I moved!

Come visit me @ http://www.the-network-core.com!

Link Aggregation on a 3Com 4200G

As I've been building up my lab, I needed to get a backbone switch that would not only support my production/lab network traffic but also iSCSI and to do iSCSI right you need jumbo frames. Lo and behold, I was able to get my hands on a 24 port 3Com 4200G. You might wonder why I would want such a thing (and trust me... it's not your father's Cisco) but I was able to get it for free and it's fully managed (and they're only about $150 on Ebay). HP actually recently released an updated firmware and boot code for it which fixed a few bugs (get it here)- and it was their first one in something like five years. These might be made by the black sheep of the networking world (I don't know many that actually like 3Com switches) but they support many of the functions that I'll need for my lab - namely link aggregation and jumbo frames.

Speaking of link aggregation, let me tell you about how I thought 3Com implemented ether-channel and then actually show you the hidden way to do it. Basically my set-up is as follows: I have an ESXi host with four NICs. Two for production traffic and eventually the other two will be for iSCSI. I'm running 5.1 and my vSwitch is set up as follows:

Pretty standard - nothing extra going on. So I head on over to my 4200G and create, what I thought was, a load sharing link-aggregation group.

[4200G] link-aggregation group 1 mode manual
[4200G] interface GigabitEthernet 1/0/11
[4200G-GigabitEthernet1/0/11] link-aggregation group 1
[4200G-GigabitEthernet1/0/11] interface GigabitEthernet 1/0/12
[4200G-GigabitEthernet1/0/12] link-aggregation group 1
[4200G-GigabitEthernet1/0/12]

Now since ESXi doesn't support LACP without a vDS and I wouldn't want to use a vDS on my management network, etherchannel is my only option and I thought what I was doing created that. Well turns out I was wrong. I went to deploy my vCenter appliance and then went over to see what my networking usage was out of the blue. Suddenly I noticed that my second NIC... hadn't been used at all over the last hour and I know it should've been. I started to investigate between the 3Com's config and the setting on the ESXi server. All seemed correctly set up but just the odd behavior of all the traffic going down one pipe for every VM that I created. I did a "show interface" on the 3Com port that my server's second NIC was plugged into... I then saw something interesting:

[4200G]display interface GigabitEthernet 1/0/12
 GigabitEthernet1/0/12 current state : UP
 IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 0024-731c-1d4e
 Media type is twisted pair, loopback not set
 Port hardware type is 1000_BASE_T
 1000Mbps-speed mode, full-duplex mode
 Link speed type is autonegotiation, link duplex type is autonegotiation
 Flow-control is not enabled
 The Maximum Frame Length is 9216
 Broadcast MAX-pps: 1488100
 Unicast MAX-ratio: 100%
 Multicast MAX-ratio: 100%
 Unknown Multicast Packet drop: Disable
 Unknown Unicast Packet drop: Disable
 Allow jumbo frame to pass
 PVID: 1
 Mdi type: auto
 Port link-type: trunk
  VLAN passing  : 1(default vlan), 2, 4, 20
  VLAN permitted: 1(default vlan), 2, 4, 20
  Trunk port encapsulation: IEEE 802.1q
 It belongs to a link-aggregation
 Master port: GigabitEthernet1/0/11
 Last 300 seconds input:  2 packets/sec 1957 bytes/sec
 Last 300 seconds output:  2 packets/sec 322 bytes/sec
 Input(total):  274612 packets, - bytes
         - broadcasts, - multicasts, - pauses
 Input(normal):  274612 packets, 23868716 bytes
         2463 broadcasts, 3080 multicasts, 0 pauses
 Input:  0 input errors, 0 runts, 0 giants,  - throttles, 0 CRC
         0 frame,  0 overruns, 0 aborts, - ignored, - parity errors
 Output(total): 540857 packets, - bytes
         - broadcasts, - multicasts, - pauses
 Output(normal): 540857 packets, 669171676 bytes
         11800 broadcasts, 99165 multicasts, 0 pauses
 Output: 0 output errors,  - underruns, - buffer failures
         0 aborts, 0 deferred, 0 collisions, 0 late collisions
         - lost carrier, - no carrier

Not quite sure what a "master port" was, I went to ask wise old Google. It came back with links that referenced 3Com link-aggregation ports and the best I could discern was that when a link-aggregation group is created, a master port is chosen by the lowest port number in the group and all traffic is sent through that port and the others are used for "backup".

