storage Deep Dive – Considerations and Best Practices by Jim Yanick, VMware Optimizing the Base Image for VMware View by Todd Dayton, VMware

PCoIP Architectural Overview by Stuart Robinson, Teradici PCoIP Tuning by Chuck Hirstius, VMware Delivering Applicationsby Heath Doer, VMware Leveraging Security Server for PCoIP by Mark Benson, VMware Automating View with Powershell by Tom Elliot, VMware

VMware View’s Stateless Reference Architecture by Mac Binesh, VMware

Additional Resources

Design Consideration Guidelines for VMware ViewJohn Dodge, Sr. Manager PSO Services, VMware

PRESENTED BY VMWARE





4Additional Resources

Agenda

View Design• The View Design Methodology

• Design Objectives

• Logical Design and Technical Specifications

• Designing Large-Scale View 4.6 Implementations

PRESENTED BY VMWARE






View Design Methodology

PRESENTED BY VMWARE






Use Cases

Customer Requirements

Use Case 1AppsOSDevices

AppsOSDevices

Workload Category

ConnectivityCategory

Workload Category

ConnectivityCategory

Use Case 2

Use Case Definition

PRESENTED BY VMWARE






Use Case Attributes

AttribUte Definition

Workload category Standard worker

Connectivity classification LAN

Location(s) London

Time of use 7am-7pm GMT, Mon-Fri

Core applications Adobe Acrobat ReaderAdobe Flash PlayerMicrosoft Office 2010Microsoft IE6

User access device(s) Thin client, iPad

Use of video/multimedia No

Printers Follow me printing

Monitors and connection 1xVGA

Devices USB: Networks scanner

Authentication (e.g., Smartcard, SSO) Standard Windows logon

Persona Application and user profile persistence

PRESENTED BY VMWARE






Workload Categories


Task worker user Limited privileges in OS

Cannot install applications or device drivers

Session will run few applications in total and a limited number of applications concurrently

User is not guaranteed session persistence except with redirected user persona

Standard worker user May have limited or granted full access privileges within the OS May be able to install applications and devices May or may not be guaranteed session and profile persistence

Power user Full privileges to the local operating system

Expected to install applications and devices

Expects session and profile persistence

May expect shared profile in multiple sessions simultaneously

PRESENTED BY VMWARE






Connectivity Classification


Low bandwidth User access via display protocol over moderate to low bandwidth connection with moderate to high latency (e.g., WAN, Internet).

Local mode Workload runs locally, whether connected to the LAN, connected to the corporate network via a WAN, or disconnected from the network

LAN User access over a high-speed (1GBE or higher), low latency (5ms>) network with low overall utilization

PRESENTED BY VMWARE






Persona, Desktop, and Pool Design

Persona, desktop & pool

Use cases and volume

PersonaNone (no persistence)

Native OSExternal

DesktopOS

Virtual hwLocal apps

Pool typesFloating

DedicatedLocal mode

Non-LC

ApplicationsVirtual

TraditionalSaaS

PRESENTED BY VMWARE






Pod and block Design

Pod and Block

Pool design

Pod(s)Locations

Security boundariesBCDR requirements

P1 Block 1Pool types

AdministrationProvisioning frequency

Px BlockyPool types

AdministrationProvisioning frequency

PRESENTED BY VMWARE






vSphere infrastructure Design

vSphere Infrastructure

Pod and block design

Mgmt blockConn SrvsSec Srvs

Infra Srvs

Block 1vCenter

ESX/ESXiNetworking

VMs + images

Px BlockyvCenter

ESX/ESXiNetworking

VMs + images

PRESENTED BY VMWARE






Storage Design

Storage

vSphere Infrastructure

Mgmt blockServer workloads

DR

VMs datastoresOS

Disposable disksWorkload IOPSMax footprint

RepositoriesHome directoriesPersistent disks

Pro�le storesTransfer server

TemplatesApplication

PRESENTED BY VMWARE






Shared Storage example for a View building block

PRESENTED BY VMWARE






User access device

Pre-existing equipment

ClientsOS

MonitorsDevices

Software

Client mgmtPatching

Software distribution

User Access Device Design

PRESENTED BY VMWARE






related Design Considerations

PRESENTED BY VMWARE






Design objectives

PRESENTED BY VMWARE






non-functional Specifications (Service Qualities)

• Manageability- Desktops: FTE

- Time to provision

- Time to recompose or refresh

• Security- Unauthorized access prevention

- Data integrity and confidentiality

- Logging and granular administration

• Availability- Uptime SLA

• Recoverability- RTO and RPO

• Performance- IOPS, MB/s, Transaction/sec

- VMs/core

PRESENTED BY VMWARE






Constraints

PRESENTED BY VMWARE






John Dodge Design Checklist

• Simplicity

• Customer involvement

• Balance business and technical (best practices)

• Design rationales

• Clarity over ambiguity

• Reusable

• Simplicityfollow this

checklist to create lasting designs

PRESENTED BY VMWARE






Logical and technical Specs In the quest for simplicity, keep similar aspects of the design together

- Group logical design elements with other logical elements

- Combine technical specifications with other technical (or detailed) specifications

Avoid repeating details whenever possible

- Label a logical component once and consistently

- Describe the technical specifications once and completely

Avoid repeating configuration items or specifications

Make high-level logical designs easy to find and understand

Keep technical specs separate for interested parties

PRESENTED BY VMWARE






Design Changes in View 4.6

• View Security Server with PCoIP support

• Tiered Storage

• View Local Mode

PRESENTED BY VMWARE






PRESENTED BY VMWARE






View Security Server Access – with PCoiP Support

Connection Sequence• User connects to View Connection

Server and authenticates

• When a PCoIP desktop is selected, the PCoIP protocol goes to the Security Server

• If the PCoIP session is on behalf of an authenticated user it is forwarded to the correct desktop

PRESENTED BY VMWARE






Security Server with PCoiP Support PCoIP between View Client and Security Server

- TCP 4172 from Client to Security Server

- UDP 4172 from Client to Security Server

- UDP 4172 from Security Server to Client

PCoIP between Security Server and Virtual Desktop- TCP 4172 from Security Server to virtual desktop

- UDP 4172 from Security Server to virtual desktop

- UDP 4172 from virtual desktop to Security Server

No Client Changes- All View 4.5 supported clients (including Teradici Zero Clients) will work

No Agent Changes

Simple Upgrade of Connection Server and Security Server from 4.5

Won’t work for all use cases!- Blocked ports (e.g. when going through certain web proxies)

- Deprioritized UDP

- For these situations, a VPN may still be required

PRESENTED BY VMWARE






View Composer improvements

Storage Performance and Optimization

• Tiered storage support resulting in lower cost

• Leverage different tiers of storage to maximize performance vs. cost

PRESENTED BY VMWARE






Placing the replica Disk on Separate Storage View 4.5 Offers the Ability to Use Tiered Storage

- The replica disk is placed on a separate datastore than the one used for the linked clones

• Although there is a slight savings in storage the primary benefit is faster read I/O operations (for example, by using SSD)

- Replica disk storage must be shared so that all ESX/ESXi hosts running linked clones in a pool can access the replica disk

- Requires that all hosts are ESX/ESXi 4.x and above because vSphere mode must be enabled

- If the datastore with the replica fails, all linked clones in the pool will be unavailable

- If the replica disk is placed on local storage, all the linked clones in the pool must be placed on local storage

PRESENTED BY VMWARE






View Client with Local Mode

• Check-out virtual desktop to physical devices

• Support devices like laptops that can lose network connectivity

• Extend security and encryption policies to offline users

• “Heartbeat” back to the datacenter

- Synchronization

- Update

- Remote Expiration

PRESENTED BY VMWARE






Designing for Local Mode Storage Requirements

- Network-based repository for base images (Transfer Server repository)

- VMFS storage for replicated OS and persistent disks

ESX Requirements - Local mode VMs don’t require any compute resources, so you can dedicate an ESX host and

“run” up to 500 VMs on a single ESX host

Network Requirements - Initial check-out is a huge file transfer, ongoing block-level replication is very low

- Assume the network will be saturated when checking out 20 VMs at once (1GBE)

Transfer Server Requirements - At least two (for redundancy) per vCenter instance (Block)

Click here for Additional Resources

PRESENTED BY VMWARE

31






network Considerations and best PracticesShannon McFarland CCIE# 5245, VCP Corporate Consulting Engineer, Office of the CTO/CE, Cisco

PRESENTED BY VMWARE

32






Agenda

Solution Overview

Solution Design- General Considerations

- Optimizing the VMware View Environment

- View Security Servers/View Connection Servers

- QoS for View

- WAN Optimization

Conclusion

PRESENTED BY VMWARE

33






Solution overview

http://bit.ly/8sC9RY


PRESENTED BY VMWARE

34






Matching View requirements with network Capabilities

View Requirements Network Capabilities

Unified Solution

User Experience QoS/HA/Performance

Availability End-to-End High Availability

Access Any Device/Anywhere

Performance Network/Compute

Security Defense-in-Depth

E2E Management Service Mgmt

PRESENTED BY VMWARE

35






Addressing Common Assumptions “I deal with desktops, servers and applications and I don’t get why the network matters”

It is critical to have a hierarchical, scalable and flexible network architecture that can meet your demands regardless of application and service

The network provides end-to-end security, availability, QoS and many other elements that improve user experience

“Do I really need to buy a bunch of networking gear to get VMware View deployed?”

