VIRTUALIZING MICROSOFT APPLICATIONS IN A MULTI-TENANCY ENVIRONMENT WITH VCE VBLOCK 1

Transcription

1 White Paper VIRTUALIZING MICROSOFT APPLICATIONS IN A MULTI-TENANCY ENVIRONMENT WITH VCE VBLOCK 1 A Detailed Review EMC SOLUTIONS GROUP Abstract This white paper presents a solution that can help a service provider or IT department segregate information, without the need for separate physical infrastructures or implementations. It uses VCE Vblock 1 to consolidate Tier 1 Microsoft applications and VMware vcloud Director with VMware vcenter Chargeback to enable a chargeback model for a multi-tenancy environment. February 2012

2 Copyright 2012 EMC Corporation. All Rights Reserved. EMC believes the information in this publication is accurate of its publication date. The information is subject to change without notice. The information in this publication is provided as is. EMC Corporation makes no representations or warranties of any kind with respect to the information in this publication, and specifically disclaims implied warranties of merchantability or fitness for a particular purpose. Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. For the most up-to-date listing of EMC product names, see EMC Corporation Trademarks on EMC.com. Vblock is a trademark of EMC Corporation in the United States. VMware, ESX, VMware vcenter, VMware vsphere, VMware vcloud Director, and VMware vshield, are registered trademarks or trademarks of VMware, Inc. in the United States and/or other jurisdictions. All other trademarks used herein are the property of their respective owners. Intel and Xeon are trademarks of Intel Corporation in the U.S. and/or other countries. Part Number H

3 Table of contents Executive summary... 6 Business case... 6 Solution overview... 6 Key benefits and considerations... 7 Introduction... 9 Purpose... 9 Scope... 9 Audience... 9 Terminology... 9 Technology overview Introduction to the components VCE Vblock EMC CLARiiON CX EMC Ionix Unified Infrastructure Manager Cisco Unified Computing System Manager VMware vcenter Server EMC Replication Manager VMware vcloud Director VMware vshield VMware vcenter Chargeback Microsoft Systems Center Operations Manager Microsoft Forefront Endpoint Protection Configuration Overview Design considerations Physical environment Hardware resources Software resources Environment profile Deployment Overview Vblock Authentication Advanced Management Pod UCS Manager Ionix UIM

4 vcenter Server vshield vcloud Director SCOM Forefront Replication Manager vcenter Chargeback Microsoft Exchange Server Overview Design Configuration Jetstress validation Microsoft SQL Server Overview Design Configuration Microsoft SharePoint Server Overview Design Test methodology Configuration Combined testing Overview Exchange 2010 Server Performance Test results SQL Server Performance Test results SharePoint Server Performance Test results Failure testing Overview Design Blade failure test scenario Switch failure test scenario

5 Test results Blade failure test scenario Impact on Exchange Impact on the SQL Server Impact on the SharePoint Server Switch failure test scenario Replication Manager testing Overview Design Configuration Test results vcenter Chargeback Overview Configuration Test results Conclusion Summary Findings References White papers Product documentation Other documentation

6 Executive summary Business case This solution provides a simplified architecture to host the infrastructure of two individual companies, ensuring that each company s information is fully separated from that of the other and cannot be accessed. The Virtual Computing Environment Company (VCE) Vblock 1 (Vblock) powered by the Intel Xeon processor is leveraged as the infrastructure, greatly simplifying the overall environment and reducing operational and management costs. For example, with added software products from EMC and VMware, usage of the environment can easily be tracked, simplifying chargeback as a result. The solution is designed in accordance with Microsoft application best practices and with customer service-level agreements (SLAs) in mind. From the service provider s perspective, allocated resources are based on the customer need and, if required, can be expanded. All customer applications are fully protected with EMC Replication Manager snapshots. As part of a multi-tenant environment, service providers need to provide secure separation between tenants. Secure separation involves the provisioning of a pool of shared resources so they are dedicated and available to a tenant for consumption. As additional tenants are added to the environment, the resources of existing tenants are untouched and the integrity of the applications, workloads, and data is uncompromised. Resources in the converged stack are presented to the tenant as a dedicated stack. Each tenant can have different amounts of processing capacity, storage allotment, and dedicated network resources. The design guidance and example solution provided in this white paper can be leveraged by service providers who are servicing separate customers or by companies whose IT organizations service different departments. For example, human resources (HR) and financial information is highly confidential within any organization and only available to members of those respective departments. The methodology provided can help a company to achieve this information separation without burdening its IT department with separate infrastructures, which means the environments remain simplified and overall costs are reduced. Solution overview This solution demonstrates the delivery of virtualized Microsoft applications in a multi-tenant environment, each with separate requirements for user profile and size where the physical infrastructures are shared across the Vblock. This solution outlines how to segregate companies or departments, such as HR and Finance, that handle sensitive or confidential information from other teams. There is a distinct need to isolate workloads and information to ensure they cannot be compromised or viewed by another company or another department within a company. This solution showcases a comprehensive design methodology that service providers or customers can use to create a scalable building block for their environments. In this case, the environment includes Microsoft Exchange Server, SharePoint Server, and SQL Server. The architecture includes cloud management elements, such as chargeback, and management to show how the Vblock platform can enable the consolidation of several Tier 1 Microsoft-based workloads. EMC Ionix Unified Infrastructure Manager (UIM) 2.0 is utilized for overall Vblock management. VMware vcloud Director, for virtual data center provisioning, integrated with VMware 6

