Scanning the Internet for External Cloud Exposures via SSL Certs
Next Gen Datacenter
1. ALBORA Portugal
ALBORA
SOLUCIONES
Datacenter de
Nova Geração
Albora Portugal
Rui Lopes, System Engineer
2. Agenda
ALBORA Portugal
1. Evolução do Datacenter
2. Virtualização enquanto habilitador de datacenter de
nova geração
Citrix XenServer - Servidores
Datacore SanMelody – Storage
Marathon everRun vm – cluster & failover
3. Objectivos para o novo Datacenter
Elasticidade e Mobilidade
Alta Disponibilidade & Continuidade de negócio
Provisão e Operação Automatizada
4. Aspectos de segurança
3. Evolução do Datacenter
ALBORA Portugal
P ha s e 1 – P ha s e 2 – P ha s e 4 –
R e c o g n iz e P h a s e 3 – A g ilit y D y n a m ic
C o n s o lid a t e
D a ta c e nte r
Under utilized hardware Test/Dev Some tier 1 applications Dynamic Workload
Delivery
Increasing costs of Encapsulation High Availability
ownership Automation / Policy
Consolidation Disaster Recovery
Difficult management Chargeback / Utility
“Craplications” Mobility
Barriers to expansion Pervasive Virtualization
4. Datacenter 2.0
NextGEN DATACENTER
• Virtual Infrastructure
ALBORA Portugal
• Citrix XenServer
• Citrix Provisioning Server
• Storage Virtualization BACKUP/ DR SITE
• Datacore SANMelody
everRun A
• Business Continuity & DR
• Marathon everRUN C
• Datacore SANMelody PVS
PRIMARY SITE XenPool
SAN
A
everRun
PVS C
IP
XenPool
iSCSI/FC
SAN
IDE,SCSI, SATA,
SAS,FC, iSCSI, etc
6. O que é o XEN?
• Native 64-bit hypervisor
ALBORA Portugal
• Runs on bare metal
• Widely-deployed at tens of thousands of
sites
• Optimized for hardware-assisted & S un C it r ix
paravirtualization
HP C it r ix
• Highly secure Xen open security
framework In t e l
IB M
• Small exposure footprint
• Lightweight and efficient
7. Fiabilidade empresarial
ALBORA Portugal
• Live Migration / Motion
• Dynamic Resource Pooling
• Automated Host Level HA
• Fault Tolerance
• Storage support for DR
• Distributed management
8. Suporte para VM’s Guest
ALBORA Portugal
• Windows
– Windows Server 2008 64-bit & 32-bit Microsoft
Microsoft
– Windows Server 2003 32-bit SP0, SP1, SP2, R2; 64-bit SP2 Virtualization
Virtualization
Validation
Validation
– Windows Small Business Server 2003 32-bit SP0, SP1, SP2, R2 Program
Program
– Windows XP 32-bit SP 2, SP3
– Windows 2000 32-bit SP 4
– Windows Vista 32-bit SP 1
• Linux
– Red Hat Enterprise Linux 32-bit 3.5, 3.6, 3.7, 4.1, 4.2, 4.3, 4.4, 4.5,
4.7, 5.0, 5.1, 5.2; 64-bit 5.0, 5.1, 5.2
– Novell SUSE Linux Enterprise Server 32-bit 9 SP2, SP3, SP4; 10
SP1; 64-bit 10 SP1, SP2
– CentOS 32-bit 4.1, 4.2, 4.3, 4.4, 4.5, 5.0, 5.1 , 5.2; 64-bit 5.0, 5.1,
5.2
– Oracle Enterprise Linux 64-bit & 32-bit 5.0, 5.1
– Debian sarge (3.1), etch (4.0)
9. XenCenter - Consola de gestão
ALBORA Portugal
Device • Included at no cost
Drivers
XenTool Stack
Xen Hypervisor • Runs on any PC
Bare Metal Hardware
Device • No single point of failure
Drivers
XenTool Stack
Xen Hypervisor
• Real time replication
Bare Metal Hardware • Performance monitoring
• VM searching/tagging
Device
Drivers
XenTool Stack • Installs in minutes
Xen Hypervisor
Bare Metal Hardware
10. Saber Mais: Virtualização Servidores
ALBORA Portugal
• Download Citrix Xenserver 5.0 (versão gratuita)
http://deliver.citrix.com/go/citrix/wbFreeXenServer
• Como fazer? Demonstrações video online
http://citrix.com/English/ps2/products/demo.asp?contentid=683148
• Documentação Xenserver
http://support.citrix.com/product/xens/v5.0/#tab-doc
• Forums de suporte
http://forums.citrix.com/category.jspa?categoryID=101
12. datacore
DataCore Software
ALBORA Portugal
X86 Server
