By Mark Benson, Senior Architect and Senior Staff Engineer, End-User-Computing CTO Office, VMware

• Introduction
• What are the requirements for deploying UAG appliances using this script?
• How do I run the script?
• Configuration Settings
• Managing SSL Server Certificate Files

Introduction

Updated March 2017 for version 2.9

From version 2.9 the appliance is is now called Unified Access Gateway (UAG) instead of the old name of Access Point. It's the same, just a different name.

In September 2015, I posted A Technical Introduction to Access Point for Secure Remote Access article. Unified Access Gateway (UAG), formerly known as Access Point, is a VMware virtual appliance which is used with VMware Horizon (View) and Horizon Air (DaaS). In that article I mentioned the ability to perform a scripted deployment of an Access Point virtual appliance using VMware OVF Tool in order to perform a repeatable deployment where all settings can be applied in a way that allows UAG to be production ready on first boot. This procedure is described in the document Deploying and Configuring Access Point.

Whilst it is great to be able to specify all configuration settings in one go at deployment time, the downside of this is that the OVF Tool command line can become very long and complex. It is also easy to introduce errors on the command line as the command syntax for OVF Tool used in this way can be difficult to get right. Also, it is not possible to validate the settings with OVF Tool and it is therefore very easy to make configuration errors such as setting an admin REST API password that doesn't meet the required complexity rules.

Many Windows administrators managing a VMware Horizon environment need a much simpler way to deploy UAG in a secure, reliable and repeatable way and to have complete control over the settings. For these reasons, we have developed a sample PowerShell script that can be used to deploy Access Point and which overcomes the main difficulties of using OVF Tool directly on the command line. As this PowerShell script is delivered as a sample script, you can also adapt it as required for your specific needs although in most cases you won't need to modify it at all. The script calls the OVF Tool command but validates the settings and automatically constructs the correct command line syntax. The settings are taken from a simple .INI file. This script runs OVF Tool in a fully supported way for Access Point according the procedure in the document Deploying and Configuring Access Point . Note that no password values or private key values are stored within the .INI configuration files.

The PowerShell script sets all configuration settings for OVF Tool at deployment time. This includes setting up the CA issued SSL Server certificate and all other possible settings. After UAG has been deployed by this script, there is no need to make configuration changes after deployment. UAG will be ready for production use on first boot.

What are the requirements for deploying UAG appliances using this script?

1. For Access Point itself, a vSphere ESX host with a vCenter Server is needed. Decide on the vSphere datastore to be used and the Network name to be used. A vSphere Network Protocol Profile must be associated with every referenced network name. This Network Protocol Profile specifies network settings such as IPv4 subnet mask, gateway etc. The deployment of Access Point uses these values so make sure the values are correct.
2. The PowerShell script runs on a machine running Windows 8.1 (or newer) or Windows Server 2008 R2 (or newer). This can be the vCenter Server itself if it is running on Windows, or can be a separate Windows machine.
3. The Windows machine running the script must also have the VMware OVF Tool command installed. Install OVF Tool 4.2.0 or newer. You can download it from here OVF Tool Software and Documentation.

How do I run the script?

• Download a version of UAG virtual appliance image from VMware onto your Windows machine. This is an OVA file. e.g. euc-access-point-2.9.0.0-5178136_OVF10.ova. Refer to VMware Product Interoperability Matrixes to determine the version to download.
• Download the latest apdeploy ZIP file attached below and extract the files into a folder on your Windows machine.
• On your Windows machine, open a PowerShell console and change directory to the location of your script.
• Create a .INI configuration file for your UAG virtual appliance. In this example, I am going deploy a new Access Point appliance called AP1. I have created a .INI file called ap1.ini which contains all the configuration settings for AP1. You can use the sample .INI files contained within the apdeploy ZIP file to create your .INI file and then modify the settings to the values you want.
• Make sure script execution is unrestricted for the current user. You can do this by running the command:
  set-executionpolicy -scope currentuser unrestricted
  You only need to run this once and only if it is currently restricted.
  If you get a warning about running this script, you can unblock that warning by running the command:
  unblock-file -path .\apdeploy.ps1
• Run the command .\apdeploy.ps1 -iniFile ap1.ini as shown in the screenshot below. If you don't specify the -iniFile option, the script will default to ap.ini. You will be prompted to set a root password for the appliance and an optional password for the admin REST API. You will also be prompted for the vCenter password. Deployment takes around a minute depending on your host and storage performance. If you are prompted to add the fingerprint for the target machine, enter yes.

