Service console question

Similar Questions

• Newbie question: accessibility vs. insulation Service Console

  Hi all

  I wonder what people do in practice to balance isolate the service console/vCenter to be able to access essential services (updates, NTP, etc.) and to administer the host and vCenter.

  Quick reminder:

  Local government, not a department store. Just is about to go into production with ESX3.5/VC2.5, have licenses for the VDI which is one of the reasons why I'm not starting with v4. Had ESX in test for about a year.

  Network is a bit sophisticated, equipment Alcatel, can do VLAN etc., but managed by one other team so I didn't know very well how it can or can not do access control.

  Firewall is on the periphery of the network only; an inter - VLAN firewall or an ISA Server would be new for me, and probably ask a negotiation.

  Because I'm not quite yet in production, I know that my best chance now is to configure the network according to best practices. I have read the Security Hardening Guide, now I'm hoping to get some opinions 'the street '. Should I go the distance and set up a firewall, or can configure us a VLAN enough tight to be a good (if the second best) choice? What are the trade-offs of usability? How do you get updates if you do not connect that network to the Internet? All the creative solutions out there for the budget conscious?

  Thanks for your help,

  Jenna Flanagan

  City of Belmont COMPUTER service

  The service console is often regarded as the "keys to the Kingdom", if it is compromised, you have access to all the guests running.  the hardening guide is a very good starting point, an internal firewall would be a very good option there are several out there that are safe, but have a low learning curve, ISA is one, but there so smoothwall.

  However that said, even VLAN even though they are not considered as a security mechanism, should be used to separate your traffic, more important still is to separate traffic flows.  Make sure that your Service console and VMKernel traffic are separated from your Production comments traffic, this may be at the lowest level by exchanges and VLANs (not particularly sure, but better than nothing), moving to separate from Teddy and vSwitches and finally a game completely separated from pSwitches in order to guarantee a circulation independent flow (very safe but also very expensive.

  How many bears will you have in the comments. We're crazy.  with as little as 4 pNiICs you can start the design with real security in mind.

  vmnic0 + vmnic2-> traffic Service Console and VMKernel

  vmnic1 + vmnic3-> traffic Production comments.

  Very good Ed Haletky (Texiwill) reading series on the placement of NIC in design found here

  Now you are aware that the view output 4 is just around the corner, (guesstimated release date: mid November) this would introduce you to all the benefits of vSphere and use of VDI.  just a thought

  If you have found this device or any other answer useful please consider useful or correct buttons using attribute points

  Tom Howarth VCP / vExpert

  VMware communities user moderator

  Blog: www.planetvm.net

  Writer on "[vSphere of VMware and Virtual Infrastructure Security: securing ESX and virtual environment | ]. "[http://www.Amazon.co.uk/VMware-vSphere-Virtual-Infrastructure-Security/DP/0137158009/ref=sr_1_1?ie=UTF8&s=Books&qid=1256146240&SR=1-1].

• Service console and VM kernel port group Question

  I have the separate subnet of installation for the service console and the port the kernel VM group. Currently, I plan to install the software iSCSI adapter to connect the LUN. Is there something else I need to do to configure?

  It is said that if the console VM kernel and service are in separate groups of port.

  Usually I use a different physical network for iSCSI.

  But if you only have two network adapters is not applicable.

  Don't forget the vmkernel interface used for iSCSI is in the same logical network and same VLAN as your iSCSI target.

  I need to create a service console more, I do not have it?

  With ESX 3.x, you need a SC for iSCSI (or routing rules).

  With ESX 4.x is not necessary.

  André

• What is the cause of the message "Waiting for Service ' Console CVD activity

  I have two related questions.

  basis, I just started centralizing 200 computers ish, all except 2 appears fine, 2 questions, one below and another with VSS errors.  This message is just for the question "in waiting for the Service.

  1. What is the cause of the message "Waiting for Service ' Console CVD activity and is there anywhere that documents these meanings of status.
  2. No idea where I should start troubleshooting the message "Waiting for Service ' I get to the computer below.

  I have a computer with this status which comes to have installed the client and will not be to centralize.  Other computers seem to work properly (centralized).

