VMworld 2021 – My Content Catalog and Session Recommendation

VMworld 2021 – My Content Catalog and Session Recommendation

VMworld 2021 is going to happen from October 6-7, 2021 (EMEA). This year you can expect so many sessions and presentations about the options you have when combining different products together, that help you to reduce complexity, provide more automation and therefore create less overhead.

Let me share my 5 personal favorite picks and also 5 recommended sessions based on the conversations I had with multiple customers this year.

My 5 Personal Picks

10 Things You Need to Know About Project Monterey [MCL1833]

Project Monterey was announced in the VMworld 2020 keynote. There has been tremendous work done since then. Hear Niels Hagoort and Sudhansu Jain talking about SmartNICs and how they will redefine the data center with decoupled control and data planes – for ESXi hosts and bare-metal systems. They are going to cover and demo the overall architecture and use cases!

Upskill Your Workforce with Augmented and Virtual Reality and VMware [VI1596]

Learn from Matt Coppinger how augmented realited (AR) and virtual reality (VR) are transforming employee productivity, and how these solutions can be deployed and managed using VMware technologies. Matt is going to cover the top enterprise use cases for AR/VR as well as the challenges you might face deploying these emerging technologies. Are you interested how to architect and configure VMware technologies to deploy and manage the latest AR/VR technology, applications and content? If yes, then this session is also for you.

Addressing Malware and Advanced Threats in the Network [SEC2027] (Tech+ Pass Only)

I am very interested to learn more cybersecurity. With Chad Skipper VMware has an expert who can give insights on how the Network Detection and Response (NDR) capabilities if NSX Advanced Threat Prevention provide visibility, detection and prevention of advanced threats.

60 Minutes of Non-Uniform Memory Access (NUMA) 3rd Edition [MCL1853]

Learn more about NUMA from Frank Denneman. You are going to learn more about the underlying configuration of a virtual machine and discover the connection between the Generapl-Purpose Graphics Processing Unit (GPGPU) and the NUMA node. You will also understand after how your knowledge of NUMA concepts in your cluster can help the developer by aligning the Kubernetes nodes to the physical infrastructure with the help of VM Service.

Mount a Robust Defense in Depth Strategy Against Ransomware [SEC1287]

Are you interested to learn more about how to protect, detect, respond to and recover from cybersecurity attacks across all technology stacks, regardless of their purpose or location? Learn more from Amanda Blevins about the VMware solutions for end users, private clouds, public clouds and modern applications.

5 Recommended Sessions based on Customer Conversations

Cryptographic Agility: Preparing for Quantum Safety and Future Transition [VI1505]

A lot of work is needed to better understand cryptographic agility and how we can address and manage the expected challenges that come with quantum computing. Hear VMware’s engineers from the Advanced Technology Group talking about the requirements of crypto agility and VMware’s recent research work on post-quantum cryptography in the VMware Unified Access Gateway (UAG) project.

Edge Computing in the VMware Office of the CTO: Innovations on the Horizon [VI2484]

Let Chris Wolf give you some insight into VMware’s strategic direction in support of edge computing. He is going to talk about solutions that will drive down costs while accelerating the velocity and agility in which new apps and services can be delivered to the edge.

Delivering a Continuous Stream of More Secure Containers on Kubernetes [APP2574]

In this session one can see how you can use two capabilities in VMware Tanzu Advanced, Tanzu Build Service and Tanzu Application Catalog, to feed a continuous stream of patched and compliant containers into your continuous delivery (CD) system. A must attend session delivered by David Zendzian, the VMware Tanzu Global Field CISO.

A Modern Firewall For any Cloud and any Workload [SEC2688]

VMware NSX firewall reimagines East-West security by using a distributed- and software-based approach to attach security policies to every workload in any cloud. Chris Kruegel gives you insights on how to stop lateral movement with advanced threat prevention (ATP) capabilities via IDS/IPS, sandboxing, NTA and NDR.

A Practical Approach for End-to-End Zero Trust [SEC2733]

Hear different the VMware CTOs Shawn Bass, Pere Monclus and Scott Lundgren talking about a zero trust approach. Shawn and the others will discuss specific capabilities that will enable customers to achieve a zero trust architecture that is aligned to the NIST guidance and covers secure access for users as well secure access to workloads.

Enjoy VMworld 2021! ūüôā

 

VMware Carbon Black Cloud Workload – Agentless Protection for vSphere Workloads

VMware Carbon Black Cloud Workload – Agentless Protection for vSphere Workloads

At VMworld 2020 VMware announced Carbon Black Cloud Workload (CBC Workload) as part of their intrinsic security approach.

For me, this was the biggest and most important announcement from this year’s VMworld. It is a new offering, which is relevant for every vSphere customer out there – even the small and medium enterprises, which maybe still just rely on ESXi and vCenter only for their environment.

CBC Workload introduces protection for workloads in private and public clouds. For vSphere, there is no additional agent installation needed, because the Carbon Black sensor (agent) is built into vSphere. That’s why you may hear that this solution is “agentless”.

Carbon Black Cloud Workload Bundles

This cloud-native (SaaS) solution provides foundational workload hardening and vulnerability management combined with prevention, detection and response capabilities to protect workloads running in virtualized private cloud and hybrid cloud environments.

Carbon Black Cloud Workload Protection Bundles

Note: Customers, that are using vSphere and VMware Horizon, should take a look at Workspace Security VDI, which has also been announced at VMworld 2020. A single-vendor solution with the combination of VMware Horizon and Carbon Black.

If you would like to know more about the interoperability of Carbon Black and Horizon, have a look at KB79180.

Carbon Black Cloud Workload Overview

Customers and partners have now the possibility to provide a workload security solution for Windows and Linux virtual machines. The complete system requirements can be found here.

“You can enable Carbon Black in your data center with an easy one-click deployment. To minimize your deployment efforts, a lightweight Carbon Black launcher is made available with VMware Tools. Carbon Black launcher must be available on the Windows and Linux VMs.”

Carbon Black enable via vCenter

Carbon Black Cloud Workload consists of a few key components that interact with each other:

CBC Workload Components

You must first deploy an on-premises OVF/OVA template for the Carbon Black Cloud Workload appliance (4 vCPU, 4GB RAM, 41GB storage) that connects the Carbon Black Cloud to the vCenter Server through a registration process. After the registration is complete, the Carbon Black Cloud Workload appliance deploys the Carbon Black Cloud Workload plug-in and collects the inventory from the vCenter Server.

The plug-in provides visibility into processes and network connections running on a virtual machine.

As a vCenter Server administrator, you want to have visibility of known vulnerabilities in your environment to understand your security posture and schedule maintenance windows for patching and remediation. With the help of vulnerability assessment, you can proactively minimize the risk in your environment. You can now monitor known vulnerabilities from the Carbon Black Cloud Workload plug-in:

vSphere Client Carbon Black

The infosec guys in your company would do the vulnerability assessment from the CBC console:

CBC Vulnerabilities

Carbon Black Cloud Workload protection provides vSphere administrators a full inventory, appliance health and vulnerability reporting from one console, the already well-known vSphere Client.

Carbon Black vSphere Client Summary

Cybersecurity Requirements

According to the NIST Cybersecurity Framework the security lifecycle is made of five functions:

  1. Identify – Cloud & Service Context, Dynamic Asset Visibility, Compliance & Standards, Cloud Risk Management
  2. Protect –¬†Services / API Defined, Cloud Access Control, Network Integrity, Data Security, Change Control & Guardrails
  3. Detect –¬†Cloud-Speed, Inter-connected Services, Events & Anomalies, Continuous Monitoring
  4. Respond –¬†DevOps Collaboration, Real-time Notifications, Automated Actions, Response as Code
  5. Recover –¬†Templates / Code Review,¬†Shift Left / Pipeline,¬†Exceptions and Verification

Workload Security Lifecycle

CBC Workload focuses on identifying the risks with workload visibility and vulnerability management, which are part of the “Workload Essentials” edition.