• When the script completes, the UAG appliance is ready to use. No further configuration steps are required.

.INI File Contents

The apdeploy ZIPfile attached at the bottom of this post contains four example .INI files. ap1-basic.ini is a minimal .INI file which just contains the minimum settings needed. ap2-advanced.ini is a more complex configuration file showing additional settings available. ap3-securid.ini is an example of a configuration including RSA SecurID authentication. ap4-radius.ini is an example of a configuration including RADIUS authentication. You should start with just a basic .INI file to ensure that this deployment method works in your environment. You can then add more advanced settings in your .INI file and repeat the deployment. If you have already deployed the named UAG appliance, then running the script again will power off the appliance, delete it, and will redeploy it with the current .INI settings. This is a useful capability to use when either upgrading the appliance to a newer version, or just to change any of the settings.

Basic .INI File Example

##############################################

[General]

name=AP1

source=C:\APs\euc-access-point-2.9.0.0-5178136_OVF10.ova

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/Datacenter1/host/esx1.myco.int

ds=Local Disk 1

netInternet=VM Network

netManagementNetwork=VM Network

netBackendNetwork=VM Network

honorCipherOrder=true

[Horizon]

proxyDestinationUrl=https://192.168.0.209

##############################################

The following table describes each configuration setting. These must be arranged in the .INI file under the appropriate Group Name shown in the first column and as shown in the sample .INI files.

Configuring UAG as a Web Reverse Proxy for VMware Identified Manager

UAG (or Access Point) 2.6 and newer can be used as a Web Reverse Proxy in front of VMware Identity Manager version 2.6 (and newer). Make sure you use a 2.6 (or newer) version of UAG or Access Point e.g.

source=C:\APs\euc-access-point-2.9.0.0-5178136_OVF10.ova

For exact up to date information on UAG and Access Point compatibility, refer to the VMware Product Interoperability Matrixes.

For this setup, remove the entire [Horizon] section from the .ini file and replace it with a new [WebReverseProxy] section. Use the values shown in the sample ap10-vidm.ini file in apdeploy ZIP file below. Set the proxyDestinationUrl to the URL of the Identity Manager server. If that service does not use a trusted CA signed SSL server certificate then you will also need to add the proxyDestinationUrlThumbprints value. Leave all other values in [WebReverseProxy] exactly as shown in the sample ap10-vidm.ini.

The setup requires "split DNS" to be setup where the URL hostname for an external user resolved to the address of UAG, and the same URL hostname for an internal user resolves to the address of the Identity Manager server.

Configuration Settings

Managing SSL Server Certificate Files

pemCerts and pemPrivKey configuration items in the [SSLCert] section of the .INI file reference the SSL certificates file and the RSA private key file both in PEM format. If you don't specify pemCerts and pemPrivKey, UAG will instead generate a self-signed SSL server certificate. This self-signed certificate will not be trusted by Horizon Clients and therefore users will receive a warning when connecting via UAG.

For production environments, it is best to obtain an SSL server certificate for use on each UAG appliance. If you have the PEM format files for the SSL server certificate (including any intermediate CA certificates and root CA certificate) you can reference the files in the pemCerts and pemPrivKey values as described above.

