R E F E R E N C E A R C H I T E C T U R E. VMware View WAN Reference Architecture

Transcription

1 R E F E R E N C E A R C H I T E C T U R E

2 Contents Introduction...1 Goals of This Reference Architecture...1 Design Considerations...2 Client Access Devices...2 Virtual Infrastructure...3 View Desktops...3 Access Infrastructure...3 Network Layer Performance...3 Remote Desktop Protocol Considerations...4 VMware View Reference Architecture...4 Use Case 1: Home Access or Small Office Without WAN Optimizer...4 Use Case 2: Small to Midsized Office with WAN Optimization...5 Use Case 3: Midsized to Large Branch Office with WAN Optimization...5 WAN Optimization...5 VMware View Testbed Setup Details...6 Virtual Desktops...6 Other Components...6 Printing...6 Workload Description...6 Reference Architecture Validation...7 User Experience...7 Results...8 Results for Use Case 1: Home Office...8 Results for Use Case 2: Small to Midsized Office...9 Results for Use Case 3: Midsized to Large Branch Office...9 Printing Conclusion About the Author Acknowledgement...11 Resources Appendix: Configuring Virtual Desktops for Optimization Disabling Compression in the RDP Configuration File...12 Contents i

3 Configuring View to Use Uncompressed RDP Sessions...12 Disabling Encryption...13 Contents ii

4 Introduction Organizations of all sizes are increasingly adopting VMware View to replace traditional PCs with virtual desktops that are hosted in and managed from the datacenter. View enables you to reduce operational costs, increase desktop security, simplify desktop management, and extend business continuity and disaster recovery to enterprise desktops. In order to serve the widest user base within the enterprise, you must be able to deliver these virtual desktops across a WAN so they are available for users working from home or in branch office environments. LANs have, over time, evolved to provide 100Mbps to 1Gbps Ethernet transmit speeds. The effective bandwidth of a WAN is significantly lower than that of a LAN. This speed difference is a result of the costs of leasing or buying WAN connections and the fact that the data is transmitted for long distances. VMware View uses the Microsoft Remote Desktop Protocol (RDP) to deliver centralized virtual desktops from the datacenter to the user. RDP, although it is acceptable for delivering desktops to users on a local network, is deficient when used to deliver desktops to users across high-latency, low-bandwidth WAN links. Deploying virtual desktop solutions for the enterprise presents the following challenges: Poor performance of display protocols over the WAN, affecting employee productivity High bandwidth consumption, leading to saturated links that require costly WAN upgrades to remediate Limited scalability, reducing the number of users you can support Poor performance of centralized printing and performance degradation of RDP sessions during large print jobs The above factors call for careful consideration and design when you deploy VMware View to serve users connecting over WAN links. To address the challenges associated with today s complex user desktops, VMware has validated the reference architecture described in this paper over the WAN. Goals of This Reference Architecture This reference architecture provides IT and network architects, consultants, and partners a proven and tested architecture for WAN-based enterprise desktop deployments. The goal was to design and validate branch office use cases in which users access centralized virtual desktops over various WAN links. The WAN scenarios utilize components capable of supporting up to a hundred virtual desktops. The overall design includes the infrastructure components described in the VMware View Reference Architecture and additional network elements needed to create an optimized WAN infrastructure. The architecture uses common components and a standardized design to reduce the overall cost of implementation and management. All the infrastructure components used to validate the reference architecture are interchangeable, so you can use components from your vendor of choice to incorporate unique features that enhance the value of the overall solution. All the components of VMware View used in this reference architecture are derived from the VMware View reference architecture. This WAN reference architecture focuses only on the WAN link, its attributes, such as bandwidth and latency, and the WAN optimization aspect of the architecture. Introduction 1

5 VMware Design Considerations VMware View consists of a number of components. This architecture includes four key layers, described in the sections below. Figure 1: VMware View Components in a LAN and WAN Environment Client Access Devices This layer includes the physical devices that provide users access to their virtual desktops. Sublayers include: Client device thin client or thick client Client software host operating system on the local client device Peripheral support locally attached USB or serial devices Design Considerations 2

