This is the second of a 2-part series delivered at Prairie DevCon in Calgry on March 15. 2012. The sessions provided a quick overview of the new features of Hyper-V in Windows Server "8" Beta and how these compare to VMware vSphere 5.
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Prairie DevCon-What's New in Hyper-V in Windows Server "8" Beta - Part 2
1. What’s New in Windows Server
“8” Beta for Hyper-V (Part 2)
Damir Bersinic
Senior Platform Advisor
Microsoft Canada Inc.
damirb@microsoft.com
Twitter: @DamirB
http://blogs.technet.com/b/canitpro
2. Session Objectives and Takeaways
• Why Windows Server "8" Hyper-V for Private Cloud
• What did we learn from you and our Partners?
• Networking
• Hyper-V VM Mobility
• Critical Cloud Security
• Hyper-V Replica
5. Network Considerations
Customers
• How do I ensure network • Fully Leverage Network
multi-tenancy? Fabric
• IP Address Management is a • How do I integrate with
pain. existing fabric?
• What if VMs are competing • Network Metering?
for bandwidth? • Can I dedicate a NIC to a
workload?
6. Hybrid Clouds
Windows Server "8" is optimized for Hybrid Clouds to host multi-tenant
workloads
Tenant 1: Multiple VM Workloads
Tenant 2: Multiple VM Workloads
Data Center
7. Security
In a multi-tenant environment …
… customers want security and isolation
Tenant 1: Multiple VM Workloads
Tenant 2: Multiple VM Workloads
Data Center
8. Multi-Tenant Network Requirements
• Tenant wants to easily move VMs to/from the cloud
• Hoster wants to place VMs anywhere in the data
center
• Both want: Easy Onboarding, Flexibility & Isolation
Woodgrove Bank Contoso Bank
Blue 10.1.0.0/16 Cloud Data Center Red 10.1.0.0/16
9. One Solution: PVLAN
Green Blue Red1 Red2
10.1.1.31 10.1.1.21 10.1.1.11 10.1.1.12
Hyper-V Switch
u
Isolated Isolated Community Community
4, 7 4, 7 4, 9 4, 9
Win 8 Host
• Isolation Scenario To Internet (10.1.1.1)
• Hoster wants to isolate all VMs from each other and allow internet connectivity
• #1 Customer Ask from hosters
• Community Scenario
• Hoster wants tenant VMs to interact with each other but not with other tenant VMs
• Requires a VLAN id for each “community” (limited scalability, only 4095 VLAN IDs)
10. Introducing Hyper-V Network Virtualization
Woodgrove VM Contoso VM Woodgrove network Contoso network
Physical
Physical network
server
Hyper-V Machine Virtualization Hyper-V Network Virtualization
• Run multiple virtual servers on a • Run multiple virtual networks on a physical network
physical server • Each virtual network has illusion it is running as a physical
• Each VM has illusion it is running fabric
as a physical server
11. Reliability
Even when hardware fails …
… customers want continuous availability
TEAMING
Tenant 1: Multiple VM Workloads
Tenant 2: Multiple VM Workloads
Data Center
12. Predictability
Even when multiple VMs are competing for bandwidth …
… customers want predictability
15
Tenant 1: Multiple VM Workloads
$$
25
Tenant 2: Multiple VM Workloads
Data Center
$$$$
13. Scalability
Cloud admins want scalability …
… and customers want performance
Tenant 1: Multiple VM Workloads
Tenant 2: Multiple VM Workloads
Data Center
14. Extensibility
Customers want specialized functionality with lots of choice …
… for firewalls, monitoring and physical fabric integration
Tenant 1: Multiple VM Workloads
Tenant 2: Multiple VM Workloads
Data Center
15. Hyper-V Extensible Switch
Forwarding extensions direct traffic, defining the
Filtering extensions can also be
Capture extensions can inspect traffic and
Windows Filter Platform (WFP) Extensions
destination(s) of each packet
generate new traffic for report insert APIs
implemented using NDIS filteringpackets
Root Partition
VM1 VM2
can inspect, drop, modify, andpurposes
VM NIC Host NIC VM NIC using WFP APIs
BFE Service Firewall Forwarding extensions can capture and filter traffic
