For a few years I ve been using three Intel NUC Skull Canyon (NUC6i7KYK) mini PCs for my home lab. Each NUC is equipped with the following:
6th Gen Intel i7-6770HQ processor with Intel Iris Pro graphics
2x 16GB Kingston Value RAM DDR4-2133
2x 500GB Samsung 960 EVO NVMe M.2
1x Transcend JetFlash 710S USB boot device
These small computers were nice in terms of space, but are limited to 32GB RAM, have only 1 network interface and no separate management interface.
This was enough and acceptable when I worked with XenServer, used local storage and just had to validate XenDesktop/XenApp configurations and designs during my time as Citrix consultant.
When I started to replace XenServer with ESXi and created a 3-node vSAN cluster for my first Horizon 7 environment, all was running fine at the beginning. But after while I had strange issues doing vMotions, OS installations, VCSA or ESXi upgrades.
So, I thought it’s time build a “real” home lab and was looking for ideas. After doing some research and talking to my colleague Erik Bussink, it was clear for me that I have to build my computing nodes based on a Supermicro mainboard. As you may know, the Skull Canyons are not that cheap and therefore I will continue using them for my domain controller VMs, vSAN witness, vCenter Server appliance etc.
I found two Supermicro X11SPM-TF motherboards for a reduced price, because people ordered and never used them. This was my chance and a “sign” that I have to buy my stuff for the new home lab NOW! Let’s pretend it’s my Christmas gift. 😀
The key features for me?
768GB RAM limit (not that I would need that much, but better than 32GB)
I went for the Fractal Design Node 804 because it offers me space for the hardware and cooling. And I like the square form factor which allows me to stack them.
I need some number of cores in my system to run tests and have enough performance in general. I will mainly run Workspace ONE and Horizon stuff (multi-site architectures) in my lab, but this will change in the future. So I have chosen the 8-core Intel Xeon Silver 4110 Processor with 2.10 GHz.
RAM was always a limiting factor with my NUCs. I will reuse two of them and start with two 32GB 2666 MHz Kingston Server Premier modules for each ESXi host (total 64GB per host). If memory prices are reducing and I would need more capacity, I easily can expand my system.
Samsung 860 EVO Basic 250GB which is way too much for ESXi, but the price is low and I could use the disk for something else (e.g. for a new PC) if needed.
Caching Device for vSAN
I will remove one Samsung 960 EVO 500GB M.2 of each NUC and use them for the vSAN caching tier. Both NUCs will have still one 960 EVO 500 left to be used as local storage.
Capacity Device for vSAN
Samsung 860 Evo Basic 1TB.
Currently, my home network only consists of Ubiquiti network devices with 1GbE interfaces.
So I ordered the Ubiquiti 10G 16-port switch which comes with four 1/10 Gigabit RJ45 ports – no SFPs needed for now. Maybe in the future 😀
This is the home lab configuration I ordered and all parts should arrive until end of November 2018.
I failed the VCAP7-DTM Design exam, but expected it and the first try of the exam showed me what stuff I need to learn better and where my weaknesses are. Let me tell you about my exam experience.
I arrived on time at the PearsonVUE test center, but they had PC problems and so I had to wait first for 30min until I could start the exam. The timer showed me that I have two hours for the 60 questions. The most of the time I was guessing and eliminating the obviously wrong answers and so I was through 50% of the questions of 50% of the time. If you would know a little bit more than I do and you work/worked with all the products on a daily basis, I would say that the exam is a piece of cake!
Nevertheless, I answered all 60 questions 15 minutes before the timer ended, but I didn’t review any of them, because I knew that I still wouldn’t have the better or correct answers. This may sound to you like I failed with a score of 0, but no. I had 252 of the 300 needed points and this is a sign for me that I just need to improve my weak spots and the topics I didn’t check during my preparation time.
Today I’m going to travel to VMware Airwatch in Milton Keynes (UK) for my VMware Workspace ONE: Deploy and Manage [V9.x] training which starts tomorrow. And I have to prepare a presentation for a roadshow with five events where I will be the speaker of a 30min slot. This means no time for studying yet.