You probably already have a pretty robust network that supports existing applications and services that can be used for VMware View

PRESENTED BY VMWARE

36






network overview for VMware View

PRESENTED BY VMWARE

37






Solution Design General Considerations

PRESENTED BY VMWARE

38






Direct Mode and tunnel Mode (1)

• Direct Mode – When a View Client establishes a direct connection to the View Agent over RDP or PCoIP

• Advantages- Significantly less load (CPU/Memory/Network) on the View CS

- More granular application visibility for QoS and WAN optimization

- Flexibility to run either RDP or PCoIP

- Higher availability for in-progress sessions

• Disadvantages- Without comprehensive security policies users can access the View Agent VM via Microsoft RDC and

bypass the View CS and associated policies – “AllowDirectRDP” Registry setting is used to help solve this issue.

- Cannot be used in an environment where only HTTP or HTTPS is permitted

PRESENTED BY VMWARE

39






Direct Mode and tunnel Mode (2)

• Tunnel Mode or “proxy mode” is when a View Client establishes a connection to the View SS/CS for all phases of communication

• Tunnel Mode is based on the encapsulation of RDP in HTTP or HTTPS

• Advantages - Tighter access control and policy enforcement

- Allows for an HTTPS connection from any IP-based connection into the View environment

- Both HTTP and HTTPS can be optimized by WAN Optimization solutions

• Disadvantages - Significantly more load (CPU/Memory/Network) on the View CS

- It becomes much more difficult to differentiate traffic on the network when it is all HTTP or HTTPS

- The use of HTTP proxies may interfere with the View Client connections

PRESENTED BY VMWARE

40






remote Access options

• You can use your existing VPN solution to provide remote access to the View environment - i.e IPSec or SSL VPN solutions

• View Security Servers – RDP-in-HTTPS

• Combination of the two – Contractors may use View SS while full-time employees use VPN solution (or those wanting to use PCoIP remotely [short-term limitation with View SS being TCP only]

bandwidth Considerations

• Bandwidth consumption can vary wildly depending on display protocol, workload and auxiliary connections (i.e.USB redirection)- This makes capacity planning difficult

- Not every connection yields the same consumption rate

- Tunnel mode connections make View sessions ‘look’ like browser traffic

• Thorough testing with live applications and users or at least with RAWC is critical to capacity planning

• WAN optimization is a priceless asset for bandwidth conservation via compression and reduction of redundant data

• QoS will make or break the deployment as it helps manage congested links

PRESENTED BY VMWARE

41






Protecting VMware View – Layer 2 Attacks

• DHCP client access has been a campus and branch thing – View now brings common client requirements to the DC

• DHCP Snooping – Acts like a firewall between un-trusted hosts (View Agents) and trusted DHCP servers

– Helps prevent VM from acting as an unauthorized DHCP server

• Dynamic ARP Inspection (DAI) – Validates ARP requests and responses

– Uses DHCP snooping bindings

– Helps prevent ARP-poisoning based MITM attacks

• IP Source Guard (IPSG) – Filters traffic on vEthernet interfaces and permits only traffic where IP and MAC address match

(DHCP bindings/static)

– Helps prevent a VM from spoofing the IP address of another VM

PRESENTED BY VMWARE

42






Solution Design optimizing the

VMware View environment

PRESENTED BY VMWARE

43






VMware View network-based optimization – Summary

SerVer LoAD bALAnCinG SSL WAn oPtiMizAtion

View Client N/A N/A *Yes

View Connection Server Yes Yes **Yes

View Security Server Yes Yes **Yes

*Depending on the remote display protocol used and features (MMR, USB-Redirection, etc.)

**Optimization to View Administrator, View Portal and Tunneled RDP Sessions

PRESENTED BY VMWARE

44






firewall Port Layout – View Security Server

Outside Interface RulesSoUrCe ProtoCoL Port DeStinAtion

Any HTTPS 443 SLB Virtual IP

DMZ/Inside Interface RulesSoUrCe ProtoCoL Port DeStinAtion

Security Servers AJP13 8009 Connection Servers

Security Servers JMS 4001 Connection Servers

Security Servers USB-Redirection 32111 View Agent VMs

Security Servers RDP 3389 View Agent VMs

Security Servers MMR 9427 View Agent VMs

PRESENTED BY VMWARE

45






traffic flow – internet-to-View Agent

PRESENTED BY VMWARE

46






SLb Deployment options for View

1. SLB only - Performs L4-7 SLB but offers no SSL services

2. SLB + SSL End-to-End – Option 1 + SSL termination (Client) and SSL initiation (Server)

3. SLB + SSL Termination – Option 1 + SSL termination (Client) and HTTP to server

PRESENTED BY VMWARE

47






View Security Server Configuration

View SS in View Administrator Console

4.0 4.5

“External URL” Field for View SS

SeCUrity SerVer SerVer nAMe fieLD externAL UrL fieLD

View4-sec1 view4-sec1 https://view-ext.cisco.com:443

View4-sec2 view4-sec2 https://view-ext.cisco.com:443

“locked.properties” file in “C:\Program Files (x86)\VMware\VMware View\Server\sslgateway\conf”

clientProtocol=https

clientHost=view-ext.cisco.com

clientPort=443

serverPort=80

serverProtocol=http

PRESENTED BY VMWARE

48






View Connection Server Configuration

• L4-7 SLB and SSL mostly the same as with View SS

• View CS with SSL does not use “locked.properties” file for SSL-Offload configuration

• Need “External URL” field defined External URL: http://view-int-vip.ese.com:443 Example: https://myServer:myPort

• For SSL Offload – don’t require SSL for Client/View connections Require SSL for No client connections and View Administrator

Persistence and redirection

• Persistence - VMware View does not support persistence in the form of JSessionID or similar so the only means of persistence support is sticky

Source IP - Not ideal especially with Internet clients as many may connect via a NAT/PAT/Proxy and this causes uneven distribution of load based on sticky entry

Cookie with “location.id” – Value sent by View Client = Client MAC address Cookie: com.vmware.vdi.broker.location.id=00-14-A5-6F-12-F0

• Redirection - Redirect HTTP sessions to HTTPS using redirect policy http://blah.cisco.com ---- > https://blah.cisco.com

PRESENTED BY VMWARE

49






Validation for View SS – Health Probe (1) tiered Checks

Cisco ACE Health Probe – Success for View SS

Wireshark Output – ACE Probes SS – SS checks CS via AJP13

PRESENTED BY VMWARE

50






Validation for View SS – Health Probe (2) tiered Checks

Cisco ACE Health Probe – Success for View SS

CS is Down – Fails Check – Probe Fails

PRESENTED BY VMWARE

51






Deploying QoS for VMware View

• QoS for View allows for differential treatment of View traffic during times of congestion

• Without classifying/marking, queuing and policing View traffic it will be placed into class-default or other lower priority policy

• During times of congestion the QoS policies can protect View traffic from less important flows or prevent View traffic from impacting more important flows (i.e. Voice)

• Tunnel mode flows will all look like any other HTTP/HTTPS flow. Classification on source/destination (i.e. View CS or Agent IP address(s)) can help distinguish flows

• Direct mode is ideal for proper classification

PRESENTED BY VMWARE

52






WAn optimization for VMware View

• Overcome limitations with TCP in WAN environments, remove/reduce redundant data and provide optimal compression

• Optimization in a View environment for: - HTTP/HTTPS

- Microsoft RDP

- USB Redirection

- MMR

WAN Optimization Deployment Examples: http://bit.ly/8sC9RY


PRESENTED BY VMWARE

53






Conclusion

• The combination of VMware View plus a well designed and implemented end-to-end infrastructure offers improved security, optimal server utilization and increased availability

• The end result of these combined solutions and a well thought-out design is a more streamlined user experience and increased productivity

• The critical network elements for a successful VMware View deployment include: - Hierarchical and scalable network design

- Network and application-focused defense in-depth approach to security

- End-to-end network-based Quality of Service

- Server Load Balancing and resource optimization

- WAN optimization for display and other supporting protocols (RDP, USB redirection, MMR, etc.)