Capture extensions do not modify Broadcom
Example: VM DoS Prevention by existing
Extensible Switch
Filtering Engine Callout Extensible Switch traffic Firewall software
Windows Antivirus and
Examples:
uses WFP for traffic filtering
Extension Protocol – Cisco Nexus 1000V and UCS
–
Capture Extensions Example: sflow byFirewall by 5NINE Software
Example: Virtual inMon
NEC ProgrammableFlow's vPFS OpenFlow
WFP Extensions
Filtering Extensions
Forwarding Extensions
Extension Miniport
Physical NIC
16. Feature Rich Networking in the Box
• Open, Extensible Virtual Switch• SR-IOV Network Support
• Nexus 1000 Support – Reduce Latency & CPU
• Openflow Support Utilization
• Network Introspection – Supports Live Migration
• Much more…
• Network QoS
• Advanced Networking – Per VNIC bandwidth
• ACLs reservation & limits
• PVLAN
• …much more…
• Network Metering
• Windows NIC Teaming
17. Single-Root I/O Virtualization (SR-IOV)
• Reduces latency of network
path Root Partition Virtual Machine
• Reduces CPU utilization for Hyper-V Switch
processing network traffic Routing
Virtual NIC
• Increases throughput VLAN Filtering
• Direct device assignment to Data Copy
virtual machines without
compromising flexibility
Virtual Function
Physical
• Supports Live Migration
SR-IOV Physical NIC
NIC
Network I/O path with SR-IOV
Network I/O path without SR-IOV
18. SR-IOV Enabling & Live Migration
Turn On IOV Live Migration Post Migration
Enable IOV (VM NIC Property) Break Team Reassign Virtual Function
Virtual Function is “Assigned” Remove VF from VM Assuming resources are
Team automatically created Migrate as normal available
Traffic flows through VF
Software path is not used
Virtual
Network Stack
Machine
“TEAM”
Software NIC “TEAM”
VM has connectivity even if
Switch not in IOV mode
Software Switch Software Switch
(IOV Mode) IOV physical NIC not (IOV Mode)
present
Virtual Function Virtual Function
Different NIC vendor
Physical
SR-IOV Physical NIC Different NIC firmware SR-IOV Physical NIC
NIC
19. Cloud Admins Want Scale, Customers Perf
DVMQ, IPsec Task Offload, SR-IOV
IPsec Task Offload: Microsoft expects
Dynamic Virtual Machine Queue deployment of Internet Protocol security
(VMQ) is a feature available to (IPsec) to increase significantly in the coming
years. The large demands placed on the CPU
computers running Windows Server by the IPsec integrity and encryption
2008 R2 with the Hyper-V server role algorithms can reduce the performance of
installed, that have VMQ-capable your network connections. IPsec Task Offload
network hardware. VMQ uses is a technology built into the Windows
operating system that moves this workload
hardware packet filtering to deliver from the main computer's CPU to a dedicated
packet data from an external virtual processor on the network adapter.
machine network directly to virtual
machines, which reduces the SR-IOV is a specification that allows a PCIe
device to appear to be multiple separate
overhead of routing packets and physical PCIe devices. The SR-IOV
copying them from the management specification was created and is maintained
operating system to the virtual by the PCI SIG, with the idea that a standard
machine. specification will help promote interoperability.
SR-IOV works by introducing the idea of
physical functions (PFs) and virtual functions
(VFs). Physical functions (PFs) are full-
featured PCIe functions; virtual functions
(VFs) are “lightweight” functions that lack
configuration resources.
20. Advanced Network Security
DHCP Guard, Router Guard, Monitor Port
• DHCP Guard is a security feature that
drops DHCP server messages from
unauthorized virtual machines pretending
to be DHCP servers.
• Router Guard is a security feature that
drops Router Advertisement and
Redirection messages from unauthorized
virtual machines pretending to be routers.