Powered by DataCore™
Storage Server
RAID Drive
Controllers
Disks &
JBOD /
SATA Fibre-Channel or
Ethernet NICs
(Host connection)
Latest Components, Latest Speeds,
Individually Upgraded, Software Maintenance only
14. datacore
Virtualização e Optimização de Storage
ALBORA Portugal
• Hardware Independent
Licenced capacity on Custom Server
Support for Virtual Machines
iSCSI or Fiber Channel
• Increased Perfomance & Availability
Auto Thin Provisioning
I/O Performance Acceleration
Data Migration (SAN Motion)
• Business Continuity
Snapshot
Continuous Data Protection & Recoveery (Traveller)
Auto-Failover - Synchronous Mirroring (HA)
Asynchronous IP Mirroring (DR)
15. Saber Mais: Virtualização Storage
ALBORA Portugal
• Download Trial Datacore SanMelody
http://www.datacore.com/products/prod_SANmelody.asp
• Como fazer? Demonstrações e videos online
http://www.datacore.com/videos/
http://www.datacore.com/videos/citrix-iforum-demo.wmv
• SANMelody Highlights
http://www.datacore.com/products/prod_SANmel_suppserv.asp
• Webinars
https://datacore.ilinc.com/perl/ilinc/lms/event.pl
17. everRun VM
Unique Architecture – VM Fault-Tolerance in Software
ALBORA Portugal
•Installs directly onto a pair of Citrix XenServer hosts
–Thin software layer between hypervisor and VM environment
•Auto-creates and maintains identical PVM on alternate host
–“Active” VM is paired with a “Ready” VM
–Assured recovery if Active VM host fails
•PVM’s I/O resources are transparently paired
–Aggregated across both XenServer hosts
–Fully redundant networking & storage
–“ComputeThru” device failures
•Availability Manager attaches to each PVM
–Mini Linux VM, manages I/O redirection
–Automated error detection, fault handling
18. everRun VM
Key Benefits
•Available
ALBORA Portugal
•Zero downtime due to subsystem failures
•Patented “ComputeThru” technology ensures
transparent fail-out of devices
•No complex failover management or testing
•No false failovers
SQL •Mirrored storage for zero data loss
Exchange •Affordable
Oracle •Allows consolidation of multiple business-critical
applications
•Priced for broad adoption
•No shared-disk subsystem or SAN required
•Automated
•Easy to install, operate and maintain
•“Point and click” operation
•Automated fault handling and policy management
•Active redundancy provides assured recovery on host
failure
•No scripting or custom coding
19. Saber Mais: Cluster & Failover
ALBORA Portugal
• Download versão trial
https://mtextranet.marathontechnologies.com/webreq/webreq.asp?req=
• Demonstrações video online
http://www.marathontechnologies.com/everRun_product_demos.html
• “Life on Clusters vs Life on Marathon”
http://www.marathontechnologies.com/jp/media/homeflash.swf
• HA, DR & data protection resource center
http://www.marathontechnologies.com/resource_center.html
21. Elasticidade e Agilidade
ALBORA Portugal
Objectivos
Consolidação de servidores
Melhor aproveitamento da infrastrutura física
Rápida provisão de recursos
Capacidade de resposta dinâmica em função da carga
Operação sustentável (gestão & patching)
Citrix XenServer
Citrix Provisioning Server
22. Operação ininterrupta - XenMotion
ALBORA Portugal
Device Drivers Device Drivers Device Drivers
XenTool Stack XenTool Stack XenTool Stack
X e n H y p e r v is o r X e n H y p e r v is o r X e n H y p e r v is o r
Bare Metal Hardware Bare Metal Hardware Bare Metal Hardware
VM guest storage
23. Dynamic Workload Streaming
Citrix Provisioning Server
ALBORA Portugal
Silo One
A
Citrix Provisioning
Server B
Silo Two
C
Silo Three
Image repository holds Virtual Hard Disks
Servers are configured for network boot.