This bummed me out a little and I spent the next hour playing with LACP and this link-aggregation group setting to see if I could make it work. Nothing... I could not get my ESXi server to send or receive data on both ports at the same time no matter what I did. Last resort I did what any good network engineer would do:

[4200G] ?

I'm not quite sure of what I was looking for but I came across a curious command:

port-group

Huh? 

[4200G]port-group ?
  INTEGER<1-100>  Specify port-group ID

[4200G]port-group 1 

With a ? I can see that I can add ports to this port group. I asked Google again what this "port-group" command was but there was a big fat zero hits on it. Eventually I just figured it couldn't hurt to try it so I blew up the link-aggregation group and threw my two ports into this new "port-group" and logged into each of my server to do a transfer from a NAS to test. 
 
[4200G] undo link-aggregation group 1
[4200G] interface GigabitEthernet 1/0/11
[4200G-GigabitEthernet1/0/11] port-group 1
[4200G-GigabitEthernet1/0/11] interface GigabitEthernet 1/0/12
[4200G-GigabitEthernet1/0/12] port-group 1
[4200G-GigabitEthernet1/0/12]

Here's the results... Check it out:

"Houston, we have lift off". I couldn't believe it. Not only is there NO reference to this command anywhere in the manuals that I've read but it seems to be mimicking Cisco proprietary non-LACP etherchannel. I'm still pretty stunned and happy to say the least.

Lab time! Part 2

So here I am with three sweet servers for $600. I now had another issue to solve...

How do I use them?

Funny as it may sound, something I do everyday at work slipped my mind, before my wife asked me how much was my lab going to cost us overall when I mentioned buying the servers. I then sat down to think about what my design goal was and here's what I came up with:

• With three servers I can dedicate one to running my home server infrastructure (ie. AD, DNS, etc.)
• I can run my VMware lab on the other two by virtualizing three ESXi servers on each of those hosts
• I wanted to use shared storage from the get-go just to get more practice in and to test some theories out (like running VDI completely off of NFS since vSphere 5.0 and above can reference the storage device by DNS name now... not exactly sure how View composer is going to react to that, but we'll see). Just needed to pick out a NAS that supports VAAI
• On the physical side, I need to completely enclose these servers in some kind of sound proof rack so I wouldn't drive myself and my wife crazy when we're up here in my office trying to relax.
• I would need a gigabit switch with jumbo frames and port channeling (LACP) for decent iSCSI performance
• I would need a good UPS with at least voltage regulation and hopefully of the pure sine wave type

I settled on using a Synology DS1512+ for the shared storage because of the VAAI support, dual nics, five bays and nice reviews (http://www.smallnetbuilder.com/nas/nas-reviews/31774-synology-ds1512-disk-station-reviewed). I'm also going to use a TP-Link TLSG2216 to run the network because of the low cost (roughly $150), LACP support and jumbo frames. From a high-level standpoint, this is what my lab will look like:

(on a side note... yes it does say 2.5GHz for the processor speeds on that picture. That's because I'm still on the fence about picking up some cheap low power Xeon L5420's to swap in there)

Next up... how I will keep my sanity while using the lab.

Lab time! Part 1

I've been wanting to start writing about my adventures in home lab building but it's been difficult to come up with a way to talk about it that hasn't been hashed out one way or another before somewhere else. I've lost count of the number of web pages and forum threads that are devoted to building a VMware home lab so instead of rehashing all their posts here I think I'm just going to write about how I'm building mine, what I'm looking for design wise, and how much I'll be spending on each item. I hope these next series of posts will help someone else out as well.