• Monitor Mode duplicates all egress and
ingress traffic to/from one or more switch
ports (being monitored) to another switch
port (performing monitoring)
21. Manage to a Service Level Agreement
Network Bandwidth & QoS
• Bandwidth
Management allows
you to easily reserve
minimum or set
maximums to provide
QoS controls to
manage to a service
level agreement
22. Windows 8 Networking: It’s All There
Feature rich, extensible, in the box, no compromises
Windows Server 2008 Windows Server 2008 R2 Windows Server "8“ Beta
NIC Teaming Yes, via partners Yes, via partners Windows NIC Teaming in box.
VLAN Tagging Yes Yes Yes
MAC Spoofing Protection No Yes, with R2 SP1 Yes
ARP Spoofing Protection No Yes, with R2 SP1 Yes
SR-IOV Networking No No Yes
Network QoS No No Yes
Network Metering No No Yes
Network Monitor Modes No No Yes
IPsec Task Offload No No Yes
VM Trunk Mode No No Yes
23. VMware Comparison
Windows Server “8” VMware VMware vSphere
Capability
Beta Hyper-V ESXi 5.0 5.0 Enterprise Plus
Extensible Switch Yes No Yes1
Confirmed Partner Extensions 4 No 2
Private Virtual LAN (PVLAN) Yes No Yes1
ARP Spoofing Protection Yes No vShield App/Partner2
DHCP Snooping Protection Yes No vShield App/Partner2
Virtual Port ACLs Yes No vShield App/Partner2
Trunk Mode to Virtual Machines Yes No No
Port Monitoring Yes Per Port Group Yes3
Port Mirroring Yes Per Port Group Yes3
1. vSphere Distributed Switch (required for extensibility & PVLAN capability) is available only in the
Enterprise Plus edition of vSphere 5.0
2. ARP Spoofing, DHCP Snooping Protection & Virtual Port ACLs require either vShield App or a Partner
solution, all of which are additional purchases on top of vSphere 5.0 Enterprise Plus
3. Port Monitoring and Mirroring at a granular level requires vSphere Distributed Switch, which is
available in the Enterprise Plus edition of vSphere 5.0.
23
24. VMware Comparison
Windows Server “8” VMware VMware vSphere
Capability
Beta Hyper-V ESXi 5.0 5.0 Enterprise Plus
Dynamic Virtual Machine Queue Yes Yes Yes
IPsec Task Offload Yes No No
SR-IOV Yes DirectPath I/O1 DirectPath I/O1
Storage Encryption Yes No No
1. DirectPath IO, whilst not identical to SR-IOV, aims to provide virtual machines with more direct access
to hardware devices, with network cards being a good example. Whilst on the surface, this will boost
VM networking performance, and reduce the burden on host CPU cycles, in reality, there are a
number of caveats in using DirectPath I/O:
• Very small Hardware Compatibility List
• No Memory Overcommit
• No vMotion (unless running certain configurations of Cisco UCS)
• No Fault Tolerance
• No Network I/O Control
• No VM Snapshots (unless running certain configurations of Cisco UCS)
• No Suspend/Resume (unless running certain configurations of Cisco UCS)
• No VMsafe/Endpoint Security support
No such restrictions are imposed when using SR-IOV, ensuring customers can combine the highest
levels of performance with the flexibility they need for an agile infrastructure.
24
26. Customers Discuss VM Mobility
• Don’t provide new features • No Downtime Servicing
that preclude Live Migration. – SAN Upgrades/Migrations
• I want to be able to securely • When VMs migrate, move
move any part of a VM the historical data with the
anywhere at anytime. No VM
Limits. • Fully Leverage hardware to
speed migrations
27. Virtual Machine Mobility
• Live Migration with High Availability
• SMB Live Migration
• Live Storage Migration
28. Live Storage Migration
• Enables Storage Load Hyper-V
Balancing Virtual Machine
1
• No downtime VHD Stack 3
servicing 2
• Leverages Hyper-V
Offloaded Data 5 VHD VHD 4
Transfer (ODX) Source Device Destination Device
29. Wouldn’t it be great if you could Live Migrate
a VM with nothing but an Ethernet cable?