You may have a certificate file with private key and certificate trust chain all in one PKCS#12 format file with either a .p12 or .pfx file extension. To use this file with UAG you must first convert the PKCS#12 format file into the two PEM format files. You can do this with openssl (which you can download from Shining Light Productions - Win32 OpenSSL) by running the following example openssl commands which start with a PKCS#12 file called mycaservercert.pfx.

openssl pkcs12 -in mycaservercert.pfx -nokeys -out mycaservercert.pem

openssl pkcs12 -in mycaservercert.pfx -nodes -nocerts -out mycaservercertkey.pem

openssl rsa -in mycaservercertkey.pem -check -out mycaservercertkeyrsa.pem

Edit mycaservercert.pem and remove any unnecessary certificate entries. It should contain the one SSL server certificate followed by any necessary intermediate CA certificates and root CA certificate.

In the .INI file, add the following lines.

[SSLCert]

pemCerts=mycaservercert.pem

pemPrivKey=mycaservercertkeyrsa.pem

When the script is run, these certificates and private key will be automatically deployed to the new UAG appliance. The private key PEM file should be deleted from the Windows machine once UAG has been deployed.

If you find that the deployment of UAG works when you don't specify the PEM files (i.e. for UAG to use a self-signed SSL server certificate) but fails when you supply your own certificate as described above, then follow these steps. It could be caused by a missing intermediate or root certificate in your specified PEM file.

• Log into the console of UAG as user root and enter the root password you chose when you ran the apdeploy.ps1 script.
• Using an editor such as vi, look at the log file /opt/vmware/gateway/logs/admin.log
• If you see entries saying "Unable to build the certification path" and "No issuer certificate for certificate in certification path found" it means that you having missing intermediate or root certificate entries in the PEM file specified for pemCerts.

• To correct this, you must make sure that any required intermediate certificates and/or root certificate are present in the PEM file and then re-run the apdeploy.ps1 script.

Troubleshooting Deployment Problems

1. I get a security warning about running scripts downloaded from the Internet

Verify that the PowerShell script is the script you intend to run, and then from the PowerShell console, run the command:

unblock-file .\apdeploy.ps1

2. I get an error saying "ovftool command not found".

Make sure you have installed the OVF Tool software on your Windows machine and that it is installed in the location expected by the script. OVF Tool Download.

3. I get an error saying "Invalid Network in property netmask0" or "Cannot initialize property 'netmask0'. Network 'VM Network' has no associated network protocol profile"

The message may state netmask0, netmask1 or netmask2, Check that a value has been set in the .INI file for each of the three networks (netInternet, netManagementNetwork and netBackendNetwork),Also check that a vSphere Network Protocol Profile has been associated with every referenced network name. This specifies network settings such as IPv4 subnet mask, gateway etc. so make sure the associated Network Protocol Profile has correct values for each of the settings.

4. I get a warning message about the operating system identifier being not supported (id: 85)

The full message is: The specified operating system identifier 'SUSE Linux Enterprise Server 12.0 64bit' (id:85) is not supported on the selected host. It will be mapped to the following OS identifier: 'Other Linux (64-bit)'.

This can be ignored. It is mapped to a supported operating system automatically.

5. How do I configure UAG for RSA SecurID authentication?

Add the following two lines to the [Horizon] section of your .ini file:

authMethods=securid-auth && sp-auth

matchWindowsUserName=true

Add a new section at the bottom of your .ini file containing:

[SecurIDAuth]

serverConfigFile=C:\temp\sdconf.rec

externalHostName=192.168.0.90

internalHostName=192.168.0.90

The IP addresses should both be set to the IP address of UAG. The sdconf.rec file is obtained from RSA Authentication Manager (RSA-AM) which should be fully configured according to RSA documentation.

Make sure you are using UAG 2.5 or newer and that the RSA-AM server is accessible on the network from UAG.

If there is a firewall between UAG and your RSA Authentication Manager server, make sure it isn't blocking the communication. This is normally UDP 5500 from AP to RSA-AM and the reply traffic.