7 vcenter Chargeback, is used to demonstrate granular usage reporting to enable a chargeback model for a multi-tenant deployment scenario. In the new cloud infrastructure, a service provider must support multi-tenant environments for customers while assuring the service levels agreed with the customer. Vblock 1 is a perfect solution for this type of situation because it allows virtual machines to be automatically allocated to the blades in a balanced way, using a distributed resource scheduler (DRS), while at the same time allowing complete separation of each organization s network and security infrastructure. Because vcenter Server is used with vcloud Director, the underlying hardware is invisible to the organization and vapps and virtual machines can be created on demand by each organization. VMware vshield then ensures that the networks used by the organization, and even between separate vapps, are inaccessible by any other networks. This separation guarantees complete network security even though the same hardware is being used. The service provider, therefore, only has to allocate resources to organizations who can then create their own infrastructure (vapps, virtual machines, and networks) without much intervention from the service provider. The service provider can use vcenter Chargeback to monitor and cost the organization s deployment, based on several cost models, and charge accordingly. Key benefits and considerations Organizations can decide to move their applications to the service provider s cloud at the pace that they are comfortable with, be that one virtual machine at a time, or all applications at once. This simplifies the deployment of private, public, and hybrid clouds for any organization and simplifies management of the system by the service provider. Excellent performance levels achieved during the combined testing of a twocustomer (medium and large) Microsoft application workload Easy-to-use, simple cloud management interface that service providers, IT departments, and their customers can utilize in a multi-tenancy environment using vcloud Director Sizing and performance for medium and large Exchange Server, SharePoint Server, and SQL Server virtual environments Minimal impact and no downtime during Vblock hardware failure simulation Results from two cost models allocation-based and utilization-based costing Protection of all three Microsoft applications within the two organizations through Replication Manager snapshots with minimal impact Table 1 describes some additional points for consideration. 7

8 Table 1. Considerations Multi-tenancy vcloud Director Authentication EMC Replication Manager Combined testing Hardware failure Vblock UIM Using Vblock 1 with Ionix UIM, vshield, and vcloud Director enables multi-tenant environments that are simple to deploy and use. A service provider must be aware of the order and necessity of allocating resources for the organization to be able to create vapps and virtual machines. Raw device mappings (RDMs) need to be created in vcenter Server because they cannot be added in vcloud Director. Domain controllers (DCs) for the organization s network must be outside the Vblock if network address translation (NAT) is used. Replication Manager does not support NAT so must be located in the organization s vapp. All applications performed well within both organizations and were run concurrently without performance degradation. The Vblock and VMware High Availability (HA) enables a quick recovery from blade failure without a major impact on the applications. Switch failure did not have any impact. For Cisco Unified Computing System (UCS), trunk VLANs must be added for each blade to be able to allow communication inside an organization network when using more than the external network. No more than eight blades can be provisioned at a time. Create a script to ensure that the HLUs are identical in all storage groups. Thick storage pools are not supported. 8

9 Introduction Purpose Scope Audience Terminology This white paper presents a solution that explores aspects of scalability and performance with a focus on cloud management with vcloud Director and vcenter Chargeback. It uses the Vblock 1 infrastructure package, which appeals to both the internal and external service provider and system integrator markets. The scope of this paper is to document: The deployment of Microsoft applications on Vblock 1 Performance and test results Multi-tenancy on Vblock 1 Application protection using Microsoft Forefront and Systems Center Operation Manager The protection of a multi-tenancy environment using EMC Replication Manager The impact of hardware failure on Vblock 1 and Microsoft applications The use of vcenter Chargeback to illustrate different usage costing models The intended audience for the white paper is: Customers EMC partners Internal EMC personnel This paper includes the following terminology. Table 2. Term AMP Terminology Description VCE Advanced Management Pod. DAG DC Disk transfers/sec DRS LUN NAT RAID RDM Database availability group. Domain controller. Disk transfers/sec is the rate of read and write operations on the disk. Distributed resource scheduler. Logical unit number. A unique identifier used to identify logical storage objects in a storage system. Network address translation. Redundant array of independent disks. Raw device mapping. 9

10 Term Throughput vapp VMDK VMFS Description The number of individual I/Os the storage system can process over time, which is measured in I/Os per second (IOPS). A logical entity composed of virtual machines and software applications that can be installed and managed as a unit. A vapp uses the industry standard Open Virtualization Format (OVF) to encapsulate the components of a multitier application, along with the operational policies and service levels associated with it. Virtual Machine Disk format. A VMDK file stores the contents of a virtual machine's hard disk drive. The file can be accessed in the same way as a physical hard disk. VMware virtual machine file system. 10