6 Virtual Infrastructure This layer defines the components and technology used to host the virtual desktop operating systems and supporting VMware View Infrastructure. Sublayers include: Host infrastructure physical servers and VMware ESX infrastructure Virtual and physical network infrastructure switches, WAN acceleration devices, etc. Storage infrastructure storage for VMware View virtual machines and user data View Desktops This layer defines the components and configuration of the virtual machines assigned to and accessed by users. Sublayers include: Virtual hardware configuration configuration for virtual servers and network devices Virtual desktop guest operating system operating system for the hosted virtual desktop Access Infrastructure This layer addresses networking and connectivity components designed to facilitate client communication. Sublayers include: Wide area networking with optimization WAN connection and link optimization devices VMware View Manager and security server secure connection broker with authentication Network load balancing connection distribution for scalability and availability Network Layer Performance To achieve a user experience similar to that of a traditional PC, the VMware View environment requires an optimal network infrastructure, so you should take both network bandwidth and latency into consideration in the design phase. Studies have shown that the minimum bandwidth for a usable RDP session is approximately 30Kbps. Streaming multimedia content using multimedia redirection increases bandwidth requirements. The amount of bandwidth needed per virtual desktop user varies, depending on the user workload characteristics. As a starting point, Kbps is a good rule of thumb to use until you can determine environment-specific usage patterns. You should measure bandwidth when the desktop is under active use to account for the peak usage of a typical VMware View user. As noted above, multimedia usage increases the amount of bandwidth needed, but it is contentspecific and typically not needed on a regular basis. Another attribute of the WAN link is network latency, an expression of how much time it takes for a packet of data to get from one point to another and often expressed in a round-trip measurement. It is unavoidable in a network environment, especially at long distances. Transmission and equipment delays typically create latency that may be as low as 1ms on a LAN and ms for US domestic WAN links. For international links, latency can range from 100ms to 200ms, sometimes higher, and multiple-hop satellite links can produce delays of more than 2,000ms. Design Considerations 3

7 High network latency can contribute to a slow refresh of the desktop display and data input, which has an adverse impact on the user experience. For some users, a round-trip latency of up to 150ms provides an acceptable user experience using RDP for simple tasks, such as data entry, 2-D graphics rendering, and low rates of application screen refresh. As latency approaches 200ms using RDP, the user experience often begins to degrade. It is often difficult to categorize how remote offices or users will experience a VMware View desktop under these conditions. VMware recommends that if network latency exceeds 150ms, you should test the performance of the targeted applications under these network conditions before migrating users to VMware View. Remote Desktop Protocol Considerations RDP is the display protocol most commonly used to access a VMware View 3 environment, except when View is deployed in combination with an OEM hardware-based solution. As a starting point, to maximize use of available network bandwidth and enhance each user s experience, you should follow the recommendations in the Windows XP Deployment Guide. The VMware View Client also allows a large number of customized settings. You can centrally control and manage these settings using Microsoft group policy objects. For information on these settings, see the VMware View Manager Administration Guide under VMware View Client Advanced Active Directory RDP Settings. VMware View Reference Architecture The previously published VMware View Reference Architecture proposes a building-block approach for building the components described above using View on a LAN. In building the reference architecture with a WAN network, we use the approach described in the VMware View Reference Architecture and replace the network component with a WAN emulator to create WAN use cases. We borrow the remaining considerations such as virtual desktop density, storage settings and domain infrastructure pieces from the LAN-based architecture published earlier. For this WAN-based reference architecture, we validated three use cases: Use case 1 Home access or small office with three to five users Use case 2 Small to midsized branch with up to 15 users Use case 3 Midsized to large branch with up to 100 users Use cases 2 and 3 use WAN optimizer blocks, as shown in Figure 1. Use Case 1: Home Access or Small Office Without WAN Optimizer Link type Bandwidth Latency DSL or cable modem 384Kbps Less than 50ms Number of users 3 to 5 Example Home users, small clinic VMware View Reference Architecture 4

8 Use Case 2: Small to Midsized Office with WAN Optimization Link type Bandwidth Latency T1 link 1.544Mbps Up to 100ms Number of users Up to 15 Example Small office Use Case 3: Midsized to Large Branch Office with WAN Optimization Link type Bandwidth Latency 10Mbps 10Mbps Up to 100ms Number of users Up to 100 Example Midsized branch office WAN Optimization When you employ a strategy of accessing applications over wide area links, you eventually encounter bandwidth constraints and increasing latency. As the footprint of enterprises expands, organizations using this strategy must ensure not only that the WAN provides a way to access applications and datacenter-centric data but also that applications perform well. This interest has led to innovation in the area known as WAN optimization. WAN optimization products accelerate a broad range of applications and use cases that provide tangible benefits to distributed enterprise users. These WAN optimization products eliminate redundant transmissions, stage data in local caches, compress and prioritize data, and streamline chatty protocols (for example, CIFS). WAN optimization also helps avoid packet delivery issues common in saturated WAN environments. These products use techniques such as compression and caching. By using compression, they can represent data patterns more efficiently over a WAN link, making more bandwidth available for other data that is not so compressible. Compression is most efficient when the WAN bandwidth is nearly saturated. High utilization exponentially increases the chances of having repeated byte patterns, thus increasing the compression rates. Caching reduces the overhead by storing data bits that are accessed repeatedly. These devices also exhibit protocol awareness that is, they can examine the data payload and make the transmission efficient for that particular type of data. Compression and caching are foundation technologies for many products. VMware networking ecosystem partners have developed powerful features offering value in a variety of use cases in the areas of network integration, quality of service, security, management, and reporting. This reference architecture does not discuss the merits or demerits of any particular vendor s approach. You should evaluate the vendor-specific features that most fit your needs. The WAN optimizers come in the form of physical devices or virtual appliances, providing flexibility to meet the needs of organizations that prefer one form or the other. VMware View Reference Architecture 5

