Create Azure Site-to-Site VPN Solution using Cisco Pix 501

    Windows Azure contains configuration Sample for Cisco ASA and Juniper Firewall to Create A Site-to-Site VPN Solution , In my Case I only Have Cisco PIX 501 and I needed to build this VPN Solution . It toke me Some time figuring out how to Do the configuration on PIX. :-)

    In this Article I’m building a solution that span Azure Network , where some VMS are on Azure and other on local Network , below Steps that I have made for this configuration:

    Create Storage Account to Store you VM Vhd files , creating a storage Account helps assign a meaningful name to the storage location and selecting MS Data Center that will host your VHD and VM files. Select the Storage icon form the right Site then click create A Storage Account

    clip_image001

Name your storage Account and Location , if you have multiple subscriptions you can choose the one you want to use , also you can Enable Geo-replication If needed. (don’t Do it for SQL VMS)

    clip_image002

Create affinity groups to Keep VMs in the Same Group

    clip_image003

Create local network , You will need to add your Firewall External Adapter Public IP address to act as VPN Gateway

    image

Add Local Network IP address range this Defines the IP address range at your on-primes Network

    clip_image005

Register Local DNS Server

    clip_image006

Create Virtual Network

    clip_image007

Select your DNS Server , Local network and Configure Site-to-Site VPN

    clip_image008

Define Azure VMs networks and Azure gateway Network

    clip_image009

Create static routing Gateway

    clip_image010

Confirm Gateway Creation , it take 15 Minute to create Gateway

    clip_image011

    Confirm gateway creation , you will need the public IP address assigned by Azure for PIX Configuration

    image

Copy The Shared key by clicking manage Key

    clip_image013

Configure the Cisco PIX Firewall

    object-group network RP_AzureNetwork

    network-object 172.16.0.0 255.240.0.0

    object-group network RP_OnPremiseNetwork

    network-object 192.168.0.0 255.255.0.0

    access-list 10 permit ip object-group RP_OnPremiseNetwork object-group RP_AzureNetwork

    nat (inside) 0 access-list 10

    sysopt connection tcpmss 1350

    sysopt connection permit-ipsec

    crypto ipsec transform-set RPAzure esp-aes-256 esp-sha-hmac

    crypto ipsec security-association lifetime seconds 3600 kilobytes 102400000

    crypto map RP_Azmap 20 ipsec-isakmp

    crypto map RP_Azmap 20 match address 10

    crypto map RP_Azmap 20 set peer 137.Azure.Public.IP

    crypto map RP_Azmap 20 set transform-set RPAzure

    crypto map RP_Azmap interface outside

    isakmp enable outside

    isakmp key ******** address 137.Azure.Public.IP netmask 255.255.255.255

    isakmp policy 20 authentication pre-share

    isakmp policy 20 encryption aes-256

    isakmp policy 20 hash sha

    isakmp policy 20 group 2

    isakmp policy 20 lifetime 28800

Confirm VPN Connection Status

    clip_image014

    Done your Now connected to Azure

Posted in Azure, Private cloud, Tips | Tagged , , , , | Leave a comment

MS Jordan Partners Sales training

MS Jordan conducted sales training event for partners ,  at LeRoyal hotel – 50 people from SMB and Solutions partners in  M&V attended the Event 12/6/2013.

The event covered the following topics:

  • The Enovation in Windows server and System Center – Ready for Hybrid Cloud
  • Microsoft Partner Network – How to get the max in M&V
  • Compete with VMWARE
  • Tools to help you
  • Comparison slides How VDI/VDA and application Virtualization help us to sell
  • Designing and generating the correct Bill of SKUs for the Data Center
  • Q&A

where I have presented two sessions :

blog

Windows Server R2 adding more features to existing
Compete with VMWARE  o Tools to help you  o Comparison slides
Posted in events | Tagged | Leave a comment

Things to consider for Live Migration

  • Live Migration will migrate VHD files that are Directly attached to IDE or SCSI adapters , VMs that use differencing Disk cannot participate in Share Nothing Live Migration , as only differencing disks is directly attached to the IDE or SCSI adapter so the parent VHD can’t be moved which cause VM move to fail between hosts.
  • Live Migration (Running Machines) is Not Supported between hosts that use CPU from Different Venders Intel and AMD, you can migrate VM only between Hosts that use the Same Processor Vender.
  • To live Migrate VM between Host that use different Processor Family from the Same Vender Intel or AMD , processor compatibility mode must be enabled form VM to successfully be life migrated
  • Unified Virtual switches names are recommend to use otherwise Hyper-v will ask for new network switch name
Posted in Hyper-v, Tips, Windows 2012 | Tagged | Leave a comment