Rerun apdeploy PowerShell command to redeploy your UAG configured for RSA SecurID. Refer to VMware UAG RSA SecurID Authentication Setup Video for a full step-by-step description of this setup. Also Refer to the RSA Ready Certification Document for VMware UAG.

Note that when RSA SecurID is configured in the .INI file, then after deployment when UAG first starts up, it performs a check against RSA-AM. If RSA-AM is not available, or if DNS cannot resolve the hostname of RSA-AM referenced in the sdconf.rec file, or if a firewall is blocking the UDP port for this communication, this startup will fail. When this initial handshake fails, the RSA SecurID component on UAG remains disabled. You can open up the sdconf.rec file with a text editor and although it is a binary file, you can see the RSA-AM hostname(s). If you suspect a communication failure, you can log in to the console of UAG as root and run nslookup with that hostname to verify that it can be resolved. Once you have resolved any environment issues, just rerun the PowerShell command to redeploy UAG.

If you need to redeploy UAG with the PowerShell command when it was previously configured for RSA SecurID, then you must first "clear node secret" on RSA-AM so that trust can be re-established.

6. How do I configure UAG for RADIUS authentication?

Add the following two lines to the [Horizon] section of your .ini file:

authMethods=radius-auth && sp-auth

matchWindowsUserName=true

Add a new section at the bottom of your .ini file containing:

[RADIUSAuth]

hostName=192.168.0.100

authType=PAP

authPort=1812

radiusDisplayHint=XXX Token

For more information on these and other settings, refer to the sample ap4-radius.ini file in the latest apdeploy ZIP file below. Also refer to the [RADIUSAuth] descriptions in the table above.

Make sure you are using UAG 2.5 or newer and that the RADIUS server is accessible on the network from UAG.

If there is a firewall between UAG and your RADIUS server, make sure it isn't blocking the communication. This is normally UDP 1812 from UAG to to the RADIUS server and the reply traffic.

Rerun apdeploy PowerShell command to redeploy your UAG configured for RADIUS.

Note that when RADIUS is configured in the .INI file, then after deployment when UAG first starts up, it performs a check against the configured RADIUS server. If the server is not available or if a firewall is blocking communication, this startup will fail.

7. How do I configure UAG for Client Device certificate authentication?

Add the following line to the [Horizon] section of your .ini file:

authMethods=certificate-auth && sp-auth

Add a new section at the bottom of your .ini file containing:

[CertificateAuth]

pemCerts=C:\Users\Administrator\Documents\SSL\CA Certs\north-ca-256.cer

The .cer file is the public certificate authority (CA) certificate that was used to issue required client device certificates.

A client device certificate must be installed in the user or computer certificate store on the system where the Windows Horizon Client is installed. This proves the identity of the client computer. Unless the client supplies a valid certificate issued by this CA, then UAG will reject the connection with an error as shown below.

Client devices that do supply a valid certificate will get the normal user authentication prompt.

This feature is typically used to ensure that only Windows domain joined client computers can connect to desktops and applications via UAG. The client device certificates can be managed automatically as part of a Windows client machine enrolment policy.

For the Cryptographic Service Provider (CSP) specified in the certificate issuing template, use the "Microsoft Enhanced RSA and AES Cryptographic Provider". This supports SHA256 certificates and TLS 1.2. SHA1 is generally now considered too weak for authentication purposes so you should use SHA256.

For Windows to be able to use the certificate for client authentication purposes, the user on the client computer must have read access to the certificate private key. It is not necessary or desirable to make the private key exportable.

8. I get an error saying "Locator does not refer to an object"

This means that the target= value (used by vSphere OVF Tool) is not correct for your vCenter environment. Refer to the table above for examples of the target format used to refer to a vCenter host or cluster. If you are not sure of the names to use, you can start with the top level object, e.g. by specifying:

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/

This will then show a list of possible names to use at the next level. You can then expand it, one level at a time based on this list.