My first objective of this home lab project was overall conceptual design. How was my lab going to look at from a high level overview and how was it going to function the way I was hoping it would. Since I don't have access to an actual lab at my work, I needed to build something that could not only act as a host for my own servers but that I could use to VPN into and test work stuff out on as well. I  knew from the beginning that one server wasn't going to do it for me... even with the ability to virtualize ESXi on top of itself. Basically it boiled down to I didn't have or want to spend $1500 to $2000 on a few machines that might cost me a bunch just to keep them running. I messed around with the possibility of building a AMD 8-core Bulldozer based "server" for a while because I could find a few deals that had the processor and board together for about $250 (namely at MicroCenter) but every time I came up with a price, I was still looking at around $500 - $700 for just 1 host with 32GB of RAM and some add-ons that I was specifically looking for. Since I'm a scrooge with my own cash I kept looking for a better deal. After months of searching for the right gear, I hopped onto ebay one day and saw this puppy:

I'll have to admit that after sitting there thinking about it I got a little excited. Dual quad core low- power 64 bit Xeons (with VT-d support) and 24GB of DDR2 FB-DIMMs with a 160GB hard drive, dual on-board gigabit NICs and a tiny 280W power supply... and it was half size. Every other time I was searching for cheap servers the usual batch of them came up with 4 to 8GB of DDR2, full size, 120W TDP processors that would cost me an arm and a leg to run and when I went to price it out, the extra RAM totaled four times the cost of the server itself. Not only that, but I know how servers were built during the days of socket 771... Loud. Very loud. These servers that I wanted needed to be housed in my office which also served as a night time get-away for my wife after we put the toddler to bed since we have a couch and TV in here. 

On a side note: Let's be honest here for a second... I'm not really sure why everyone wants hardware pass-through on their home server. Granted, you can do some really tricky storage related things with it but for all intents and purposes, if you're building a lab to mimic a real world scenario and to study for VMware certs, is it that important? Back to the fun stuff...

Now, I was hoping to go max RAM on VMware Hypervisor but for the price I was getting these servers for, I wasn't going to bitch about being only 8GB short per server. To be honest as well, picking up three of these for $600 and some change was a steal. I had an entire three host cluster for the price of one newer computer. I also told myself I would find a way to make these guys run quiet and I would have to do it without breaking the bank.

Stay tuned to see how I accomplished this feat!

View 5.1 certificate for multiple connection servers

I apologize for the delay with posts. I've been pretty busy at work keeping everything ship-shape. I finally got to a point where I could start thinking about some redundancy in our View environment and after going through some documents and other blogs, I decided to go with two load balancers on the outside connected to two security servers which in turn have two dedicated connection servers on the inside. Then on the inside I have two dedicated connection servers and two load balancers (btw, I've been testing out Zen Loadbalancers internally and so far, for open source, this program is pretty impressive - and it's still being developed!)

The one thing that had me a little stumped was the SSL certificate. I was going from one connection server and one security server to four connection servers and two security server. My original design was for view.<organization>.com to be reachable no matter where you were - inside or out and I wanted to keep it that way. Well, the problem was that the certificate I purchased was of the single domain variety for around $40 from GoDaddy. I loaded that cert on both the original security server and connection server and had my internal DNS doing eveything for both the servers. That worked out just fine... until now. I didn't want to ask to purchase a multi-domain SSL cert and I didn't want to risk re-keying the original with a CSR that had multiple subject alternative names (SANs) due to the fact that GoDaddy's support site said you had to purchase a multi-domain SSL to use SANs in the first place.

Well the answer it turns out, was our internal CA server. I kept the GoDaddy cert for the outside servers and installed a new internal cert on our internal connection servers. As it's being tested out now, everything is working just fine (just need to convert and upload the CA's root certificate to the zero clients and I should be good to go). Since it's not clearly documented anyways on how to actually create a multi-domain CSR, I thought I'd document the process here. This process is for a Windows Server 2008R2 machine.