Installing Hyper-v inmon Switch Extensions

Hyper-v Switch Extensions are software packages created by Microsoft partners to extend the functionality of Hyper-v switch. Developed by InMon, sFlow is the leading, multi-vendor, standard for monitoring high-speed switched and routed networks. Sflow hyper-v Switch extension is monitoring solution that extend hyper-v switch traffic monitoring. The Sflow agent is free product that downloadable from inmon web site http://www.inmon.com . The agent is installed on Hyper-v hosts. sFlowTrend™ is a free, graphical network and server monitoring tool. sFlowTrend makes use of the popular sFlow® standard to generate real-time displays of the top users and applications making use of network bandwidth. SflowTrend is built using Java and require Java VM to run.

Install Inmon Hyper-v switch Extensions:

1. Install Java

2. Download and install Inmon Agent Double Click the hsflowd-win-1.22.2-x64 windows installation package file to install Slfow Switch extension

3. In the welcome to the sflow agent setup Wizard  click Next

clip_image001

 

4. Accept the Sflow License Agreement and click next

clip_image002

5. Click next to accept the default installation folder location

clip_image003

 

6. Deselect the Configure using DNS-SD check box option and click Next

clip_image004

 

7. In the ready to install screen click install button.

clip_image005

 

8. The progress installation screen will appear and after installation is completed click Finish.

Enable Sflow Hyper-v Switch Extensions:

1. Lunch Hyper-v Manager console

2. From the action panel click the Virtual Network Manager

3. Select the External Switch from list of switches

4. Expand the Extensions node under Switch name

5. From Switch Extensions list , Enable the Sflow traffic monitoring Switch Extensions

clip_image007

6. Click OK, then Click yes to confirm the enable action.

Install SflowTrend Console

1. Download SflowTrend  

2. Double Click the sFlowTrend.jnlp Java(TM) Web Start Launcher which will download Sflow Trend application

clip_image008

3. In Confirm run application click yes to run Sflow trend

clip_image009

 

4. The Sflowtrend console will open , keep it running and check the console of time to time , to check VMs traffic information

clip_image011

Posted in Hyper-v, Networking, Private cloud, Windows 2012 | Tagged | 2 Comments

Features Removed or Deprecated in Windows Server 2012 R2 Preview

 

The new Widows 2012 R2 has some features that has been removed check out before you start deploying it , things to consider:

1. Nor More Windows Server 2003 domain and functional levels of Active Directory

2. SMN 1.0 is removed people with XP and 2003 , be extra careful with File sharing  

3. No More IIS 6.0 manager

4. No more telnet Server

5. Windows Authorization Manager (AzMan) has been removed , Hyper-v Deployments with Authorization customization need to consider this

 

http://technet.microsoft.com/en-us/library/dn303411.aspx

Posted in Windows 2012 | Tagged | Leave a comment

Apply logical Switch to Hyper-v Host Fail

when you try to apply a logical switch to Hyper-v Host , you might get an SCVMM error like the one below :

Error (2915)
The Windows Remote Management (WS-Management) service cannot process the request. The object was not found on the server (win12-hv.jitpros.local).

WinRM: URL: [http://schemas.microsoft.com/wbem/wsman/1/wmi/root/virtualization/v2/Scvmm_VirtualEthernetSwitchInternalSettingData?InstanceID=Microsoft:Definition\8b54c928-eb03-4aff-8039-99171dd900ff\Default]

Unknown error (0×80338000)

Recommended Action
Ensure that the VMM agent is installed and running. If the error persists, restart the virtualization server (win12-hv.jitpros.local) and then try the operation again.

This error can also happen due to an older version of the VMM agent on the virtualization server. Ensure that the VMM agent is upgraded to the latest version, and then try the operation again.

To resolve this try this solution :

1. Use Physical Adapter to manage Hyper-v Host , if your Physical Adapter  has a Virtual Switch the addition would fail .

2. Disable IP 4 and IP 6 on Team adapters (if your DHCP provide a DNS configuration that are different than your management DNS configuration )

Posted in Hyper-v, VMM2012, Windows 2012 | Tagged , , | 2 Comments

Windows 2012 Hyper-v 3.0 Network Virtualization

This Blog post was inspired by a set of blog post by BrianEh at his blog http://ITProctology.blogspot.com  in effort to better understand Windows 2012 Virtualization.