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/Datacenter1/

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/Datacenter1/host

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/Datacenter1/host/Cluster1/

or

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/Datacenter1/host/esxhost1

Note that folder names, host names and cluster names used in the target value are case sensitive.

9. I get an error saying "Transfer failed and Error: failed to send http data"

This will happen if you are using a version of vSphere OVF Tool that is not compatible with the version of vSphere and vCenter you are using. I have seen this error after upgrading vSphere to version 6.5 where I was using an older 4.1.0 version of OVF Tool which is not compatible. In this case, the solution was to upgrade to OVF Tool version 4.2.0 or newer - see OVF Tool Software and Documentation.

If you have any questions about this PowerShell script leave a comment below. For any questions on UAG itself, post a message on the discussion section of the Horizon community forum.

I have a need to enable QOS on many different vCenter's and dVs's. I could do it on the dVs uplink or individual port groups. Either way its going to be different traffic rules that are going to be added & maintained. Can anyone think of a good reason to create the traffic rules on the uplink vs. port group(s)? Thanks

Hi,

I cannot access any of the Apps using HTML in any of the browser. I am using the latest Horizon View 7.1, a security server and the ports 443, 4172 and 8443 are forwarded to the Security Server. I do not have any issues accessing apps using the Client.

The HTML access works fine internally.

Thanks in advance.

Just Looking to log in from a the vmware host to another linux box (as a different user).  I done this before plenty of times on Linux boxes before but not sure on the actual VMware host.  I have generated public key

/usr/lib/vmware/openssh/bin/ssh-keygen

then copied it over to the server I want to ssh to without password:

cat /etc/ssh/testserver_pub_key.pub  | ssh myuser@testserver 'cat >> /home/myuser/.ssh/authorized_keys'

Still can't log in without password.

Hi guys,

Just a quick one on this issue, I'm going to replace the vCenter SSL cert for 2 vCenters (5.0) running in linked mode, will they break?

Do I need to reconfigure the linked mode after the new certs are loaded in to vCenters?

Thank you.

When am login here "VMware Horizon View HTML Access" am getting "You cannot access your applications or desktops from the web client. Please install the VMware Horizon Client, version 3.0 or later."

But i can access apps and desktops from connect using VMware Horizon View desktop client", Anyone help what i am missing....

Thanks

Ganesh

Well, it only took a month of back and forth with my tech; I wanted to share the solution here that worked for us. Many people are not going to like it as it's more work ahead

Long story short you are going to have to UPDATE all of your old apps that you built on 2.11 or any other apps that have this registry string

I went from 6 minute log ins to 1 min and 20 with 7 + apps I need to rebuild the rest of my apps

So go to your App Volumes and Edit whatever app is taking a long time to log in.

Start building you app make sure its installed and working before you complete the reversion. You need to make changes to the  snapvol.cfg

1. Open the mounted appstack disk on the reference machine through C:\SnapVolumesTemp  you have to type this in as it's hidden
2. Open the snapvol.cfg file using a text editor located in the root of the appstack.
3. In the snapvol.cfg file, locate this line:
4. reverse_replicate_registry_key=\MACHINE\Software\Classes

Delete the line

reverse_replicate_registry_key=\MACHINE\Software\Classes

Save the snapvol.cfg

Finish with the App Volumes and complete the task

Start with just ONLy testing 1 app at a time

I'm on our 6th app and this is working like a charm for me now

If it's helpfull we are on VMware Horizon 7 7.03 Agent and

App Vol 2.12 agent

This is for Windows 10 64 Bit

-Alex

Good day!

I have got a repetitive issue on one of my esxi 5.1 hosts causing it to fall into PSOD (in attachment). The stacktrace is always the same from one PSOD to another. Had never faced it before and on other hosts everything works fine.

I will be glad to any help you can provide to identify if it is a hardware of software issue.