If you would like to prevent malicious activities to protect your workloads and replace your existing legacy anti-virus (AV) solution, then “Workload Advanced” would be the right edition for you as it includes Next-Gen AV (NGAV).

Behavioral EDR (Endpoint Detection & Response), also part of the “Advanced” bundle, belongs to “detect & respond” of the security lifecycle.

Workload Security for Kubernetes

Carbon Black Guardrails and Runtime Security

You just learned that Carbon Black Cloud gives workload protection for virtualized Windows or Linux virtual machines running on vSphere. What about container security for Kubernetes?

In May 2020 VMware officially closed its acquisition of Octarine, a SaaS security platform for protecting containers and Kubernetes. VMware bought Octarine to enable Carbon Black to secure applications running in Kubernetes.

Traditional security is no longer relevant for the security of Kubernetes, because Kubernetes is so powerful and hence risky, networking is very complex and a total different game, because static IPs and ports are no longer relevant. And you need a new security approach which is compatible with IT’s organizational shift from traditional to a DevSecOps approach.

VMware’s solution covers the whole lifecycle of the application from building the container to the app running in production. It is a two-part solution with the first one being “Guardrails“. It is able to scan container images for vulnerabilities and Kubernetes manifests for any misconfigurations.

Carbon Black Cloud Guardrails Module

The second part is runtime protection. When the workloads are deployed in production, the Carbon Black security agent is able to detect malicious activities.

Carbon Black Cloud Runtime Module 

Let’s have a look at the different features the Kubernetes “Guardrails” provide for each phase of the application:

  • Build: Image vulnerability scanning, Kubernetes configuration hardening
  • Deploy: Policy governance, compliance reporting, visibility and hardening
  • Operate: Threat detection and response, anomaly detection and least privilege runtime, event monitoring

And these were the key capabilities and benefits, which have been mentioned at VMworld 2020 for “Guardrails”:

Carbon Black Kubernetes Guardrails Features

For “runtime” security the following key capabilities and benefits were mentioned:

  • Visibility of network traffic
  • Coverage of workloads and hosts activity
  • Network policy management
  • Threat detection
  • Anomaly detection
  • Egress security
  • SIEM integration

Customers will be able to have visibility of all the workloads running in the local or cloud-native production clusters and how they interact with each other. They will also see which services are exposed to ingress traffic, which services are exiting the cluster and where this egress traffic is going to. It is also going to be visible which communication is encrypted and what type of encryption is used.

Note: The Carbon Black Cloud module for hardening and securing Kubernetes workloads is expected to be generally available until the end of 2020.

The launch of Carbon Black Workload was the first important step to let the intrinsic security vision become more a reality (after VMware acquired Carbon Black). Moving on with Kubernetes and bringing new container security capabilities is going to be the next big move forward, that VMware can become a major security provider. 

Stay tuned for more security announcements!

Additional Resources

If you would like to know more about Carbon Black Cloud Workload and security for Kubernetes, have a look at:

Introduction to Alibaba Cloud VMware Solution (ACVS)

Introduction to Alibaba Cloud VMware Solution (ACVS)

VMware’s hybrid and multi-cloud strategy is to run their Cloud Foundation technology stack with vSphere, vSAN and NSX in any private or public cloud including edge locations. I already introduced VMC on AWS, Azure VMware Solution (AVS), Google Cloud VMware Engine (GCVE) and now I would like to briefly summarize Alibaba Cloud VMware Solution (ACVS).

VMware Multi-Cloud Offerings

A lot of European companies, this includes one of my large Swiss enterprise account, defined Alibaba Cloud as strategic for their multi-cloud vision, because they do business in China. The Ali Cloud is the largest cloud computing provider in China and is known for their cloud security, reliable and trusted offerings and their hybrid cloud capabilities.

In September 2018, Alibaba Cloud (also known as Aliyun), a Chinese cloud computing company that belongs to the Alibaba Group, has announced a partnership with VMware to deliver hybrid cloud solutions to help organizations with their digital transformation.

Alibaba Cloud was the first VMware Cloud Verified Partner in China and brings a lot of capabilities and services to a large number of customers in China and Asia. Their current global infrastructure operates worldwide in 22 regions and 67 availability zones with more regions to follow. Outside Main China you find Alibaba Cloud data centers in Sydney, Singapore, US, Frankfurt and London.

As this is a first-party offering from Alibaba Cloud, this service is owned and delivered by them (not VMware). Alibaba is responsible for the updates, patches, billing and first-level support.

Alibaba Cloud is among the world’s top 3 IaaS providers according to Gartner and is China’s largest provider of public cloud services. Alibaba Cloud provides industry-leading flexible, cost-effective, and secure solutions. Services are available on a pay-as-you-go basis and include data storage, relational databases, big-data processing, and content delivery networks.

Currently,  Alibaba Cloud has been declared as a Niche player according to the actual Gartner Magic Quadrant for Cloud Infrastructure and Platform Services (CIPS) with Oracle, IBM and Tencent Cloud.

Alibaba Gartner CIPS MQ

Note: If you would like to know more about running the VMware Cloud Foundation stack on top of the Oracle Cloud as well, I can recommend Simon Long’s article, who just started to write about¬†Oracle Cloud VMware Solution (OCVS).

This partnership with VMware and Alibaba Cloud has the same goals like other VMware hybrid cloud solutions like VMC on AWS, OCVS or GCVE – to provide enterprises the possibility to meet their cloud computing needs and the flexibility to move existing workloads easily from on-premises to the public cloud and have highspeed access to the public cloud provider’s native services.

ACVS vSphere Architecture

In April 2020, Alibaba Cloud and VMware finally announced the general availability of Alibaba Cloud VMware Solution for the Main China and Hongkong region (initially). This enables customers to seamlessly move existing vSphere-based workloads to the Alibaba Cloud, where VMware Cloud Foundation is running on top of Aliyun’s infrastructure.

As already common with such VMware-based hybrid cloud offerings, this let’s you move from a Capex to a Opex-based cost model based on subscription licensing.

Joint Development

X-Dragon ‚Äď Shenlong in Chinese ‚Äď is a proprietary bare metal server architecture developed by Alibaba Cloud for their cloud computing requirements. It offers direct access to CPU and RAM resources without virtualization overheads that bare metal servers offer (built around a custom X-Dragon MOC card). The virtualization technology, X-Dragon, behind Alibaba Cloud Elastic Compute Service (ECS) is now in its third generation. The first two generations were called Xen and KVM.

X-Dragon  NIC

VMware works closely together with the Alibaba Cloud engineers to develop a VMware SDDC (software-defined data center based on vSphere and NSX) which runs on this X-Dragon bare metal architecture.

The core of the MOC NIC is the X-Dragon chip. The X-Dragon software system runs on the X-Dragon chip to provide virtual private cloud (VPC) and EBS disk capabilities. It offers these capabilities to ECS instances and ECS bare metal instances through VirtIO-net and VirtIO-blk standard interfaces.

Note: The support for vSAN is still roadmap and comes later in the future (no date committed yet). Because the X-Dragon architecture is a proprietary architecture, running vSAN over it requires official certification. 

Project Monterey

Have you seen VMware’s announcement at VMworld 2020 about Project Monterey¬†which allows you to run VMware Cloud Foundation on a SmartNIC? For me, this looks similar to the X-Dragon architecture ūüėČ

Project Monterey VMware Cloud Foundation Use Cases

Data Center extension or retirement. You can scale the data center capacity in the cloud on-demand, if you for example don’t want to invest in your on-premises environment anymore. In case you just refreshed your current hardware, another use case would be the extension of your on-premises vSphere cloud to Alibaba Cloud.ACVS Disaster Recovery

Disaster Recovery and data protection. Here we’ll find different scenarios like recovery (replication) or backup/archive (data protection) use cases. You can use your ACVS private clouds as a disaster recovery (DR) site for your on-premises workloads. This DR solution would be based on VMware Site Recovery Manager (SRM) which can be also used together with HCX. At the moment Alibaba Cloud offers 9 regions for DR sites.