11 Technology overview Introduction to the components This solution provides a comprehensive design methodology aimed at helping service providers to create a scalable building block for their customers, including Microsoft Exchange Server 2010, SharePoint Server 2010, and SQL Server. The solution simulates a multi-tenant scenario by demonstrating two distinct customer environments ACME (large) and OMZE (medium) each with separate requirements for user profile and size, where the physical infrastructures are shared across the Vblock. The following components are used in this solution: VCE Vblock 1 EMC CLARiiON CX4-960 EMC Ionix Unified Infrastructure Manager Cisco Unified Computing System VMware vcenter Server EMC Replication Manager VMware vcloud Director VMware vshield VMware vcenter Chargeback Microsoft Systems Center Operation Manager Microsoft Forefront Endpoint Protection 2010 VCE Vblock 1 With Vblock Infrastructure Platforms, VCE delivered the industry s first completely integrated IT offering that combines best-in-class virtualization, networking, computing, storage, security, and management technologies with end-to-end vendor accountability. This converged infrastructure enables rapid virtualization deployment, so customers quickly see a return on investment (ROI). Vblock Infrastructure Packages offer varying storage capacities and processing and network performance, and they support such incremental capabilities as enhanced security and business continuity. Three Vblock Infrastructure Platforms are offered: Vblock 1 is used in this solution. Vblock 1: Is designed for large sizes and numbers of virtual machines in a compact footprint, supporting midsized configurations that deliver a broad range of IT capabilities to organizations of all sizes Consists of the Cisco Unified Computing System, EMC CLARiiON CX4 or EMC Celerra unified storage, and VMware vsphere Delivers performance and virtualization for large or mid-sized companies and is suitable for data centers of any size, including remote-office locations For more information about Vblock 1, visit the VCE website: 11

12 EMC CLARiiON CX4-960 EMC CLARiiON CX4-960 provides premium-performance, maximum-capacity networked storage. It enables you to handle the most data intensive workloads and large consolidation projects, while reducing energy consumption. CLARiiON CX4-960 combines CLARiiON five 9s availability with innovative technologies Fully Automated Storage Tiering (FAST), FAST Cache, Flash drives, compression, Virtual Provisioning, 64-bit operating system, and multicore processors. It also supports up to 512 highly available, dual-connected hosts and scales up to 960 disk drives for a maximum capacity of 1,899 TB. UltraFlex technology gives you dual-protocol, onlineexpandable connectivity options, and the ability to integrate future technologies. EMC Ionix Unified Infrastructure Manager EMC Ionix Unified Infrastructure Manager (UIM) provides simplified management for Vblock Infrastructure Packages, including provisioning, configuration, change, and compliance management. By managing Vblocks as a single entity, operational expenses and integrated management for Vblock network, compute, and storage resources can be dramatically reduced. With a consolidated dashboard view, policy-based management, automated deployment, and deep visibility across the Vblock environment, Ionix UIM is integral and essential to effectively and efficiently manage Vblock Infrastructure Packages. Cisco Unified Computing System Manager Cisco Unified Computing System (UCS) Manager provides centralized management capabilities, creates a unified management domain, and serves as the main processing center of the Cisco UCS. This embedded device-management software manages the entire system as a single logical entity through an intuitive GUI, a command line interface (CLI), or an XML API. Role and policy-based management is performed using service profiles and templates. This construct improves IT productivity and business agility. Now infrastructure can be provisioned in minutes instead of days, shifting IT's focus from maintenance to strategic initiatives. VMware vcenter Server VMware vcenter Server is the simplest, most efficient way to manage VMware VSphere whether you have ten or tens of thousands of virtual machines. It provides unified management of all the hosts and virtual machines in the data center, from a single console with an aggregate performance monitoring of clusters, hosts and virtual machines. VMware vcenter Server gives administrators deep insight into the status and configuration of clusters, hosts, virtual machines, storage, the guest OS, and other critical components of a virtual infrastructure all from one place. EMC Replication Manager EMC Replication Manager manages EMC point-in-time replication technologies through a centralized management console. Replication Manager coordinates the entire data replication process from discovery and configuration to the management of multiple application-consistent, disk-based replicas. Auto-discover your replication environment and enable streamlined management by scheduling, recording, and cataloging replica information including auto-expiration. With Replication Manager, you can put the right data in the right place at the right time on-demand or based on schedules and policies that you define. This application-centric product allows you to simplify replica management with application consistency. 12