Server model is supermicro SYS-6018R-MTR with m/b X10DRL-i with double Xeon 2630 v4 and 4x Kingston KVR21R15D4/32 on board. Memory was tested for about 3 days using memtest86 with no errors.

As far, as i could notice, this PSOD doesn't depends on VMs activity - it can occur in a high load, or at midnight.

I have met this KB looking for a solution: ESXi host fails with PSOD when using Intel Xeon Processor E5 v4, E7 v4, and D-1500 families (2146388) | VMware KB but it is about ESXi v5.5 and 6.0. Anybody met this problem using ESXi 5.1 with E5 v4 Xeons and resolved it this way?

Thanks in advance, Alex.

Hello,

We are deploying a new Horizon environment on View 7.1.0.  We will be deploying on all-flash vSAN and want to utilize AppVolumes on top of non-persistent linked-clones to publish some specialized software for specific users.  I just installed and deployed AppVolumes 3 and it looks much different than the book I read about AppVolumes 2 (Learning VMware App Volumes from PACKT Publishing.)  So my question is, is anyone using version 3 yet, or would we be better off deploying on the latest version of 2.x?  I can't find a lot of documentation about 3 so already having some issues with my first package (it shows all kinds of launch points for Visio 2013 instead of just the EXE for the program itself.)  Thanks so much!

Chad

Hi,

I have some doubts in configuring SMTP please find below.

what is User Name and Password? [is it mail server related?]

what is sender email address? [we can use any random email or we have to use one already existing under our mail server?]

please provide me information on it, thanks 

First I noticed that after updating VMware tools on a windows 8 VM, it appeared a protected folder inside \AppData\Local\Temp folder and inside this protected folder a file called dfixapi.dll.

Every time I use my VM a new protected folder with an additional copy of the dll file appears and there is no way to delete it.

After Workstation 12.5.5 the same protected folder and file appears also on the host  (windows 10 pro)  and not only at the VM level.

I have tried to install a new host (windows 10.pro) from scratch.  I have installed windows, updated it and installed office and no problem showed up. As soon as I install VMware, the problem shows up.

Any explanation why this difxapi.dll file is being created by the VMware workstation?

Is this normal? Is this a virus or malware?  if so, any solution?

thanks, Robert Lobel

Hello All, new user, testing VMWare Workstation Pro 12.5, 30 Day evaluation.  So far so good.  One lingering problem, and it's a big one, is Wacom Tablet Intuos Pro has lag.  This is a big deal because we are unable to be precise with our drawings.  We produce engineering drawings.  Laggy mouse = screwed up drawings.

Main System = Windows 10 Pro 64 bit, 32GB Memory, Core i7 7700K, 256GB SSD.

Virtual System = Windows 7 Pro 64 bit, 1 processor allocated, 4GB Memory Allocated, 2GB Video Memory.

I've disabled Windows 10 tablet mode, unchecked the "Use Ink Mode" in the Wacom software, disabled 3D performance check box of virtual machine, tried Never and Always for mouse option in virtual machine, but still get lag.

Disabling ink mode on the tablet made the biggest difference.  Windows 10 and the Wacom tablet work excellent, but using it in the Windows 7 machine in a pass-thru atmosphere produces lag.

Can anyone help?  Any suggestions?

I am running esxi 6.5 with the latest patches and vmware tools 10.1.5

I am having very inconsistent performance issues with both of my hosts. Basically the windows 2016/windows 10 guests are sluggish at times. nothing will load and the os is basically unresponsive when interacting with the gui. The issue seems to be stemming from disk performance but I am not 100% certain that this is the cause, it may be a side affect.

What I have noticed is that some vms show a average response time for the disk of about 2000ms. Yet if i check the performance monitor at a host level the disk and datastores are all showing sub 1ms response time. I am not able to explain the inconsistencies there.

I have a local ssd datastore on each host as well as a rather fast nvme iscsi san that is connected via 100gb mellanox connectx4 cards. I see the issue with both hosts and both datastores. The issue seems to be worse now with the most recent patches and vmware tools drivers. I am using vmxnet3 network cards and paravirtual scsi controllers on all vms.