  The computer is to ping requests, but appears as disconnected in the console.

  I deleted the CVD and restarted the centralization CVD using a different policy on a different volume without change.

  Journal of the history of CVD below

  Description of the Type of weather

  31/01/2014-08:52:32 AUDIT_EVENT assign device, device: PC30866 (1995), cardiovascular disease: 11614, political CVD: don't Default - every 4hrs - no drive D (1.1)

  02/05/2014-13:53:58 politics AUDIT_EVENT assign CVD, CVD: PC30866 (11614), CVD policy: Migration Post-quotidien (1.0)

  31/01/2014 General Office EVENT 20:44:46 service error

  31/01/2014 General Office service EVENT 17:39:04 error

  31/01/2014 14:44:34 EVENT has not finished downloading, internal error, exception attached

  31/01/2014 General error from the EVENT 13:05:15 service office

  31/01/2014-12:30:37 TRANSACTION_START PC30866 - centralize endpoint

  the transaction log has an inscription mentioning a failure (not sure if it is the server or PC related) disc.

  Diseases cardiovascular diseases cardiovascular name Type State layer size (MB) data transferred (MB) branch reflector savings start time end time transfer (MB)

  Of the endpoint PC30866 centralize 11614 reading disc failed 169648 1531 0 31/01/2014 12:30:37 05 d 04:16:52

  The next event is in the application event log and the Mirage event log for the failed computer. (there were not all other errors in the paper since the deployment of mirage customer and there is no errors in the system event log)

  Event type: error
  Event source: VMware Horizon Mirage customer
  Event category: no
  Event ID: 0
  Date: 31/01/2014
  Time: 20:44:46
  User: n/a
  Computer: PC30866
  Description:
  Error general service office
  Unexpected exception taken (sender Name:Wanova.Desktop.Service.exe
  There is no policy context.
  , the object exception System.OutOfMemoryException: Exception of type 'System.OutOfMemoryException' was thrown.
  System.Collections.Generic.List to ' 1.set_Capacity (Int32 value)
  System.Collections.Generic.List to ' 1.EnsureCapacity (Int32 min)
  to System.Collections.Generic.List' 1. Add (T item)
  at Wanova.Net.DataTransfer.TransferStreams.SignatureResponseStream.ProcessChunk (ChunkInfo chunkInfo)
  at Wanova.Net.DataTransfer.TransferStreams.ChunkInfoDecodingStream.BeginWrite (Byte [] buffer, TransferStreamWriteCallback onWriteComplete)
  at Wanova.Net.DataTransfer.DataHandler.ExecuteDataStreamTask (DataHandlerExecutionTask task, MarkCompletionCallback markCompletionCallback)
  at Wanova.Net.DataTransfer.DataHandler.ExecuteTask (IExecutionTask task, MarkCompletionCallback markCompletionCallback)
  Wanova.Net.DataTransfer.ExecutionController.QueueListener (Group IExecutionTask)
  to Wanova.Common.ThreadUtils.ParamaterizedWorkItem'1.Run (object fakeParam)
  at System.Threading.QueueUserWorkItemCallback.WaitCallback_Context (Object state)
  at System.Threading.ExecutionContext.Run (ExecutionContext executionContext, ContextCallback callback, Object state, Boolean ignoreSyncCtx)
  at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem)
  at System.Threading.ThreadPoolWorkQueue.Dispatch)
  at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback (), ends at True)

  For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

  It turns out that this computer seems to have hard drive errors, so not a matter of mirage.

• Command not found in the service console ESX 4.0 u2

  Hi all

  I have a very simple question.

  I have haven´t access to the service console ESX 4.0 for some time and today I need run commands to verify information on some host bus adapters.

  I logged a user then used 'su root' to switch to the ROOT user.

  I use Putty to connect to the Service Console.

  But when I try to execute the following commands it said "Command Not Found":

  vmkload_mod

  esxcfg-module

  I read VMware KBs, that say to use these commands for this version of ESX, but I can´t do run.

  I think the answer is something very simple, but I can´t find it.

  Anyone have any ideas?

