HeathReynolds.com

Working with NSX Distributed Firewall I needed a way to help me audit the impact of a proposed firewall rule on specific systems. In the physical firewall world I would normally create a rule for the traffic and allow it, but log the allow. As I dug into Syslog for the distributed firewall I discovered that firewall log messages are sent to the same Syslog collector as other ESXi messages, firewall messages can't be directed to a security specific syslog server. I honestly hadn't spent much time with Log Insight, but I knew we had the lab servers pointed to a Log Insight box so I began to dig around with it. I was honestly impressed with how intuitive and easy to use LogInsight is. The field extraction functionally of Interactive Analytics let's you quickly slice and dice massive amounts of log data exactly as you would like to see it, and I didn't have to learn another query language. Everything "Just Works" and I was able to isolate firewall logs down to s...

As I prepare to change jobs one of the things I will miss about my current employer is the LAB (capitalized because a lab this awesome deserves it). Nexus 7k, 6k, 5k, two UCS fabric, UCS blades, and UCS C460s all backed by a VNX plus whatever storage they are beta testing for EMC. I'll probably never be able to replicate the level of lab I had access to outside of VCE or Cisco, but I need some type of home lab to continue my work with VCAC, LogInsight, NSX and to continue preparing for my VCDX defense. Two 16GB MAC minis with a synology would make a nice, quiet, cool, power efficient homelab with high wife acceptance. Unfortunately I need more RAM than that, and the cost can get quite high. I looked into Intel NUCs and white boxes, but the best value for me turned out to be older Dell "cloud systems" boxes that are wholesaled on eBay. These boxes are a 2U chassis designed to house four individual servers allowing shared web-hosting companies to drive server densit...

As soon as I passed the VCAP5-DCA I scheduled the VCAP5-DCD exam. I scheduled the DCD exam for 30 days after the VCAP5-DCA exam. The registration process for the DCD exam is identical to the DCA exam. You need pre-approval from VMware and a registration code in order to register for the exam on the Pearson-Vue site. The exam is given at the "Pearson Professional" center which could impact exam scheduling. There are only a few Pearson Professional exam centers in each region, and they are quite busy with non-IT exams. I went into the exam without an expectation of passing. I was hoping for a passing score, but honestly I got burned by the DCA so bad I didn't expect to pass this. About half way through the exam I was feeling better, but I was still surprised with I clicked finish and got my score and passed. Unlike the DCA you get your score immediately when you finish the exam. Just like the DCA exam time management plays a big role in the DCD exam. This exam has mul...

I had trouble registering for the exam. The process is to request authorization from VMware, then once authorized register for the exam with Pearson Vue. My account got wonky and it took more phone calls that it should have to get registered for the exam.  The exam is only offered at Pearson "Professional" centers, so isn't offered at the normal IT training places that offer testing. In a metro of 1M people I probably have 8 testing centers where I could have taken the VCP, but only two that offer the VCAP. I registered for the March 18th, and the date snuck up on me really fast. Exam Day Experience I don't drink coffee, but on the morning of the exam I was careful with the Diet Coke. I didn't want to be bogged down from lack of caffeine, but I also didn't want to be jittery. The other consideration is that time is precious on this exam; If you have to take a bio break the clock is still running. I normally eat lunch early and my exam was schedule...

If you are studying for the VCAP5-DCA you definitely need a lab. If you are studying for the VCP probably need a lab unless you are in vCenter all day at work. Nested virtualization runs one hypervisor upon another; so a nested ESXi lab runs the ESXi hypervisor on another hypervisor like VMware Workstation. So why build a nested lab instead of a physical lab? Flexibility - A nested lab on workstation is going to provide more flexibility than a physical lab.  I have both, and I love having the ability to create another ESXi host in minutes by cloning it from a template. I can also turn off my 5.0 lab I am using to study for the VCAP5-DCA and turn on my 5.5 lab and show a coworker a new feature. Cost - The cost of a nested lab can be cheaper than the cost of a physical lab, especially if you have box that you can simply upgrade the RAM in. When building a computer to run a nested lab the cost could be similar or more than buying used servers from eBay, but the power consumption...

What is Multi-NIC vMotion? Multi-NIC vMotion allows you to send multiple vMotion streams (even when migrating a single virtual machine), and if configured properly provides a higher overall throughput to the vMotion process. The configuration is straightforward, the vMotion service is configured on multiple VMkernel adapters, and each VMkernel adapter is associated with a single physical interface. With multiple gigabit interfaces the throughput of the vMotion migration scales linearly with amount of adapters used, with 10G you will very likely hit some other performance barriers once you have more than two 10G interfaces involved.  This feature was added in ESXi 5.0 and remains mostly unchanged. In my experience it is not a heavily used feature, although I depend on it in our production environment and have been running it since early 2012 in 5.0 and now 5.5. Why do I need it? There are two scenarios where the available throughput for vMotion can come into play. The fir...

The other day I needed to remove three nexus 1000v distributed switches from one of our lab vCenter environments in order to prepare for NSX testing. Removing the Nexus 1000v should be a fairly straightforward process. In my case it seemed like the supervisor modules had become self aware and knew I was trying to kill them. The first step is to use the migration tool and migrate all virtual machine and VMkernel networking to a standard or VMware distributed switch. Once all VM and VMkernel networking is migrated the next task is to remove the hosts from the distributed switch object. Click Inventory , then Networking , and select the 1000v you wish to remove from the list of distributed switch objects. Click on the Hosts tab, right click on the host, and select Remove from vSphere Distributed Switch . Repeat for each host.

I've got a couple of devices at the house that don't have integrated wifi (Dish Hopper and Onkyo Receiver), but it would be nice to get them on the network. I can't fish Cat5 to the location easily and the wifi add-on adapters from Dish and Onkyo are expensive. My solution to this problem was to take my old Linksys WRT54GL running DD-WRT firmware and convert it from an AP to a wireless bridge that can connect these two wired devices to my home wireless (provided by my Asus RT-NSSU). This solution is free since I have the Linksys sitting around; I recently replaced it with the Asus. The first thing you need is an old wireless router (secondary router). I used a WRT54GL from linksys, an 802.11G box. There are several "aftermarket" software versions for these routers but I know this will work with DD-WRT. DD-WRT is easy to install and there is plenty of information to help you get it on your router if you are still running the stock software.  I needed to mak...