Step 1) Enter MMC and open the certificates snap in

Step 2) Right-click, go to "All Tasks" --> "Advanced Options" --> "Create Custom Request"

Step 3) Start the enrollment process

Step 4) Select "Proceed without enrollment policy"

Step 5) Under "Template" select "Legacy Key" and keep "PKCS #10" selected under "Request Format"

Step 6) Under "Custom Certificate" hit "Properties"

Step 7) Under the "General Tab" type in "vdm" as the "Friendly Name"

Step 8) On the "Subject" tab, select the drop down for "Subject Name" and select "Organization". Type in the FQDN of the DNS entry point for your internal View clients (ie. view.yourdomain.com) and hit "Add". Then for the drop down menu under "Alternative Name", select "DNS" and being by entering the FQDN of the DNS entry point

Step 9) Then add a "DNS" entry under "Alternative Name" for each or your connection servers (this is vitally important if you're going to load balance connection servers).

Step 10) On the "Extensions" tab, under "Key Usage", add "Digital signature" and "Key encipherment"

Step 11) Then under "Extended Key Usage" select and add "Server Authentication" and "Client Authentication"

Step 12) On the "Private Key" tab and under "Cryptographic Service Provider", have only "Microsoft Strong Cryptographic Provider (Signature)" and "Microsoft RSA SChannel Cryptographic Provider (Encryption)" selected

Step 13) Under the "Key Options" section, choose your key strength. I chose 2048 and marked the key as exportable in the example.

Step 14) Click "OK" and it should bring you back to this screen

Step 15) Hit "Next" and select where you want to save the CSR. Make sure "Base 64" is marked as the format.

Congrats! You now have a CSR for your load balanced View environment created with Windows Server 2008R2. The next step is up to you, but I chose to have the cert signed with our internal CA to save some money. Getting a multi-domain certificate can be a little expensive. One of the drawbacks to having an internal CA signed certificate is you have to load the root CA on mobile devices but depending on your MDM platform, that could be an automatic thing for you.

I'm still here

Two months.

That's almost an eternity in the online world (and quite frankly, the real world as well if you've been as busy as I have). To tell you the truth, I've been a little nervous to write this post as sometimes I feel like there's just not enough time to actually write down everything that's happened. Just in the small amount of time that I've tried this blogging thing, I've grown an immense gratitude toward everyone that has the propensity to sit down and actually crank out post after post every two to three days... AND have something original to write about (or at least something nice to say). I really do want to have this blog work and maybe when my real work slows down a bit I can get a little bit deeper into writing a bit more. I just really wanted to stop by and say that I haven't abandoned this blog (not that anyone actually reads it right now anyways) and hopefully in the near future I'll have a more meaningful post for you... Like the process of building up my home lab - which I'm really psyched about!

Talk to you soon

First networking related post

This is what happens when you have time to manage some cables:

BEFORE....

And this is what it looks like now (with two more 48 port patch panels)

There's been a year lapse between the two pics with the first being taken right after I took over the Network Engineer's position. Since then we completed the network core upgrade (moved from RIP to OSPF and implemented a redundant campus architecture) added a VNX5300, six ESXi servers (with 10 NICs each) and a partridge in a pear tree. I'm now going to work on removing the run of cables on the left and moving them down to a more modular patch panel design like on the bottom right. I can't wait to do this to the rest of our network closets.

Weird storage vMotion issue

I had a server template that I created on a ESXi 4.1 cluster and moved to a ESXi 5 cluster. After I did that, I upgraded the hardware version and remade it into a template and left it at that. I had been successfully deploying VM's from this template for a few months so I never thought there was something wrong. Well today I've been moving VM's to a new storage cluster on my vSphere 5 data-center using storage vMotion and when I got to this particular server, I converted it back into virtual machine and tried to vMotion it to the cluster. Well at 99% it fails with an "invalid configuration for device 12" error.

Huh?

Some searching turned up a buried post saying that it was an issue with the MAC address on the vnic. So I removed the old nic and added a new one and presto! Storage vMotion worked.

Weird.

Comments...

Apparently they're broken. I need to fix them.

edit: fixed them.

Off in the Horizon...

Application virtualization has been on the rise for the last few years with all the different mobile platforms available. Citrix has been doing it for years... well they've been presenting users with a remote app type environment at least. You can't really call that "virtualized" when the user has an entire session on a terminal server all to themselves. VMware's Thinapp is a whole lot different though. When you take an entire application and box it up into an MSI package then stream it to a user... that's what I call virtualization. So the question is how do you present that Thinapp to the end user? VMware's solution is their Horizon Application Manager.