  Thank you

  Mark

  Try this command:

  quo

  as documented in http://kb.vmware.com/kb/1006573

• Export data to a drive that is mapped to the Regional service console server

  Hi all
  I have a question regarding the export of data from the Regional service console:

  can export us the data to the drive mapped in the Regional service console?

  Is it possible and how can it happen?

  We sent our local drives to the server and tried to export data from the console of Regional service to that mapped drive. The process has failed. Could you provide information why it go failed with the mapped drive.

  Waiting for your update.
  
  Thanks in advance

  Make sure that the user must have write access to the shared files (mapped drive)...

• Update of the modules for security issues ESX service console

  Today, I was asked a question on the vervsion of OpenSSH used on the service console for our environment vSphere 4.0. Apparently, there is a vulnerability in OpenSSH 5.6/7 with a certificate which has been corrected in version 5.8. My response to the security team has been we are the 4.3.p2 and as a result, this issue does not concern us. So the following questions then becomes why you are not in the latest version?

  I'm curious to know if someone has already discussed with VMware on these types of security issues where the components used by RHEL, like OpenSSH, are vulnerable. What was their response to attempts to update this kind of things? I guess some of the answers would not be supported, you'll break, if you patch it's no guarantee your fix will not get downgraded, etc..

  I'm looking for is a solid answer that explains why we do not have that kind of stuff to ESX, only when VMware provides the fix. I could contact the support, but I thought her first check and see what others have met.

  Thank you

  Hello.

  I think that all the reasons you mentioned (not supported, you're going to break, if you patch it's no guarantee your fix will not get downgraded, etc.) are pretty much true.  The ESX 4.1 Patch Management Guide stated in the FAQ section:

  When a rpm on my ESX host has an equivalent Linux, can I use the Linux RPM to upgrade my system?
  N ° VMware recommends that you update your host ESX 4.1 with RPM provided by VMware.

  An answer I could use would be to take a step back to look at the bigger picture.  Is a SSH, which should be secluded/protected to some extent in a first time, have a vulnerability more risky than having an ESX host unstable/not supported with X number of VMS running on it.

  Good luck!

• In the Service Console the path value preferred on vSphere?

  Hello

  We have a problem here.

  Environmental: political vSphere Host, 8 HBAs, path: fixed path of vmware, on 1,000 paths to storage

  To reduce the total number of paths we want to reconfigure our warehouses of data and reduce the number of used HBA for warehouses of test and reference using only 2 of the 8 host bus adapters. We use all the time, then put 6 of them on all our servers of vsphere for people with reduced mobility, only two remain active.

  That is why we have active and people with disabilities with the help of a script on paths of console service - it works very well.

  But after that we reduce active host bus adapters, vsphere seems to forget reset the preferred path (just checked in the GUI). We put vmhba1 and vmhba7 to be active, 0-8 (except no. 6 as is the lsi controller) should be disabled, but on most of these disabled HBA Lun remains the favorite.

  On esx 3.5 service console, we were used to:

  / usr/sbin/esxcfg-mpath - favorite - political fixed = - lun = $lun - path = $: ${lun # *------:}}

  but these options (favorite, political) seem to be outdated since vsphere, which apparently obtained these commands on the api storage?

  Can someone answer the following questions on this issue:

  1 did affect the feature if you prefer the path is one of the disabled?

  2 will be the vsphere host keeps this configuration after reboot (disabled HBA to a lun, active paths)?

  3. is there a new command to set the access path AND / OR politics (MRU, FIXED, RR) to a logical unit number?

  Thanks in advance,

  Kind regards

  Alex

  Hello

  for active/passive, please use MRU;

  as you know, when fixed in use and the LUNS mapped to multiple hosts, 1 host perhaps selects path fixed-to-controller 0 and 2nd host perhaps selects fixed path to controller 1, then the current path will change between two controllers, way stolen here;

  Binoche, VMware VCP, Cisco CCNA

• PCPU service console

  Hey people,

  I have a question for you. We know all that the Service Console VCPU is connected to PCPU0 and CPU load balancing cannot be established on the Service Console.

  1. what happens if PCPU0 fails? Would break the ESX Server? (v 3.5)

  2. consider an ESX Server has 4 PCPU and 4 connected to the VSwitch VM. Service using PCPU0 console and 4 VM load share the JEPP 3. What happens if one of these (not PCPU0) PCPU fails?