9 For WAN optimization devices to add value, you must disable RDP encryption. Although this may seem to open a security hole, this configuration change does not compromise data security in RDP. Other tunneling mechanisms are used alongside encryption to protect data integrity. See the appendix for the steps you should take to disable RDP encryption. VMware View Testbed Setup Details The test environment was set up with View 3.0 running on VMware Infrastructure 3.5 U2. Virtual Desktops Each server running the VMware Infrastructure environment hosts eight virtual machines with the following configuration: Microsoft Windows XP guest operating system with Service Pack 2 One virtual CPU 512MB of RAM 8GB hard disk RDP encryption disabled VMware desktop workload Other Components Microsoft Windows 2003 Server running as a VMware virtual machine serving the entire datacenter network includes the following: Microsoft Active Directory Domain Name System (DNS) Dynamic Host Configuration Protocol (DHCP) Printing Depending on the printing use case, the print server runs either in the branch office or on the datacenter side. For more details, see the implementation sections. We used the following printer to test printing: HP LaserJet 4000 with Jetdirect network port Workload Description Each virtual machine is equipped to run a workload that simulates typical user behavior, using an application set commonly found and used across a broad array of desktop environments. The workload has a set of randomly executed functions that perform operations on a variety of applications. Several other factors can be implemented to increase the load or adjust the user behavior for example, configuration options include changing the number of words per minute that are typed and the delay between the times applications are launched. The workload configuration used for this validation included Microsoft Word, Excel, PowerPoint, Internet Explorer, Adobe Acrobat, McAfee Virus Scan, and PKZIP. The workload controller opened multiple applications at the same time and minimized and maximized their windows as the VMware View Reference Architecture 6

10 workload progressed, randomly switching among applications. Individual application operations that the controller performed randomly included: Microsoft Word Open, minimize, and close the application; write random words and numbers; save modifications Microsoft Excel Open, minimize, and close the application; write random numbers; insert and delete columns and rows; copy and paste formulas; save modifications. Microsoft PowerPoint Open, minimize, and close the application; conduct a slide show presentation. Adobe Acrobat Reader Open, minimize, and close the application; browse pages in a PDF document Internet Explorer Open, minimize, and close the application; browse a page. McAfee VirusScan Scanning operation PKZIP Open and close the application; compress a large file Based on the think time and words per minute used for this validation, this workload can be compared to that of a midrange task worker or lower-end knowledge worker. Reference Architecture Validation We used the workload described above to monitor network activity across all three WAN use cases. We focused the validation on the network layer and configured all the other components of the View architecture as in the VMware View Reference Architecture. We used the workload in two modes midrange task worker and low-end knowledge worker. Because the workload is configurable, we could set the parameters to modify the usage pattern of the View desktop. At a high level, the midrange task worker uses multiple applications at the same time. Other applications are minimized when the user is working on a primary task in a particular application. This user profile assumes a variety of tasks, such as using a browser, typing inside a Word document or checking in the desktop. The low-end knowledge worker role assumes that the user primarily uses one application and has fewer screen refreshes compared to the task worker. User Experience Many factors influence the overall user experience on a virtual desktop. The factors that enhance or degrade the experience include CPU processing, storage I/O, network bandwidth and latency, and the application architecture, among many others. Individual judgment also affects user experience. What one user might regard as acceptable responsiveness of a virtual desktop might not be acceptable to another user. This reference architecture does not try to quantify application responsiveness. Instead, it focuses on measuring the bandwidth of this random workload over the simulated WAN links as described earlier. Reference Architecture Validation 7

