VMware NSX Home Lab

The required Physical Infrastructure

To prepare for the VCIX-NV Exam, the ideal environment to practice is similar to the one we may find on the Hands-on-Labs:

We are particularly interested in the following 4 HoL-s:
  • HOL-SDC-1403 - VMware NSX Introduction
  • HOL-SDC-1425 - VMware NSX Advanced
  • HOL-SDC-1603 - VMware NSX Introduction
  • HOL-SDC-1625 - VMware NSX Advanced


They all have one thing in common: There are 5 Physical Hosts (ESXi-s) distributed into 3 Logical Clusters:
-        Compute Cluster A (2 hosts)
-        Compute Cluster B (1 host)
-        Compute Cluster C (2 hosts)

In the ideal case, you would have 5 Physical Servers to install the native ESXi, and a Physical Switch. Since the majority of us do not have an infrastructure like this just lying around, we need to do an alternative approach: Use 1 Physical Server (needs to be packed with RAM, Memory and CPU), and build the Nested ESXi-s to simulate the target environment.

Before you even start thinking about building your home lab, you should make sure that your Server complies with the bare minimum of the requirements:
  • Minimum 32GB of RAM. With 32 you will be “on the edge”. It´s recommended that you have between 48 and 64GB.
  • Minimum 12 Cores
  • Minimum 512GB HDD (SSD Highly Recommended). You will need more GBs for your VMs later if you want to test the functionalities, so it´s recommended to have 2x512GB or 1TB.


The Server should have no Windows, or any other Standard Use OS. You will install the ESXi as the OS
directly on the Bare Metal. If you choose to use Windows and the VMware Workstation, you will need
the requirements mentioned above + what Windows requires for the adequate performance. In this guide
I will only focus on Home Lab built directly on ESXi as the native OS.


Simulate a physical environment, Step-by-Step

Step 1


You first need to Install ESXi 6.0U1 as the Native OS on your Physical Server. In my case I have a HP Z800 with 48GB of RAM, 1TB HDD and 512GB SSD (I use SSD only for the entire HOME LAB, and then later when I install a bunch of Linux VMs in order to test the features - I use a 1TB disk [you need to create a Datastore using this disk, or it won't be visible].
I assigned the Static IP to the ESXi: 192.168.1.53/24


Step 2


Install a vCenter 6.0 and connect it to the Physical ESXi. I assigned the Static IP to the vCencer: 192.168.1.78/24, with the GW 192.168.1.1.

Once you´ve done this, you can now login to vSphere Web Client to add the ESXi host:

You should log in as administrator@vsphere.local, not as root. The difference is that the “root” user has the additional privileges to configure the authentication. Yes, this is better, but you should get used to use the “admin” account, because in the future you will be having the Admin set of privileges.

Step 3


You now need to deploy your 5 Nested ESXi-s as the VMs with the ESXi 6.0 ISO. Before you start deploying the nested hosts you need to copy your ESXi .iso to a Datastore [just browse around, you´ll manage how to copy from a local PC to Datastore].

IMPORTANT: Be sure to assign at least 4GB of RAM to each host, or it will report weird errors afterwards. Sometimes these errors are random, I once got – Network Adapter not present.
Briefly, you should create a new VM, and the Type should be Other – Other (64 bit), as shown on the screenshot below:




To boot the ESXi installation on your VM, you need assign the ESXi .iso that you placed in the Datastore to a CD Drive. In the CD Drive Type choose the Datastore, and do as shown in the screenshot below:



Step 4


You should now build 3 clusters, MANAGEMENT, COMPUTE A and COMPUTE B (that’s EXACLY like in the HOL). Have in mind that the management IPs of ALL ESXi should be STATIC, so in my case I assigned 192.168.1.101 - 105/24.

IMPORTANT: You´re doing a Nested environment, so you need to set the Security settings within your vSwitch on a Physical Host to Accept the Promiscuous traffic. If you do not do this, the traffic between your Nested ESXis and the Physical NIC will be dropped (Rejected).