Cloud migrations or consolidation. If you want to start with a lift & shift approach to migrate specific applications to the cloud, then ACVS is the right choice for you. Maybe you want to refresh your current infrastructure and need to relocate or migrate your workloads in an easy and secure way? Another perfect scenario would be the consolidation of different vSphere-based clouds.

ACVS Migration to Alibaba Cloud

Multicast Support with NSX-T

Like with Microsoft Azure and Google Cloud, an Alibaba Cloud ECS instance or VPC in general doesn’t support multicast and broadcast. That is one specific reason why customers need to run NSX-T on top of their public cloud provder’s global cloud infrastructure.

Connectivity Options

For (multi-)national companies Alibaba Cloud has different enterprise-class networking offerings to connect different sites or regions in a secure and reliable way.

Cloud Enterprise Network (CEN) is a highly-available network built on the high-performance and low-latency global private network provided by Alibaba Cloud. By using CEN, you can establish private network connections between Virtual Private Cloud (VPC) networks in different regions, or between VPC networks and on-premises data centers.  The CEN is also available in Europe in Germany (Frankfurt) and UK (London).

Alibaba Cloud Cloud Enterprise Network

Alibaba Cloud Express Connect helps you build internal network communication channels that feature enhanced cross-network communication speed, quality, and security. If your on-premises data center needs to communicate with an Alibaba Cloud VPC through a private network, you can apply for a dedicated physical connection interface from Alibaba Cloud to establish a physical connection between the on-premises data center and the VPC. Through physical connections, you can implement high-quality, highly reliable, and highly secure internal communication between your on-premises data center and the VPC. 

Alibaba Cloud Express Connect

ACVS Architecture and Supported VMware Cloud Services

Let’s have a look at the ACVS architecture below. On the left side you see the Alibaba Cloud with the VMware SDDC stack loaded onto the Alibaba bare metal servers with NSX-T connected to the Alibaba VPC network.

This VPC network allows customers to connect their on-premises network and to have direct acccess to Alibaba Cloud’s native services.

Customers have the advantage to use vSphere 7 with Tanzu Kubernetes Grid and could leverage their existing tool set from the VMware Cloud Management Platform like vRealize Automation (native integration of vRA with Alibaba Cloud is still a roadmap item) and vRealize Operations.

Alibaba Cloud VMware Solution Architecture

The right side of the architecture shows the customer data centers, which run as a vSphere-based cloud on-premises managed by the customer themselves or as a managed service offering from any service provider. In between, with the red lines, the different connectivity options like Alibaba Direct Connect, SD-WAN or VPN connections are mentioned with different technologies like NSX-T layer 3 VPN, HCX and Site Recovery Manager (SRM).

To load balance the different application services across the different vSphere-based or native clouds, you can use NSX Advanced Load Balancer (aka Avi) to configure GSLB (Global Server Load Balancing) for high availability reasons.

Because the entire stack on top of Alibaba Cloud’s infrastructure is based on VMware Cloud Foundation, you can expect to run everything in VMware’s product portfolio like Horizon, Carbon Black, Workspace ONE etc. as well.

You can also deploy AliCloud Virtual Edges with VMware SD-WAN by VeloCloud.

Node Specifications

The Alibaba Cloud VMware Solution offering is a little bit special and I hope that I was able to translate the Chinese presentations correctly.

First, you have to choose the amount of hosts which gives you specific options.

1 Host (for testing purposes): vSphere Enterprise Plus, NSX Data Center Advanced, vCenter

2+ Hosts (basic type): vSphere Enterprise Plus, NSX Data Center Advanced, vCenter

3+ Hosts (flexibility and elasticity): vSphere Enterprise Plus, NSX Data Center Advanced, vCenter, (vSAN Enterprise)

Site Recovery Manager, vRealize Log Insight and vRealize Operations need to be licensed separately as they are not included in the ACVS bundle.

The current ACVS offering has the following node options and specifications (maximum 32 hosts per VPC):

ACVS Node Specifications

All sixth-generation ECS instance come equipped with Intel¬ģ Xeon¬ģ Platinum 8269CY processors. These processors were customized based on the Cascade Lake microarchitecture, which is designed for the second-generation Intel¬ģ Xeon¬ģ Scalable processors. These processors have a turbo boost with an increased burst frequency of 3.2 GHz, and can provide up to a 30% increase in floating performance over the fifth generation ECS instances.

Component Version License
vCenter 7.0 vCenter Standard
ESXi 7.0 Enterprise Plus
vSAN (support coming later) n/a Enterprise
NSX Data Center (NSX-T) 3.0 Advanced
HCX n/a Enterprise

Note: Customers have the possibility to install any VIBs by themselves with full console access. This allows the customer to assess the risk and performance impacts by themselves and install any needed 3rd party software (e.g. Veeam, Zerto etc.).

If you want to more about how to accelerate your multi-cloud digital transformation initiatives in Asia, you can watch the VMworld presentation from this year. I couldn’t find any other presentation (except the exact¬†same recording on YouTube) and believe that this article is the first publicy available summary about Alibaba Cloud VMware Solution. ūüôā

Google Cloud VMware Engine (GCVE)

Google Cloud VMware Engine (GCVE)

In June 2020 VMware and Google made the announcement that Google Cloud VMware Engine (GCVE) is generally available. Almost exactly one year ago, the market received the information that VMware’s Cloud Foundation (vSphere, vSAN and NSX) stack will come to Google Cloud.

With this milestone VMware is now present on top of all the so-called “big three” hyperscalers.

GCVE has the same goals like the other similar offerings like VMware Cloud on AWS or Azure VMware Solution and belongs to the VMware multi-cloud strategy Рto seamlessly migrate and run applications in the public cloud. In this case in Google Cloud! Run your applications in the public cloud exactly the same way as you already do now withh your on-premises VMware environment. With the very important addition, that you have high speed access to Google Cloud services like Cloud SQL, Cloud Storage, big data or AI/ML services.

To be able to run VMware workloads on top of the Google Cloud global infrastructure, Google acquired CloudSimple (with which they partnered with already) last November 2019.

At the moment of writing, the VMware hybrid cloud experience on Google Cloud is sold, operated and supported by Google and their partners.

Many customers are already looking at this very interesting offer, which is going to be available in more regions until the end of 2020. But there are also already a few customers using the joint offering. Google just published a customer reference story about the “Deutsche B√∂rse Group”, a large and international financial organization, which extended their on-premises environment to Google Cloud with Google Cloud VMware Engine. One of the reasons why Deutsche B√∂rse went for this vSphere-based cloud approach, was, to keep migrations to the cloud easy. I expect we can hear more about this success story at VMworld 2020.

Cloud Migration and Workload Mobility

A lot of customers underestimate the amount of work, time and costs involved in refactoring or re-platforming applications and the overall challenges when it comes to migrations from on-prem to the cloud. To build this secure hybrid cloud extension with GCVE, you’ll need VMware HCX, which is included in the GCVE offering.

There are different options available to connect both worlds:

GCVE Connectivity Options

  • VPN Gateway for point-to-point connections, used for the secure admin access to vCenter. Useful for the initial setup of the GCVE environment.
  • Cloud VPN for site-to-site connections, a secure layer 3 connection over the internet. This is one of the lower cost options for use cases, that don’t require high bandwidth.
  • Dedicated Cloud Interconnect with a direct traffic flow to Google with 10Gbps or 100Gbps circuits with 50Mbps to 50 Gbps connection capacities. This direct connection is required for HCX and the preferable connectivity option for customers requiring high speed and low latency.
  • Partner (Cloud) Interconnect is another option of a Cloud Interconnect, where your traffic flows through one of the supported service providers (e.g. Colt, Equinix, BT, e-shelter, Verizon, InterCloud, Interxion, Megaport)

Note: One unique feature of GCVE is the ability to route between different GCVE environments in the same region, without the need for additional configuration. 