- Network intelligence that is capable of identifying and properly dealing with rich media flows

PRESENTED BY VMWARE

54






reference informationCisco Validated Design for VMware View 4 http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/vmware/cisco_VMwareView.html

Cisco VDI and VMware View 4.5 http://www.cisco.com/en/US/netsol/ns971/index.html#~virtual

Cisco Virtual eXperience Infrastructure http://www.cisco.com/en/US/netsol/ns1102/index.html

VMware View http://www.vmware.com/products/view/

VMware View Documentation http://www.vmware.com/support/pubs/view_pubs.html


http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/vmware/cisco_VMwareView.html

http://www.cisco.com/en/US/netsol/ns971/index.html#~virtual

http://www.cisco.com/en/US/netsol/ns1102/index.html

http://www.vmware.com/products/view/

http://www.vmware.com/support/pubs/view_pubs.html

PRESENTED BY VMWARE

55






Storage Deep Dive – Considerations and best PracticesJim Yanick, Senior Systems Engineer, VMware

PRESENTED BY VMWARE

56






Agenda

• Updates on View Composer

• Storage Considerations

PRESENTED BY VMWARE

57






View Composer improvements

Storage Performance and Optimization

• Tiered storage support resulting in lower cost

- Leverage different tiers of storage to maximize performance vs. cost

PRESENTED BY VMWARE

58






View Composer enhancements

• Customization/Provisioning- Sysprep support

- Refresh, Recompose and Rebalance [RRR] for Floating Pool

- In 4.5:

- Floating = Non-Persistent

- Dedicated = Persistent

• Storage Performance and Optimization- Tiered support

- Optimization

- Disposable disk and Local swap file redirect

- Allow creation of linked-clones on local storage

• Management- Full Management of Persistent Disk (formerly known as UDD)

- Garbage collection script to clean-up linked-clones

PRESENTED BY VMWARE

59






View Composer: Customization/Provisioning

• Sysprep support- Sysprep : Optional New SID for each clone

• Refresh/Recompose/Rebalance

PRESENTED BY VMWARE

60






View Composer: tiered Storage

• Allow master VM replica to reside in a separate data store- Use high-performance storage to boost performance (e.g. reboot, virus scan)

PRESENTED BY VMWARE

61






View Composer: tiered Storage

• OS Disk and View Persistent Disks

• Linked Clones vs. Replicas

PRESENTED BY VMWARE

62






View Composer: Disposable Disk

• Disposable Disk: Redirect paging and system temp files to a temporary disk removed upon VM powered off

PRESENTED BY VMWARE

63






View Composer: Disposable Disk

• Disposable Disk: Redirect paging and system temp files to a temporary disk removed upon VM powered off

PRESENTED BY VMWARE

64






View Composer: other Storage optimization

• Local swap file redirect - Not reducing storage but allow the use of cheap local storage for individual VM swap file

• Allow creation of linked-clones using local data stores - Wizard will not filter out local data stores for use of VM cloning

- Allow use of cheap local storage for non-persistent pool VMs

View Composer: enhanced Management functions

• Persistent Disk (formerly known as UDD) Management - Detach/Migrate/Archive/Reattach

- Managed as “first class object”

• Garbage collection scripts - Remove one or more linked-clone VM(s) by name(s) from View, SVI, VC, and AD

PRESENTED BY VMWARE

65






View 4.5 / Composer 2.5 Developer notes (Dnotes)

• Major Efforts- Sysprep support

- Storage savings

- Enhanced refresh operations

- In the past recompose and refresh were the same; now the refresh is much quicker, we use an internal snapshot and roll back to that

- This is a snapshot of a snapshot that makes rollbacks easier

- Added disposable disk

- Whenever the clone gets rebooted that disk gets refreshed

- What goes to the disposable disk: c:\temp, c:\windows\temp, and pagefile

- We just change registry paths to redirect the files to the disposable disk

PRESENTED BY VMWARE

66






Dnotes: recompose Steps in Quickprep

1. On initial power on, set some dependencies that depend on computer name to be dependent on us

2. Set computer name

3. Do a reboot

4. Then remove some service dependencies (services that depend on us like tcpip)

5. Then join domain

6. Then enable upnp, check driver compatibility and then reboot if necessary

7. Then setup temp disk and udd

8. Then run postsync script

9. Then notify view manager that we are ready

10. Then view powers computer off and takes our internal snapshot

PRESENTED BY VMWARE

67






Dnotes: tiered Storage

• Linked Clone Limits - There is no hardcoded limit as to how many linked clones can be built against 1 replica

- The 8 hosts limit is going to be the max not the code

- The broker figures out which clones point to which replicas; the composer just gets told a clone and replica to use

• UDD Enhancements - Eliminated the need to make a backup copy of the profiles on the udd

- Before we copied the default and all users profiles to the udd

- Now we don’t have to do that and we can point a hard link back to the path on c:

PRESENTED BY VMWARE

68






Dnotes: tiered Storage improvements

• Error Reporting Improvements - A lot better error reporting

- Make the errors more visible to the admins

• Misc Improvements - At the platform there has been work to prevent boot storms and other performance enhancements

- There is a feature request to allow disposable disks on separate volumes but not in this release

- Some research on how windows uses storage and determined what services should be disabled

• They may be putting a guide together on what services should be disabled and provide a way to disable them or have these in the admin guide

- Local storage is a new feature

• Allows users to configure disk storage to place a replica

Dnotes: Windows Licensing issues

• Guest customization side added license activations - Don’t support MAK activations, only KMS

- Master must be KMS licensed before snapshotting

PRESENTED BY VMWARE

69






Storage Considerations

• There are a lot of factors to consider - How many master images will be used?

- How many total unique linked clone VMs are needed?

- What is the IO pattern of the VMs?

- What types of tasks do the users do?

• Any info are suggestions that need to be verified with lab testing

How to find

• Image sizes for the VMs - Ask the current desktop admins for the size of their current “ghost/acronis” images.

They can probably recite it from memory

- Have a partner run a VDI Assessment and get some real data

• Number and size of applications - Usually no one knows all the applications and how large they are


• Number of average IOPs per desktop - Most likely, no one will have a clue


- For a quick and dirty answer, stick a test VDI desktop on a dedicated LUN and ask the SAN team for a report on the IOPs

PRESENTED BY VMWARE

70






Some Standard numbers

These are rough guesses — please run a VDI Assessment for real data

• Storage Info (from http://en.wikipedia.org/wiki/IOPS) - IOPs

- 7200RPM SATA drives - ~80 IOPS

- 10kRPM Serial Attached SCSI drives - ~ 140 IOPS

- 15kRPM Serial Attached SCSI drives - ~180 IOPS

- Simple SLC SSD - ~400 IOPS

- Enterprise Flash from EMC - ~2500 IOPS

Desktop Guesstimate Stats - Lite User ~ 6 to 8 IOPS

- Medium User ~ 8 to 20 IOPS

- Heavy User ~ 20 to 30 IOPS

Datastore Stats for ESX 4.0 - Max VMs per VMFS Datastore ~ 90 safer at 60

- Max VMs per NFS Datastore ~ 170 safer at 150

http://en.wikipedia.org/wiki/IOPS

PRESENTED BY VMWARE

71






Decisions to Make

• Dedicated/Persistent vs. Floating/Non-Persistent - This can effect how often the linked clone is refreshed which can effect how big they grow

• UDD or Not - If using Dedicated desktops, will you use UDD’s for what percent of users?

- For flexibility, it’s better to avoid them

- Effects how much space is needed in the VDI environment vs. on file servers

- The data still needs to be stored — the question is just about where to allocate it


PRESENTED BY VMWARE

72






optimizing the base image for VMware ViewTodd Dayton, Staff Product Manager, Desktop Product Management, VMware

PRESENTED BY VMWARE

73






Virtual Desktops Are Similar to Physical Desktops

• Things that would cause poor performance in a physical PC, will cause problems in a VM

PRESENTED BY VMWARE

74






Key Areas for basic oS tuning

• Keep the amount of installed software down to an absolute minimum

• Understand what each component of your image does and why it’s in there

• Update to the latest (or best) version of the software you are using

• Know when enough tuning is enough

PRESENTED BY VMWARE

75






Virtual Desktops Are Different than Physical Desktops

• Some things that don’t cause poor performance on a physical PC, may cause problems in a VM

PRESENTED BY VMWARE

76






Key Areas for basic Virtual Desktop tuning

• Understand the ramifications of shared resources

• Work to reduce or eliminate “background” processes that run when the user is not present

• Putting extra effort into getting the master image right means a lot less work patching, updating, or replacing deployed desktops

• Tune your images for both performance and for user acceptance

PRESENTED BY VMWARE

77






3 Areas for Quick, easy, and Substantial improvement

• Storage Reduction - Hibernation File

- Debug Logs

• Background Performance - Indexing Services

- Virus Scanning

- Screensavers

• Remote Display Performance - Disable Wallpaper/Sounds

- PCoIP Tuning Parameters

PRESENTED BY VMWARE

78






VMware View Storage reduction Disable Hibernation

• The Hibernation feature will generally not be used in a View environment

• The size of the Hibernation file is typically at least 2/3 the size of allocated system memory, typically close to 1GB or more

• Hibernation files are generally unique and may appear in each linked clone, further increasing disk use

• Disable Hibernation with “powercfg /hibernate off”

• http://support.microsoft.com/kb/920730

http://support.microsoft.com/kb/920730

PRESENTED BY VMWARE

79






turn off Debug Logging

• Debug Logging is on by default in the VMware View Agent

• Debug Logs are typically 10MB+ per log and can add up quickly

• The logs appear in the linked clones and increase overall write operations during use

PRESENTED BY VMWARE

80






turn off Debug Logging

• Make the following registry changes: - HKLM\SOFTWARE\VMware, Inc.\VMware VDM

- DebugEnabled = False

- TraceEnabled = False

PRESENTED BY VMWARE

81






VMware View background Performance background indexing

• Indexing and search tools typically use “idle time” on a desktop to catalog files

• The idea of “idle time” is much different in a VDI environment, as it takes resources away from other users who aren’t idle

• This indexing can be very disk intensive from a read/write perspective

• When images are recomposed, the indexing may start over, compounding the issue

PRESENTED BY VMWARE

82






Disable background indexing

• Disable the “Windows Search” service to prevent background indexing.

• Don’t install desktop search tools such as Google Desktop in a View image.