We think so too…
Introducing: Share Nothing Live
Migration
30. VM Mobility
Complete mobility. Simply the best.
• Live Migration with High Availability
• Live Migrate among servers in a failover cluster
• SMB Live Migration
• Live Migrate VMs among servers with SMB storage
• Live Storage Migration
• Live Migrate VM storage from one volume to another without downtime
• Share Nothing (SNO) Live Migration
• Live Migrate VMs among servers with nothing, but an Ethernet
connection
31. VMware Comparison
Windows Server “8” VMware VMware vSphere
Capability
Beta Hyper-V ESXi 5.0 5.0 Enterprise Plus
VM Live Migration Yes No1 Yes2
1GB Simultaneous Live Migrations Unlimited3 N/A 4
10GB Simultaneous Live Migrations Unlimited3 N/A 8
Live Storage Migration Yes No4 Yes5
Shared Nothing Live Migration Yes No No
Network Virtualization Yes No No
1. Live Migration (vMotion) is unavailable in ESXi 5.0 – vSphere 5.0 required
2. Live Migration (vMotion) is available in Essentials Plus & higher editions of
vSphere 5.0
3. Within the technical capabilities of the networking hardware
4. Live Storage Migration (Storage vMotion) is unavailable in ESXi 5.0
5. Live Storage Migration (Storage vMotion) is available in Enterprise &
Enterprise Plus editions of vSphere 5.0
31
34. Hyper-V Replica
Unlimited Replication
• Disaster Recovery Scenarios:
• Planned, Unplanned and Test Failover
• Pre-configuration for IP settings for primary/remote
location
• Key Features:
• RPO/RTO in minutes
• Seamless integration with Hyper-V and Clustering
• Automatically handles all VM mobility scenarios
(e.g. Live migration)
• Supports heterogonous storage between primary
and recovery
• Integrates with Volume Shadow Services (VSS)
35. Hyper-V Replica
Complements Array Based Replication
Replication Cost Management Performance
Provider
Microsoft • Flexible Storage • VM Granularity • 5 minutes RPOs
Hyper-V Options Available • Open APIs • Application Level
Replica • Unlimited VM provide Consistency
Replication included extensibility, • File Level
interoperability Consistency
and prevent
vendor lock-in
Storage Based NetApp, HP, Fujitsu, • High end replicating • LUN-VM Layout • Synchronous
Replication IBM, Hitachi, FalconStor, storage • Coordination with Replication
3Par, EMC, LSI, • Additional storage team • High Data
Compellent, EqualLogic replication software Volumes
and more…
36. VMware Comparison
Windows Server VMware VMware vSphere
Capability
“8” Beta Hyper-V ESXi 5.0 5.0 Enterprise Plus
Incremental Backups Yes No Yes1
VM Replication Yes No vCenter SRM2
NIC Teaming Yes Yes Yes
Integrated High Availability Yes No3 Yes4
Guest OS Application Monitoring Yes N/A No5
Failover Prioritization Yes N/A Yes6
Affinity & Anti-Affinity Rules Yes N/A Yes6
Cluster-Aware Updating Yes N/A Yes6
1. VMware Data Recovery is available in Essentials Plus and higher vSphere 5.0 editions
2. vSphere Replication is a feature of VMware vCenter Site Recovery Manager (SRM), which is available