Use Cases

These use cases, if you made yourself already familiar with a hybrid cloud approach, shouldn’t be new to you.

Data Center extension or retirement. You can scale the data center capacity in the cloud on-demand, if you for example don’t want to invest anymore in your on-premises environment. In case you just refreshed your current hardware, another use case would be the extension of your on-premises vSphere cloud to Google Cloud.

Disaster Recovery and data protection. Here we’ll find different scenarios like recovery (replication) or backup/archive (data protection) use cases. You can also still use your existing 3rd party tools from Zerto or Veeam to replace or complement existing DR locations and leverage the Cloud Storage service. You can also use your GCVE private clouds as a disaster recovery (DR) site for your on-premises workloads. This DR solution would be based on VMware Site Recovery Manager (SRM) which can be also used together with HCX.

Cloud migrations or consolidation. If you want to start with a lift & shift approach to migrate specific applications to the cloud, then GCVE is definitely right for you. Maybe you want to refresh your current infrastructure and need to relocate or migrate your workloads in an easy and secure way? Another perfect scenario would be the consolidation of different vSphere-based clouds.

Application modernization. Re-architecting or refactoring applications is not that easy. Most customers start with a partial approach to modernize their applications and leverage cloud-native services (e.g. databases, AI/ML engines).

Interesting: Did you know that Google’s on-prem GKE (Google Anthos) is running on vSphere?

VMware Horizon on VMware Engine

The advantages of a public cloud like Google Cloud are the “endless” capacity, agility and high-bandwidth connections. These items are very important for a virtual desktop infrastructure (VDI) and specially during disaster scenarios, when onboardings have to happen fast or if you look for on-demand growth.

Another regular example could be a merger & acquisition use case, where we the main infrastructure doesn’t have the necessary physical resources to onboard to new company and their employees.

Because something like this has always happen as easy and fast as possible. Running virtual desktops in Google Cloud VMware Engine can help in such situations. Together with VMware Horizon, organizations could install a VDI environment in GCVE and connect it to their Horizon on-premises infrastructure using the Cloud Pod Architecture (CPA). 

Note: When migrating applications to the cloud (GCVE), it is a best practice to keep the virtual desktop close to the application, which is a general use case we see when talking about application locality.

Horizon Global Pod GCVE

With the release of Horizon 2006 (aka Horizon 8) it is also possible to choose “Google Cloud” as deployment option during the connection server installation.

C:\\Users\\mrebmann\\OneDrive - VMware, Inc\\cloud13\\2020 - Google Cloud VMware Engine\\Horizon on GCVE.png

In case you need a load balancer (for your Horizon components and in general) for your on-premises environment and the public cloud, have a look at NSX Advanced Load Balancer.

GCVE Node Specs

When planning your GCVE resource needs, be aware of the following specifications and limits:

CPU: Intel Xeon Gold 6240 (Cascade Lake) 2.6 GHz (x2), 36 Cores, 72 Hyper-Threads

Memory: 768 GB

Storage (vSAN): 2 × 1.6 TB (3.2 TB) NVMe (Cache), 6 × 3.2 TB (19.2 TB) NVMe (Data)

Number of nodes required to create a private cloud: 3 (up to 64 hosts per private cloud)

Number of nodes allowed in a cluster on a private cloud: 16

3rd party tools compatibility: Yes, you can use existing tools (elevated privileges allow you to install 3rd party software)

Interesting facts: It only takes about a half hour to spin up your private cloud with three nodes! The addition of a new node takes approximately 15 minutes.

GCVE Elevated Privileges

Software License and Versions

Please find the current software versions and licenses below used for the GCVE offering (purchased with a 1- or 3- year commitment). The listed software versions are fixed and all updates are managed by Google. Google is responsible for the lifecycle management of the VMware software, which includes ESXi, vCenter and NSX.

Component Version License
vCenter 6.7 U3 vCenter Standard
ESXi 6.7 U3 Enterprise Plus
vSAN 6.7 U3 Enterprise
NSX Data Center (NSX-T) 2.5.1 Advanced
HCX 3.5.3 Advanced

Shared Responsibilities

Google Cloud VMware Engine is coming with all components you need to securely run VMware natively in a dedicated private cloud. Google takes care of the infrastructure (service) and their native service integrations. As a customer you only need to take care of your virtual machines or containers with your applications and data. Besides that, you also need to make sure that your configurations, policies, network portgroups, authentication and capacity management are properly configured.

GCVE Shared Responsibilities

If you want to know and learn more about Google Cloud VMware Engine, have a look at the following resources: 

Multi-Cloud Load Balancing and Autoscaling with NSX Advanced Load Balancer (formerly Avi Networks)

Multi-Cloud Load Balancing and Autoscaling with NSX Advanced Load Balancer (formerly Avi Networks)

Do you want to build your private cloud like a hyperscaler is doing it? You know that VMware Cloud Foundation is becoming the new vSphere, but still wonder how you can implement software-defined load balancing (LB) or application services and features like autoscaling or predictive scaling? Then this article about multi-cloud load balancing and autoscaling with NSX Advanced Load Balancer aka Avi Networks is for you!

My Experience with a Legacy ADC

A few years ago, I was working on the customer side for an insurance company in Switzerland as a Citrix System Engineer. My daily tasks included the maintenance and operation of the Citrix environment, which included physical and virtual Citrix NetScaler Application Delivery Controller (ADC) appliances. The networking team owned a few hardware-based appliances (NetScaler SDX) with integrated virtualization capability (XenServer as hypervisor) to host multiple virtual NetScaler (VPX) instances.

The networking team had their dedicated NetScaler VPX instances (for LDAP and HTTP load balancing mostly) and deployed my appliances after I filed a change request. Today, you would call this multi-tenancy. For a Citrix architecture is was best practices to have one high availability (HA) pair for the internal and one HA pair for the external (DMZ) network access. A HA pair was running in a active/passive mode and I had to maintain the same setup for the test environment as well.

Since my virtual VPX appliances were hosted on the physical SDX appliance, I always relied on the network engineers, if I needed more resources (CPU, RAM, SSL, throughput) chips allocated to my virtual instances. Before I could upgrade to a specific firmware version, I also had to wait until they upgraded the physical NetScaler appliances and approved my change request. This meant, we had to plan changes and maintenance windows together and had to cross fingers, that their upgrade went well, that we could upgrade all our appliances after.

NetScaler SDX

It was also possible to download a VPX appliance, which could run on top of VMware vSphere. To be more independent, I decided to install four new VPX appliances (for the production and test environment) on vSphere and migrated the configuration from the appliances running on the physical SDX appliance.

Another experience I had with load balancers was when I started to work for Citrix as a consultant in Central Europe and had to perform a migration of physical NetScaler MPX appliances, which had no integrated virtualization capability. I believe I had two sites with each two of these powerful MPX appliances for tens of thousands of users. Beside the regular load balancing configuration for some of the Citrix components, I also had to configure Global Server Load Balancing (GSLB) in active/passive mode for the two sites.

NetScaler GSLB Active Passive

There were so many more features available (e.g. Web Application Firewall, Content Switching, Caching, Intrusion Detection), but I never used anything else than the NetScaler Universal Gateway for the remote access to the virtual desktop infrastructure (VDI), load balancing, HTTP to HTTPS redirections and GSLB. In all scenarios I had a HA pair where one instance was idling and doing nothing. And the active unit was in average not utilized more than 15-20%. It was common to install/buy too large or powerful instances/licenses, because you wanted to be on the safe side and have enough capacity to terminate all your SSL sessions and so on.

It (load balancing) was about distributing network traffic across multiple servers by spreading the requests and work evenly, and do add some intelligence (health monitoring) in case an application server or a service would fail or be unavailable for any reason. If one more application server was needed, I ordered a new Windows Server, installed and configured the Citrix components and added the necessary load balancing configuration on the NetScaler. These were all manual tasks. The same work has been done by the network engineers when the application team requested a new application server, which then had to be added to the load balancing configuration on their NetScaler appliances.