• Be careful of toolbars and other add-in software that may contain similar functionality from various vendors

PRESENTED BY VMWARE

83






Disable Scheduled Virus Scans

• Pre-scan your master image with your virus scanner before deployment

• Disable “Full Scan” Scheduling

• Your “On-Access Scanner” should catch any changes made after the image is deployed

• Pre-scan before a recompose operation to ensure no malware sneaks into your master image

PRESENTED BY VMWARE

84






Stagger Virus Scan Signature Updates

• In a View environment, it’s important to prevent all of your VM’s from updating their virus signatures at once causing an “update storm”

• Provide a larger randomization window (4+ hours) to ensure that updates are distributed across a larger time window

• This setting can be pushed from most enterprise Virus Scan management consoles

PRESENTED BY VMWARE

85






Disable Screensavers

• In a View environment, screensavers should generally be disabled in favor of screen blanking and/or locking

• Screensavers can be forced to the blank “scrnsave.scr” and users can be blocked from making changes through GPO

• User Configuration Policies - Administrative Templates

- Control Panel

- Personalization

PRESENTED BY VMWARE

86






VMware View remote Display tuning remove Wallpaper and Audio

• In a View environment, high resolution, high color wallpaper can cause spikes as it’s loaded and uncovered by other windows

• Switching to a solid color background allows for smoother transitions and more consistent bandwidth utilization

• Windows sounds consume additional bandwidth in the protocol stack, and should be disabled if not needed

PRESENTED BY VMWARE

87






PCoiP GPo Settings Affecting bandwidth

• You can now make modifications to the PCoIP protocol

• Settings which directly affect bandwidth have been highlighted here

• Maximum Frame Rate is a separate registry setting

PRESENTED BY VMWARE

88






PCoiP Details: Ceiling

• The Ceiling caps the amount of bandwidth a single PCOIP session can use. It will not go above this level, but can reach and sustain the ceiling for as long as necessary

(This may affect display performance for some workloads)

PRESENTED BY VMWARE

89






PCoiP Details: floor

• The Floor sets the lowest bandwidth that PCoIP will tune down to; under network congestion, it will “fight it out” up to the floor; this is not a minimum — PCOIP still concedes bandwidth below the floor when not needed

PRESENTED BY VMWARE

90






PCoiP Details: Min/Max initial image Quality

• Min/Max initial image quality (along with available bandwidth) determines how far from lossless the first load of the screen will be; higher values mean a better picture but higher bandwidth and potentially choppier display in constrained environments

PRESENTED BY VMWARE

91






PCoiP Details: framerate

• Framerate determines how many times per second the display will be updated; higher framerates appear smoother to a point, but require more bandwidth

PRESENTED BY VMWARE

92






PCoiP Details: framerate

• The default framerate for PCOIP sessions is 6fps higher than Citrix HDX; a good desktop experience can use even lower values.

PRESENTED BY VMWARE

93






PCoiP Details: Maximum frame rate

• Framerate does not currently have a policy, and must be set manually in the registry at the following location:

PRESENTED BY VMWARE

94






image tuning – final thoughts

• Not meant to be the “last word” on tuning

• Weigh the benefits of tuning against the experience that your users will expect

• There are many resources for detailed tuning through GPO, registry, and file system culling which can further shrink the footprint

• Tools like nLite can drastically reduce the size of your disk images, but may remove critical features or cause intermittent issues that are difficult to troubleshoot

image tuning – other resourcesVMware View Optimization Guide for Windows 7 http://www.vmware.com/files/pdf/VMware-View-OptimizationGuideWindows7-EN.pdf

VMware Windows XP Deployment Guide http://www.vmware.com/files/pdf/resources/vmware-view-xp-deployment-guide.pdf

myvirtualcloud.net: Mastering VDI Templates for Win7 & PCOIP http://myvirtualcloud.net/?p=929

VMware View Resources http://www.vmware.com/technical-resources/products/view.html


http://www.vmware.com/files/pdf/VMware-View-OptimizationGuideWindows7-EN.pdf

http://www.vmware.com/files/pdf/resources/vmware-view-xp-deployment-guide.pdf

http://myvirtualcloud.net/?p=929

http://www.vmware.com/technical-resources/products/view.html

PRESENTED BY VMWARE

95






PCoiP Architectural overviewStuart Robinson, Director of Strategic Marketing, Teradici

PRESENTED BY VMWARE

96






implementation of the PCoiP Protocol

PRESENTED BY VMWARE

97






Software PCoiP Protocol Codec

Software PCoIP Protocol CODEC provides

• Mobility via notebooks

• Workload assignment flexibility across any server

• Lower acquisition cost for low numbers of users

Can optimize any one at the expense of the others

CPU loading

Network

User

Reduced CPU loading results in larger network footprint and/or reduced user experience

Reduced network loading results in larger CPU load and/or reduced user experience

Increasing # of displays, resolution, frame rate, and/or quality settings results in larger CPU and network load

PRESENTED BY VMWARE

98






Hardware PCoiP Protocol Codec

PCoIP hardware optimizes all three elements at once

CPU loading

Network

User

Zero CPU loading for compression, real-time quality/bandwidth optimization for best user experience at available bandwidth.

Wire-speed, strong encryption offload; network acceleration including traffic shaping and network transport

Maximize number of displays at high resolution and frame rates

Additional PCoIP hardware benefits:

• Perception-free experience for the most demanding desktops

• OS and application independence, complete USB device support

• Zero-clients provide enhanced security and lower TCO

• Very sticky – customers become locked in to VMware View

PRESENTED BY VMWARE

99






PCoiP Hardware and Software options

To Support any Enterprise User

PRESENTED BY VMWARE

100






Many PCoiP zero Client options

Unique View 4 Benefit

PRESENTED BY VMWARE

101






Mainstream thin Client Architecture

Many Components Eliminated by Hardware Zero Client

PRESENTED BY VMWARE

102






Mainstream thin Client Architecture

Many Components Eliminated by Hardware Zero Client

PRESENTED BY VMWARE

103






zero Clients: Unique benefit for VMware View

• Citrix and Microsoft trying to minimize zero client impact - Citrix promoting their “Xenith” client (actually a thin client)

- Microsoft promoting a future hardware zero client (does not exist yet)

• True Zero Client for VMware View - Application and OS independence

- Lowest Operational Cost

- Highest Security

- Future proof graphics

- Scalable performance (one client across environment)

- Brokered by VMware View

PRESENTED BY VMWARE

104






thin Client Software Stack

Equates to Management Cost and Complexity

PRESENTED BY VMWARE

105






PCoiP Hardware zero Client Software Stack

The Most Efficient Remote Desktop

PRESENTED BY VMWARE

106






Client imaging: Another High Peak, Low Average Challenge

PRESENTED BY VMWARE

107






Client imaging: Another High Peak, Low Average Challenge

Display imaging a key metric for desktop performance- PCoIP progressive imaging helps minimize average imaging needs

- Must consider instantaneous screen changes at an acceptable display frame rate

- Mainstream / productivity requirements

- Display frame rate – mainstream need ~15fps for a responsive desktop (slightly less than a DVD video)

- % of screen changing – peak at 100% with full screen changes

- Large wide-screen displays becoming dominant due to alignment with 1080p TV production lines

- Multi-display, but typically one display active at a given time

PCoIP Hardware Zero Client to

PCoIP Host Card

PCoIP Hardware Zero Client to VMware View

2.6GHz Core i7 Client

1.6GHz ATOM Client

1.6GHz Sempron Client

1GHz Eden Client

Blue area = % of 19x10 screen that can support image changes at 15fps


PRESENTED BY VMWARE

108






PCoiP tuning Chuck Hirstius, Senior Systems Engineer, PSO Advanced Services WW, VMware

PRESENTED BY VMWARE

109






Agenda

• PCoIP Protocol Background

• PCoIP Deployment Best Practices

• Tuning PCoIP

• Tunable Parameters

• Tuning Guidelines

• Conclusion/Recap

• Further Reading/Additional Resources

PRESENTED BY VMWARE

110






PCoiP Protocol background

PRESENTED BY VMWARE

111






PCoiP Protocol

• Designed to address the highest-end workloads- CAD/CAM

- Video/Multimedia

- Medical Imaging

• Began as a hardware-to-hardware solution

• Encryption inherent to the protocol

• WAN enhancements added in May, 2009

• Implemented as software-to-software solution in View 4.0

PRESENTED BY VMWARE

112






Host-based Pixel encoding

• “Pixels only” approach

• Simplifies end-points (and hence, endpoint management)

• Greater compatibility and immediate support for “the next big thing”

• Network optimization

• No impact to application performance – not required to wait for client-side rendering

PRESENTED BY VMWARE

113






UDP transport

• Ideal for real-time protocols

• Less overhead than TCP

• Reliability at the application layer, not the network layer

• Perfect fit for “pixels only” approach

• UDP is the basis for: VoIP, Telepresence, IPTV

PRESENTED BY VMWARE

114






Special features

• Build to lossless- Gradually build static screen areas to pixel-perfect

• Image Decomposition- Utilize multiple codecs depending on screen content

• Adaptive bandwidth consumption

PRESENTED BY VMWARE

115






PCoiP Deployment best Practices

PRESENTED BY VMWARE

116






best Practices

• PCoIP is a real-time protocol- Insure proper QoS/CoS classification

- Classify PCoIP traffic as real-time interactive, typically just below VoIP

- Insure that QoS/CoS mappings are preserved across WAN links

• Utilize the PCoIP Security Gateway for remote access- Most efficient remote access solution