11 We ran the workload for each use case and studied the impact of the network over this type of WAN link. Results The sections below outline the results we saw for each type of worker in each of the use cases. The graphs show activity on the WAN link over a 10-minute period. Results for Use Case 1: Home Office For the low-end knowledge worker in the home office use case, we observed the following results: Total WAN traffic (Kbps) Peak load on network with three users: 349 Kbps Average load over the test run for three users: Kbps Average bandwidth per user: 58.05Kbps :00 0:05 0:10 0:15 0:20 0:25 0:30 0:35 0:40 0:45 0:50 0:55 1:00 Time (h:mm) Figure 2: Network Load for Three Low-End Knowledge Workers in Home Office Use Case For the midrange task worker in the home office use case, we observed the following results: Total WAN traffic (Kbps) Peak load on network with three users: 350 Kbps Average load over the test run for three users: Kbps Average bandwidth per user: 70.1 Kbps :00 0:05 0:10 0:15 0:20 0:25 0:30 0:35 0:40 0:45 0:50 0:55 1:00 Time (h:mm) Figure 3: Network Load for Three Midrange Task Workers in Home Office Use Case Reference Architecture Validation 8

12 Results for Use Case 2: Small to Midsized Office For the low-end knowledge worker in the small to midsized office use case, we observed the following results: Total WAN traffic (Kbps) Peak load on network with 15 users: 1.31Mbps Average load over the test run for 15 users: 715Kbps Average bandwidth per user: 47.6Kbps :00 0:05 0:10 0:15 0:20 0:25 0:30 0:35 0:40 0:45 0:50 0:55 1:00 Time (h:mm) Figure 4: Network Load for 15 Low-End Knowledge Workers in Small to Midsized Office Use Case For the midrange task worker in the small to midsized office use case, we observed the following results: Total WAN traffic (Kbps) Peak load on network with 15 users: 1.3Mbps Average load over the test run for 15 users: Kbps Average bandwidth per user: 63.9Kbps :00 0:05 0:10 0:15 0:20 0:25 0:30 0:35 0:40 0:45 0:50 0:55 1:00 Time (h:mm) Figure 5: Network Load for 15 Midrange Task Workers in Small to Midsized Office Use Case Results for Use Case 3: Midsized to Large Branch Office For the low-end knowledge worker in the midsized to large branch office use case, we observed the following results: Peak load on network with 100 users: 7.1Mbps Reference Architecture Validation 9

13 Average load over the test run for 100 users: 5.4Mbps Average bandwidth per user: 54Kbps :00 0:05 0:10 0:15 0:20 0:25 0:30 0:35 0:40 Total WAN traffic (Mbps) 0:45 0:50 0:55 1:00 Time (h:mm) Figure 6: Network Load for 100 Low-End Knowledge Workers in Midsized to Large Branch Office Use Case For the midrange task worker in the midsized to large branch office use case, we observed the following results: Total WAN traffic (Mbps) Peak load on network with 100 users: 9.7Mbps Average load over the test run for 100 users: 7.06Mbps Average bandwidth per user: 70Kbps :00 0:05 0:10 0:15 0:20 0:25 0:30 0:35 0:40 0:45 0:50 0:55 1:00 Time (h:mm) Figure 7: Network Load for 100 Midrange Task Workers in Midsized to Large Branch Office Use Case Printing Printing can be a challenge when the desktops reside in the datacenter and the printing infrastructure resides in a branch office, because print data streams are quite large and, in some use cases, that data stream is contained within the RDP session. When a user prints from within an RDP session, the printer is defined on the client machine and is virtualized by RDP on the virtual desktop. In this use case, RDP sends a print job to the client machine, and the client machine then sends the job to the spooler. If the print server is located at the datacenter, CIFS and raw or PostScript print traffic is sent across the network. Table 1 shows the results of printing a 10-page Word document over a T1 line with a latency of 100ms (use case 2). Reference Architecture Validation 10