13 VMware vcloud Director VMware vcloud Director enables you to deliver resources to organizations as virtual data centers. By logically pooling compute, storage and networking capacity into virtual data centers, IT can manage a more efficient data center with complete separation between the consumption and delivery of infrastructure and IT services. VMware vcloud Director builds on VMware vsphere to provide a complete, out-of-thebox solution that enables IT organizations to act as true service providers for the businesses they support. Companies can leverage their existing investments to build elastic, secure, multi-tenant clouds that are compatible with their existing applications. VMware vcloud Director integrates with management and service desk solutions to enable the move to cloud computing with minimal disruption. VMware vshield VMware vcenter Chargeback Microsoft Systems Center Operations Manager Microsoft Forefront Endpoint Protection 2010 VMware vshield provides comprehensive perimeter network security for virtual data centers with VMware vshield Edge, part of the VMware vshield family. vshield Edge integrates seamlessly with VMware VSphere and includes essential network gateway services so you can quickly and securely scale your cloud infrastructures. VMware vcenter Chargeback improves the utilization of virtual infrastructure with accurate visibility into the true costs of virtualized workloads. It enables line-ofbusiness owners to have full cost transparency and accountability for self-service resource requests. Microsoft System Center Operations Manager (SCOM) 2007 R2 enables organizations to reduce the cost of data center management across server operating systems and hypervisors through a single, familiar, and easy-to-use interface. It provides numerous views that show state, health, and performance information, as well as alerts generated according to some availability, performance, configuration, or security situation being identified. In this way, operators can gain a rapid insight into the state of the IT environment, and the IT services running across different systems and workloads. Forefront Endpoint Protection 2010 enables businesses to align security and management to improve endpoint protection, while greatly reducing operational costs. It builds on System Center Configuration Manager 2007 R2 and R3, allowing customers to use their existing client management infrastructure to deploy and manage endpoint protection. This shared infrastructure helps reduce ownership costs while providing improved visibility and control over endpoint management and security. 13

14 Configuration Overview Design considerations This solution simulates the role of a service provider using Vblock 1 to host a multitenancy cloud environment for two organizations. The first organization, ACME, hosts a large Microsoft application infrastructure and the second, OMZE, hosts a mediumsized Microsoft application infrastructure. The solution is configured as follows: Each organization can deploy vapps for its own applications (Microsoft Exchange, SharePoint, and SQL) and the virtual machines inside the separate vapps. The service provider allocates the resources necessary for each organization to be able to deploy their vapps and virtual machines in vcloud Director, using separate logins. Each organization uses a completely separate virtual network and has no access to the other organization s resources. All the virtual machines are hosted using a CLARiiON CX4-960 for disk storage and management. The virtual machines co-exist on the ESX servers on Vblock 1 and are automatically distributed among the physical hosts by VMware DRS. UCS Manager and Fibre Channel over Ethernet (FCoE) technologies are the backbone of the virtual infrastructure, providing a data center architecture for administrators that is easy to use and manage. The platform, optimized for virtual environments, is designed within open industry-standard technologies and aims to reduce the total cost of ownership (TCO) and increase business agility. The system integrates a low-latency, lossless 10 gigabit Ethernet (GbE) unified network fabric with enterprise-class, x86-architecture servers. The system is an integrated, scalable, multi-chassis platform in which all resources participate in a unified management domain. Vblock 1 and VMware High Availability (HA) allow for full redundancy in case of hardware failure. SCOM is used for application monitoring and Forefront Endpoint Protection is used for application security for each organization. Replication Manager is used to manage multiple-application, consistent, diskbased replicas. vcenter Chargeback is used to accurately generate resource allocation or usage, with the actual cost calculated according to a defined cost model. This cost can then be charged back to the customer at a chosen rate. This solution includes the following design considerations: RDMs were used because the replication technology (Replication Manager) requires them. Separate LUNs were used as boot disks for the virtual machines for Replication Manager. A service provider can use one large LUN to simplify the creation of virtual machines but a different replication or backup technology would have to be used in that case. External networks can be used for the virtual machines and firewalled to get around NAT issues with authentication and Replication Manager, but the service provider is limited by the amount of IP addresses and vshield would 14

15 only be used for firewalling. This has security implications for example, only one level of security would be available, and the separation of organization networks would be compromised. Best practice LUN layouts were used for each application instead of using tiered pools to maximize application I/O performance. Physical environment Figure 1 illustrates the overall physical architecture of the environment. Figure 1. Environment overview 15

16 Hardware resources The hardware used to validate the solution is listed in Table 3. Table 3. Hardware requirements Equipment Used for Quantity Configuration Vblock 1 Exchange, SharePoint, SQL, Replication Manager, SCOM, Forefront Security 1 Each UCS contains 8 B-200 blades. The blades are split 50/50. 2 x blades with 96 GB of RAM with 2 sockets quad CPUs each 14 x blades with 48 GB of RAM with 2 sockets quad CPUs 73 x 2 TB SATA drives 41 x 600 GB 10 k FC drives 10 x 450 GB 15 k FC drives Management servers Advanced Management Pod module and authentication 2 16-core 64 GB RAM Software resources The software used to validate the solution is listed in Table 4. Table 4. Software Vblock 1: Software resources Version Ionix UIM UCS Manager 1.3(1c) vcloud Director 1.0 vcenter Chargeback vsphere with VMware vcenter 4.1 vshield Edge 1.0, Update 1 Replication Manager SCOM Windows Server Windows Server Exchange Server SharePoint Server SQL Server 2007 R R2 Enterprise Edition 2008 R2 Standard 2010 SP1 Enterprise Edition 2010 Enterprise Edition 2008 R2 Enterprise Edition Forefront Protection for Exchange Server 2010 Forefront Protection for SharePoint