But I’m lucky that I still got a seat at the Digital Workspace Livefire Architecture & Design training taking place in three weeks. This will be last part of my preparation for the retake which I planned for 23rd November 2018. But first I have to wait for my new exam voucher. 🙂
I cannot tell you which topics/technologies or questions were asked during the exam, but I can assure you that I didn’t expect some of the questions – they were just craaaaazy or about veeeery old stuff.
This is also one of my problems. You have to study things which are not valid anymore for the today’s product version or implementation. In a few cases the configuration limits or some parts of an architecture have changed.
So, I read the exam blueprint again and checked some of the attached URLs and document links again. In my opinion the following products and versions you should know for the exam:
VMware Identity Manager 2.8
App Volumes 2.12
User Environment Manager 9.1
Unified Access Gateway 2.9
vRealize Operations 6.4
So, this was my exam experience of the VCAP7-DTM Design exam and my advices after. It is totally okay to fail, because it will just help you if you are not prepared well enough or just went to early for your first shot.
My last advice: Use the note board for the difficult answers and topics you have no clue of. If you have enough time, reviewed your answers and you are ready to end the exam, memorize all your notes. Just in case you didn’t pass, you now have the notess in your mind and could transfer themto your personal notebook. This is totally legal and really helpful! 🙂
Good luck to you if you take the exam. I have another four weeks now to fill the gaps. 🙂 See if I passed or not.
My last article was about the Horizon reference architecture and four weeks have already passed since then. My VCAP7-DTM Design exam is scheduled for October 18 – that’s in five days!
I haven’t opened my books the last three weeks, because I think it’s important to take a break and get some distance of your books and documents, which allows you to understand things better and faster and see connections between things you haven’t seen before. And another reason was my pregnant wife who delivered our beautiful daughter on October 4! 🙂
I started from scratch and repeated reading all my training material and PDF documents.
To design a Horizon 7 environment you have to follow a process to work out a VMware EUC solution that meets the customer’s requirements and follow the VMware design guidelines and use the reference architectures while considering customer constraints. It is very important that all customer business drivers and objectives are clearly defined. Then you will start to gather and analyze the business and application requirements and document the design requirements, assumptions, risks and constraints. For example, if you talk about technical requirements with your customer, the following categories should be covered:
Virtualization infrastructure and data center hardware
With the information from the assessment phase, the design work can begin and you create the conceptual design before you head over to create a logical design. Advice: Minimize risks and keep things simple!
Horizon Logical Design
The logical design (high level design) follows the conceptual design and defines how to arrange components and features. It is also useful to understand and evaluate the infrastructure design. The easiest and most common way to create a logical design is the use of architecture layers. Each layer contains one or more components and has functional and technical inter-dependencies:
Application deployment and type (cloud-based, locally installed, enterprise apps etc.)
Use cases and type of user
Scalability and multi-site
Desktop types and OS
Compute, network and storage
Network and storage
Cluster and resources
Internal and external
Authentication and authorization
A Horizon logical design could look like this:
If you need to write down use cases and their attributes, here an example:
Time of use
Horizon Block and Pod Design
In part 4 I covered this topic how to use a repeatable and scalable approach to design a large scale Horizon environment.
Horizon Component Design
To have a complete design you must define the amount and the configuration of Horizon components required for your environment. You have to include certain design recommendations and design the configuration for Horizon components for your use cases. These are some required infrastructure components:
VMware Identity Manager
Load Balancing for resiliency and scale
Connection to Active Directory
SaaS-based implementation recommended
Approx. 100’000 users per virtual appliance
Up to 10’000 virtual machines per vCenter
Recommendation: 2’000 desktops per vCenter
Dedicated vCenter Server instance per resource block
Up to 2’000 sessions per Connection Server (4’000 tested limit)
Install at least one Replica Server for redundancy
Max. 7 Connection Servers per pod
Max. 10’000 sessions per pod recommended
Cloud Pod Architecture
Max. 175 Connection Servers
Max. 120’000 sessions
Max. 5 sites
View Composer needed?