14 Table 1: Results of Printing a 10-Page Microsoft Word Document Action Local printer on client using RDP RDP printing with datacenter print server RDP printing with local branch office print server Results 16.1 sec/1.6mb 62.6 sec/1.1mb 22.1 sec/1.53mb Conclusion With the study presented in this paper, we were able to establish a baseline number of active desktops that can be accommodated on a WAN link for enterprises that are seeking validated sizing reference information. Although the amount of bandwidth required per user varies depending on the user workload, this study provides a validated starting point. The following key points emerge from this validation: Data throughput regularly exceeds the current bandwidth limit without WAN optimization appliances. You should use WAN optimization techniques to be successful with a VMware View deployment over a WAN link supporting 10 or more users across that WAN link. Maximum peaks of data exceeded the available bandwidth, rising to 200 percent to 400 percent of the bandwidth. We observed these data peaks while running the same test without WAN optimization. The results of native testing are beyond the scope of this paper. User experience can be very subjective. You should study user experience within your target user group while you are conducting your proof of concept before a large rollout. The graph patterns in this paper reflect a random workload. The workload software generates a random number to decide the duration of each application run, the number of iterations, and other variable workload parameters. Printing performance improved by two to three times when we used WAN optimization. The average bandwidth used by an average task worker varied between 50 and 70Kbps. Note: Actual bandwidth usage varies for particular users depending on their specific activities. VMware View brings the benefits of reduced operational expense and improved security and management to desktops. With the proper approach and design, View augmented with WAN optimization can provide these benefits to enterprises even over WAN links. About the Author Anjan Srinivas is a senior technical marketing manager in the desktop business unit at VMware. Srinivas time is primarily spent in developing content and customer architectures that help customers adopt View. In the past Srinivas worked for Cisco Systems and Aruba Networks. Acknowledgement VMware would like to acknowledge the following individuals for their contributions to this paper and help with the test setup: Radhakrishnan Manga, Pak-Shun Lei, Amarjit Singh, Fred Schimscheimer, Mason Uyeda, David White and Aaron Black. Conclusion 11

15 Resources VMware View Manager Administration Guide VMware View Reference Architecture Windows XP Deployment Guide Appendix: Configuring Virtual Desktops for Optimization To optimize the VMware View traffic, you should disable the underlying protocol s encryption and compression. RDP is the underlying protocol used by the current version of View and is currently the predominant protocol used by the various View implementations. To disable encryption on RDP, you must change the settings on the virtual desktop. You can make the changes using either group policy settings or changes to the registry. With either method, you can also distribute the changes to large groups of virtual desktops using Microsoft Active Directory. To disable compression, you must modify the settings on the View client. You can configure these settings using group policy, and thus you can easily deploy the settings to large groups of clients using Microsoft Active Directory Disabling Compression in the RDP Configuration File To disable compression in the RDP configuration file, follow these steps: 1. Open the RDP connection (.rdp) file in Notepad. 2. Find the line: compression:i:1 Change it to : compression:i:0 3. Save the file. After you make the change, new connections made using the changed file do not use RDP compression. Configuring View to Use Uncompressed RDP Sessions To configure View to use uncompressed RDP sessions, follow these steps: 1. On the View Manager server, find the following file: c:\ Program Files\VMware\VMware View\Server\Extras\GroupPolicyFiles\vdm_client.adm Copy the file from the View Manager server to the View client machine. 2. Import this file to the group policy object (GPO). Select Start > Run on the View client machine and enter gpedit.msc. Right-click Administrative templates and click Add/Remove templates. Select the vdm_client.adm file you copied from View Manager server. Click Apply. 3. In the GPO, select User Configuration > VMware View Client and disable the Enable Compression policy. Resources 12

16 Disabling Encryption To disable encryption on Windows virtual desktops, use regedit to make the following registry changes: Set HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\MinEncryptionLevel to 1. Create HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\SecurityLayer as a DWORD value and set it to 0. For large deployments, use Microsoft Active Directory to push these changes to the virtual desktops. Note: On Windows XP 32-bit virtual desktop machines, we used a hotfix from Microsoft to add the capability to disable RDP protocol encryption. However, this hot-fix was not required to disable RDP protocol encryption on Windows XP 64-bit and Windows Vista desktops. The hotfix is available at Appendix: Configuring Virtual Desktops for Optimization 13

17 Revision: Item: RA-095-SLN VMware, Inc Hillview Ave. Palo Alto CA USA Tel Fax VMware, Inc. All rights reserved. Protected by one or more of U.S. Patent Nos. 6,397,242, 6,496,847, 6,704,925, 6,711,672, 6,725,289, 6,735,601, 6,785,886, 6,789,156, 6,795,966, 6,880,022, 6,961,941, 6,961,806, 6,944,699, 7,069,413; 7,082,598, 7,089,377, 7,111,086, 7,111,145, 7,117,481, 7,149, 843, 7,155,558, 7,222,221, 7,260,815, 7,260,820, 7,269,683, 7,275,136, 7,277,998, 7,277,999, 7,278,030, 7,281,102, 7,356,679, 7,409,487, 7,412,492, 7,412,702, 7,424,710, 7,428, 636, 7,433,951, and 7,434,002; patents pending. VMware, the VMware boxes logo and design, Virtual SMP and VMotion are registered trademarks or trademarks of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.