My wife & I are fans of Michael Bublé, and of the style of music he sings, so that greatly influenced our final choices.

For those of you who attending the ceremony or evening reception, or are just curious about the music we picked, here is the play list, in the order it was played. Enjoy!

Everything (Bob Rock Mix) by Michael Bublé [Crazy Love, disc 2]
Summertime, sung by Peter Gabriel [The Glory of Gershwin]
The Best Is Yet to Come by Michael Bublé [Call Me Irresponsible]
I Will by the Beatles [White Album]
Crazy Love by Michael Bublé [Crazy Love]
Let There Be Love by Nat King Cole [Music to Watch Girls Go By]
For Once in My Life by Michael Bublé [Sway]
The Man I Love, sung by Kate Bush [The Glory of Gershwin]
Crazy Little Thing Called Love by Michael Bublé [Sway]
Anyone at All by Carole King [You’ve Got Mail]
Hold On by Michael Bublé [Crazy Love]
Wives and Lovers by Jack Jones [More Music to Watch Girls Go By]
Wonderful Tonight by Michael Bublé [Call Me Irresponsible]
I Couldn’t Live Without Your Love by Petula Clark [More Music to Watch Girls Go By]
Baby (You’ve Got What It Takes) by Michael Bublé [Crazy Love]
Magic Moments by Perry Como [Music to Watch Girls Go By]
I’ve Got the World on a String by Michael Bublé [Call Me Irresponsible]
What a Wonderful World by Louis Armstrong [More Music to Watch Girls Go By]
The Way You Look Tonight by Michael Bublé [Sway]
It Ain’t Necessarily So, sung by Cher [The Glory of Gershwin]
I’ve Got You Under My Skin by Michael Bublé [It’s Time]
Somebody Loves Me, sung by Meat Loaf [The Glory of Gershwin]
All I Do Is Dream of You by Michael Bublé [Crazy Love]

and then, to mark the start of their honeymoon,

Circle of Life from The Lion King

http://blogs.technet.com/b/scvmm/archive/2011/09/08/now-available-the-release-candidate-for-system-center-virtual-machine-manager-2012.aspx

It has been interesting learning about VMM 2012 by using the beta VHD but it became frustrating recently when the provided copy of SQL Server expired. I didn’t have the mental energy to move the databases onto our production SQL Server so I’m glad that a refresh of the VHD is now out.

Evaluating VMM 2012 by using the VHD is, in my opinion, the simplest way to start playing around with VMM and learning what it can do. Download, attach to a virtual server and away you go!

It is also possible – and supported – to upgrade from VMM 2008 R2 SP1 to VMM 2012 RC and then to VMM 2012 RTM, so if you have an existing VMM 2008 R2 SP1 estate, you can upgrade to VMM 2012 RC safe in the knowledge that you’ll be able to upgrade to RTM when it arrives.

Speaking of which, I wonder when it will arrive? Are the various System Center products going to be released independently or in one big hit? If the latter, I suspect we may be waiting a while because I think VMM is the first Release Candidate … DPM has only recently hit beta!

I can’t see any support listed for Linux, though, which is a shame given that RHEL, amongst others, are supposed to be supported guests of Hyper-V.

However, if you then statically assign an IPv6 address to a server, for example, you end up with two IPv6 addresses … which seems to me to be very messy. Deleting the dynamically assigned address seems to be pretty difficult … you can delete the DNS entry to try to stop other systems using it, but the DNS entry will come back.

The answer lies with netsh. All you need to do is run this command:

netsh interface ipv6 set interface <x> routerdiscovery=disabled

where <x> is the index for the interface. This can easily be found with the command:

netsh interface ipv6 show interface

This will stop the server from listening for those Router Advertisements and automatically remove the dynamic address.

The goal of the HA feature in VMM is to ensure that a VM can recover from failure, e.g. the failure of a host, and to ensure that a VM can easily be migrated. Over and above the capabilities of HA in previous versions of VMM, VMM 2010 adds the ability to create & delete clusters, manage clusters in untrusted domains, have a non-HA VM on a cluster and have VMM Server itself HA. VMM 2012 also adds the functionality manage Citrix XenServer (over the already existing functionality to manage VMware).