You do this following this path, and clicking on a small PENCIL icon that enters the Edit Settings  menu of a vSwitch:

Inventories -> Hosts and Clusters -> Click on a Physical Host (192.168.1.53) -> Manage -> Networking

You need to set it as in the following Screenshot:




Step 5


On the vSwitch on your physical ESXi you need to put all 5 ESXi in the same port group. Once this is done, you go to your vCenter server, build 3 clusters and add the Hosts (VMs from your native ESXi point of view) to them:
-        CLUSTER A: 2 Hosts (.101 and .102)
-        CLUSTER B: 1 Host (.103)
-        MANAGEMENT Cluster: 2 Hosts (.104 and .105)

Once you're done, you should see something like this:



That’s it, your environment is ready, you have 5 “physical” hosts to build your NSX Lab. For a reference, this is how a HOL environment looks, and what we should be going towards with a Home Lab:




Migrate to the Virtual Distributed Switches (VDS)


Virtual Distributed Switch is the basis of the NSX, and before we start with any of the NSX-related “activities” we need to deploy the VDS, and migrate all the 5 hosts ports to the VDS.
We will need 2 Switches:
-        VDS for the two Compute Clusters, and we will call it Compute_VDS
-        VDS for the Management Clusters, and we will call it Mgmt_Edge_VDS

To create a VDS, you need to follow the simple procedure shown on the screenshot below. When prompted, select the VDS version based on your ESXi version (in my case I did the VDS 6.0), and choose the number of Uplinks that your Hardware allows.



You now need to create the Port Groups, and perform a Migration of the existing Hosts from the vSwitch to the VDS.



Once the port groups are created (Check the Screenshot below to see which Port Groups you need), go to “Add and Manage Hosts”, and migrate all the 5 Hosts to the corresponding VDS. Use the Mgmt Port Groups for the VMkernel network adapters.



Deploy the NSX


Before you install the NSX 6.2, consider your network configuration and resources. You can install one NSX Manager per vCenter Server, one Guest Introspection per ESX™ host, and multiple NSX Edge instances per data center.

First consider the System Requirements:

RAM
NSX Manager: 16 GB (24 GB with certain NSX deployment sizes*)
NSX Controller: 4 GB
NSX Edge Compact: 512 MB, Large: 1 GB, Quad Large: 1 GB, and X-Large: 8 GB

Disk Space
NSX Manager: 60 GB
NSX Controller: 20 GB
NSX Edge Compact, Large, and Quad Large: 512 MB, X-Large: 4.5 GB (with 4 GB swap)

The number of vCPU Cores
NSX Manager: 4
NSX Controller: 4
NSX Edge Compact: 1, Large: 2, Quad Large: 4, and X-Large: 6

Once you´re sure that your Home Lab meets the requirements, you may deploy the NSX Manager OVA. Be sure to assign the IP address and set the credentials. In my case, I assigned the IP 192.168.1.242 to the NSX Manager:



Integrate the NSX Manager with your vSphere


The first thing you need to do is enter the NSX Manager console with the username: admin and the password you configured when deploying the OVA.



Have in mind that you will not use this portal at all. The only purpose of it is to integrate it with the existing vSphere. Enter the “Manage vCenter Regustration”, and fill in your vCenter details. Once you fill in the credentials and accept the certificate association, you will see your vCenter status as “Connected”:



Logout from your vSphere Web Client, and log back in. You will the the new icon called “Networking and Security”. Congratulations, you have installed the NSX Manager, and connected it to your vSphere.



Deploy the NSX Controllers


From the beginning we knew that we wanted to deploy 3 NSX Controllers, and that we want to do it in the Management Cluster. Since there are 2 Hosts in the Management cluster (.104 and .105), we will deploy 2 Controllers on one, and 1 Controller on the other host. We need to have 3 NSX Controllers because the Controllers use the VOTING principle to avoid the Split Brain. This means that if 1 Controllers stays alone, it will not be able to make any configuration changes.
You need to create the new IP Pool while Adding the First Controller. I called mine NSX_Controller_Pool, and assigned the IP range 192.168.1.200-192.168.1.202.



Have in mind that if you didn’t assign enough resources to your ESXi VM-s, the NSX Controller deployment will fail. On the screenshot below you can see that I had 10 failed attempts to deploy the NSX controller. Each time I had to go back, and tune the storage and the CPUs on the Management Cluster hosts.




Once you have successfully deployed all 3 NSX Controllers, you will be able to see something like this:


After this, you may use the HoL Workbooks to test the NSX Features in your environment.

Good luck!!!

Cisco Data Center: UCS Basics

TIP: Be sure to use the HUU (Host Upgrade Utility) when adding the Blade to the UCS architecture, to make sure you have the latest drivers and the Firmware.

UCS (Unified Computing System) is a BladeCenter chassis that integrates compute, networking and Storage (FCoE) at backplane level whilst adding management capabilities through UCSM (USC Manager). UCSM seats on top of the blade chassis and are responsible for the overall management of the UCS stack.

UCS Upgrade Sequence: 
Download –> Update –> Activate. Start the upgrade from the UCS Manager, and then the Subordinate FI and later the Primary FI and the other components. The other way is the Host Firmware Package, which Updates using the Service Profiles.