Security Server (not recommended anymore, use UAG)
Should not be member of AD domain
Should be hardened Windows server (placed in DMZ)
1:1 mapping with Connection Servers
Unified Access Gateway (UAG)
Virtual appliance (placed in DMZ) based on linux (Photon OS)
Scale-out is independent of Connection Server
Does not need to be paired with a single Connection Server
Know the key firewall considerations for Horizon 7
Bandwidth requirements for different types of users
WAN considerations (e.g. latency, WAN optimization)
Optimization/Policies for display protocols (LAN/WAN)
vSphere networking requirements
Separate networks for management, VMs, vMotion etc.
Use vSphere Distributed Switch
Secure your desktops (lockdown, GPOs, UEM)
Use secure client connections (secure gateways/tunnel)
Use Unified Access Gateway for remote access (use three NICs)
View Security Server (if needed)
User authentication method from internal and external
Two Factor Authentication for external connections
Restrict access (tags, AD groups)
Use NSX for micro segmentation
Install signed SSL certificates
Our objective of a Horizon implementation is to provide better support to users than the physical solution. Session management is an aspect of this. Configuration and different settings on the sessions or client device are essential for a smooth user experience.
This is my recommendation. Within the last 8 weeks I’ve effectively studied 5 weeks for the exam. I work approx. since 4 months with Horizon products in a pre-sales role, not as a consultant. I will update you after the exam if the experience combined with learning was enough to pass! 🙂
Did I forget anything? Let me know! Jump to part 12
I only focus on the component design part since I already covered topics like use cases, business drivers, design methodology etc.
A successful deployment depends on good planning and a very good understanding of the platform. The core elements include Connection Server, Composer, Horizon Agent and Horizon Client. Part 4 to part 9 cover the Horizon 7 component design and also provide more information on the following components.
VMware Identity Manager (VIDM) can be implemented on-premises or in the cloud, a SaaS-based implementation. If you decide to go with the SaaS implementation, a VIDM connector needs to be installed on-prem to synchronize accounts from Active Directory to the VIDM service in the cloud.
If cloud is no option for you, you still have the possibility for the on-prem deployment and use the Linux-based virtual appliance. There is also a Windows-based installer available which is included in the VMware Enterprise Systems Connector. VMware’s reference architecture is based on the Linux appliance.
Syncing resources such as Active Directory and Horizon 7 and can be done either by using a separate VMware Identity Manager Connector or by using the built-in connector of an on-premises VMware Identity Manager VM. The separate connector can run inside the LAN in outbound-only connection mode, meaning the connector receives no incoming connections from the DMZ.
VIDM comes with an embedded PostgreSQL database, but it’s recommended to use an external database server for production deployments.
For high availability, based on your requirements, at least two VIDM appliances should be deployed behind a load balancer. After you have deployed your first appliance, you simply clone it and assign a new hostname and a new IP address.
As you still may know from part 8, App Volumes has two functions. The first is the delivery of applications for VDI and RDSH. The second is the provision of writable volumes to capture user-installed applications and the user profile.
For high availability, always use at least two App Volumes Managers which are load-balanced.
AppStacks are very read intensive, hence, you should place AppStacks on storage that is optimized for read operations. Writable volumes should be placed on storage for random IOPS (50/50). There reference architecture uses vSAN to provide a single highly available datastore.
For the SQL database it is recommended using an AlwaysOn Availability Group.
User Environment Manager
When User Environment Manager design decisions need to be made, you have to think about user profiles (mandatory, roaming, local) and folder redirection. As already described in part 9, VMware recommendation is to use mandatory profiles and folder redirection. Use appendix B if you need help configuring the mandatory profile.
The first key design consideration is using DFS-R to provide high availability for the configuration and user shares. Note: Connect the management console only to the hub member when making changes. DFS-R will replicated those changes to the spoke members.