This was my personal experience from 2017. Since then applications became more complex and distributed. The analysts and market are focusing on containerized and portable apps running and more and more in multiple clouds. The prediction is also that the future is multi-cloud.

Multiple Clouds vs. Multi-Cloud

There are different definitions and understandings out there what multi-cloud means. In my understanding, using a private cloud, AWS, Microsoft Office 365 and Azure are a typical setup with multiple clouds. There are simple scenarios where you migrate workloads from the private to the public cloud (e.g. Azure) or having applications with services lying on the private on the public cloud. The latter would be an example of a hybrid cloud architecture.

The reasons for which services and resources are needed or distributed on multiple clouds (on-prem, Azure, AWS, GCP etc.) are various:

  • Avoid dependence on only one cloud provider
  • Consume different specific services that are not provided elsewhere
  • Optimize costs for different workloads and services
  • React to price changes by the providers

That is why we are seeing also the trend to break up big legacy applications (monoliths) in smaller pieces (segments), which is a best practice and design principle today. The goal is to move to a loosely coupled and more service-oriented architecture. This provides greater agility, more flexibility and easier scalability, because of less inter-dependencies.

And, if we take the second example from the list before, a segmented application is much easier to run in different clouds (portability). Running one application over multiple clouds is in my understanding the right definition of multi-cloud.

Multiple Clouds versus Multi-Cloud

Let’s assume that most probably all the four reasons above apply to larger enterprises. If we take another angle, we can define some business and technical requirements for multi-cloud:

  • Application or services need to be cloud vendor-agnostic
  • Provide or abstract control and management interface of multiple clouds
  • Support application portability/relocation between clouds
  • Combine IaaS and services from different clouds
  • Possibility to deploy components of applications in multiple clouds
  • (Cloud) Broker service needed
  • Policy and governance over multiple clouds
  • Network connectivity for migration scenarios with partially modernized applications
  • Automated procedures for deployments
  • Application monitoring over different clouds
  • Costs management
  • Lifecycle management of deployed applications in multiple clouds
  • Self-adaption and auto scaling features
  • Large team with various expertises needed

How can you deliver and manage the different applications services like load balancing, web application firewalling, analytics, automation and security over multiple clouds?

Another important question would be, how you want to manage the deployment on the various clouds. But cloud management or a cloud management platform is something for another article. ūüôā

The requirements for the developers, operations and the business are very complex and it’s a long list (see above).

It is important, that you understand, based on the requirements for multi-cloud, that it is mandatory to implement a modern solution for your modernized application architectures. Enterprises have become more application-centric and everyone is talking about continious integration, continuous delivery and DevOps practices to automate operation and deployment tasks. A modern solution implicits a software-defined approach. Otherwise you won’t be able to be agile, adapt to changes and meet future requirements.

My past experience with Citrix’ NetScaler is a typical example that “virtualized” and “software-defined” are not the same thing. And this is very important if we want to have a future-ready solution. If we look at VMware’s¬†software-defined data center (SDDC),¬†beside the virtual compute, also includes software-defined storage and networking. Part of the software-defined networking portfolio is “NSX Advanced Load Balancer“, the software-defined application services platform, which was also known as “Avi Networks” before VMware bought them in June 2019.

Unlike a virtualized load-balancing appliance, a software-defined
application services platform separates the data and control planes
to deliver application services beyond load balancing, real-time
application analytics, security and monitoring, predictive autoscaling,
and end-to-end automation for Transport (Layer 4) to
Application (Layer 7) layer services. The platform supports multicloud
environments and provides software-defined application
services with infrastructure-agnostic deployments on bare metal
servers, virtual machines (VMs), and containers, in on-premises
data centers and private/public clouds.

Autoscaling became famous with AWS as it monitors your applications and automatically adjusts capacity to maintain availability and performance at the lowest possible costs. It automatically adds or removes application servers (e.g. EC2 instances), load balancers, applies the right network configuration and so on.

Can you achieve the same for your on-premises infrastructure with VMware? Yes.

Is there even a solution which can serve both worlds – on-prem and cloud? Yes.

And what about predictive scaling with real-time insights? Yes.

NSX Advanced Load Balancer (NSX ALB)

Why did VMware buy Avi? Because it follows the same architecture principles like NSX: A distributed platform with a separate control and data plane built on software-defined principles for any cloud.

Avi High Level Architecture

Traditional ADCs or load balancers are mostly configured in active/standby pairs, no matter if physical or virtual. Typically you would see around 15% utilization on the active node where the secondary standby node is just idling and doing nothing. Each pair is its own island of static capacity which shares the management, control and data plane.

You have to decide where to place the virtual IP (VIP) and how much you want to overprovision the physical or virtual appliances, because there is no capacity pooling available. This leads to operational complexity, especially when you have hundreds of such HA pairs running in different clouds. Therefore, legacy and virtualized ADCs are not the ideal choice for a multi-cloud architecture. Let’s check NSX ALB’s architecture:

Control Plane РThis is the brain (single point of management) of the whole platform that can be spun up in your on-prem environment or in the cloud (also available as a managed SaaS offering), typically as a three-node cluster. Within this cluster, all configuration is done, this also where the policies reside and the decisions are made. It is the controller’s duty to place virtual services on SEs to load balance new applications or increase the capacity of running applications.

The control plane comprises the three pillars that deliver the key capabilities of the Avi platform:

  • Multi-Cloud – Consistent experience for any cloud, no lock-in
  • Intelligence – The machine learning based analytics engine enables application performance monitoring, troubleshooting, and operational insights (gathered by the SEs)
  • Automation – Elastic and predictive auto scaling & self-service without over-provisioning through a complete set of REST APIs

Data Plane –¬† The Service Engines (SEs) handle all data plane operations by receiving and executing instructions from the controller. The SEs perform load balancing and all client- and server-facing network interactions. It collects real-time application telemetry from application traffic flows.¬†

As already mentioned, NSX ALB can be deployed in multiple cloud environments like VMware vCenter, Amazon Web Services, Microsoft Azure, Google Cloud Platform, Oracle Cloud, IBM Cloud, VMC on AWS, Nutanix, OpenStack or bare-metal.

Use Cases

Most customers deploy Avi because of:

  • Load Balancer refresh
  • Multi-Cloud initiatives
  • Security including WAF, DDoS attack mitigation, achieve compliance (GDPR, PCI, HIPAA)
  • Container ingress (integrates via REST APIs with K8s ecosystems like GKE, PKS (TKGI), OpenShift, EKS, AKS, TKG)

Advanced Kubernetes Ingress Controller Avi Networks

  • Virtual Desktop Infrastructure (Citrix, VMware Horizon)

Consistent Application Services Platform (Features)

Avi/NSX ALB is an enterpise-grade solution. So, everything you would expect from a traditional ADC (e.g. F5), layer 4 to layer 7 services, SSL, DDoS, WAF etc. is built-in without the need for a special license edition. There is also no NSX license requirement even the product name would suggest it. It can be deployed as a standalone load balancer or as an integrated solution with other VMware products (e.g. VCF, vRA/vRO, Horizon, Tanzu etc.).

Avi Networks Features

Below is a list with the core features:

  • Enterprise-class load balancing – SSL termination, default gateway, GSLB, DNS, and other L4-L7 services
  • Multi-cloud load balancing – Intelligent traffic routing across multiple sites and across private or public clouds
  • Application performance monitoring –¬†Monitor performance and record and replay network events like a Network DVR
  • Predictive autoscaling Application and load balancer scaling based on real-time traffic patterns
  • Self-service – For app developers with REST APIs to build services into applications
  • Cloud connectors – VMware Cloud on AWS, SDN/NFV controllers, OpenStack, AWS, GCP, Azure, Linux Server Cloud, OpenShift/Kubernetes
  • Distributed application security fabric – Granular app insights from distributed service proxies to secure web apps in real time
  • SSO / Client Authentication – SAML 2.0 authentication for back-end HTTP applications
  • Automation and programmability – REST API based solution for accelerated application delivery; extending automation from networking to developers
  • Application Analytics – Real-time telemetry from a distributed load balancing fabric that delivers millions of data points in real time

Load Balancing for VMware Horizon

NSX ALB can be configured for load balancing in VMware Horizon deployments, where you place SEs in front of Unified Access Gateways (UAG) or Connection Servers (CS) as required.