  Anyone could comment on that?

  NB: Please correct me if I am wrong anywhere.

  If the failed LCPU which means one on the physical processor cores could not and I still think that it would cause ESX - Crash

  If you find this or any other answer useful please consider awarding points marking the answer correct or useful

• How many cards to the Service Console

  I hope that my question is not too noob like... Can someone tell me what the rule of thumb is for network cards how much should I use for the service console? Thanks in advance.

  I use two and set an active and a standby adapter. In addition, if you can balance between edge and PCI

• Service Console isolation Clarification

  I have read the Security Hardening Guide but I have some questions about the isolation of isolation of service console.

  1. What are the security risks? I found that newspapers are sent clear test that represents a risk, but in a fully routed network once newspapers leave the service console network they may be captured or read on the syslog network, unless an ipsec tunnel is created between the two systems. Another risk I've read is that if the console service is on the same vswitch as an internet workstation or network type VM service console could be exposed to the internet. Other risks?

  2. If the service console is isolated on its own vswitch/network, but the network outside the vm environment has other systems not necessarily vm systems is always considered a risk or the physical environment also must be isolated to only management traffic? In order to clarify if the service console is located on a network 192.168.1.0/24 and this network have physical systems connected to this same 192.168.1.0/24 network is the console service at risk? Again, what are the risks and that no matter the fully active physical network and uses the isolation of port? If a company has a fully routed network isolation really provides increased security? To be compliant with the Safety Guide is the key to keep isolated from the internet access management network/traffic?

  For some reason, I'm having trouble getting this concept and the security risks. Thanks in advance for the help in the understanding of console service isolation.

  Also remember that if your service console came down, you could lose the ability to manage all the virtual machines that reside on this ESX host.

• PCI, antivirus and service console

  We are trying to get security to buy on our design of the PCI ESX cluster. One thing that came was antivirus in the COS. Is need antivirus in the cos ESX and if not a good white paper or statement of VMware that I could show as proof? and the next question; If it is not something like that, how about ESXi? I thought that ESXi eliminated the COS, so shouldn't have an AV agent be negligible in this situation? Once more, is there proof on that? And last question! Only VMSafe for vSphere address and solve many of these issues?

  My anitvirus software experience is not necessary for the service console.

  This is an article written on techtarget on the subject since last year.

  http://ITKnowledgeExchange.TechTarget.com/virtualization-Pro/installing-anti-virus-software-on-VMware-ESX-service-console/

  It is also a good post on the subject Council

  http://communities.VMware.com/message/1030091;JSESSIONID=4F44B8A6C48B53176A84B7C81367C791

  www.phdvirtual.com, manufacturers of esXpress

• VMotion and Service Console Mac address

  All,

  This may seem like a simple question, but how to find the Mac address of assocated to the port of Vmotion and the Service Console, as my network team ask Mac addresses for all static IP addresses.

  Cordially Spence...

  Click on the properties of the vSwitch to VIC, select the port of VMotion, then on the right, under the IP settings, you should see the MAC address

• Is it ok/possible to add a GUI to my ESX server service console?

  Can I download one of the lightest LINUX GUI and run it from the service console?  Also, how to connect using putty?  Should be on licence somewhere?

  You can add a graphical interface on the ESX console... Can be... but be careful that the console has only a limited amount of Max (above 800 MB) memory and it has been optimized to manage your virtual machines. He is also set to always run on CPU0.

  If you interfaces graphics crashes... it could take down the management of all your virtual machines.

  So the question is "If you do that?", then the answer is no. you'd better not.

  It also cancels your support/warranty. Your ESX Server will be is no longer supported.

  If it's for an experience... go ahead... If you want to run production on this same host... don't even think about it.

  --

  Wil

  _____________________________________________________

  Visit the new VMware developers at http://www.vi-toolkit.com wiki

• Remote Access Service Console

  Is there a way to access the VMware host service console remotely?

  Try to run the command "dcui" in an SSH session...

  Direct Console User Interface (DCUI) since a SSH session access (2039638). VMware KB

  / Rubeck