17 Environment profile The environment profile is detailed in Table 5. Table 5. Simulated configuration Application Requirements Customer OMZE (Medium) Quantity/Type/Size Exchange mailbox count total 500 5,000 Customer ACME (Large) Quantity/Type/Size Exchange Server Exchange mailbox size 2 GB 2 GB Exchange IOPS (per mailbox) 0.15 IOPS 0.15 IOPS Exchange DAG used? Yes, 2 HA copies Yes, 2 HA copies Exchange number of messages per user SharePoint total user count 7,000 16,000 SharePoint total data ~1 TB ~2 TB SharePoint max content database size ~200 GB ~100 GB SharePoint document size range 75 k to 2 MB 75 k to 2 MB SharePoint Server SharePoint total site collection count 10 (2 per content database) SharePoint size per site 10 GB 10 GB 20 (1 per content database) SharePoint sites per site collection SharePoint total site count SharePoint usage profile(s) (% browse/% search/% modify) 50%/20%/30% 80%/10%/10% SharePoint user concurrency 10% 10% SQL TPC-E user count 20,000 users 75,000 users SQL Server SQL read response times - data/logs <20 / N/A milliseconds (ms) <10 / N/A ms SQL write response times - data/logs < 20 / 5 ms < 20 /5 ms SQL workloads TPC-E TPC-E SQL workload profile - size 250 GB 800 GB 17

18 Deployment Overview Vblock 1 This section describes the deployment of the hardware and software used in this solution. Vblock 1 Authentication Advanced Management Pod UCS Manager Ionix UIM vcenter Server vshield vcloud Director SCOM Forefront Replication Manager vcenter Chargeback For processing power, the Vblock 1 servers consisted of 16 Cisco UCS B200 M2 blade servers, each with two quad-core Intel Westmere CPUs. Each chassis in a Vblock 1 system had eight UCS B200 blades. The first blades in each chassis had 96 GB of RAM, while the remaining blades had 48 GB of RAM. Two Cisco 6120 switches were used as Fabric Interconnects. Cisco UCS 6120 Fabric Interconnects provided both network connectivity and management capabilities to all attached blades and chassis. The 6120 series offered line-rate, low-latency, lossless 10 GbE and FCoE functions. In addition, by supporting unified fabric, the 6120 series provided both LAN and SAN connectivity for all blades within its domain. The uplink switches were two Cisco MDS 9506 switches. Cisco MDS 9500 Series Multilayer Switches integrated the high-performance Fibre Channel (FC) and IP into a single module, connecting the 10 GbE and CLARiiON FC storage. Disk storage was provided by a CLARiiON CX4-960 with 450 and 600 GB FC disks and 2 TB SATA disks. Each UCS blade was running VMware ESX Server 4.1. Each blade had two 10 GB converged network adapters to carry network and storage data. The 16 blades in the two chassis were configured as a VMware HA cluster managed by a single VMware vcenter 4.1 server. Authentication Two DC virtual machines were built for each of the three distinct organizations the service provider, ACME, and OMZE. The service provider s DCs were used for authenticating the Advanced Management Pod (AMP) servers and the vcenter Chargeback server. These DCs were located on the AMP servers. 18

19 The ACME and OMZE DCs were also located on the AMP servers because the active directory (AD) does not work with NAT. The DCs are only allowed to have real IP addresses and NAT produces authentication issues as a result. Since these are DCs, it is assumed that organizations would prefer not to have them in the cloud so as to have complete control over their authentication security. Also, a prerequisite for Exchange Server 2010 installation is that Exchange must contact the DC with the flexible single master operations (FMSO) role, so the option of using a read-only DC does not work. The DCs with the FMSO role were given four CPUs and 4 GB of RAM each and the secondary DCs were given two CPUs and 4 GB of RAM. This was more than enough to deal with all of the Vblock application authentications. Advanced Management Pod The VCE Advanced Management Pod (AMP), which was external to Vblock 1 and hosted on two ESX servers, consisted of Ionix UIM, vcenter Server, vshield Manager, vcloud Director, vcloud Director database, and vcenter Chargeback. The IOPS were low and SATA II thin pools were sufficient to support the AMP servers. The configurations for the AMP server and ACME LUN are detailed in Table 6 and Table 7. Table 6. AMP server configuration Virtual machine Quantity CPUs RAM (GB) UIM vcenter vcloud Director database vcloud Director vshield vcenter Chargeback Table 7. AMP LUN configuration Virtual machine Role Quantity LUN sizes Storage pool UIM Boot vcenter Boot 1 50 vcloud Director database Boot vcloud Director Boot TB SATA II R1 Thin vshield Boot 1 8 vcenter Chargeback Boot UCS Manager The Vblock consisted of dual Cisco UCS 5108 chassis, 16 Cisco B200-M1 blades interconnected through the Cisco 6120 Fabric Interconnects. Once the Fabric Interconnects were configured according to the Cisco UCS 6100 Series Fabric Interconnect Hardware Installation Guide, access to the UCS and Vblock networks 19