Update management is a new feature of VMM 2012 and aims to keep Windows fabric servers up to date. The reason why this has been added to VMM is to enable management of the complete fabric from a single pane of glass – and that includes all aspects of the server fabric lifecycle.

The feature requires a pre-existing, dedicated, root WSUS 3.0 SP2 64 bit server. If the WSUS server is remote, the WSUS console is required on the VMM server. It supports WSUS in SSL mode.

VMM gets a catalog of updates from the update server. It points the fabric servers to the correct update server, i.e. configures the WUA agent on each fabric server.

A baseline is then created. The baseline is a logical grouping of updates to assess compliance. VMM provides two sample baselines for Security and Critical updates. You can assign the baseline to hosts, host groups and host clusters, plus VMM server roles (library server, PXE server, Update server and VMM server). You cannot assign it to VMs (running or stored) or VHDs in the library.

A scan is then conducted to see if the server is compliant or not for the assigned baseline. VMM leverages WUA for applicability and compliance. Scan is on demand and automatable using PowerShell. VMM then makes the server compliant by installing missing updates. Update installation progress can be tracked in the VMM console and remediation is on demand and automatable using PowerShell.

There is an orchestrated workflow for remediating a Hyper-V cluster whereby each node in turn is put into maintenance mode, evacuating the node using Live Migration, install the missing updates based on baselines assigned, take the node out of maintenance mode, go to the next node and repeat. It supports Windows Server 2008 as well as R2 clusters and is automatable using PowerShell.

Dynamic Optimization is another new feature of VMM 2012. It keeps a cluster balanced for resource usage; Live Migration avoids VM downtime and the feature does not require Operations Manager. It supports Hyper-V, VMware and Citrix XenServer clusters.

DO has two modes – manual and automatic, with the default being manual. The feature optimises for CPU, memory, Disk I/O and Network I/O. It optimises when resource usage goes above the DO threshold. There is a configurable level of aggressiveness … more aggressive = more migrations = more balanced. The default is least aggressive.

There is also Power Optimisation, which extends DO and can only be enabled if DO is in automatic mode. It optimises for the same resources as in DO and optimises when resource usage goes below PO threshold. What PO does is powers off and on the physical hosts when it can move guests elsewhere. It evacuates a host before powering off and ensures that evacuation will not cause other nodes to go above the DO threshold, or that powering off will not violate cluster quorum requirements. It leverages out-of-band management for power off/on.

I need to follow up with Microsoft on the cluster quorum requirements because as I understand it, an even-node cluster requires a file share witness, whilst an odd-node cluster doesn’t … so if you turn off any node in a cluster, you are changing the quorum requirements!

That said, VMM is not a storage resource manager. There is no value in trying to replace partner specific tools, it is not possible to keep up with new capabilities and to attempt to be an SRM product would mean that VMM would not ship on time!

What this functionality offers the administrator is the ability to control what host groups can access in terms of available storage logical units and available storage pools.

The standard used by VMM is SMI-S and the four companies announced as supported so far are EMC, HP, HDS and NetApp.

There is support for VDS but it is largely deprecated with the future focus being on SMI-S.

For me, this presents quite a challenge if I want to use VMM to manage the storage used with the VMs because I’ve now go to make sure that the storage is “compatible” with VMM. No real news about Dell, which is my preferred supplier, which makes things extra tricky. It may be that I’ll have to stick with something like Dell’s MD3000i array which supports VDS and wait a few years until there is more clarity around SMI-S and VMM’s storage capability, and change to an SMI-S array at that time.

Having said all of that, it looks like it might be possible to get hold of an SMI-S provider for Dell’s MD arrays – both iSCSI and DAS!

http://www1.euro.dell.com/content/topics/topic.aspx/global/shared/services/en/smi_form?c

… however, that appears to be for an early version of the software that Dell were working on. There seems to be a newer version from what I can gather in a manual I found:

http://support.dell.com/support/edocs/systems/RBOD_com/SMIS/SMIS.pdf

but I haven’t been able to find the corresponding download. I am encouraged, though, that it should be technically feasible to control a Dell MD array from VMM 2012 so the hunt continues!