Avi Horizon High Level Architecture

For a multi-site architecture you can also configure GSLB if needed. With GSLB, access to resources is controlled with DNS queries and health checking.

Note: If you are using the Horizon Universal Broker, the cloud-based brokering service, there is no need for GSLB, because the Universal Broker can orchestrate connections from a higher level based on different policies.

Automation

With NSX Advanced Load Balancer there are two parts when we talk about automation. One part is about infrastructure automation, where the controller talks to the ecosystem like a vCenter, AWS or Azure to orchestrate the Service Engine. So, when you configure a new VIP, the controller would talk to vCenter to spin up a VM, put it in the right portgroup, connect the front and the back-end, download the policy and service engine, and starts receiveing traffic.

The second piece of automation focuses more on the operational automation which is through the REST API (the UI and CLI don’t offer all the configuration, 100% can be done via REST API). But, on top of that you can also run Ansible playbooks, Terraform templates, Go and Python SDKs, have integrations with Splunk or other tools like vRealize Automation. This is the built-in automation in the product.

Avi Networks Automation

VMworld 2020 Sessions

This year VMworld is going to be for free and virtual. Take this chance and register yourself and learn more about Avi aka NSX ALB:

  1. Making Your Private Cloud Network Run Like a Public Cloud – Part 2 [VCNC2918]
  2. Modern Apps and Containers: Networking and Security [VCNC2920]
  3. Prepare for the New Normal of Work from Anywhere [VCNC2919]

Expectations and Current Approaches

There is the general understanding and need for hybrid or multi-cloud architectures. Different people will tell different stories and give different advices. The result are different architectures and different approaches. Some people will tell you, that you can use a cloud serially, so moving from one cloud to another. Or, simultaneously, when using different services from different clouds.

My last article focused on hybrid cloud, the architecture with some services lying on the private infrastructure, while other services are hosted on a public cloud. A public cloud providers tells you, that you can buy all services from them and tries to give you a better discount than the competition (to avoid multiple clouds). Enterprises see the need for multiple (public) clouds to avoid a vendor lock-in instead of going all-in with just one of them.

VMware is about multi-cloud and workload mobility, with the vision, that their VCF stack is running everywhere in the future. Now, some people would now say that this is also a vendor lock-in. Depending on your strategy and technology choices and preferences (e.g. databases, AI/ML services, virtual desktops), you have to decide somewhen which (cloud) vendor, approach and operation model is the right one for you.

It may not true for every large environment, but if you go for multiple clouds, multiple technologies, management and security consoles, architecture and so on, you’ll spend a lot of time and money on engineering and keeping your environment “integrated” and functional.

VMware offers you choice. The choice to run your workloads today and tomorrow wherever you want.

If you have the same vision and strategy like VMware, then you are looking for solutions which run in or on top of every cloud. Because of that it’s very important to understand the different between multiple clouds and multi-cloud.

In this case, NSX ALB brings you multi-cloud load balancing and auto scaling features for any cloud and for multi-cloud enabled applications and services.

Don’t forget: Some people are also saying,¬† that multi-cloud is not needed and doesn’t exist in reality.¬†Nobody is saying multi-cloud is a piece of cake, but VMware can definitely help you to abstract this complexity. And part of this abstraction can be handled with vRealize Automation for example, which can act as a cloud broker to deploy your application and services.

 

Mobile-First with Samsung DeX and VMware Horizon

Mobile-First with Samsung DeX and VMware Horizon

Currently, most people must work from home because of COVID-19. When the global lockdown started, companies were challenged to provide continuity of business with:

  • Remote PC access (physical access to computers with VMware Horizon or Citrix)
  • Remote access via VPN
  • Published desktops and apps hosted on-premises
  • Published desktops and apps hosted in the Cloud (e.g. Azure or AWS)
  • Shipping of new laptops
  • Shipping of new thin clients (don’t forget the Raspberry Pi 4)
  • Shipping of new mobile devices like smartphones and tablets

The options look clear but the execution of these action wasn’t that easy. Nobody was prepared for a pandemic and its consequence of shipping problems and delays of servers, PCs and mobile devices. On the other side some of the companies already had the necessary infrastructure but not enough licenses for their virtual desktop infrastructure (VDI) of unified endpoint management (UEM) platform.¬†

In Switzerland we are lucky to have modern and stable internet connections where 1 Gigabit over fiber is not the exception anymore. I don’t know how VMware’s internal IT was challenged at the beginning of this crisis but I could always access my applications and data from my laptop with Workspace ONE (I don’t need Horizon for work).¬†

After a few weeks I was asking myself if the employers know all their options to enable their employees for remote working. For sure the most increased numbers are related to digital workspace products. That’s why people on Twitter and LinkedIn are shouting out that it’s “the year of VDI”.¬†

As long as not every virtual desktop or remote desktop session host is equipped with a vGPU or when GPUs are affordable for everyone and become commodity, in my opinion, we cannot talk about the year of VDI. But that’s another topic.¬†

When I heard that PC and smartphone shipments are delayed for weeks, I looked for alternatives which don’t rely on shipping of new devices:¬†¬†

  • I assume the employee has a private PC or laptop at home
  • I assume the employee possesses at least one smartphone or tablet
  • I assume the employee has a stable internet connection at home
  • I assume the employee has 4G/5G reception

To access a virtual desktop brokered via VMware Horizon you would only need a PC or laptop with a HTML5 capable browser to access the virtual environment. The installation of the Horizon Agent is not mandatory but would give you a much richer user experience.

Working directly on a smartphone or tablet makes only sense and fun when: 

  • You don’t have to access a virtual desktop or virtual app on a tiny display
  • You can use mobile apps
  • You can SaaS apps
  • You can connect your phone or tablet to an external display – ideally with a keyboard and mouse

I have an iPad Pro at home but decided to test a mobile-first approach with a Samsung S20+, because it is more common that employers provide a smartphone instead of tablet. I am not aware of any mobile-only company that solely work with smartphones or tablets. But I think it’s important to understand how a mobile-first or mobile-only approach affects the user experience and if it’s possible to replaces PCs, laptops or thin clients.

Why is this thought interesting and important? The employee experience (EX) is the number one priority for a digital workspace and with today’s UEM platforms you can manage almost every formfactor and operating system (iOS, Android, macOS, Windows 10, Linux).

What if we can provide the same user experience and reduce costs with a mobile-first strategy coupled with Horizon for VDI use cases? Don’t ignore that there’s an ongoing shift towards 5G and it’s becoming more and more accessible.¬†

The most famous telco provider in Switzerland is “Swisscom” who already offers a pretty wide 5G (up to 1Gbit/s) and 5G+ (up to 2Gbit/s) coverage:

Swisscom 5G Coverage

My vision here is, that every employee is only equipped with a smartphone which they can use in the office and at home to securely connect to the corporate network to access internal apps or data and SaaS applications.

Here is what I would like to test:

  • Can the Samsung S20+ replace my Dell laptop?
  • How can I connect peripherals like an external display, keyboard, mouse, headset, webcam, printer etc.
  • Which internal and external (mobile/SaaS) applications can be used with a good user experience?
  • Which applications should better be accessed via a virtual desktop or published app delivered with Horizon?
  • How is the user experience with Samsung DeX?
  • Which 3rd party applications are supported with Samsung DeX?
  • Can Samsung DeX transform a Samsung smartphone into a Windows thin client?
  • How is my daily work affected?
  • How does Samsung DeX and VMware Horizon work together?