A new feature in Hyper-v 3.0 is network virtualization which allow hosting providers to host VMs from different customer that can have the same IP address schema without the need to change their IP address or facing any IP conflict errors. Hyper-v provide two method to achieve this :

  • IP packet encapsulation protocol Generic Routing Encapsulation (GRE), that encapsulate VM traffic into hyper-v traffic and use the host IP to deliver the encapsulated traffic to its destination hosting hyper-v.
  • IP Rewrite : is Kind of Static Nat configuration where each VM IP address get rewritten using physical  IP address before it is transferred on the physical network.

The example below use GRE ,The following description was take form Simple Hyper-V Network Virtualization Script with Gateway

“Hyper-V Network Virtualization (WNV) virtualizes the VM networks by:
1. Associating each VM IP address (Customer Address, CA) with a corresponding physical IP address used on the actual packets on the wire (PA)

2. (Provider Address,PA). Each VM packet is transformed (rewritten or encapsulated) from a CA  packet to PA packet before the packet is transmitted onto the physical  network.

3.On the destination host, the packet is transformed back with matching rules from PA packet to CA packet before it is delivered to the destination VM.

The WNV module operates on the packets based on the virtualization policy rules provisioned from management servers such as SCVMM (System Center Virtual Machine Manager). These policy rules define the mapping of CA:PA for each VM, the corresponding virtualization mechanism (rewrite/encap), and which customer virtual subnet these rules are for. Additionally, the virtualization rules also defines routing topology between customer virtual  subnets, and between WNV virtual subnets and non-WNV networks (cross premise, virtual-to-physical resources, etc.) “

its So lets see the below Scenario where we will host two VMs for two different customers on the same Host using the same IP address.I used BLACK font for host1 configuration , RED for host 2 configuration and Blue for PowerShell output

The steps to enable and configure network virtualization:

1. Assign VMs to a Virtual network id

2. Enable network Virtualization

3. Assign Provider IPs

4. Create Domain and Define Customer Routes

5. Build Lookup table (Routing table) 

Win2k12Virt

1. Assign VMs to a Virtual network id 

To Start lets  Setup CustomerA-VM1 and CustomerB-VM1 on Host1 connecting them to the external Switch , if you assign IP address  to these Two Machines you would end with IP Conflict error on one these machines. An IPconfig/all would show this :

image

now you can solve this by assigning each VM to different VLAN , but you can only use maximum of 4,096 also , you would need to configure your switch for VLAN Tagging. Hyper-v 3.0 remove this limitation using network Virtualization .

So lets First Solve this issue at the level of single host , using the Get-VMNetworkAdapter PowerShell command , we can look at the IPs assigned to these two machines , in the output below note that  CustomerB-VM1 has two IP address one of them is APIPA address due to Address conflict

Get-VMNetworkAdapter cu*

Name            IsManagementOs VMName        SwitchName         MacAddress   Status IPAddresses
—-            ————– ——        ———-         ———-   —— ———–
Network Adapter False          CustomerB-VM1 LAN Virtual Switch 00155DFA9905 {Ok}   {192.168.50.1, 169.254.97.103, f…
Network Adapter False          CustomerA-VM1 LAN Virtual Switch 00155DFA9904 {Ok}   {192.168.50.1, fe80::2c30:3b37:8…

So to solve this Problem  assign each machine to a different Virtual LAN using the  Set-VMNetworkAdapter  commandlet , we will assign Customer A the VLAN ID 445566 and Customer B the VLAN ID  7788990 , you can notice that we have passed the 4096 limitation of the IEEE 802.1Q limitation . On Host1 Open PowerShell command prompt :

Get-VMNetworkAdapter customerA-vm1 | Set-VMNetworkAdapter -VirtualSubnetId 445566

Get-VMNetworkAdapter customerb-vm1 | Set-VMNetworkAdapter -VirtualSubnetId 7788990

you can now go and disable and re-enable Network adapter at CustomerB-VM1 and see that your IP address conflict have been cleared . you can check this again by reissuing the command:

Get-VMNetworkAdapter cu*

Name            IsManagementOs VMName        SwitchName         MacAddress   Status IPAddresses
—-            ————– ——        ———-         ———-   —— ———–
Network Adapter False          CustomerB-VM1 LAN Virtual Switch 00155DFA9905 {Ok}   {192.168.50.1, fe80::857b:2c47:a…
Network Adapter False          CustomerA-VM1 LAN Virtual Switch 00155DFA9904 {Ok}   {192.168.50.1, fe80::2c30:3b37:8…

Even Without enable network Virtualization on the host we where able to solve this conflict and by pass the VLAN Limitation problem. the same command need to be applied to VMs on Host2.