- Allows remote access for zero-clients

• If you must use VPN, avoid SSL-based solutions- Use IPSEC, L2TP/IPSEC, GRE, DTLS

• Insure that PCoIP is bypassed on all WAN acceleration devices

• Insure that PCoIP is bypassed or trusted on any IDS/IPS devices in the network path and in endpoint protection software

PRESENTED BY VMWARE

117






best Practices

• Prefer fixed bandwidth WAN circuits over “burstable” circuits - Make sure you understand your use case well and perform accurate measurements to allow for proper

circuit sizing

• If you must use “burstable” circuits- Insure that the CIR is high enough to cover all existing high-priority traffic and the total average traffic

for all PCoIP sessions

- PCoIP may see high packet loss when it consumes burst bandwidth

- Carriers tag burst packets as “out of contract” and low priority

- May artificially limit the total bandwidth PCoIP “sees” across the circuit

• Utilize WRED for congestion avoidance- Avoid tail-drop

- Do not configure WRED on the physical interface as it will override all other QoS policies

• Avoid use cases where round-trip latency is greater than 300ms

PRESENTED BY VMWARE

118






best Practices

• Do not utilize per-packet load balancing- This will cause out of order packet delivery leading to PCoIP perceived packet loss

- Insure that affinity or session “stickiness” is enabled

• Utilize desktop VM optimization guides to configure visual settings

• Optimize PCoIP tunable parameters for your use case

PRESENTED BY VMWARE

119






tuning PCoiP

PRESENTED BY VMWARE

120






tuning PCoiP

As with any performance tuning you must:

• Identify and understand the problem you are trying to solve

• Be diligent about benchmarking and recording data

• Only modify one variable at a time and track the changes you make

In short – have a plan and methodology.

Don’t pull levers and turn dials just to see what happens!

PRESENTED BY VMWARE

121






PCoiP tunable Parameters

Can be adjusted via GPO with pcoip.adm file

• pcoip.adm located on any Connection Server at the following path:

C:\Program Files\VMware\VMware View\Server\Extras\GroupPolicyFiles

Can be set directly within the Windows Registry at the following location:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Teradici\PCoIP\pcoip_admin_defaults\

PRESENTED BY VMWARE

122






PCoiP network Parameters

• Maximum PCoIP session bandwidth (1000000Kbps)

pcoip.max_link_rate

This setting will cap the maximum bandwidth PCoIP is allowed to use for any one session

• PCoIP session bandwidth floor (0Kbps)

pcoip.device_bandwidth_floor

This setting determines the lower bound PCoIP will throttle down to when bandwidth is required but there is congestion detected on the network. PCoIP will still concede bandwidth below this value when it is not needed. At the default setting PCoIP will determine the actual value based upon network conditions

• PCoIP session MTU (1300bytes)

pcoip.mtu_size

Adjust (reduce) this value if you are seeing packet fragmentation due to VPN or other encapsulation

PRESENTED BY VMWARE

123






PCoiP image Quality Levels

• Minimum Image Quality (50%)

pcoip.minimum_image_quality

Determines the lower bounds of image quality “compression” when network congestion triggers increased build-to-lossless

• Maximum Initial Image Quality (90%)

pcoip.maximum_initial_image_quality

A lower bound on the image quality that PCoIP tries to deliver “immediately” when screen updates occur. The higher this setting the more “pixel perfect” initial screen updates will be at the cost of higher bandwidth peaks

• Maximum Frame Rate (30 fps)

pcoip.maximum_frame_rate

This setting determines the maximum frequency of client screen updates. Lower values will reduce bandwidth when there are high rates of motion that need to be rendered

PRESENTED BY VMWARE

124






PCoiP Audio Parameters

• Enable/Disable Audio in the PCoIP Session (Enabled)

pcoip.enable_audio

This setting enables or disables the transmission of audio entirely. If the desktop use case does not require audio it can be disabled here to insure that no bandwidth is wasted transmitting it

• PCoIP session audio bandwidth limit (500Kbps)

pcoip.audio_bandwidth_limit

This setting will limit the maximum bandwidth that audio traffic can consume. PCoIP can still dynamically adjust this setting down based upon current network conditions. Setting this value below 50Kbps may result in no audio being transmitted at all

PRESENTED BY VMWARE

125






When to tune

• Cover the best practices first- Confirm network environment is properly configured and sized

- Confirm that desktop image optimizations have been done

• Remember PCoIP already adapts- Altering parameters can have unexpected results

PRESENTED BY VMWARE

126






tuning Guidelines

PRESENTED BY VMWARE

127






PCoiP tuning Guidelines

• Configure the maximum session bandwidth- For low bandwidth links set the limit at or slightly below (10%) the maximum link rate

- Even on the LAN it may make sense to apply a limit

• Configure the session floor when…- PCoIP is experiencing packet loss but the network link has plenty of headroom

- May not always improve user experience – YMMV

- When packet loss is seen on WiFi networks

- Be careful to avoid unintentional oversaturation

PRESENTED BY VMWARE

128







• Configure the maximum frame rate- In almost all cases the maximum frame rate can be reduced to 20-24fps with little noticeable impact –

but also little gain

- Settings below 15fps may be noticeable in use cases which require rich media

- Task workers without media requirements can often utilize settings as low as 6-8fps without significant visual impact

- Examine the PCoIP Server log files for the following values:

MGMT_IMG:log:cur_s0max_s30tbl2bwc0.01bwt4.39fps2.60fl_ps5.03

MGMT_IMG:log:cur_s7max_s33tbl2bwc0.15bwt4.39fps2.67fl_ps5.53

• Configure the maximum initial image quality- When on a WAN link with constrained bandwidth reduce this setting to 60-70%

- Setting this value too low may result in noticeably “fuzzy” or “blurry” images

PRESENTED BY VMWARE

129







• Configure the minimum image quality- This value must be below the maximum initial image quality setting

- The default value of 50% is acceptable for most cases

• Configure the audio bandwidth limit- For use cases that utilize significant amounts of audio – legal/medial transcription for example –

reducing audio bandwidth may increase user density

- Audio bandwidth limit is a target, not a literal value

- Vary the audio bandwidth limit between 450Kbps – 50Kbps until the desired mix of bandwidth savings and audio intelligibility is achieved

PRESENTED BY VMWARE

130






Conclusion

• Always start with the basics before resorting to PCoIP tuning- Majority of PCoIP issues are external to the protocol

- Optimize VDI Base image

- Insure proper implementation of network configuration QoS/CoS, UDP tunneling through VPN, etc.

- Proper network sizing for desired use case

• Utilize the information in the PCoIP logs to determine where the trouble spots are

• Determine proper settings to adjust- Vary one item at a time, make as few changes as possible

- Test, test, and re-test against the intended use case. Utilize a repeatable set of users actions and/or a scripted set of actions to validate the impact of changes

• If all else fails reach out for help to VMware/Teradici

PRESENTED BY VMWARE

131






Additional resources

Learn more about tuning PCoIP with Optimization guides for Desktop images and PCoIP

PCoIP Tuning ResourcesPCoIP Scenario-Based Network Sizing Guide http://www.vmware.com/files/pdf/VMware-View-PCoIP-Network-Sizing-Guide-IG-EN.pdf

PCoIP Zero Client Optimization Guide http://www.vmware.com/files/pdf/VMware-View-PCoIP-Zero-Client-Optimization-Guide-TN-EN.pdf

Desktop Optimization GuidesWindows XP + 7: http://myvirtualcloud.net/?p=929

Windows 7: http://www.vmware.com/resources/techresources/10157


http://www.vmware.com/files/pdf/VMware-View-PCoIP-Network-Sizing-Guide-IG-EN.pdf

http://www.vmware.com/files/pdf/VMware-View-PCoIP-Zero-Client-Optimization-Guide-TN-EN.pdf

http://myvirtualcloud.net/?p=929

http://www.vmware.com/resources/techresources/10157

PRESENTED BY VMWARE

132






Delivering ApplicationsHeath Doer, Senior Systems Engineer, VMware

PRESENTED BY VMWARE

133






Agenda

• View and ThinApp – Benefits Overview

• Application Virtualization

• Reference Architecture

• Integrating ThinApp and View

• Demonstration

• Q & A

PRESENTED BY VMWARE

134






turning a Monolithic System to Modular

• Virtualization breaks the bond between each layer

• Allows IT to manage each layer separately

• Increases flexibility and reduces costs

PRESENTED BY VMWARE

135






Simplify Application Delivery with View & thinApp

• Reduce Storage - Reuse templates

- Reduce image size and complexity

• Simplify Software Delivery (no agents/infrastructure) - Multiple versions of same

app installed on desktop image

- Plugs into existing environment without requiring server hardware or software

• Streamline Patch Updates - Modify 1 app for an entire environment

- In place upgrades

• Migration Readiness - OS and app in single image

PRESENTED BY VMWARE

136






thinApp Key benefits

• Agentless architecture - Single file – EXE, MSI

- No installation or changes to registry

- Zero management required on end point device

• Seamlessly fits into any environment - No streaming server hardware or software needed