In part 6 I mentioned that a UAG is typically deployed within the DMZ.
UAG appliances are deployed in front of the Horizon 7 Connection Servers and sit behind a load balancer. The Unified Access Gateway also runs the Content Gateway as part the AirWatch (WorkspaceONE UEM) service.
You have two sizing options during the appliance deployment:
Standard (2 vCPU, 4GB RAM, 2’000 Horizon server connections, 10’000 AirWatch service connections)
Large (4 vCPU, 16GB RAM, 2’000 Horizon server connections, 50’000 AirWatch service connections)
As you can see, the big difference here are the estimated AirWatch service connections per appliance. In production you would deploy dedicated UAG appliances for each service. Example:
2 standard size UAGs appliances for 2’000 Horizon 7 sessions (n+1)
3 large size UAG appliances for 50’000 devices using Content Gateway and per-App Tunnel which gives us a total of 100’000 sessions. The third appliance is for high availability (n+1)
vSphere and Physical Environment
The software-defined data center (SDDC) is the foundation that runs all infrastructure servers and components. The products and the licensing for the foundation are outside of the Horizon 7 product (except vSAN), but are required to deliver a complete solution.
And in my opinion this is what makes the whole solution so brilliant. Even I work for VMware, I would never say from the beginning that Horizon is better than XA/XD. This was also the case when I worked as a consultant for Citrix before I joined VMware in May 2018.
It depends on the requirements and use cases which need to be satisfied. That are the most important things if you choose a vendor or a specific technology. Our goal is to make the customer happy! 🙂
But I would say that VMware Horizon including WorkspaceONE is very hard to beat if you use the complete stack! But that’s another topic.
The vSphere infrastructure in the reference architecture includes vSAN and NSX. In part 5 I covered the basics of vSAN, but I think I maybe need to write a short overview about NSX and how you can use it with Horizon.
vSAN provides a hyper-converged storage optimized for virtual machines without the need for an external SAN or NAS. This means that the physical server not only provides the compute and memory resources, but also storage in a modular fashion. You can use vSAN for the management and resource block and follow a hybrid approach for the management resources and use all-flash vSAN for the Horizon resources.
I will not cover the vSphere design, but it’s important to understand that all components are operating redundantly and that you have enough physical resources to meet the requirements.
A general recommendation is to use at least 10 GbE connections, to separate each traffic (mgmt, VM traffic, vSAN, vMotion) and make sure that each of them has sufficient bandwidth.
NSX for vSphere
NSX provides several network-based services and performs several security functions within a Horizon 7 implementation:
Protects VDI infrastructure
Protects desktop pool VM communication with applications
Provides user-based access control (user-level identity-based micro-segmentation)
If you want to use NSX you have to think about a NSX infrastructure design as the NSX platform adds new components (e.g. NSX manager) and new possibilities (distributed firewall and identity firewall).
The most important design consideration for Horizon 7 is the concept of micro-segmentation. In the case of Horizon 7, NSX can block desktop-to-desktop communications, which are normally not needed or recommended. Each VM can now be its own perimeter and this desktop isolation prevents threats from spreading:
The Horizon 7 reference architecture of probably the best document to prepare yourself for the VCAP7-DTM exam. What do the current VCAP7-DTM certified people say? What else needs to be covered? Jump to part 11
This is the fifth part of my VCAP7-DTM Design exam series. In part 4 I covered the creation of a physical design for vSphere and Horizon components. This time we take a look at section 4 of the blueprint, the creation of a physical design for horizon storage:
Section 4 – Create a Physical Design for Horizon Storage
Objective 4.1 – Create and Optimize a Physical Design for Horizon Infrastructure Storage
Objective 4.2 – Create and Optimize a Physical Design for View Pool Storage
Objective 4.3 – Create and Optimize a Physical Storage Design for Applications
Objective 4.4 – Create and Optimize a Tiered Physical Horizon Storage Design
Objective 4.5 – Integrate Virtual SAN into a Horizon Design
This article is not a comparison between HCI and traditional storage architecture and if you build hosts by yourself or buy Dell EMC’s VxRail or any other vSAN ReadyNode.