• VMM Admin
• Scope: Entire system
• Can take any action
• Can use Administrator console or PowerShell
• Delegated Admin
• Scope: host groups and clouds
• Set up fabric by configuring hosts, networking and storage
• Create cloud from physical capacity
• Assign cloud to self-service users
• Can use Administrator console or PowerShell
• Self-Service User
• Scope: clouds only
• Author templates
• Deploy/manage VMs and Services
• Share resources
• Revocable actions
• Quota as a shared and per-user limit
• Can use Administrator console, PowerShell and Self-service portal
• Read-only Administrator
• Scope: host groups and clouds
• No actions

Network Fabric Management

• Define logical networks using VLANs and Subnets per datacentre location
• Address management for static IPs, Load Balancer VIPs and MAC addresses
• Automated provisioning of Load Balancers

A logical network is the abstraction of the physical network infrastructure, which allows you to model the network based on business needs. You can use them to describe networks for different purposes, e.g. traffic isolation, provision network for different SLAs.

It can span host groups in different locations with different IP subnets or VLANs. For each IP subnet/VLAN, it is possible to define IP pools of addresses to be used by VMM. Pools can contain IPv4 addresses or IPv6 addresses but not both.

An IP pool consists of a range of addresses, which is then described in terms of static IPs, reserved IPs and virtual IPs. Once the pool is defined, when a new VM is created, an IP address is checked-out. When the VM is deleted or migrated, the IP address is checked-in.

The virtual IPs are used for load balancers; they are similarly checked out from the IP Pool. Adding a load balancer to VMM requires a PowerShell provider. Once the provider has been added, a load balancer is defined through its connection properties and the connection validated. A VIP template is then defined in terms of the protocol, LB method, persistency and health monitors. There is support for f5, Citrix and Brocade, along with Microsoft’s NLB. There will also be a published interface if you want to develop your own PowerShell provider .

VMM also supports MAC Address Pool management. You define the MAC range, associate it to a host group and then, when a VM is created, a MAC address is checked out and when the VM is deleted, the MAC address is checked in.

The Windows Team recently shared that if you use this feature with a WordPress blog, you really get some great benefit and the thing about WordPress is that there are over 20 million sites that immediately gain this benefit.

So what does it give you? Well, here is the jump list for my blog, pinned to the task bar:

So, at the top, you get the 5 most recent posts followed by a set of tasks that are most useful to the blog owner.

If you enjoy reading this blog, please consider pinning it to your taskbar. Alternatively, you can now subscribe to the blog by email – there is a Sign me up! button on the right hand side of the page, at the top. You’ll then get notifications of new posts by email. Alternatively, there is the good old RSS Feed, which is on the page just a bit higher than the Email Subscription feature.

Thanks for reading.

The company I work for has perhaps a slightly unusual network configuration in that both the DMZ and Internal networks use public IP addresses. This was done before I joined them . I’ve recently introduced private IP addresses to augment the number of addresses available to us but my initial implementation had both NICs on the DA server using public IP addresses.

That seems to be a configuration that Direct Access can’t handle although you won’t see any errors. The upshot of this configuration is that the 6to4 adapter on the DA server, which is used to tunnel traffic from clients with public IPv4 addresses, had three IPv6 addresses instead of two. The two you would expect to see map onto the two public IPv4 addresses used on the external NIC.

This was diagnosed by performing network captures on the client whilst trying to ping some IPv6 addresses on the internal network. If you are trying to do DirectAccess network troubleshooting, I would strongly recommend the use of Microsoft’s Network Monitor tool, even instead of other popular tools such as WireShark. One of the reasons I make this recommendation is because Network Monitor will capture traffic going through tunnel adapters such as the 6to4 adapter, whereas WireShark seems to be only able to capture traffic going through physical adapters.

When you do a packet capture on a DA client, you’ll see both the IPv4 and IPv6 traffic. What happens is that the client will wrap the IPv6 PING into an IPv4 packet, pass it across to the DA server where it then gets unpacked and the IPv6 packet sent out.

What I was seeing was that instead of the wrapped up packets going to the external IPv6 address of the DA server, they were going to the internal IPv6 address … which clearly wasn’t going to work because the internal interface isn’t reachable from outside. To solve that particular issue, I had to reconfigure the DA server’s internal NIC to use a private IP address. That stopped an address being created on the 6to4 adapter for it and that allowed the tunnelled traffic to be sent consistently to the correct destination.