20 were set up using Cisco UCS Manager, a Java application that provides a user interface for Cisco UCS management, as shown in Figure 2. Before provisioning was started, the Protect Configuration check box in the local disk configuration policy was cleared in the UCS Manager. If Protect Configuration is enabled and the local disk configuration policy encounters mismatches between the previous service profile and the new service profile, all subsequent service profile associations with the server are blocked. After the VLAN was set up, Ionix UIM was used to fully provision the rest of the Vblock. UCS Manager was used to monitor hardware or gain direct KVM console access. Each blade had to be configured to use VLAN trunking for multiple VLANs within the Vblock for both organizations. Figure 2. UCS Manager Ionix UIM A Red Hat Enterprise Linux (RHEL) virtual machine was installed with all the appropriate RHEL Package Groups for use with Ionix UIM, with two CPUs, 8 GB of RAM, and 200 GB virtual machine disk format (VMDK) to accommodate the PostgreSQL database that is required. Figure 3 illustrates the Ionix UIM. For installation information, refer to the EMC Ionix Unified Infrastructure Manager Version 2.0 Service Pack 1 Installation Guide. 20

21 When deploying Vblock 1, a maximum of eight blades was provisioned per service offering, leading to multiple service offerings, despite no hard limit in Ionix UIM. Because of the multiple provisioning of service offerings, the host LUN numbers were not the same across all the blades, which led to the virtual machines being unable to move to blades in different services. Ionix UIM 2.0 does not support thick storage pools for ESX boot LUNs but does support thin storage pools and RAID groups. The blades were provisioned in a RAID group for better I/O performance over a pool. Figure 3. Ionix UIM vcenter Server vcenter Server was installed on the AMP servers and all 16 Vblock blades were added as ESX servers. Once all the servers were added, vcloud Director was able to connect to the vcenter Server for further configuration. RDMs must be added in vcenter Server because they cannot be added in vcloud Director. VMware virtual machine file system (VMFS) volumes must also be added in vcenter Server before they can be added as datastores in vcloud Director. Resources were virtualized by creating the DRS clusters, datastore, and virtual network switches using vsphere, and then creating a provider data center in vcloud Director. For high availability and even distribution of the virtual machines across the ESX servers, VMware HA, DRS, and vmotion were configured and enabled in vcenter Server. A separate vcenter Server was created for the AMP servers and the DCs. 21

22 All blades were configured to use distributed switches. This solution had one distributed switch for the external ESX network. Internal networks were added through vcloud Director, which created network port-groups in the distributed switch. Figure 4 provides a view of the vcenter Server showing the 16 blades and an expanded OMZE organization. Figure 4. vcenter Server vshield vshield deployed one vshield Edge device for each organization. The Edge devices were virtual machines (one CPU, 256 MB RAM) that were assigned to each organization s resource pool. The Edge devices created the internal networks and performed the NAT for the virtual machines. For vcloud Director, inbound NAT was one-to-one and outbound NAT was many-to-one only. This is the only NAT configuration supported by vcloud Director. The vshield Edge devices were virtual machines and were protected by VMware HA in this solution. Each vshield Edge device was assigned to one organization so there was complete separation of networks between the organizations as shown in Figure 5. Each organization had its own internal network for communication between the virtual machines. The vshield firewall was configured to allow an organization's IP addresses to connect only to that organization's vapps. In this way, only authorized users within an organization can connect to the applications hosted inside the Vblock. 22

23 Figure 5. Separate customer networks vshield also has a firewall for each Edge device that can be configured to allow only certain IP addresses or subnets to connect to hosts on the internal networks for added security. Figure 6 shows the vcloud Director interface to vshield. Figure 6. vcloud Director interface to vshield 23

24 vcloud Director vcloud Director requires an Oracle database server to be installed and to hold all the configuration information. The service provider uses the web interface to create the organizations, configure each organization s resources and resource limits, add datastores, configure networking and NAT, and add organization users. Each organization can use the web interface to create their vapps, and then create virtual machines in their vapps. In this solution, each organization had four vapps: SQL, SharePoint, Exchange, and Infrastructure. The Infrastructure vapp contains the virtual machines for infrastructure servers like Replication Manager, SCOM, and Forefront. Only an organization s vapps, virtual machines, and networks are visible to that organization. The organization s virtual data centers (vdcs) should be created from the service provider s vdc to allocate resources for the vapps. Service providers must add datastores to the organization so that the virtual machines can be created on them. For each virtual machine, the service provider should enable the correct datastore, and disable the other datastores, to ensure that the correct virtual machine uses the correct datastore. Otherwise, vcloud Director uses the next available datastore automatically. Note After adding a datastore, the storage resource pool for the organization must be expanded before it can be used. As RDMs cannot be added in vcloud Director, they must be added in vcenter Server to each virtual machine before they are visible in vcloud Director. Enough disk space must be allocated to the vcloud Director server to store all the media (ISOs) that are uploaded to the catalogs for use in installing virtual machines or installing software on the virtual machines. Catalogs that contain the vapp templates and media can be shared between organizations. In this solution, an OS template was used to install the organizations virtual machines. The template was created in vcenter Server and imported into an organization s catalog and then the catalog was shared between both organizations. A service provider allows for the creation of a virtual machine using vcloud Director by: Adding a disk for the new virtual machine in the organization s storage Expanding the size of the storage resource pool to include the new disk Disabling all other disks in the organization so that the new disk is used for the new virtual machine Note Alternatively, the service provider can create a large datastore to enable the customer to create multiple virtual machines. An organization s administrator can create a virtual machine using vcloud Director by: Creating a vapp Adding a virtual machine to vapp Choosing a template from the catalog (either the organization s or a public catalog) 24