Since it is VMware’s strategy to push vSAN and get away from traditional storage, I only cover vSAN. For my VCDX design I will also move away from traditional storage and use vSAN – it’s also my customer’s strategy. The price for flash storage is decreasing constantly and makes a hybrid vSAN architecture less attractive – at least for our use cases.
In general the storage design of a Horizon implementation is very critical. You have to think about capacity, growth capacity, data/object placement, disaster recovery, kind of SSD disks and so on. But in my opinion, HCI or vSAN makes your life a lot easier and simplifies the storage deployment.
If you fail to correctly size the storage and I/O capacity, your customer’s user experience will suffer or the deployment of new desktops is not possible anymore. So, storage performance and sizing is vital for the satisfactory of your customers and their users!
All-Flash or Hybrid Architecture
The first thing you have to figure out and define is the vSAN platform you are going to deploy – All-Flash or hybrid architecture. A All-Flash vSAN configuration aims at delivering very high IOPS with low latencies. Also in a All-Flash configuration you use two different grades of (flash) disks: lower capacity and higher endurance device for the capacity tier and more cost-effective and higher capacity disks for the capacity tier
There is no read cache available in a All-Flash configuration as all data is directly read from the capacity tier. Because you aim for extremely high IOPS, make sure you provide a dedicated 10Gb network for the vSAN traffic.
You can enable the deduplication and compression setting (not available when using a hybrid vSAN) in the vSAN cluster to reduce redundant copies of blocks within the same disk group to one copy and to compress the blocks after they have been deduplicated.
Erasure Coding (RAID 5/6 is only available with All-Flash) provides the same level of redundancy as mirroring, but with a reduced capacity requirement. In general, erasure coding means breaking data into multiple pieces and spread them across multiple devices, while adding parity data in the event data gets corrupted or lost. This is a good and short video about this feature:
When using vSAN without further adjustments, your virtual desktops and infrastructure servers are using the default vSAN storage policy. For infrastructure servers this might be okay, but for our desktops we need to create a new policies. Cormac Hogan has very good material about Horizon and vSAN Storage Policies:
The Number of Failures to Tolerate defines the number of host, disk or network failures a storage object can tolerate. This number of Failures to Tolerate (FTT) has the greatest impact on your capacity in a vSAN cluster. Based on your configured availability requirements for a VM, the settings in the policy can lead to a higher consumption on the vSAN datastore (more copies of your data). For “n” failures tolerated, n+1 copies of the object are created and 2n+1 hosts are required.
Consider to configure FTT = 0 for the OS disk for linked-clone floating pools or if you use full-clone non-persistent desktops. If vSAN should experience a failure, only non-persistent data will be lost.
I hope this information was helpful even we didn’t go to deep. If you need to know more about vSAN, then you’ll find tons of documents and other blogs about this technology.
In part 6 I’ll try to give you more information about the design for a Horizon network.
In Switzerland sites are often located in the same data center building and two separate rooms represent these sites. To keep management and the architecture simple, some customers or partners would like to take advantage of a vSAN Stretched Cluster.
This question came up several times already at the product management: “Are Instant Clone desktops supported in combination with vSAN Stretched Clusters? And can we use App Volumes?“
The short answer of our product management was that Horizon 7.x (all clones) and a vSAN Stretched Cluster are supported, but that we advise customers to follow the reference architecture design and to test the scalability of the combination of Horizon 7 and a vSAN Stretched Cluster. The caveat is that App Volumes is not supported in this scenario.
But it was not 100% clear if it’s supported to use non-persistent desktops together with a vSAN Stretched Cluster. This gap has been closed with the appendix H:
This new appendix is saying that a stretched active/active architecture is not supported and the use case described in the RA is for full clones only. So, please carefully read our guidelines when working with vSAN Stretched Clusters and Horizon 7.
App Volumes Caveat: There is no support for App Volumes at this time when using a vSAN Stretched Cluster.