- Plugs into any existing management framework

• Run virtually any application from any device - Desktop, USB, flash, terminal services, Citrix

- Any windows application – simple to complex

- Supporting components can be run side by side (java, .NET)

• Ensuring security without compromising user flexibility - User-Mode execution

- Virtual Registry protects underlying host OS

- No device drivers installed on underlying OS

PRESENTED BY VMWARE

137






How thinApp Works

VMware ThinApp Links the Application, Virtual Operating System (VOS), File System and Registry into a Single EXE MSI File

• Application encapsulation and Isolation

• Intercepts file and system calls

• Process Loading – start exe from VOS, Launch from host OS (Virtual/Physical)

• DLL Loading. loads DLL dependencies the EXE/DLL/OCX files from archive

• Thread and process management. VOS tracks all processes and threads inside virtual registry (COM & Utility)

PRESENTED BY VMWARE

138






Creating thinApp Packages

Steps for packaging an application with ThinApp

• The Setup Capture utility creates a baseline snapshot before the application is installed (pre-scan)

• The application is traditionally installed

• The Build phase of Setup Capture creates the virtualized application package (post-scan)

• Set package “entry points” and package options

• Finish by browsing and building the project

PRESENTED BY VMWARE

139






Application Link – Connecting thinApps

Seamless Interoperability - ThinApp packages can talk together and with OS

- Enables interoperability between virtual applications and underlying OS

Enhance License Management - Reduces package size to ease deployment and delivery

- Enhances software license management tracking via current inventory tools

PRESENTED BY VMWARE

140






Package once, Deploy everywhere

PRESENTED BY VMWARE

141






thinApp reference Architecture – Corporate Users

PRESENTED BY VMWARE

142






thinApp reference Architecture – remote Users

PRESENTED BY VMWARE

143






thinApp reference Architecture – Mobile Users

PRESENTED BY VMWARE

144






View Composer with thinApp

• Redirect all application “writes” to the user data disk, by default

• Reduce the number of master images and size of base disk

• Provide simplified entitlement, deployment, and management of applications

• Seamlessly update users

• Reduce storage costs

“Application updates are kind of a non-event now...” - Norton Healthcare

PRESENTED BY VMWARE

145






thinApp with terminal Server – reduce Server “Silos”

Improved Utilization and Streamlined Management

• ThinApp single files are not installed – no changes to OS

• Full isolation allows for multiple versions of the same application or multiple applications to reside on the same server to be streamed to end point devices

• Single image files fit into existing management framework

PRESENTED BY VMWARE

146






View 4.5 requirements for thinApp Applications

1. You must create MSI’s

2. You must use ThinApp 4.6 or later

3. Configure the Package.INI options to support either Streaming or Local installs

PRESENTED BY VMWARE

147






Package.ini options for Use with View 4.5

MSIStreaming=1is the new option in 4.6!

PRESENTED BY VMWARE

148






Package.ini options for Use with View 4.5

Note the size difference of the MSI file.

Small MSI files mean that Streaming is enabled!


PRESENTED BY VMWARE

149






Leveraging Security Server for PCoiPMark Benson, View Architect, Enterprise Desktop, VMware

PRESENTED BY VMWARE

150






Setting up PCoiP remote Access with View 4.6

• An Introduction to View Remote Access

• The View Security Server

• Configuring View for PCoIP Remote Access - A Single Security Server deployment

- A multiple Security Server deployment with load balancing

• Setting up the Firewalls to Allow PCoIP

• Basic Troubleshooting

PRESENTED BY VMWARE

151






View Security Server Access with rDP Connection Sequence

• User connects to View Connection Server and authenticates

• If successful, a secure HTTPS tunnel is established between the client device and the Security Server

• When a desktop is selected, the remote desktop protocol goes via the secure tunnel

PRESENTED BY VMWARE

152






View Security Server

View Security Server Security Features

• Recommended for DMZ deployment or environments with separated networks

• Only authenticated users can gain access through it

• Can ensure that virtual desktop access is only possible for authenticated users. The only desktop protocol that can enter the data center is on behalf of authenticated users

• Ensures users can only access resources (virtual desktops) they are authorized to access

• Zero administration

• Offloads the HTTPS processing and all desktop protocol traffic away from the View Connection Server

• Multiple View Security Servers are used for scalability and HA

PRESENTED BY VMWARE

153






View Access – with PCoiP

Connection Sequence• User connects to View Connection Server and authenticates

• When a PCoIP desktop is selected, the PCoIP protocol attempts to go directly to the virtual desktop

PRESENTED BY VMWARE

154






View Security Server Access – with PCoiP


• When a PCoIP desktop is selected, the PCoIP protocol attempts to go directly to the virtual desktop

PRESENTED BY VMWARE

155






View Security Server Access – with PCoiP Support (View 4.6)


• When a PCoIP desktop is selected, the PCoIP protocol goes to the Security Server

• If the PCoIP session is on behalf of an authenticated user it is forwarded to the correct desktop

PRESENTED BY VMWARE

156






Security Server with PCoiP Support – firewall rules

• PCoIP between View Client and Security Server - TCP 4172 from Client to Security Server

- UDP 4172 from Client to Security Server

- UDP 4172 from Security Server to Client

• PCoIP between Security Server and virtual desktop - TCP 4172 from Security Server to virtual desktop

- UDP 4172 from Security Server to virtual desktop

- UDP 4172 from virtual desktop to Security Server

PRESENTED BY VMWARE

157






View Security Server Access and High Availability

Connection Sequence• User connects to View Connection Server via load balancer and authenticates

• If successful, an HTTPS tunnel is established between the client device and the Security Server

• When a PCoIP desktop is selected, and the Connection Server is configured to gateway PCoIP, PCoIP goes via the Security Server

PRESENTED BY VMWARE

158






the 3 Setup Steps for PCoiP remote Access with View 4.6

1. Turn on PCoIP Gateway Functionality on the Connection Server

2. Set up the two External URLs on each server (usually the Security Server) - “External URL” used by View Clients to establish the HTTPS Tunnel

- “PCoIP External URL” used by View Clients to establish the PCoIP connection through the PCoIP Gateway

3. Set the firewall rules to allow PCoIP - PCoIP between View Client and Security Server

- TCP 4172 from Client to Security Server

- UDP 4172 between Client and Security Server in both directions

- PCoIP between Security Server and virtual desktop

- TCP 4172 from Security Server to virtual desktop

- UDP 4172 between Security Server and virtual desktop in both directions

PRESENTED BY VMWARE

159






View PCoiP remote Access and Local Access Scenario

PRESENTED BY VMWARE

160






Setting the Security Server external UrLs at installation time

PRESENTED BY VMWARE

161






PCoiP remote Access with VMware View 4.6 – troubleshooting

Common Issues

• Make sure the Connection Server is configured to gateway PCoIP connections- The default setting when you install or upgrade to View 4.6 is to perform direct PCoIP connections

to the virtual desktops. For remote access without a VPN, this will not work unless you configure the Connection Server to “Use PCoIP Secure Gateway for PCoIP Connections to desktop”

• Make sure the external URLs are set correctly- The External URLs are used by the View Clients to connect to the Security Servers or Connection

Servers. If these specify incorrect addresses or ports then the Secure Tunnel and PCoIP connection will not work. The external URLs must not be load balanced – they must represent access to the specific servers

• Check that PCoIP is not blocked by any firewall or web proxy etc.- Look at View Client logs and Firewall logs

- Test from other locations

PRESENTED BY VMWARE

162






PCoiP remote Access with VMware View 4.6 – Summary

• Use View 4.6 on Connection Servers and Security Servers

• Plan your deployment and consider the needs for local access and remote access- Make sure you know the external IP addresses used to access the environment from remote locations

• Perform the three steps for configuration- Turn on PCoIP Gateway Functionality on the Connection Server

- Set up the two External URLs on each server

- Set the firewall rules to allow PCoIP


PRESENTED BY VMWARE

163






Automating View with PowershellTom Elliot, Sr. MTS, Enterprise Desktop, VMware

PRESENTED BY VMWARE

164






Agenda

• Overview of View PowerCLI

• Architecture

• Anatomy of a Cmdlet

• Setting up an Environment

• Basic Tasks

• Getting Help

• Creating your Own Scripts

• Integrating with vSphere

• Advanced Topics – Remoting, Known Issues

PRESENTED BY VMWARE

165






overview of View PowerCLi

• First automation tool for VMware View

• Command Line interface

• Snap-in for Microsoft’s Windows PowerShell

• Allows management of - View Desktop Pools

- Individual View Desktops

- Connection Servers

- View registered vCenter Server configuration

- User Entitlements

- View Configuration (including Licensing)

• Use Cases - Manage power consumption by shrinking pools overnight

- Manage new users and increase pool size automatically

- Schedule recurring Composer operations (refresh, rebalance, recompose)

- and more…

PRESENTED BY VMWARE

166






Architecture

PRESENTED BY VMWARE

167






Anatomy of a Cmdlet

• Verb-Noun Structure - For example, Get-Pool, Set-License, Add-ManualPool

• Input Parameters - For example, Set-Licence -key ADCD-12FD-123F-BDA1

- Output Filter, Get-Pool –displayName mypool*

• Piping - Get-Pool –pool_id myPool1 | Remove-Pool

- Get-DesktopVM –poolType Manual | Add-ManualPool –pool_id myNewPool

- Get-VM xp* | Add-ManualPool –pool_id myNewPool – vc_id (Get-ViewVC –serverName vc1.local.int).vc_id