I have run disk benchmarks on the vms and the resutls vary. I have already seen it where i run a disk benchmark on a guest, get horrible results, vmotion it to the other host, and benchmarks to the san are fine, and then i vmotion the guest back to the original host and the results are fine the second time I run it.

here is an example of a bad test, the reads are terrible:

-----------------------------------------------------------------------

CrystalDiskMark 5.2.0 x64 (C) 2007-2016 hiyohiyo

                           Crystal Dew World : http://crystalmark.info/

-----------------------------------------------------------------------

* MB/s = 1,000,000 bytes/s [SATA/600 = 600,000,000 bytes/s]

* KB = 1000 bytes, KiB = 1024 bytes

   Sequential Read (Q= 32,T= 2) :     0.655 MB/s

  Sequential Write (Q= 32,T= 2) :  5384.173 MB/s

  Random Read 4KiB (Q= 32,T= 2) :     0.026 MB/s [     6.3 IOPS]

Random Write 4KiB (Q= 32,T= 2) :   617.822 MB/s [150835.4 IOPS]

         Sequential Read (T= 1) :     2.306 MB/s

        Sequential Write (T= 1) :  1907.004 MB/s

   Random Read 4KiB (Q= 1,T= 1) :    53.942 MB/s [ 13169.4 IOPS]

  Random Write 4KiB (Q= 1,T= 1) :    52.104 MB/s [ 12720.7 IOPS]

  Test : 50 MiB [C: 5.2% (15.6/299.5 GiB)] (x1)  [Interval=5 sec]

  Date : 2017/03/25 20:29:18

    OS : Windows 10 Enterprise [10.0 Build 14393] (x64)

a few seconds later on the same setup i get perfectly fine results:

-----------------------------------------------------------------------

CrystalDiskMark 5.2.0 x64 (C) 2007-2016 hiyohiyo

                           Crystal Dew World : http://crystalmark.info/

-----------------------------------------------------------------------

* MB/s = 1,000,000 bytes/s [SATA/600 = 600,000,000 bytes/s]

* KB = 1000 bytes, KiB = 1024 bytes

   Sequential Read (Q= 32,T= 2) :  6655.386 MB/s

  Sequential Write (Q= 32,T= 2) :  5654.851 MB/s

  Random Read 4KiB (Q= 32,T= 2) :   695.193 MB/s [169724.9 IOPS]

Random Write 4KiB (Q= 32,T= 2) :   609.216 MB/s [148734.4 IOPS]

         Sequential Read (T= 1) :  1810.393 MB/s

        Sequential Write (T= 1) :  1626.112 MB/s

   Random Read 4KiB (Q= 1,T= 1) :    53.266 MB/s [ 13004.4 IOPS]

  Random Write 4KiB (Q= 1,T= 1) :    54.289 MB/s [ 13254.2 IOPS]

  Test : 50 MiB [C: 5.2% (15.7/299.5 GiB)] (x1)  [Interval=5 sec]

  Date : 2017/03/25 20:32:21

    OS : Windows 10 Enterprise [10.0 Build 14393] (x64)

Yesterday I had some time on my hands, noticed 6.5.0b for vCenter appliance was released, and 6.1.4 vdp was available.

Upgraded vCenter appliance no problem (from 6.5.0a). Then tried to upgrade 2 vdp instances to 6.1.4 from 6.1.3. Both upgrades failed (no errors, just failed around 80% stating I had to recover from snapshot). Also, after reverting, the vDP plugin is no longer loaded in the vCenter web interface.

I restored the vdp appliance from snapshot, restarted, still no vdp icon to access. I also removed the vdp from the mob interface, and tried to re-register the vdp appliance using vdp-configure. It failed on re-registering to the vcenter instance.