25 Changing the virtual machine name and network the network choice can be a static IP, automatically allocated from a network pool, or a dynamic host configuration protocol (DHCP) Deploying the virtual machine Editing the properties of the virtual machine to perform Guest OS Customization (password and Sysprep, for example) Starting the virtual machine Figure 7 illustrates a vapp in vcloud Director. Figure 7. A vapp in vcloud Director SCOM SCOM provides an easy-to-use monitoring environment that can monitor all servers, applications, and clients to provide a comprehensive view of the health of an organization s IT environment. Management packs (MPs) are available for Microsoft products and third-party products to extend SCOM management capabilities to operating systems, applications, and other technology components. MPs contain best practice knowledge to discover, monitor, troubleshoot, report on, and resolve problems for a specific technology component. Figure 8 shows the servers that are being monitored in the example organization, ACME. 25

26 Figure 8. Administration with SCOM Forefront To ensure comprehensive protection, Forefront Protection 2010 for Exchange Server (FPE) was deployed on both the Exchange hub transport and mailbox server roles. This multi-layered approach to server protection provides improved security. As a first line of defense, FPE can be installed on the Edge transport and hub transport servers to provide anti-malware and anti-spam scanning of messages as they enter or exit the messaging domain. FPE can also be installed on mailbox servers to provide scanning for messages that are not scanned in transport and to provide additional scanning during malware outbreaks. Microsoft Forefront Protection 2010 for SharePoint (FPSP) was deployed on the SharePoint front-end servers to prevent users from uploading or downloading documents containing malware, out-of-policy content, or sensitive information to SharePoint libraries. Microsoft Forefront Protection Server Management Console (FPSMC) 2010 provides multi-server management for FPE and FPSP in the same organization. The management console delivers an easy-to-use graphical interface for server discovery, configuration deployment, reporting, quarantine management, and engine and definition updates, as shown in Figure 9. 26

27 Figure 9. Forefront Protection Server Management Console Replication Manager vcenter Chargeback Replication Manager was used in this solution. Because Replication Manager does not support NAT, the Replication Manager virtual machines were deployed in each organization s Infrastructure vapp. Each Replication Manager virtual machine was allocated two CPUs with 6 GB RAM and had a 100 GB boot drive. EMC Solutions Enabler, EMC Navisphere command line interface (CLI), and the EMC SnapView admsnap utility were installed as prerequisites for Replication Manager. The Replication Manager server was not used as a mount host as the mount host for each organization was a virtual machine in another vapp. vcenter Chargeback requires an Oracle or a SQL database server to be installed to hold application-specific data such as cost models, chargeback hierarchies, users, and roles. A web interface enables the service provider to create the cost models, chargeback hierarchies, users, roles and, most importantly, to generate cost and usage reports for the hosted organizations. vcenter Chargeback has data collectors that interact with the vcenter Server and vcenter Server database and with the vcloud Director database and vshield. The data collectors synchronize the information between the vcenter Chargeback database and the various other vcenter application databases of vcenter Server or vcloud Director, for example. The following cost models were used for ACME and OMZE respectively: fixed cost and actual usage, and fixed cost and allocation. 27

28 Microsoft Exchange Server 2010 Overview In this solution, the ACME Exchange organization consists of two mailbox servers and two client access and hub transport servers. The OMZE Exchange organization consists of two servers with mailbox server, client access server, and hub transport server roles installed on each of them. High availability is provided through the use of the database availability group (DAG). Within a DAG, a set of mailbox servers performs continuous database replication through the use of host-based log shipping, to provide automatic database recovery in the event of failures. In this solution, each database has two DAG copies deployed on two Exchange Server 2010 mailbox servers. The Exchange Server 2010 client access array and network load balancer are implemented to provide load balancing between the client access servers. Design Due to the many variables and diversities between different organizations, sizing and configuring storage for use with Exchange Server 2010 can be a complicated process. One of the methods used to simplify the sizing and configuration of storage for use with Exchange 2010 is to define a unit of measure a building block. A building block represents the amount of disk and server resources required to support a specific number of Exchange Server 2010 users. The amount of required resources is derived from a: Specific user profile type Mailbox size Disk requirements Using the building block approach helps to remove much of the guesswork to simplify the implementation of the Exchange Server 2010 mailbox server. After the initial building block is designed, it can be easily reproduced to support the required number of total users in the organization. Exchange administrators can now create their own building blocks that are based on their company s specific requirements for the Exchange environment. This approach is very helpful when future growth is expected, because it makes scalability of the Exchange environment much easier and more straightforward. EMC s best practices involving the building-block approach for Exchange Server design have proven to be very successful throughout many customer implementations. For more information about the building block calculation, refer to the EMC white paper: Microsoft Exchange Server 2010 Performance Review Using the EMC VNX5300 Unified Storage Platform An Architectural Overview. Table 8 and Table 9 show the user profile and building block used in this solution s ACME organization. 28