I've been a little leery of actually using Thinapps in our environment. One reason is the fact that it is a shared application package and I don't know how it will react to 300 users accessing it at the same time... but you can't find solutions to problems by sitting around worrying about the outcome so I'm delving into it a little at a time.

Last week I decided to give Horizon Application Manager a shot and see what it was all about. I needed a solution to start streaming some applications to virtual desktops so that I wouldn't have to install the software on each of them (which can be a pain). I read through the documentation and some blogs about installing it and here are my reactions to the installation process. Please note that these were jotted down as I was installing the product and therefore are in chronological order. The things I had issues with in the beginning I ended up fixing later on but you'll see what I mean.

- When deploying the template, you need to assign an IP address to the virtual machine but when powering on the machine, there must be a pool of reserved IP address on the virtual switch of the VM or else the virtual machine won't power on. But the IP address that is assigned to the VM can't be a part of that pool even though it won't be assigned an address within that pool...

- When setting up a test environment and you do NOT use the connector virtual machine (which is allowed) the local user account that gets created doesn't seem to be allowed to log in. If a password gets emailed to the administrator email, there is no option to set a SMTP server to sent the email through... and if the virtual machine assumes that it can just use the outside MX records, that's a pretty big flaw. The end result was me not being able to log in and having to delete the VM and redeploy from the template

- when setting up an organization and you wish to change the organization's name, you can't go back in the set up. you're stuck permanently with the name you've chosen

- when setting up the conntector it won't join my domain giving me a "Failed to join the domain: ERROR_INVALID_COMPUTERNAME" error.

- apparently I missed the part where during the connector set up they said it was vitally important to active directory sync to set a hostname. No option to go back and change the hostname anywhere on the connector console or in the web ui.

- when setting up the system to join our domain, I had to log into the SLES console, change the hostname and edit the /etc/HOSTNAME file. Only after I changed those values and rebooted was I able to join the domain. not fun.

- After enabling windows authentication (after I've already completed the wizard once without activating it), access to horizon stopped with a 404 error. can't log into manager. I may have to delete the connector in App Manager...

- No warning about loosing connectivity to app manager and needing to put the activation code back in after deleting the connector... and now I have to figure out how to regenerate an activation code from the app manager console

- Found out that there is a built in account named "operator" whose password I set earlier. Where was that in the documentation? 5+ hours wasted.

- No automatic agent installation from the browser... I had to go get it from VMware's site.

- No way to remove a Thinapp from the list of available apps without going into the console and deleting a file. That's kind of crazy

- The application management itself could be way better.

So the end result was finally a working Horizon installation. Repackaging previously packaged apps to work with Horizon is a little bit of a pain but it worked.

Long time no post

I apologize for the absence, but work/studying and wedding planning has taken all my time recently (not to mention I screwed up the template on this blog and after that I just didn't really feel like fixing it). I did end up taking an passing the VCP5-DT exam last month so I'm now officially a VCP5-DT. I've got a few things to write about here soon like my VMware Horizion Manager installation experience and studying for the CCNP ROUTE exam. I'll post more later.

So, what's next?

VCP5?

Done! :)

Guess I should work on VCP5-DT since it should be short and sweet (been using View since last year and I've gotten pretty intimate with it)

View 5.1 BUG Alert!

I found one!

I just upgraded our environment to the latest build of 5.1 over the weekend and in the processes upgraded the agent to 5.1 on our base virtual machines. On Tuesday, one of our users (who's using a zero client) reported they could no longer change the resolution to their desktop. I checked all the settings as recommended by KB article 1020809 and even though I could move the slider on the display settings (it is a Windows XP virtual machine) and then apply it, the display would then go dark like it was changing the resolution and when it came back, the resolution would still be the native resolution of the monitor. I even tried a little documented command:

VMwareResolutionSet.exe 0 1 , 0 0 1280 800

(btw, that command is located in "c:\Program Files\Common Files\VMware\Teradici PCoIP Server\")

which sets the resolution on the first monitor to 1280x800... no luck. Same outcome as before. One of my co-workers who also has a zero client and a Windows 7 desktop tried to change his to test and his wouldn't change either. The only resolution we could change it to was 800x600.