At this point, I decided to try to just re-create my vdp instances. I downloaded the 6.1.4 ovf file, deployed, and during vdp-configure it fails (tried 3 times, on two different datastore types iscsi/nfs).

I still had the 6.1.3 ovf, so I tried to deploy the older version, fails with the same errors as 6.1.4 is failing with.

Keep in mind I deployed 6.1.3 a month ago with absolutely NO issues. I'm wondering if this has something to do with vCenter 6.5.0b.

The errors when deploying brand new instances (both 6.1.3 and 6.1.4) are attached a screenshots.

As mentioned above, I tried both on NFS and iSCSI datastores (iSCSI datastores running VMFS6).

Anyone know anything about this?

VMware performance engineers thoroughly tested VCHA with a benchmark that simulates common vCenter Server activities in both regular and worst case scenarios. The result is solid data and a comprehensive performance characterization in terms of:

• Performance of VCHA failover/recovery time objective (RTO)
• Performance of enabling VCHA
• VCHA overhead
• Performance impact of vCenter Server statistics level
• Performance impact of a private network
• External PSC vs Embedded PSC

In addition to the performance study results, the paper describes the VCHA architecture and includes some useful performance best practices for getting the most from VCHA.

Download the paper, below.

(Updated Nov 30, 2016 to include a summary of our findings in the  Executive Summary.)

New to the site, new to VM, and if I ever get trained I'll laugh at having to ask this. We have a single Linux server that hosts a half-dozen or so guest VMs. The VMs are all RHEL 5.9 (for the time being).

I launch the VpxClient.exe from my PC. There's a config file that appears to be a basic template. No other files of significance have been installed on the PC. Specifically, no vCenter -- although we seem to be licensed for it. The corporate PC I use is considerably locked down, so acquiring vCenter is going to take some effort. I cannot just download and install it.

Getting to my point, command line attempts to ssh/scp fail as "connection refused". The people who set this up are long gone. Undocumented, of course. So with good reason, I'm not likely to bounce this production server just to learn what breaks.

Any constructive ideas are appreciated. TIA.

I am having trouble getting Windows 10 to save Default App Association when using Non-Persistent VDI, I am using UEM 9 and Horizon 7.1.  Any help would be appreciated. 

Hi.

1) I've virtualized (P2V) a physical Windows server 2003 machine by means VMWare Converter.

Then I've tried to import it and run in VMWare Workstation12 and all works without issue.

(with exception of this - skippable - error:

2) Than I've changed hardware compatibilty by means VM > Manage:

so that the VM will be compatible wirh my ESXi 5.1 server

3) At this pont I've copied all VM's file to the ESXi 5.1 datastore

4) Then I've tried to start the copied VM on the ESXi 5.1 server but this error (not skippaple) is showed on the screen and I can't start the VM on the ESXi 5.1 server 

Any idea?

Thanks in advance

Gentlermen and Ladies

I am currently running a 24 node cluster using Dell M630 blades in M1000 Blade Chassis, I am running ESXi 6.0.0. I have 14 RDM drives attached to each of the 24 nodes for two separate MSCS SQL clusters each Cluster has 6 RDM's for a total of 12 mappings per node. I have seen the articles on the RDMs causing an extremely long boot first, it takes 30 to 40 mins just to restart and then the Node gets stuck at VMW_SATP_ALUA for a majority of the boot sequence.

Can anyone tell me what the remedy is and is there a written procedure for fixing it

I'm running the latest AppVol 2.12 with instant clone VMs and following the January Windows Server Update I see several instances of the error message above in my Pending Actions log.

The Dashboard also reports an increasing Computer Utilization count of Online Computers which no longer exist.

The specific System Messages being generated by AV are:

     Error perform_search (exception Encoding::CompatibilityError): (giving up)

     Job error: Sync Computer #<Thread:0x00000000a7cec0> incompatible character encodings: ASCII-8BIT and UTF-8

Is this a known problem?  Any recommended course of action?

-Mark