Preparation of my Mobile-First Workplace

The first thing I did, after I installed all necessary Android updates, was to enroll my S20+ in VMware’s Workspace ONE.¬†

In enrolled my phone as a dedicated corporate device and could access my company’s applications within the next five minutes. The following applications are the most important ones for my daily work at VMware:¬†

  • Microsoft Outlook / VMware Boxer
  • Microsoft PowerPoint
  • Microsoft Word
  • Microsoft Excel
  • OneDrive
  • Microsoft Teams
  • Slack
  • Zoom
  • Salesforce (SaaS version)
  • Different web links (Confluence, Jira, intranet, technical marketing website etc.)

Workspace ONE Application Catalog

My phone is enrolled, remote access to the corporate network can be established and all the necessary mobile applications are installed. Internal web links and SaaS applications can be access through the secure per-app VPN tunnel (micro VPN tunnel) and the Workspace ONE application catalog (image above) with SSO (Single Sign-On).

So, how do I transform this smartphone into PC-mode? 

Samsung DeX

I believe Samsung first included the “Desktop eXperience” (DeX) feature on Galaxy S8 smartphones and the original version even required the use of a DeX docking station. And since a few months DeX can now be launched via a direct cable connected to an external display, Windows or Mac client. This means that no multiport adapter and no HDMI cable is needed if your display has an USB-C port.¬†

Samsung DeX is not hardware ‚ÄĒ it‚Äôs a software platform that extends your smartphone or tablet into a desktop computing experience.

To use DeX desktop on a Windows or Mac OS you’ll need the downloadable app, but this is not something I’m going to explore further.

Lucky me, my Dell display at home has a lot of regular USB ports and one USB-C port. This allowed me to connect the S20+ smartphone with the USB-C cable and connect peripherals like my headset (or speakers), keyboard and mouse. Another option would be, if you have a Bluetooth keyboard and mouse, to connect them directly to the S20. They only thing I didn’t do yet, because it has no priority, is to connect my network printer to the phone.

Samsung DeX Home Office Setup

In the image above you can see the DeX desktop with some applications shortcuts I created.

Samsung DeX Keyboard Settings Samsung DeX Audio Settings 

The configuration of my keyboard and headset as the primary audio device was also very simple. So far, I am very impressed! 

Adapters

All you need to get started using DeX are a display, a HDMI adapter and peripherals. The HDMI adapter is only needed if you haven’t got an integrated USB-C port in your monitor. And not every monitor has a lot of USB ports. That’s why Samsung offers three different adapters:¬†

 

 

 

Samsung DeX Adapters

The DeX cable is simple 1.4m long HDMI-USB-C cable which you plug into your monitor.

The compact HDMI adapter allows you to connect your phone to a HDMI cable on your monitor. As no additional ports are available with the DeX cable and HDMI adapter, you’ll need to use Bluetooth peripherals.

The third option is a¬†multiport adapter gives you a USB 3.0 port, a GigE port for a wired internet connect and a USB-C port to connect the phone’s charging cable (beside the HDMI port).

If you have no mouse, then you could use your phone as a touchpad. A notification on your phone will give show you this option.

Samsung Core Applications & 3rd party apps

In Samsung’s “Beginner’s Guide to Samsung DeX” you’ll find the following information about support mobile apps:¬†

All of Samsung’s core applications are optimized for DeX, meaning you can resize and maximize the apps. You can also use right-click functionality and keyboard shortcuts. There are dozens of third-party apps that are fully optimized for DeX, including the Microsoft Office suite, Adobe Acrobat Reader, Photoshop Lightroom, Photoshop Sketch, Gmail, Chrome, BlueJeans, GoToMeeting and all the leading VDI clients, to name just a few. For those that aren’t optimized for DeX, read on for the next tip.

Samsung DeX Support Apps

Here’s the next tip about the DeX Labs activation:

DeX Labs offers access to ‚Äúexperimental‚ÄĚ features that aren‚Äôt officially supported. Two current features include allowing DeX to force apps to resize and auto-open the last used app. To activate, click the DeX logo on the bottom right of your screen, open DeX Labs and toggle the features on. Now, when you open an app that is not DeX optimized, you‚Äôll be given the opportunity to force resizing. This will allow you to view it in a larger window or even in fully maximized view.

Samsung and VMware have a partnership for a while now and because of that the VMware Horizon Client and some other VMware apps are on the list of supported 3rd party apps:

Samsung DeX 3rd party apps

I tested Zoom already and it worked perfectly. First tests of Boxer and Slack also looked promising. The only apps which are not on the list of “apps in DeX mode” are:

  • MS Teams
  • Salesforce
  • Slack (seems to work)

Samsung DeX Team Crash Samsung DeX Salesforce crash

When I try to open MS Teams in DeX mode, nothing happens, and I see on the smartphone that the app is immediately crashing. DeX Labs, which attempts to resize apps that aren’t officially supported by Samsung DeX, didn’t make any difference.

Mobile Apps vs. Desktop Apps

Since MS Teams is not working in DeX mode, I’m going to check if¬†DeX Labs helps. Otherwise I have to mirror my phone’s screen to use MS Teams or start this on a virtual desktop provided with Horizon.

Launching VMware Horizon desktops when working within DeX gives you both. You’re now working on a virtual desktop with full desktop apps. You’re viewing content on a full-sized monitor, and using the keyboard and mouse to get work done. And it’s all powered by your Galaxy smartphone. That is the digital workplace, powered by mobile.

Accessing a virtual desktop is very easy. You just need to download the Horizon Client from the Workspace ONE catalog (Intelligent Hub) or install the available one from the Google Play Store.

Samsung DeX VMware Horizon Client

For my tests I’m going to use the VMware TestDrive environment again like I did it for my testing with the Raspberry Pi 4. In the Horizon Client for Android User Guide you will find more information about using the Horizon Client with Samsung DeX:

If the Android device supports Samsung DeX, you can use Horizon Client in DeX desktop mode.

When the device is in DeX desktop mode, Horizon Client treats the device as a thin client and Thin Client
mode is enabled. For more information, see Using Horizon Client on a Thin Client.

The following features are supported when you use Horizon Client in Horizon DeX desktop mode.

  • You can configure Horizon Client to start automatically when you switch to DeX desktop mode. See
    Enable the DeX Mode Auto Launch Feature.
  • Remote desktop and published application sessions continue to run after you enter or exit DeX
    desktop mode.
  • If Horizon Client is maximized, remote desktops enter full-screen mode after you switch to DeX
    desktop mode.
  • To switch the language input method in a remote desktop, you can use the language switch key on a
    Samsung physical keyboard.
  • You can connect to multiple remote desktops and published applications at the same time. Smart
    card authentication is not supported for multiple sessions

Use Cases for DeX and VDI

Let’s give you a few examples of classic use cases.¬†

Healthcare

When we think about hospitals and healthcare in general, then data security and mobility are very important topics. Mobility can help to improve productivity and almost every healthcare customers uses VDI for security and mobility purposes: E.g. shift workers, doctors need (VDI desktop) session roaming

My experience shows that doctors often have a phone, tablet and a desktop/laptop.

Instead of having:

  • a computer in the office
  • a computer or thin client in the examination room
  • and a tablet for patient data (electronic health record) or medical images

you could do it all with one device and have the same user experience everywhere an in any case. I will cover the support of various authentication methods (smart card, biometric) later.

Please find here the VMware Horizon 7 Deployment Guide for Healthcare. 

Finance

The finance vertical has also different pillars and specific use cases. With banking or wealth management customers you probably have to talk more about thin clients and VDI. And with insurances companies, that have a lot of road warriors, you need to consider scenarios where the agents/consultants are working in the car or directly at their customer.

For road warriors you could also propose a Samsung tablet and/or a mounted display and a dedicated keyboard which acts like a standalone computer.

Public Sector

Public sector customers have requirements with a combination of the healthcare and finance industry. Obviously, security is one of the most important topics. Data leakage prevention, encryption, data locality (argument for VDI) etc. or just a few of the requirements. Multi-factor authentication with smart cards is also very common.