When I dropped the user down from agent version 5.1 to 5.0, they could again change the resolution settings. I told VMware about the bug but so far, I haven't received any type of response back from them. Hopefully they'll have a fix out for it soon.

update: Turns out it was the firmware version on the zero client. As of the time of this writing, there wasn't a firmware that supported View 5.1. This issue has since been fixed.

ESXi, vCenter and Active Directory

I don't have any confirmation on this (in fact VMware support has no idea how this happened), but after spending 11 hours on Saturday rebuilding one of my vSphere servers (which houses the entire View environment), I think I figured out why 90% of my vm's went orphaned on me after I took the server offline for some hardware upgrades (like ironically, a fibre HBA to hook into our new EMC VNX5300).

When I originally built this vSphere environment, I did so with the thought that this would be all I get to work with. I didn't have any shared storage (not even a decent iSCSI/NFS store), nor did I have vMotion... and apparently I didn't really know exactly what I was doing ("gasp!" - getting that out was hard for me because I hate to think that I did anything wrong). I had an idea of what I wanted but VMware was still a little new to me. Fast forward six months, and I've gone through "Mastering vSphere 5" twice, read most of VMware's vSphere 5 documents and have taken the vSphere 5 class (my VCP test is registered for June 4th). I have a MUCH better understanding of how the whole vSphere environment works. So this is how I think I killed 96 virtual machines - causing me to re-register each and every one of them and taking down my entire View environment.

I added the ESXi host to vCenter using a domain account whose password changes every 60 days.

See, I went through and set up access to the ESXi host before adding it to vCenter. I really didn't understand how vCenter played such an important role in management until recently. Here's my train of thought (granted, none of this is verified - just my own suspicions):

• I add the ESXi host to vCenter with a domain account
• vCenter cache's the username and password used to connect and authenticate the ESXi host
• I add some VM's to the host through vCenter
• vCenter uses those cached credentials to register those VM's with the ESXi host itself
• My domain account's password is changed
• I then proceed to build out my entire view environment on this host
• Each time a VM is created in vCenter, vCenter adds it to it's database then tries to register it with the ESXi host using the original cached credentials
• uh-oh... those credentials are expired. vCenter gets to actually create the virtual machine files on the datastore but the ESXi host refuses to add the VM to its list of hosted virtual machines
• Fast forward to Saturday and I take the host down to put the new HBA cards in it
• When I bring the host back online, vCenter tries to re-add the host but is unable to do so using the cached credentials
• I have to re-add the host to vCenter, this time realizing I need to use the ESXi host root username and password.

Again, this is my speculation, but it seems to be the only logical answer to how this happened. I mean, there's no way taking a host offline on purpose should make 90+ VM's orphaned you know?

Anyways, if anyone ever reads this and they know of official documentation from VMware that supports this theory, I'd love to read it!

Hostnames and View Volatile Environment Registry Entries

We're starting to deploy a large amount of linked clones that require the zero client machine name to base network printer mappings too. I created this batch script to grab the volatile environment machine name key and shove it into a environmental variable but before I go on with the story, here's the batch script if anyone can use it for something else:

@echo off

FOR /F "tokens=4 delims= " %%A IN ('whoami.exe /user /sid') DO SET RegKey="HKU\%%A\Volatile Environment"

c:\windows\system32\reg.exe copy %RegKey% "HKCU\Volatile Environment" /f /s

c:\windows\system32\setx.exe (your variable here) -K "HKEY_CURRENT_USER\Volatile Environment\ViewClient_Machine_Name"

So a few weeks go by and the new guy on the staff get's asked to build another script to map the network printer... now he's never worked with VMware View before so keep that in mind. I go off to fix some end user issue and the next time I see him two hours later he's still working on trying to write the script but he asks me to come over and take a look at something so I do. He then proceeds to type in:

echo %ViewClient_Machine_Name%

into a command prompt and wouldn't you know... his zero client's name came up. I was like "wha??". So I had him log into his desktop using his iPad and try it again. Low and behold, the variable changed. I was like "no way". I had literally worked a half a day on that above script to get the variable created based on the key location within the HKEY_USER sub section of the registry. I guess my next question is why isn't that info documented more... The fact that all those volatile environmental entries in the registry are already made into environmental variables slipped past not only the View class I took but also 98% of all web pages out there. Grrr.

quick way to break a virtual desktop...