VN Link is a Cisco invention to connect the VM directly to the Physical port without it being handled by VDS/1000v. One physical port can actually be logically separated into various vEthernet ports, where each one connects with exactly one vNIC on the Blade. This is especially comfortable to accommodate the vMotion. There is this new concept called the Interface Virtualizer, where there are special interfaces (VIC), where there is a VN-Tag, which is created by the vNIC when sent to the Physical Network (Host Interface on FEX device, and logically represented as the LIF on the Parent device), and removed by the Interface Virtualizer and the traffic is forwarded to the corresponding vNIC/VM. Nexus Switches support this technology, so the traffic tagged with the VN tag can go through FEX from the ToR to the Parent Switch (such as N5k or N7k).

UCS has 4 types of Ports:
  • Cluster Ports, 4 dual 10/100/1000 Ethernet clustering ports, which are used for connecting two UCSs together, they do sync and hearbeat. You direct connect these with a standard Ethernet cable, and they cannot be used for other purpose.
  • Management Port, Dedicated port for Out-of-Band Management.
  • SFP+ Ports may be used to connect to the 2100 Fabric Extenders (FeX) modules inside the 5100 Chassis (that contains the blades). They may also be used to connect up to your datacenter switching core or aggregation point.
  • Expansion Modules, used to provide further external connectivity. There are 3 types available: Ethernet, Fibre Channel plus Ethernet and Fibre Channel.


CIMC (Cisco Integrated Management Controller)

CIMC forms a part of the Blade, and the Blade connects with the IOM (Input Output Module) using a single link, or a port channel.


As long as the operating system installed on the UCS blades can understand and handle multipathing, it not only can achieve a direct logical connection to the LAN cloud, but it can also achieve an active/active connection via both Fabrics A and B, shown on the diagram below:

Configure the UCS Cluster

In the initial Setup the Wizard asks you if you´re the A or the B in the UCS Cluster.

UCS C-Series (Rack Mount)

A typical example (and the model that Cisco uses in the CCNP DC exam) is a C200 M2 rackable server (up to 2 5500/5600 Xeon CPUs, up to 192GB of RAM, 2 PCI 2.0 Slots).  These are more economical. Blades of this series are also equipped with the IMC (Management Chip), and don’t forget to press F8 during the boot and assign an IP from your management VLAN.
NIC on the C series UCS can be set to one of the 3 modes:
  • Management
  • Shared LoM (LAN on Motherboard, default)
  • Cisco Card


SCOPE command it used to check the state of the LAN adapter:
# scope chassis
chassis# scope adapter 1

There is a possibility of Local Storage on the C series, and there is a RAID Controller. There might be some problems with the Drivers and with the RAID modes you want to choose, but I wont get deep into that here.

RBAC – Role Based Access Control (Management of the User Privileges)

Cisco allows another level of flexibility regarding the AAA. The options for Authentication, or PROTOCOL REALMS are:
  • LDAP
  • Radius and TACACS+
  • Local Authentication (Native Authentication, tied to the local database)

Inside these REALMS you create the PROVIDER GROUPS, which is where you put the Individual Servers. Now we have the Provider Groups where each user chooses the Provider Group in order to authenticate against the correct method.

Authorization (under USER SERVICES) is provided using the ROLES, meaning providing the particular privileges, which is done creating the ORGANIZATIONS, and then relating them to LOCALE (Organizations and Locale are optional). Locales are based on the ORGANIZATIONS, which is how they get into the organizational structure (Operations, Finance or other).

UCS B-Series

The compute hardware managed by the UCS Manager software on the Fabric Interconnects can be B-Series (blades), C-Series (rackmount) or a combination of the two. B series are inside the Chassis, and then they connect with the rest of the Network Infrastructure.

If we use 32 ports for the Virtual Machines on the IOM (Input/Output Module), and one 10Gb Uplink port to the Fabric Interconnect, so we are having the 32:1 Oversubscription.
There are 2 important commands in UCS, which are:
  • SCOPE
  • CONNECT [nxos, iom…], for read only TS tools, such as Logs.


B Series automatically comments with the LAN and with the SAN.