No local storage required
24. “Any Workload, Any Server, Any Time”
ALBORA Portugal
Silo One
XenServer /
Hyper-V
A
Citrix Provisioning
Server B
Silo Two
C
Silo Three
Virtual Hard Disks are streamed from
image repository
Boot hundreds of VMs/servers from 1
image
25. Manage Disaster Recovery
Primary Data Center Backup Data Center
ALBORA Portugal
XenServer /
Hyper-V
XenServer /
Hyper-V
XenServer /
Hyper-V
Backup servers
2
3
1 Site Failure
host real Failure
Server
workloads
Storage Replication
Provisioning Server Storage Provisioning Server Storage
VIDEO
27. Alta Disponibilidade e Recuperação
ALBORA Portugal
Objectivos
Protecção de activos críticos ao negócio
Aumentar resiliência da infrastrutura
Implementação de plano de DR
Capacidade para recuperar em cenário de desastre
RTO & RPO aceitáveis
Citrix XenServer
Marathon everRun
Datacore SanMelody
28. XenServer - High Availability
ALBORA Portugal
• Automatically restart VMs upon host server failure
• Easily administered within XenCenter
• Reports failover capacity
29. XenServer - High Availability
ALBORA Portugal
Shared Storage
VIDEO
30. Xen + Marathon = Tolerância a falhas
ALBORA Portugal
CRM1 CRM1
XCH1 XCH1 DNS1
SQL1 everRun everRun AD2
XenServer Ent Availability Link XenServer Ent
x86-Based Server x86-Based Server
XenHost1 XenHost
2
LAN
31. Simplifying Disaster Recovery
ALBORA Portugal
1 Automated backup of VM
metadata to SR
2 Replication of SR includes 4
Virtual Disks and VM metadata
3 Attach replicated SR
4 Restore of VM metadata will 1 3
recreate VMs
2
Shared Storage Shared Storage
Production Site DR Site
VIDEO @ 7’30’’
33. Provisão e Operação Automatizada
ALBORA Portugal
Objectivos
Alta disponibilidade aplicacional
Provisão automática em função de condições no
momento
Melhor Performance aplicacional
Gestão global de tráfego e carga
Citrix XenServer
Citrix Workflow Studio
Citrix Netscaler
34. The Citrix Delivery Center in Action
ALBORA Portugal
Citrix Workflow Studio Citrix XenServer
Pool A
Citrix NetScaler Pool B
Monitor Decide Act
Resposta em cenário de pico de trafego
XenServer Tráfego em de inactiva | Netscaler : aumentar serviços
Workflow : balanceamento e monitorização noinfrastrutura
Netscaler : Arrancar máquinamaistráfego pré-definido.& deservice group
Provisionar níveis capacidade contínua Netscaler
Atingido o nivel denormais. Repor Xen Aumentar capacidade!
35. Distribuição de tráfego :
Disponibilidade Global
ALBORA Portugal
www.citrix.com
www.citrix.com
www.citrix.com
www.citrix.com
Falha Europa : Netscaler GSLB direcciona clientes para melhor site site baseado em proximidade
Operação Normal : Netscaler GSLB direcciona clientes para melhor baseado em disponibilidade
36. Saber Mais:
Orquestração do Datacenter & Gestão de Tráfego
ALBORA Portugal
• Download Workflow Studio (gratuito):
https://www.citrix.com/English/ss/downloads/results.asp?pro
• Comunidade de Desenvolvimento - CDN
http://community.citrix.com/cdn/wf/multimedia/
http://community.citrix.com/cdn/wf
• Documentação Workflow Studio
http://support.citrix.com/product/wfs/v1.0/
• Forums de suporte Workflow Studio
http://forums.citrix.com/category.jspa?categoryID=164
38. Aspectos de segurança
ALBORA Portugal
Objectivos
Protecção de activos críticos ao negócio
Acesso Granular em função do utilizador e condições de
acesso
Citrix Access Gateway
Sonicwall e-Class
Sonicwall e-mail security
Sonicwall content filtering
Sophos Entreprise
39. What is Citrix SmartAccess™?
Who is connecting? What is the result What resources
ALBORA Portugal
of the connection? can be accessed?