29 Table 8. ACME user profile ACME profile characteristic Number of users supported User profile supported Value 5,000 users 150 messages sent/received per day (0.15 IOPS per user) Read/write ratio 3:2 Number of mailbox servers 2 Number of DAG copies 2 Mailbox size Table 9. ACME building block ACME building block User count per server Number of databases per server 2 GB Value 5,000 (2,500 active users, 2,500 passive users) 10 (5 active, 5 passive) User count per database 500 Database LUN size Log LUN size Disk size and type RAID type and disks required 2 TB 100 GB 2 TB 7.2k rpm SATA drives RAID 1_0 (24 x 2 TB SATA drives) Table 10 and Table 11 show the user profile and building block used in this solution s OMZE organization. Table 10. OMZE user profile OMZE profile characteristic Number of users supported User profile supported Value 500 users 150 messages sent/received per day (0.15 IOPS per user) Read/write ratio 3:2 Number of mailbox servers 2 Number of DAG copies 2 Mailbox size 2 GB 29

30 Table 11. OMZE building block OMZE building block User count per server Number of databases per server Value 500 (250 active users, 250 passive users) 2 (1 active, 1 passive) User count per database 250 Database LUN size Log LUN size Disk size and type RAID type and disks required 1 TB 50 GB 2 TB 7.2k rpm SATA drives RAID 1_0 (4 x 2 TB SATA drives) Configuration In the ACME organization, the first client access server also acts as the file share witness. To remove single point of failure, the virtual machines of the two mailbox servers and the two client access and hub transport servers are hosted on different UCS blades. The virtual machine and LUN configurations for the ACME organization are shown in Table 12 and Table 13. Table 12. ACME virtual machine configuration Virtual machine Quantity CPU RAM (GB) Mailbox server Hub/client access servers combination Table 13. ACME LUN configuration Virtual machine Role Quantity LUN size Storage pools Mailbox server Boot Mount point Database Log FC 450 GB RAID SATA 24 x 2 TB RAID 1_0 Hub/client access servers combination Boot FC 450 GB RAID In the OMZE organization, the file share witness is configured on a domain controller. To remove single point of failure, the virtual machines of the two Exchange servers and this domain controller are also hosted on different UCS blades. The virtual machine and LUN configurations for the OMZE organization are shown in Table 14 and Table

31 Table 14. OMZE virtual machine configuration Virtual machine Quantity CPU RAM (GB) Mailbox, hub, and client access servers combination Table 15. OMZE LUN configuration Virtual machine Role Quantity LUN size Storage pools Mailbox, hub, and client access servers combination Boot Mount point Database Log FC 450 GB RAID SATA 4 x 2 TB RAID 1_0 Jetstress validation The Exchange 2010 storage design should be validated for expected transactional IOPS before it is placed in a production environment. To ensure that the environment functions appropriately, EMC recommends that the Microsoft Jetstress tool is used to validate the Exchange storage design. The Jetstress tool simulates Exchange I/O at the database level by interacting directly with the Extensible Storage Engine (ESE) database technology (also known as Jet) on which Exchange is built. Jetstress can be configured to test the maximum I/O throughput available to the disk subsystem within the required performance constraints of Exchange. Jetstress can accept a simulated profile of specific user counts and IOPS per user to validate that the disk subsystem is capable of maintaining an acceptable performance level by the metrics defined in that profile. The 64-bit version of Jetstress 2010 can be downloaded from: In this solution, Jetstress version was used to simulate an I/O profile of 0.15 IOPS per user. The building blocks were validated using a two-hour performance test. Table 16 and Table 17 show the average I/O and the average latency on the mailbox servers. As can be seen, the performance of both organizations meets the design target. 31

32 Table 16. ACME - average I/O and latency on mailbox servers Database I/O Target values ACME mailbox server Achieved transactional IOPS (I/O database reads/sec + I/O database writes/sec) I/O database reads/sec N/A 244 I/O database writes/sec N/A 152 I/O database reads average latency (ms) < 20 ms 13 I/O database writes average latency (ms) This counter is not a good indicator for client latency because database writes are asynchronous. Transaction log I/O Target values ACME mailbox server I/O log writes/sec N/A 137 I/O log writes average latency (ms) < 10 ms 1 Total I/O Target values ACME mailbox server (DB+Logs+BDM+Replication)/sec N/A 695 Table 17. OMZE - average I/O and latency on mailbox servers Database I/O Target values OMZE mailbox server Achieved transactional IOPS (I/O database reads/sec + I/O database writes/sec) I/O database reads/sec N/A 58 I/O database writes/sec N/A 41 4 I/O database reads average latency (ms) < 20ms 14 I/O database writes average latency (ms) This counter is not a good indicator for client latency because database writes are asynchronous. Transaction log I/O Target values OMZE mailbox server I/O log writes/sec N/A 37 I/O log writes average latency (ms) < 10ms 1 Total I/O Target values OMZE mailbox server (DB+Logs+BDM+Replication)/sec N/A