B Series LAN Connectivity

Fabric Interconnect ports can be configured with different Port Personalities, but remember to configure the Fiber Interconnect as Ethernet or Fiber Channel before you continue with this. You can configure the Fabric Interconnect as:
  • Uplink Port (Border Links), going Northbound to the LAN Equipment, and these should be configured as Port Channels (1-256) using LACP only.
  • Server Port, going to the UCS IOM modules.
  • FCoE Port
  • FCoE Storage Ports
  • Appliance Port


The default mode is called End Host Virtualization (EHV) mode, and it doesn’t participate the Spanning Tree. There are two types of links in the Fabric Interconnect:
  • Server links, connecting to the UCS IOMs, which lead to the Blade servers.
  • Border Ports or Border Links, connecting to the Upstream LAN. These links don’t participate the STP and they do NOT forward traffic between each other. Server Links are being PINNED to the Border Links.

B Series SAN (Storage Area Network) Connectivity

The ustream Storage switches need (VSAN or some other) to be in the NPIV mode, so that they support the FCIDs. The default mode of the Fabric Interconnect for the SAN connectivity is the NPV. All the switching will be done in the upstream Switches. There are two types of Fabric Interconnect ports:
  • F Ports, to the Servers (Blades).
  • NP ports in Proxy Mode, leading to the Network Equipment, like VSANs.
  • The PINNING also occurs between the F ports and the Virtual SANs (VSANs), and it will happen in the Round Robin fashion.


FCoE needs it's own VLAN, and it cannot overlap the already used VLANs. To connect the FCoE link to SAN there is also a special switch that understands the Fiber Channel Switching and the Eternet Switching, and its called FCF.
Fabric Interconnect is being treated as a Fibre Channel Mode in this case. Each and every server link is pinned to ONE Uplink. In the storage world there are also Port Personalities, exactly like in the B Series LANs. vNIC is used with LAN, while with the storage we have the concept of vHBA (virtual Host Bus Adapter). In SAN environment we are not using the MAC addressing, but the WWN (World Wide Names), and use them in the Service Profiles.
FCoE VLAN si used for carrying FCoE traffic, and it cannot overlap with any other VLANs. We can use the SAN pin group in order to pin the particular servers to particular ports.

Fabric Interconnect

Fabric Interconnect is basically the L2 Switch, so it’s really similar to the in/host implementation of the N5k. By default it´s not in the Ethernet Switching mode.
Devices are interconnected using two 1Gbps CAT6 links. This redundancy works with Fabric Interconnect, and the UCS Manager Controller App is in charge of the Cluster Redundancy, and handles the Active – Standby roles. UCS needs to Initialize and do the Discovery before it´s usable. UCS is built with Data Management Engine (DME). SSO (Stateful SwitchOver) is also implemented between the Fabric Interconnects. In order for these 2 options to work, we need to cable the FI devices properly, so L1 and L2 are used for the Heartbeats exchange. There are also Management ports on each FI where we assign the management IP address, and there are 8 IOM ports. There are 2 cool commands that you should use to check the discovery process:
# show cluster state
# show platform software cmcctrl dmclient all

By default, the UCS’s main components, the Fabric Interconnects, operate in End-Host mode. By doing this, the UCS system literally looks like a big computer with a bunch of ports to the northbound LAN switches. With this, as long as a company has a standards-compliant network, they are able to simply “drop in” the UCS solution to their existing infrastructure. Because their existing network sees the UCS as just a “host”, the switches don’t think they’re connecting to another switch and therefore, no switching changes are needed.
The Fabric Interconnect uses the EHV (End Host Virtualization) Mode, so that the LAN switches see it as an End Host and not as a Switch, so the Spanning Tree isn´t blocking any ports, all ports are actually ACTIVE. In this mode Server to Server traffic is switched by the FI. The other mode that can be set is the Ethernet Switching Mode, where the Spanning Tree is activated and the Fabric Interconnect starts to act as a Switch.

Service Profiles

This concept is really important for both, C and B Series. Service Profile is a Logical profile of a Blade Server. It´s used to define the policies, and there are 2 groups of policies:
  • Configuration Policies.
  • Operation Policies (Power consumption, firmware and so on).


The important Policy in all the troubleshooting tasks is the Maintenance Policy, which allows you to restart the Blade immediately, User Acknowledged or Scheduled.
Power Policy is set within the Inventory tab, and it can be set to:
  • Non Redundant, as in – exactly the combined power we need
  • N+1, which means the needed ones, and an additional one in a Standby mode
  • Grid, which means the redundancy at a grid level, meaning that we have 2 Power Supplies at one company, and 2 on another.


To see all the ports and the Roles and the Review, go to: Equipment -> Fabric Interconnects -> FI A, and go to “LAN Uplink Manager”:




And for the end, a great Home Lab instruction blog: http://speakvirtual.com/2013/02/08/cisco-ucs-101-installation-and-basic-config-2/




Most Popular Posts