• View IDs - pool_id, vc_id, machine_id

PRESENTED BY VMWARE

168






Setting Up an environment

• Install View Connection Server

• Install Windows Management Framework - Includes PowerShell 2.0 and WinRM 2.0

- Components included in Windows 2008 & Windows 7

- Download from www.microsoft.com – (KB968930)

- Install on any remote workstation as required (for remoting)

• Optional install – vSphere PowerCLI Toolkit - Provides vSphere Management cmdlets

• Establish Execution Policy for PowerShell - Set-ExecutionPolicy Unrestricted (to use your own scripts)

- Set-ExecutionPolicy AllSigned (to use signed scripts only)

• Enable-PSRemoting (on the Connection Server) - Allows remote admins to run scripts

• User permissions for PSRemoting - Must connect with Domain Admin credentials

- Can configure other users, but View cmdlets require Admin privileges

PRESENTED BY VMWARE

169






basic tasks

• Get-Pool - Example: Get-Pool –displayName “My Pool”

• Get-DesktopVM - Example: Get-DesktopVM –poolType Manual

• Add-PoolEntitlement - Example: Get-User -name user | Add-PoolEntitlement -pool_id desk1

• Update-AutomaticPool - Example: Update-AutomaticPool -pool_id auto1 –maximumCount 100

• Send-SessionLogoff - Example: Get-RemoteSession-usernamemydom\fred|Send-SessionLogoff

• Add-AutomaticLinkedClonePool - Example: Get-ViewVC -serverName vc.mydom.int | Get-ComposerDomain -domain VCDOM | Add-AutomaticLinkedCLonePool -pool_id lcdpool_1 -displayName ‘LCDPool1’-namePrefix‘lcp1-{n}-dt’-parentVMPath/AutoPoolVMs/parent-parentSnaphotPath /AutoPoolSnapshots/parent1_snapshot -vmFolderPath /AutoConfig/VM_folder-resourcePoolPath/AutoConfig/host/Resources-datastoreSpecs [Aggressive,os,data]/host/datastore_1/lun04

PRESENTED BY VMWARE

170






Getting Help

• Example, Get-Help Send-SessionDisconnect

• Usage information, description and parameters

• View Integration Guide - Download from http://www.vmware.com/pdf/view45_integration_guide.pdf

http://www.vmware.com/pdf/view45_integration_guide.pdf

PRESENTED BY VMWARE

171






Creating your own Scripts

• Text file with the .ps1 extension

• Load View Cmdlets by dot-sourcing add-snapin.ps1- “C:\Program Files\VMware\Vmware View\Server\extras\Powershell\add-snapin.ps1”

• Schedule PowerShell scripts via Windows Scheduled Tasks- Example command: powershell.exe c:\scripts\updateview.ps1

PRESENTED BY VMWARE

172






integrating with vSphere

• Administer vSphere components related to View from PowerCLI

• vSphere Cmdlets loaded by View PowerCLI (if installed)

• Limited support for piping vSphere Cmdlet output to View Cmdlet

• Limited support for use of vSphere IDs

• Examples$global:DefaultVIServer | Add-ViewVC –password <password>

Get-VM pool1-* | Add-ManualPool –pool_id mp1 –vc_id (Get-ViewVC –serverName vc.mydomain.int).vc_id

PRESENTED BY VMWARE

173







How to Get a Path for a vSphere Object

#### Get the full vSphere path to an Inventory object from vSphere PowerCLI

#### Parameters: $InventoryObject - Individual vSphere PowerCLI object (not a Datastore)

#### Example Usage: VVGetPath (Get-VM -name myVM)

#### VVGetPath(Get-ResourcePool|Select-first1)

functionVVGetPath($InventoryObject){

if($InventoryObject){

$objectType = $InventoryObject.GetType().Name

$objectBaseType = $InventoryObject.GetType().BaseType.Name

if(-not ($objectBaseType.Contains(“InventoryItemImpl“) -or $objectBaseType.Contains(“FolderImpl”)

-or$objectBaseType.Contains(“DatacenterImpl“)-or$objectBaseType.Contains(“VMHostImpl”))){

Write-Error (“Not an expected vSphere object type. Object type is: “ + $objectType)

break

}

$path = ““

# Recursively move up through the inventory hierarchy, by parent or folder

if($InventoryObject.ParentId){

$path = VVGetPath(Get-Inventory -Id $InventoryObject.ParentId)

}elseif($InventoryObject.FolderId){

$path = VVGetPath(Get-Folder -Id $InventoryObject.FolderId)

}

# Add this object to the path. Skip the “Datacenters” folder at the root

if(-not$InventoryObject.isChildTypeDatacenter){

$path = $path + “/” + $InventoryObject.Name

}

$path

}

}

PRESENTED BY VMWARE

174







How to Get a Path for a Datastore

#### ConstructaView-friendlypathtoadatastoreonaspecificcluster(definedbyaResourcePool)

#### Parameters:

#### $Datastore Datastore object

#### $ResourcePool Resource Pool in desired cluster

#### Example Usage:

#### VVGetDatastorePath (Get-Datastore “datastore1”) (Get-ResourcePool “Resources”)

functionVVGetDatastorePath($Datastore,$ResourcePool){

if($Datastore-and$ResourcePool){

$dsType = $Datastore.GetType().Name

$rpType = $ResourcePool.GetType().Name

if(-not($dsType.Contains(“Datastore”))){

Write-Error “The Datastore provided is not a Datastore object.”

break

}

if(-not($rpType.Contains(“ResourcePool”))){

Write-Error “The Resource Pool provided is not a ResourcePool object.”

break

}

$ClusterPath = VVGetPath(Get-Inventory -Id $ResourcePool.ParentId)

$path = $ClusterPath + “/” + $Datastore.Name

$path

}

}

PRESENTED BY VMWARE

175






Advanced topics

Remoting

• Executing PowerShell Cmdlets from a remote machine

• All commands executed on the Connection Broker

Enter-PSSession view.local.int –Credential (Get-Credential)

. C:\Program Files\Vmware\Vmware View\Server\extras\PowerShell\add-snapin.ps1

…

…

…

Exit-PSSession

PRESENTED BY VMWARE

176






other resources

Useful LinksVMware Communities – vSphere PowerCLI http://communities.vmware.com/community/vmtn/vsphere/automationtools/powercli

VMware Communities – View http://communities.vmware.com/community/vmtn/entdesk/view

DocumentationView Integration Guide http://www.vmware.com/pdf/view45_integration_guide.pdf

vSphere PowerCLI Guide http://www.vmware.com/support/developer/PowerCLI/PowerCLI41/doc/viwin_admg.pdf

DownloadsWindows Management Framework http://support.microsoft.com/kb/968930


http://communities.vmware.com/community/vmtn/vsphere/automationtools/powercli

http://communities.vmware.com/community/vmtn/entdesk/view

http://www.vmware.com/pdf/view45_integration_guide.pdf

http://www.vmware.com/support/developer/PowerCLI/PowerCLI41/doc/viwin_admg.pdf

http://support.microsoft.com/kb/968930

PRESENTED BY VMWARE

177






VMware View’s Stateless reference ArchitectureMac Binesh, Sr. Technical Marketing Manager, Enterprise Desktop, VMware

PRESENTED BY VMWARE

178






Agenda

Reference Architecture for View 4.5 Stateless Desktops

• RA Goals and Benefits

• Cost Analysis

• BOM

• Key Use Cases

• View 4.5 Scalability Testing and Results

PRESENTED BY VMWARE

179






VMware View rA Goals

PRESENTED BY VMWARE

180






VMware View 4.5 Stateless Desktops rA Goal

• Validated VDI solution

• Realistic desktop workload (Task/Knowledge Worker)

• Lower VDI CAPEX

• VMware Reference Architecture for Stateless Virtual Desktops with VMware View 4.5

http://www.vmware.com/files/pdf/VMware-View-45-Stateless-RA.pdf


PRESENTED BY VMWARE

181






What is a Stateless Desktop?