Get-VMNetworkAdapter customerA-vm2 | Set-VMNetworkAdapter -VirtualSubnetId 445566

Get-VMNetworkAdapter customerb-vm2 | Set-VMNetworkAdapter -VirtualSubnetId 7788990

2. Enable network Virtualization

But  VMs on different hosts will not be able to communicate with each other until we enable the Hyper-v network Virtualization part , also notice that these assigned   VLANS will not show in the Hyper-v GUI , to see to which VLAN each machine is assigned use the command :

Get-VMNetworkAdapter * | Format-Table VMName, Name, MACAddress, VirtualSubnetID, IPAddresses -AutoSize

VMName                 Name                            MacAddress   VirtualSubnetId IPAddresses
——                         —-                               ———-   ————— ———–
SQL2012-161            Network Adapter 00155DFA9900               0     {192.168.250.161}
SQL2008-160          Network Adapter 00155DFA9903               0      {192.168.250.160}
SCVMM-162             Network Adapter 00155DFA9902               0      {192.168.250.162}
SCSMMGM-164      Network Adapter 00155DFA9908               0       {192.168.250.164}
SCSMDW-165          Network Adapter 00155DFA9907               0       {192.168.250.165}
SCOM-163               Network Adapter 00155DFA9906               0        {192.168.250.163}
CustomerB-VM1     Network Adapter 00155DFA9905         7788990 {192.168.50.1}
CustomerA-VM1     Network Adapter 00155DFA9904          445566 {192.168.50.1}
APPController-167 Network Adapter 00155D0F2724               0 {}

Note: you can reset your VLAN Assignment by assigning the machine to VLAN 0.

so to use Windows Network Virtualization we need to  Enable the WNV binding on each host external switch that network traffic pass through.

use the command  Get-VMSwitch -SwitchType External to get a list of the external switches

Get-VMSwitch -SwitchType External

Name               SwitchType NetAdapterInterfaceDescription
—-               ———- ——————————
LAN Virtual Switch External   Intel(R) 82579LM Gigabit Network Connection

To Enable the WNV binding use:

Enable-NetAdapterBinding -InterfaceDescription “Intel(R) 82579LM Gigabit Network Connection” -ComponentID “ms_netwnv”

to check  ms_netwnv Use the command:

Get-NetAdapterBinding -ComponentID ms_netwnv

On Host2 we issue the same command to Enable MS Network virtualization:

Enable-NetAdapterBinding -InterfaceDescription “Realtek PCIe GBE Family Controller” -ComponentID “ms_netwnv

3. Assign Provider IPs

Now we need to define the Provider Address at local host:

Get-NetAdapter –InterfaceDescription “Intel(R) 82579LM Gigabit Network Connection”

Name                      InterfaceDescription                    ifIndex Status       MacAddress             LinkSpeed
—-                      ——————–                    ——- ——       ———-             ———
Ethernet                  Intel(R) 82579LM Gigabit Network Con…      12 Up           38-60-77-CD-80-1E         1 Gbps

New-NetVirtualizationProviderAddress -InterfaceIndex 12 –ProviderAddress 192.168.250.153 -PrefixLength 24

ProviderAddress : 192.168.250.153
InterfaceIndex  : 12
PrefixLength    : 24
VlanID          : 0
AddressState    : Preferred

The Same on Host 2:

New-NetVirtualizationProviderAddress -InterfaceIndex 13 –ProviderAddress 192.168.250.166 -PrefixLength 24

ProviderAddress : 192.168.250.166
InterfaceIndex  : 13
PrefixLength    : 24
VlanID          : 0
AddressState    : Preferred

4. Create Domain and Define Customer Routes

For Hyper-v Hosts to understand that traffic from VMs belong to the same Customer and to provide isolation between customers traffic Hyper-v provide what called routing domain , you can think of routing domains as a physical switch where all customer VLANS live. The Routing domain is built using GUID , so to create to new routing domains use the following:

$CustAGUID = [system.guid]::newguid()
$CustBGUID = [system.guid]::newguid()

# Format the GUID string properly
$CustAGUID = “{” + [string]$CustAGUID + “}”
$CustBGUID = “{” + [string]$CustBGUID + “}”

we will Define a Customer Route for each customer so on host 1:

New-NetVirtualizationCustomerRoute -RoutingDomainID $CustAGUID  -VirtualSubnetID 445566 -DestinationPrefix “192.168.50.0/24“ -NextHop 0.0.0.0 -Metric 255
New-NetVirtualizationCustomerRoute -RoutingDomainID $CustBGUID -VirtualSubnetID 7788990 -DestinationPrefix “192.168.50.0/24“ -NextHop 0.0.0.0 -Metric 255

RESULT Should Show:

RoutingDomainID   : {0501F8D4-3C91-4566-B74B-6C1CAC82C6F7}
VirtualSubnetID   : 7788990
DestinationPrefix : 192.168.50.0/24
NextHop           : 0.0.0.0
Metric            : 255

RoutingDomainID   : {1ABB06F2-CE16-4125-A7E6-510A1B7273DD}
VirtualSubnetID   : 445566
DestinationPrefix : 192.168.50.0/24
NextHop           : 0.0.0.0
Metric            : 255

on Host2:

$CustAGUID=”{1ABB06F2-CE16-4125-A7E6-510A1B7273DD}”
$CustBGUID=”{0501F8D4-3C91-4566-B74B-6C1CAC82C6F7}”

New-NetVirtualizationCustomerRoute -RoutingDomainID $CustAGUID  -VirtualSubnetID 445566 -DestinationPrefix “192.168.50.0/24“ -NextHop 0.0.0.0 -Metric 255
New-NetVirtualizationCustomerRoute -RoutingDomainID $CustBGUID -VirtualSubnetID 7788990 -DestinationPrefix “192.168.50.0/24“ -NextHop 0.0.0.0 -Metric 255

RESULT Should Show:

RoutingDomainID   : {0501F8D4-3C91-4566-B74B-6C1CAC82C6F7}
VirtualSubnetID   : 7788990
DestinationPrefix : 192.168.50.0/24
NextHop           : 0.0.0.0
Metric            : 255

RoutingDomainID   : {1ABB06F2-CE16-4125-A7E6-510A1B7273DD}
VirtualSubnetID   : 445566
DestinationPrefix : 192.168.50.0/24
NextHop           : 0.0.0.0
Metric            : 255

5. Build Lookup table (Routing table) 
The Routing table need to be constructed on both hosts:

$CustAGUID=”{1ABB06F2-CE16-4125-A7E6-510A1B7273DD}”
$CustBGUID=”{0501F8D4-3C91-4566-B74B-6C1CAC82C6F7}”

New-NetVirtualizationLookupRecord -VMName CustomerA-VM1 -VirtualSubnetID 445566 -CustomerAddress 192.168.50.1 -MACAddress 00155DFA9904 -ProviderAddress 192.168.250.153 -Rule TranslationMethodEncap -CustomerID $CustAGUID

New-NetVirtualizationLookupRecord -VMName CustomerA-VM2  -VirtualSubnetID 445566 -CustomerAddress 192.168.50.2 -MACAddress 00155DFAA600 -ProviderAddress 192.168.250.166 -Rule TranslationMethodEncap -CustomerID $CustAGUID

New-NetVirtualizationLookupRecord -VMName CustomerB-VM1 -VirtualSubnetID 7788990 -CustomerAddress 192.168.50.1 -MACAddress 00155DFA9905 -ProviderAddress 192.168.250.153 -Rule TranslationMethodEncap -CustomerID $CustBGUID
New-NetVirtualizationLookupRecord -VMName CustomerB-VM2 -VirtualSubnetID 7788990 -CustomerAddress 192.168.50.2 -MACAddress 00155DFAA601 -ProviderAddress 192.168.250.166 -Rule TranslationMethodEncap -CustomerID $CustBGUID

Managing such configuration for large number of VMs  and host would be a nightmare for administrators , SCVMM 2012 SP1 take care of all these configuration and updates to the lookup Records when machines move between hosts.

Windows Server® 2012 Hyper-V Network Virtualization Survival Guide

BrianEh I.T. Proctology blog

Posted in Hyper-v, Networking, Private cloud, Windows 2012 | Tagged , , , | 6 Comments