Just FYI. If you take ownership of the c:\windows\system32 directory away from "nt service\trustedinstaller", you'll break vmware view.

Quick Java commands to compile a jar file

This is almost for just me, but maybe someone else could use the info as well.

To compile the source code into class files (I didn't have the JDK directory in my path, hence the long command):

c:\<directory to jdk>\bin\javac.exe c:\<src directory>\file.java

Once you work out the bugs to the class file (errors and warnings) you create the jar file with the following command:

c:\<directory to jdk>\bin\jar.exe cvfm <name>.jar manifest.txt com/

The "cvfm" portions are flags for the jar compressor. <name>.jar is the output file name you want. Manifest.txt contains the directory listing of class files. com/ is the base directory of your class files.

Lessons Learned

User logs into their View virtual desktop using the EVGA PD02 Zero Client (awesome machine btw), spends a few hours doing something then disconnects from the virtual machine and goes to lunch. When that user gets back and tries to re-log into their disconnected session, the virtual desktop kicks them out and the screen goes right to the login prompt on the zero client again... W...T...H...

It literally took me a week (and unfortunately a call to VMware support) to figure it out. No other person that's been using View had this problem. I uninstalled and reinstalled the View agent. Deleted and recreated the pool (twice). Tried every PCoIP and View agent group policy setting I could find that might remotely have anything to do with disconnected sessions...

nothing...

called to VMware support went like this:

VMware Rep: I see your problem is *(removed for brevity)*. Let's do a Webex.
Me: Awesome - here you go
Rep: Ok, let's first check the power settings...
Me: *(sound of hand slapping forehead in a moment of clarity)*

turn the damn monitor sleep settings in windows 7 OFF or else you won't reconnect to the session using PCoIP. It seriously took me a week to get that problem fixed.

So sometimes calling support is the right thing to do... and they're not all idiots

Lesson learned.

SANs amore

Incoming EMC VNX5300 SAN



I'm pretty stoked about this. I'll post more once everything is finalized and talk about the design concepts I've been dreaming up plus how everything will be connected from the ground/network on up.

Stay tuned!

Next solution please...

I have a real disdain for level 1 tech support. I know those people work hard and that they more than likely don't get the right kind of training to support questions from people like me, but can I have a level 2 tech support pass for every company I deal with? Please!? I get irritated when I have to spend 45 minute fielding questions such as, "did you reboot the pc?"

ok... /rant off

That had to do with calling Imprivata support support earlier today. It wasn't as bad as getting asked if I rebooted the virtual machine, but the guy on the other end clearly was having a problem fully understanding what I was trying to convey to him.

I was at the end of building a Windows 7 virtual machine for a contractor of ours and for some odd reason when I would sign into the View connection server then log into this desktop, Imprivata would pop up their logon UI asking for me to put in my credentials again. Kinda annoying. So the good tech on the end of the line spent about 15 minutes trying to decipher what I was talking about so that he could put some keywords into their little KB article search engine and try to find an answer for me. Well, like always there was no KB article for my problem, so he took my info from me and told me he'd look into it. Two hours later I get an email from them stating that the solution to my problem was a registry hack to use Kerberos authentication only. "Okay... might as well try it..."

Nope, not it. So I went digging myself and found http://portals.imprivata.com/ftp/SFAttach/Credential_Provider_Wrapping.pdf

after checking out that ISXCredProvDiag tool on the virtual desktop, I saw that the VMware Agent wasn't hooked.


so I wrapped it up, rebooted and BAM... authentication passed through from the connection server. Sweet.

Imprivata OneSign Agent version: 4.5.54.54
VMware View Agent version: 5