The next problem I faced was that the IKE tunnel wasn’t being set up. IKE failure is typically due to certificate problems. There is a good document called DirectAccess Client Cannot Establish Tunnels to the DirectAccess Server that says:

If the DirectAccess client computer cannot establish the main and quick mode SAs for the infrastructure tunnel using the default connection security rules created by the DirectAccess Setup Wizard, the most likely problem is a certificate authentication failure. For more information, see the “IKE certificate selection process” and “IKE certificate acceptance process” sections of Public Key Certificate.

Under “IKE certificate selection process”, the document says:

IKE searches the computer store for an IPSec certificate that chains to any of the trusted CA roots identified in step 1. An IPSec certificate contains an Enhanced Key Usage (EKU) attribute with a value equal to the IP security IKE intermediate object identifier (OID) 1.3.6.1.5.5.8.2.2.

Ah, I thought! I’ve only installed a certificate with the Server Authentication OID, not the IPSec IKE intermediate OID. So, I removed that cert, installed a cert with both OIDs and tried again. Things got further … when I tried to ping an internal IPv6 address, there were AuthIP packets being exchanged but the tunnel wasn’t being established and I couldn’t see why. This proved to be a harder issue to troubleshoot so I want to share the two tools I used that ultimately got me to the right answer.

The first tool is netsh, which provides network tracing functionality at a level better than Network Monitor. As an administrator, you run:

netsh trace start scenario=directaccess capture=yes report=yes

then you reproduce the problem and then you run:

netsh trace stop

This captures all of the network traffic into an ETL file which can be opened in Network Monitor. This revealed that the AuthIP traffic was failing because of the error “authentication credentials are unacceptable”. So this was still suggesting a problem with the certificates, but what?

Enter the second troubleshooting tool – event logging for CAPI2. CAPI2 is the part of the OS that deals with certificates. It is very straightforward to turn on event logging for CAPI2. Once you’ve done that, you again reproduce the problem and then look at the event log to see what is being shown.

In my case, the CAPI2 logging showed that the client goes through a process of checking that the server’s certificate has an Enhanced Key Usage of … Client Authentication. NOT, as the TechNet article said, IPSec IKE intermediate.

Again replacing the certificate on the server, this time with a cert for client and server authentication, and the tunnel is now getting established!

In part 2, I covered the steps required in VMM to initiate a bare metal deployment. The following screenshots show what happens on the bare metal server once VMM has kicked off the job.

So the first thing that the host does is a PXE boot. Once that is successful (and you may need to review this post), the host starts to transfer the boot file from the WDS server:

This allows the server to boot into WinPE:

and the VMM bare metal deployment starts:

The principle behind bare metal deployment is that VMM actually deploys a VHD rather than installing the OS onto the raw hard drive.

Once that is done, there is a customisation stage:

and the enabling of the Hyper-V role:

(Remember that this is the bare metal deployment of a new Hyper-V host because this is VMM doing this)

The install then cleans up …

and the host reboots. Although the host is configured to try PXE booting first, the WDS server refuses the PXE boot so the hardware then continues to boot to the hard drive.

From here on, it is a standard OS installation.

One more reboot …

.. and the server finally finishes with a complete installation of Windows Server 2008 R2 SP1 and, in my case, ready joined to the domain.

Very painless and very fast – the above deployment took about 30 minutes.

One of the screens in the WDS configuration wizard is the PXE server initial settings:

In the blog posting, I said to leave that setting as “Do not respond to any client computers”. I said this because I was under the impression that the provider that VMM installs onto the WDS server would cause WDS to behave in the way it needs to behave for VMM.

That is not the case.

Indeed, it seems that setting the option to the middle choice – respond only to known client computers – is not the correct option either despite the fact that Microsoft explained that when the bare metal server does a boot from PXE, the PXE server talks to VMM to authorise the PXE boot.

In testing, it looks like the only way WDS will respond is if you set the option to the last choice – respond to all client computers (known and unknown). For my testing, I also selected the checkbox: require administrator approval for unknown computers. That way, you won’t suddenly get a bunch of systems trying to boot off your WDS server!

The setting can be changed retrospectively from the WDS console by right-clicking on the server, choosing Properties and then selecting the PXE Response tab:

I’ll post a separate blog showing the various stages that a bare metal server goes through as the deployment proceeds but hopefully the above change will get everything going for you.