• Called “non-persistent” (View 3.x/4.x) or “floating” (View 4.5)

• Generic virtual desktop allocated to user at login

• User changes are discarded upon logoff

• No User installed applications

• VM returns to available desktop pool upon logoff

• Lower cost per VM via tiered storage

• With View 4.5, the “floating” VM can be placed on solid state disk on a blade server (previously, the VM resided on SAN)

PRESENTED BY VMWARE

182






benefits of a Stateless Desktop

User it business

• Fast Login

• Fast Application access

• Easy to re-boot

• Improve SLA

• Easy to manage

• No “storms”

• No SAN to config

• Easy to scale

• Reduce CAPEX

• Reduce OPEX

• Enhance user productivity

• Enhance IT productivity

• Plus, all other VDI benefits

PRESENTED BY VMWARE

183






Cost Analysis

PRESENTED BY VMWARE

184






Cost trends – Datacenter Hardware

PRESENTED BY VMWARE

185






CAPex Datacenter Cost Per Virtual Desktop – Stateless VMs / core: 12

Desktop: Win7, 32 bit, 1Gb

tyPe VenDor SPeCifiCAtion Unit CoSt Qty totAL

Virtual Desktops Dell PowerEdge R610 Nehalem 2.93/8 Cores/96GB

$13,281 16 $212,496

Network Cisco Nexus 5010 $11,842 1 $11,842

SAN NetApp FAS 2050/20TB $69,450 1 $69,450

SSD Intel SSDSA2MH 160G2R5 $499 32 $15,968

Total for 1280 Virtual Desktop $309,756

Cost Per Virtual Desktop for Data Center Infrastructure Hardware $242

[1] Based on the list price at dell.com as of 10/1/2010[2] Based on the list price at amazon.com as of 10/1/2010[3] Based on the list prices at http://docstoc.com/docs/43607195/SC-NetApp-Price-List as of 11/1/2009

http://docstoc.com/docs/43607195/SC-NetApp-Price-List

PRESENTED BY VMWARE

186






Publications

PRESENTED BY VMWARE

187






Market Segments / Use Models

PRESENTED BY VMWARE

188






Stateless Desktop: Key Use Cases

Remote Office/Branch Office- Reduce costs by managing desktops and users centrally

- Centrally control sensitive data

- Streamline desktop and application deployment

Business Process Outsourcing

- Reduce costs by managing desktop applications and users centrally

- Centrally control sensitive data

- Streamline desktop and application deployment

Labs / Kiosk / Training Centers

- Includes distance learning, lab environments

- Rapidly provision desktop

- Ensure Security with Centralized Control and Management

- Reduce costs and increase control

PRESENTED BY VMWARE

189






View 4.5 Scalability testing and results

PRESENTED BY VMWARE

190






test Setup

PRESENTED BY VMWARE

191






Compute Platform

SAMPLe SerVer

Qty Description

1 vSphere ESXi 4.1.0 Build 260247

2 Quad Core 2.93Ghz Intel Xeon X5570 Processors

1 96GB RAM per host

2 Intel SATA Solid State Drive (MTBF 1.2M Hours)

2 Converged 10Gbit Networking

http://download.intel.com/design/flash/nand/mainstream/322296.pdf

http://download.intel.com/design/flash/nand/mainstream/322296.pdf

PRESENTED BY VMWARE

192






other High-Level test items

• NetApp 3140 SAN (could easily be a 2040, as the load is so minimal for this testing)

• Cisco Nexus 5010 switching

Software

• VMware View 4.5

• VMware vSphere 4.1

• 1GB Windows 7 32-bit Virtual Desktops

• 24 GB Virtual Disk

PRESENTED BY VMWARE

193






Datastores – Logical Diagram

PRESENTED BY VMWARE

194






Solid State Data Store – Linked Clones Growth

PRESENTED BY VMWARE

195






View building block – Pools/eSx Cluster/Provisioning

• 3 ESX Windows 7 VDI Clusters (5 hosts per Cluster)

• 1 Data Store per host (2 SSD/300GB/1.5TB per Cluster)

• 96 VM/Host – 480 VM Max/Cluster (12 VM/Core density)

• 3 Pools (384 Virtual Desktops per pool/per cluster)

• Non-persistent automated pool, Refresh Immediately

• 1152 users entitled, 1440 max provision

• A single NFS volume was used for .vswp’s, as well as infrastructure VM’s.

• A standard file share was used for user data redirections

PRESENTED BY VMWARE

196






test Strategy and Success Criteria

• Establish baseline for maximum desktops per blade - Start with one blade server, deploy small number of VMs (32)

- Increment the desktop (by 32) till you max out the resources

- Back off until top line resource constraint is at an acceptable level (in this case CPU, at 70%~)

• Perform two blade testing with the maximum number of desktops

• Perform four and eight blade testing

• Application performance should be within reasonable limits

• Capacity of local SSD is being watched closely, and it is a key factor of this type of stateless design’s limitation today. However, future SSD capacity growth will easily eliminate this minor hurdle

PRESENTED BY VMWARE

197






Performance results – View 4.5

PRESENTED BY VMWARE

198






% Core Utilization time, 96 workloads

PRESENTED BY VMWARE

199






Memory Usage (96Gb total); 96 Workloads

PRESENTED BY VMWARE

200






Solid-State Drive Statistics i/o per second, 80 non-optimized

PRESENTED BY VMWARE

201






Solid-State Drive Statistics i/o per second, 96 optimized Desktops

PRESENTED BY VMWARE

202






Disk Latency, 96 Workloads

PRESENTED BY VMWARE

203






Application response times, 96 Workloads

PRESENTED BY VMWARE

204






test results Summary

• We were able to scale large number of desktops, 96 in all, on a single 8 core compute server with the workload

• We achieved a consolidation ratio of 12 VM/core

• 96 desktops withstood various reboots without consuming 100% of the system resources

• Because of 10Gbit Ethernet, as well as the removal of I/O traffic from the standard storage pipe necessary, no limits related to networking are expected even in a fully populated blade environment

• Report on shared storage is not necessary as there is not a noticeable change in storage utilization while under test

• The traffic seen would be identical to user data usage on a traditional file server

PRESENTED BY VMWARE

205






Session takeaways for transforming i.t.

• VMware View 4.5 with tiered storage will drastically lower CAPEX

• VMware View 4.5 with tiered storage capability allows for a new era in the evolution of desktop virtualization cost modeling

• VMware View 4.5 provides linear scalability across both compute and storage regardless of scale

PRESENTED BY VMWARE

206






Learn More About VMware View 4.5More information on VMware View: http://www.vmware.com/products/view/

Download and evaluate VMware View: www.vmware.com/download/view/

Use the VMware View TCO calculator: http://www.vmware.com/go/view_calculator

VMware Reference Architecture for Stateless Virtual Desktops with VMware View 4.5 http://www.vmware.com/files/pdf/VMware-View-45-Stateless-RA.pdf

EMA White Paper — VMware View 4.5 and Stateless Virtual Desktops http://www.vmware.com/files/pdf/EMA-VMware-View-StatelessVirtualDesktop-WP.pdf

Workload Considerations for Virtual Desktop Reference Architectures http://vmware.com/files/pdf/VMware-WP-orkloadConsiderations-WP-EN.pdf

Worker Types http://www.vmware.com/files/pdf/analysts/Forrester_Demystifying-Client-Virtualization.pdf


http://www.vmware.com/products/view/

www.vmware.com/download/view/

http://www.vmware.com/go/view_calculator


http://www.vmware.com/files/pdf/EMA-VMware-View-StatelessVirtualDesktop-WP.pdf

http://vmware.com/files/pdf/VMware-WP-orkloadConsiderations-WP-EN.pdf

http://www.vmware.com/files/pdf/analysts/Forrester_Demystifying-Client-Virtualization.pdf

PRESENTED BY VMWARE

207






Additional resourcesDesign Consideration Guidelines for VMware View http://www.vmware.com/technical-resources/products/view.html http://www.vmware.com/pdf/view-46-architecture-planning.pdf

Network Considerations and Best Practices http://www.vmware.com/files/pdf/VMware_View_4_to_PCoIP_Client_WAN_Network_Guidelines.pdf http://www.shannon-mcfarland.com/

Storage Deep Dive – Considerations and Best Practices http://www.vmware.com/files/pdf/view_storage_considerations.pdf

Optimizing the Base Image for VMware View http://www.vmware.com/files/pdf/view-operational-aspects.pdf

PCoIP Architectural Overview http://www.vmware.com/files/pdf/VMware_View_4_to_PCoIP_Client_WAN_Network_Guidelines.pdf http://www.vmware.com/files/pdf/VMware-PCoIP-Zero-Clients-Host-Cards-TN-EN.pdf

Delivering Applications http://www.vmware.com/resources/techresources/1098 http://www.vmware.com/files/pdf/VMware-DG-ThinApp-AppRegistration-EN.pdf

Leveraging Security Server for PCoIP http://communities.vmware.com/community/cto/desktop/blog/2010/12/13/secure-remote-access-with-view-and-pcoip

Automating View with Powershell http://www.vmware.com/files/pdf/techpaper/PowerShell-Integration-View45-WP.pdf

VMware View’s Stateless Reference Architecture http://www.vmware.com/files/pdf/VMware-View-45-Stateless-RA.pdf

http://www.vmware.com/technical-resources/products/view.html

http://www.vmware.com/pdf/view-46-architecture-planning.pdf

http://www.vmware.com/files/pdf/VMware_View_4_to_PCoIP_Client_WAN_Network_Guidelines.pdf

http://www.shannon-mcfarland.com/

http://www.vmware.com/files/pdf/view_storage_considerations.pdf

http://www.vmware.com/files/pdf/view-operational-aspects.pdf

http://www.vmware.com/files/pdf/VMware_View_4_to_PCoIP_Client_WAN_Network_Guidelines.pdf

http://www.vmware.com/files/pdf/VMware-PCoIP-Zero-Clients-Host-Cards-TN-EN.pdf

http://www.vmware.com/resources/techresources/1098

http://www.vmware.com/files/pdf/VMware-DG-ThinApp-AppRegistration-EN.pdf

http://communities.vmware.com/community/cto/desktop/blog/2010/12/13/secure-remote-access-with-view-and-pcoip

http://www.vmware.com/files/pdf/techpaper/PowerShell-Integration-View45-WP.pdf


Presentation v mware view bootcamp series

Technology

Transcript of Presentation v mware view bootcamp series