Which User What Device VPN Access Clientless Web and FileNetwork Level
Access Server Access Access
What What Web Interface XenDesktop Outlook Web XenApp
Authentication Location XenApp Access XenDesktop
Resources
Endpoint Analysis Session Policy Session and
Authentication Policy Authorization Policy
40. All Applications Reduced Applications
Denied Access
& Virtual Channels & Virtual Channels
Full Network Access Restricted network Access
ALBORA Portugal
+ + +
Full Access
+ +
Reduced Access
+
Restricted Access
Clientless Portal and SnR Security
+ Email Access Remediation
Web Site
Global Access
41. Aplicacoes 2.0
APLICAÇÕES
• Web Aplication Optimization
ALBORA Portugal
• Citrix Netscaler
WebUsers BRANCH OFFICE
• Wan Acceleration
• Citrix Wanscaler
• Citrix Branch Repeater
BranchRepeater WAN optimization +
Network servrices
• Web Services
(DHCP, AD, FS, DNS, …)
• Ventus Proxy
WebServiceClient
REMOTE USER
DATACENTER
NetScaler WanScaler
SOAP, XML SLB, Comp, SSL & TCP Offload, Cache CIFS, MAPI, ICA; FTP, [tcp]
DoS Protection, ACL, Content Filtering
42. Escritorio 2.0
POSTO DE TRABALHO
• Virtual Desktop Infrastructure
ALBORA Portugal
• Citrix XENDesktop
RoadWarrior
• Citrix XenApp
• Citrix XenServer
• Citrix Provisioning Server “Thin office”
• Secure Remote Access
• Citrix Access Gateway EE 3G SSL
• User Workstation ipsec
•Wyse X series (laptops)
•Wyse V series (desktop)
• Printing optimization
• ThinPrint .print
•Network Access
• Aruba Mobility Controllers 802.11n
• Network Security
• Sonicwall E-Class UTM DMZ
CITRIX AGEE
WLAN
DATACENTER
WebApp
XenApp XenDesktop PrintServer
46. ALBORA Portugal
OBRIGADO!
Rui Lopes
rlopes@ingrammicro.pt
91 414 3083
Junho 2009
Notas do Editor
Plase 1: Many issues. Commoditized hardware and one app per server model has created a monster. Average utilization of servers ~ 15% ( Source: Gartner) Space, power, cooling challenges abound. Nearly 80% of IT costs spent just to keep the lights on…let alone innovate. Etc… Phase 2: Virtualization begins to take root in test/dev. Benefits of consolidation starting to be seen for some production apps (“Craplications”) This is goodness. Phase 3: Virtualization beginning to be seen for more than just consolidation. Moving to more business and mission critical apps. HA and recovery (DR) become focus areas. Virtualization seen as a way to eliminate planned downtime. Again, more goodness… Phase 4: Goes beyond “Agility” to policy based computing and new ways (paradigms) to deliver apps. Applications may become largely streamed and diskless. More “Utility-like” Virtualization is a key enabler and begins to become pervasively adopted. BUT… reality is that very few severs (even today) are virtualized. We’re still a long way off from seeing pervasive adoption of virtualization. Still in the low teens. (see next slide…) 79% of IT budget to keep the business running Source: Gartner Server sprawl, electricity, floor space Managing too many physical servers
We must first start with the underpinnings of XenServer and that’s the Xen hypervisor. Leverages Open Source standard Lean with < 50K lines of code Work closely with OS vendors and advisory board: Citrix, IBM, Intel, HP, Novell, Red Hat and Sun Microsystems Community patches, updates and enhancements Security CIA and NSA actively contribute to Xen XS Differentiation from Xen Open Source Management console; XenMotion; Templates; Optimization
Red text indicates new platforms that are supported with XenServer 5.
Manages Xen servers, VMs& resources -Standard windows look and feel -No single Point of Failure- like AD Multi-master replication (Master/Slave), if one fails it will promote a 2nd -Same info on all PS - No data stored in XenCenter it is a “pane of glass”
XenMotion. Check. Got it.
The power of OS Streaming technology is more evident the wider it gets deployed. Simplifies intractable problems. Now, rather than having dedicated back up sites, multiple sites can back up to the same datacenter. This creates big savings.
VM’s on failed physical servers can automatically be restarted on other servers in the pool
Even if you are not using remote storage you can backup VMs and move them around using our import/export functionality. Again since the VMs are isolated from any hardware differences between the underlying servers you remove all of the driver headache found when moving a physical OS instance around to different boxes.
Descrição de Componentes : Citrix NetScaler = Aplication delivery controller
SmartAccess is not a feature but rather a concept. SmartAccess incorporates the following: Who is connecting? Access Gateway uses EPA scans to determine various characteristics about a client device. What is the result of the connection? Once users are authenticated, will they receive a full VPN connection, clientless access, Web Interface/Published Applications, etc? What resources can be accessed? Will users receive full access to internal network resources or only a subset of resources? How will users be able to access these resources (published apps only, FTA, etc.)?
Here is an example of providing different levels of access, based on the results of client security scans. Here, if the user doesn’t have Windows XP they are denied. Full access is given to PC’s with Prism, Symantec, a particluar registry key, and are running XP. Access is reduced as the users have fewer of these components.