Security with Samsung DeX and Horizon

In this section I want to summarize what Samsung and VMware offering for a secure mobile-first or mobile-only workplace. Samsung provides security with their phone and additional security features (Know) for the personal and enterprise use.

VMware is referring to their intrinsic security strategy with Zero Trust security approach.

Samsung and VMware

Samsung DeX and Samsung Knox

Using DeX also brings security benefits. Samsung smartphones and tablets are protected by advanced biometric security and Samsung Knox, a defense-grade security platform that‚Äôs designed from the chip up to protect devices from the minute they‚Äôre powered on ‚ÄĒ so you can be sure your information is safe.

Workspace ONE Unified Endpoint Management (UEM)

For the device management and compliance (OS updates, security patches etc.) of Android based phones we have Workspace ONE UEM before allowing any access.

With Workspace ONE Access you can grant access to your applications based on a combination of conditions (which is also known as the conditional access engine. The policy framework for conditional access consists of:

  • User (employee, contractor, customer)
  • Device (iOS, Android, Win10, macOS, BYOD, corp device, unmanaged)
  • Application (web, mobile, virtual, low or high security, internal, external)
  • Location (network range, 3G/4G/5G, geo)

For the secure remote access to the corporate network Workspace ONE offers an application tunnel and proxy. The app tunnel is established with Workspace ONE Tunnel and the Unified Access Gateway (UAG) offers edge services that you securely access your on-prem Horizon virtual app or desktop.

With Workspace ONE Intelligence you’ll get automated remediation and orchestration. Based on different conditions or triggers you can define actions or workflows like ticketing or notifications. You could also automate the blocking of a VPN access if a phone or tablet doesn’t meet the required patch level.

If you want to go one step further you could leverage the Workspace ONE Trust Network which combines the insights from Workspace ONE with verified security partners (current partners are Carbon Black, Zscaler, Lookout, Netskope, Wandera and Zimperium) by APIs to deliver predictive and automated security for your mobile clients or the digital workspace in general.

VMware Zero Trust Security Workspace ONE

You can also add VMware NSX to enhance security with micro-segmentation and secure east-west traffic for applications and desktops in the data center and the cloud.

Workspace ONE Intelligent Hub is the portal for users to access their different applications and provides the same user experience on any device. The look and feel in your browser are the same as on your Samsung phone or tablet. In DeX mode I opened the Intelligent Hub app (left) and access the portal as well in Chrome (right):

Workspace ONE Intelligent Hub

Smart Cards

Customers know the smart cards as plastic cards which have a digital certificate embedded which allows them to authenticate themselves to their desktops and applications. Some larger enterprises use the same plastic card or badge to access buildings or to digitally sign documents.

To get access to the digital certificate on the card traditionally you would insert the card in an internal or external connected smart card reader and insert your PIN after. For mobile workers and a mobile-centric platform this way of working doesn’t offer the best user experience.

And beside that physical smart cards are also considered old-fashioned, right?

Because of these reasons VMware introduced support for derived credentials a couple of years ago for Horizon Clients for Android, iOS and Windows. This eliminated the need for physical smart cards and smart card readers. All you need is the PIV-D Manager mobile app which comes with Workspace ONE:

VMware PIV-D Manager is a mobile application that integrates with various Derived Credential solution providers enabling the use of Derived Credentials with Workspace ONE UEM. The available vendors currently supported with the PIV-D Manager app are DISA Purebred, Entrust IdentityGuard, Intercede MyID, XTec, and Workspace ONE UEM.

Remote Support

What if your mobile workers have problems with their phones or tablets? Workspace ONE Assist is the last piece to complete the puzzle and it enables you to access and troubleshoot devices remotely in real time from the Workspace ONE console.

Here are the current supported features separated by platform:

WS1 Assist Capabilities Platform

In April 2020 VMware has just announced the expansion of their remote support solution offerings with VMware RemoteHelp. 

The difference between RemoteHelp and Workspace ONE Assist is, that you don’t Workspace ONE UEM with RemoteHelp. You can look at RemoteHelp like Bomgar or TeamViewer, but with the addition that support engineers can launch remote support sessions of Android (and iOS) devices directly from their CRM platform. RemoteHelp is sold as a standalone product and has its own console and end-user mobile application.

You would use RemoteHelp where customers are using DeX with Horizon but are not managing the device with Workspace ONE.

Samsung Galaxy S20+ as Thin Client

I mentioned already once or twice that I wrote articles about the Raspberry Pi 4 (RPi) and how it performs as a thin client for VMware Horizon. From a price perspective you cannot compare a S20+ and RPi because a smartphone has so many more features and is used for a lot else than connecting to a virtual desktop or web browsing. But let us have a look at the specs of both devices:

SpecificationsSamsung S20+Raspberry Pi 4 B/4GB
FormfactorSmartphoneSmall Single-Board Computer
Dimensions & Weight161.9 x 73.7 x 7.8mm
188g
88 x 58 x 19.5mm
46g (board only)
Operating System(s)Android 10Raspbian
Stratodesk NoTouch OS
ThinLinX
Ubuntu (MATE, Core, Server)
RISC OS
Win 10 IoT Core
Processor (CPU)64-bit 8-Core 2.70 GHz4-Core Cortex-A72 (ARM v8) 64-bit SoC @ 1.5GHz
Memory (RAM)8GB4GB
Network & Connectivity5G
LTE
Wi-Fi
1 GigE (with adapter)
Wi-Fi
1 GigE
Display ConnectivityUSB-C
HDMI (with adapter)
2x micro-HDMI
Power ConnectivityUSB-C
Wireless Charging
Wireless PowerShare
Power Supply
USB-C Connector

The specifications of the Galaxy S20+ let us expect that we should have the same user experience compared to a Raspberry Pi4 Model B with 4GB RAM.

Horizon Test Environment

I’m going to use the same vGPU enabled Windows 10 from VMware TestDrive in the EMEA region. The Win10 desktop is equipped with four vCPUs from a Xeon Gold 6140 CPU, 8GB RAM and a Nvidia Tesla V100 GPU (V100-2Q profile).

VMware TestDrive

As you can see in the screenshot above in Remote Desktop Analyzer I’m connected with the Blast protocol and that the active encoder is NVIDIA NvEnc H264. This tells us that the non-CPU encoding (H.264) on the virtual desktop and the H.264 decoding on the Samsung smartphone are supported and working.

Performance Testing

I have tested a YouTube HD trailer and graphic intensive applications as usual. All my uploaded videos have been compressed to a more web-friendly format and size.

1) YouTube

Here is the link for the Avengers 4 Endgame Trailer.

2) Nvidia Faceworks

3) eDrawings Racecar Animation

4) Nvidia “A New Dawn”

5) FishGL

Can a Samsung Galaxy S20+ replace my laptop?

A Samsung smartphone (or tablet) can definitely replace a fat client like a PC or laptop. The videos above are clearly showing that accessing and working with a virtual desktop is no problem at all and that the user experience is very good.

Working in DeX mode was a little strange at the beginning, but I think I and people in general could get used to it over time.

The 3rd party apps which are not working in DeX mode need to be accessed from a virtual desktop delivered with VMware Horizon or directly on the phone. You can switch to screen mirroring quickly and go back to DeX mode after. That’s just how it is.

When I joined VMware two years ago, I chose the Galaxy S8 as my corporate device and a Dell Precision laptop. For my role as a pre-sales solution architect who has to work a lot offline while travelling, a laptop is probably a better fit. Otherwise, at home or in the office, I could easily work with my S8 or S20+ only.

And as companies are giving you a phone and laptop as well, the price for a S20+ is very acceptable if you can replace at least one device like a PC or thin client.

Mobile computing is already transforming productivity across many industries. I believe that Samsung’s key features and VMware’s digital workspace offering make it possible to provide a secure mobile-first workplace.