in 2 editions and is a chargeable addition to vSphere 5.0
3. ESXi 5.0 has no high availability features built in – vSphere 5.0 is required.
4. VMware HA is built in to Essentials Plus and higher vSphere 5.0 editions
5. VMware have made APIs publicly available, but actual application monitoring is not included
6. Features available in all editions that have High Availability enabled.
37. VMware Comparison
Windows VMware
VMware
Capability Server “8” Beta vSphere 5.0
ESXi 5.0
Hyper-V Enterprise Plus
Nodes per Cluster 64 N/A1 32
VMs per Cluster 4,000 N/A1 3000
Max Size Guest Cluster (iSCSI) 64 Nodes 02 02
Max Size Guest Cluster (Fiber) 64 Nodes 2 2
Max Size Guest Cluster (File Based) 64 Nodes 03 03
Guest Clustering with Live Migration Support Yes N/A1 No4
Guest Clustering with Dynamic Memory
Yes No5 No5
Support
1. High Availability/vMotion/Clustering is unavailable in the standalone ESXi 5.0
2. VMware does not support VM Guest Clustering using iSCSI storage.
3. VMware does not support VM Guest Clustering using File Based Storage i.e. NFS
4. VMware does not support the vMotion of a VM that is part of a Guest Cluster
5. VMware does not support the use of Memory Overcommit with a VM that is part of
a Guest Cluster
39. Windows Server "8" for Cloud
• Most Manageable & Extensible
• Hyper-V Extensible Switch
• New Minimal Server Install (MinShell)
• PowerShell Flexibility
• HTTP
• WSMan
• DCOM
• Persistent Metrics
• Maintenance Mode in the Box
40. Windows Server "8" for Cloud
• Most Scalable
• Largest Virtual Disks
• Native 4K disk support
• Most NICs per Team
• Most Virtual Disks per VM
• Most Nodes per cluster
• Most VMs per cluster
41. Windows Server "8" for Cloud
• Most Secure
• BitLocker integration with Failover Cluster
• Secure Guest Fiber Channel
• DHCP Guard, Router Guard
• IPSec Task Offload
• Secure Boot, Attestation, Measured Boot
• Simple Authentication
42. Windows Server "8" for Cloud
• Complete VM Mobility & In the Box
• Share Nothing Live Migration
• SMB Live Migration
• Live Migration with High Availability
• Live Storage Migration
• Concurrent Live Migration
• Concurrent Live Storage Migration
43. Windows Server "8" for Cloud
• Most Feature Rich, All • More…
Server Editions include: 7. Hyper-V Resource Pools
1. Hyper-V Extensible Virtual Switch
2. Hyper-V Replica
8. Hyper-V Offloaded Data
3. Live Storage Migration Transfer
4. Network I/O Control 9. GPU Accelerated VM
5. Storage I/O Control Video
6. SR-IOV
10. ….And…
Hyper-V Network
Virtualization
44. We Didn’t Even Get To…
• New CPU Instruction Support • Simple Authorization
• Dynamic Memory 2.0 • In Box Maintenance Mode
• Network Resource Pools • Configurable Saved States
• Storage Resource Pools
• VDI
• Persistent Metrics
• RemoteFX 2.0
• Secure Boot, Measured Boot,
• Just scratching the surface..
Attestation
45. In Review: Session Objectives and Takeaways
• Windows Server "8": The Definitive Cloud OS
• Designed for Mission Critical, Scale Up
• New Rich Industry Leading Networking
• Hyper-V Extensible Switch
• Hyper-V Network Virtualization
• Unparalleled VM Mobility
• Share Nothing Live Migration
• Unlimited VM Replication with Hyper-V Replica
49. Download System Center 2012 RC Eval
http://technet.microsoft.com/en-ca/evalcenter/hh505660.aspx
50. Microsoft Virtualization Certifications
Exam Number
Core Exam for the Following Track
and Title
70-659, TS: Windows Server 2008 R2, Microsoft Certified Technology Specialist
Server Virtualization (MCTS)
70-669, TS: Windows Server 2008 R2, Microsoft Certified Technology Specialist
Desktop Virtualization (MCTS)
70-693, PRO: Virtualization Administrator Microsoft Certified IT Professional
2008 R2 (MCITP)
http://www.microsoft.com/learning/
52. What’s New in Windows Server
“8” Beta for Hyper-V (Part 2)
Damir Bersinic
Senior Platform Advisor
Microsoft Canada Inc.
damirb@microsoft.com
Twitter: @DamirB
http://blogs.technet.com/b/canitpro