VMWare 4 rant...

[tpunx99GSX]

So i have been working on a very large Proof of Concept project for a school for the past month. The whole concept is to use VMWare with virtual desktops that all of the teachers can use instead of their local desktops. We created a concept that has two sides that they can compare and choose which way to go. On the one side is VMWare, the Other is Citrix ESX.
Both were lacking performance when dealing with flash, as well as overall performance. But there was an update coming out for VMWare that enables PC Over IP and is supposed to run smoother than ever with everything and was touting lower bandwidth usage and such. So we decided, lets wait for this upgrade to come out and install it and hopefully this will solve a lot of our performance issues.
Enter VMWare 4...
Install goes ok, and I provision the desktops. I go to run the desktop through the portal and Bam Error, PCoIP cannot run through the Portal. Interesting i think, well there must be another way to connect to it. After going back and forth with our engineer that we have been working with (from a different company) we find out that this stupid peice of crap needs a VPN Connection. One of the purposes we were choosing to go with a solution like this is so that we do not have to use a VPN. VMWare has ABSOLUTLY NO DOCUMENTATION that says anything about needing a VPN. BAH!!! So now the same people that were screaming "We are better than citrix because we have this new product with enormous bandwidth savings and everything will run smooth" decided to not devulge the fact that you must have a Overhead hog like VPN for it to actually work. Sure, your software doesnt take up much bandwidth, but when you add the vpn Citrix looks a lot better. VMWare is looking more and more like a shady company these days.

[s1ngletracker]

My knowledge on VMWare and such is pretty limited, but why the heck do teachers need a virtual machine, rather than just having a local machine in their classroom or whatever? I mean, they need one anyway to be able to use a Virtual Image anyway... soooo

[Nartanian]

We gotta use vmware in some of our classes too. I think we use so that in case we screw anything up it doesn't affect the laptop that we pretty much need for every single class.

[tpunx99GSX]

Originally Posted by s1ngletracker

My knowledge on VMWare and such is pretty limited, but why the heck do teachers need a virtual machine, rather than just having a local machine in their classroom or whatever? I mean, they need one anyway to be able to use a Virtual Image anyway... soooo

Its a charter school, all teachers are remote. With the regulations that the government now puts on schools having to archive everything it makes it much easier to control the data stored on their laptops by not allowing them to store anything on their laptops.

[s1ngletracker]

all teachers are remote? How does that work?

[cmspaz]

Wouldn't it just be easier to boot them off the network via PXE or from a fresh image on the drive, connect a network drive for storage, and disallow access to the hard drive? Or even just use remote desktop?

Virtual machines are great for managing load and power draw on servers, but it seems like a more complicated way to go about doing something that's been optimized through other means.

[Matt D.]

We are going through the same thing where I work, we are getting to the size that one person (myself) can not manage 200+ desktops on top of all the other responsibilities I have and they (executives outside of IT) refuse to let us hire more people.

We already have a hefty VMware environment, so we are set on using VMware's VDI. Right now we're testing different hardware and boot options. We have a couple different boxes from WYSE, a diskless barebones Shuttle box from our consultant, and we've even tested it with our current Lenovo desktops. All work great, but as Tom said the PCOIP option doesn't exist, they are still using the old RDP.

My friend/coworker is the network admin and VMware guy, he just discovered a linux boot option that will connect to the virtual desktop, it worked as well as expected.

Tom, are you replacing desktop hardware with thin clients or are you leaving everything in place? If you are not touching the desktops, have you tried that client that you install and run from Windows to connect to the virtual desktop? It works slick and allows PCOIP, Flash and everything runs smooth. I can get you more info if you want.

Spaz, virtual desktops provide one thing that Windows never did well without a ton of headaches: roaming profiles. You can log into any machine on the network and there is your stuff. Granted, it costs disk space, but enterprise-grade SANs aren't exactly expensive these days.

[mlomker]

I wouldn't be able to type this message without using a VMWare server at home...my employer blocks websites like this. lol.

One of the divisions that I work with uses Citrix and terminals heavily. My site is looking to deploy Xendesktop for our database developers. I can see how Flash could be a problem, tho.

[Matt D.]

Tom, I spoke to my coworker this morning about this. We are running View 4.0. We have a WYSE terminal that supports PCOIP and works great but the HP one uses RDP. The problem is that the "view open client" is only currently built to run RDP on linux, it's basically a live CD that loads linux and allows you to connect to a virtual desktop, and the HP client is a custom linux build. The portal uses the same View agent as the VMware View Client, PCOIP works great, so my only guess is you're doing it wrong.

Since the teachers are all remote how are they connected to the network? He said that every piece of documentation he has read specifically uses a replica server in the DMZ. I don't know if that relates to the VPN issue you are describing or what.

But seriously, if you want to speak to my coworker I can surely ask him, or if you're in the University area maybe stop by and check out what we have set up.

[cmspaz]

Originally Posted by Matt D.

Spaz, virtual desktops provide one thing that Windows never did well without a ton of headaches: roaming profiles. You can log into any machine on the network and there is your stuff. Granted, it costs disk space, but enterprise-grade SANs aren't exactly expensive these days.

Fair enough. I've never had huge issues with roaming profiles in Active Directory, but then again I've never dealt with them on a large scale. Max I've supported has been 40 locally with 15 coming in over RDP.

[tpunx99GSX]

Originally Posted by Matt D.

Tom, I spoke to my coworker this morning about this. We are running View 4.0. We have a WYSE terminal that supports PCOIP and works great but the HP one uses RDP. The problem is that the "view open client" is only currently built to run RDP on linux, it's basically a live CD that loads linux and allows you to connect to a virtual desktop, and the HP client is a custom linux build. The portal uses the same View agent as the VMware View Client, PCOIP works great, so my only guess is you're doing it wrong.

Since the teachers are all remote how are they connected to the network? He said that every piece of documentation he has read specifically uses a replica server in the DMZ. I don't know if that relates to the VPN issue you are describing or what.

But seriously, if you want to speak to my coworker I can surely ask him, or if you're in the University area maybe stop by and check out what we have set up.

Currently they are using a Cisco VPN Client that is having issues with Disconnects. Hence one reason why we want to get away from vpn altogether.
Some issues we think relates to the slow performance of VMWare:
Network bandwidth (they have 2 t-1s so this should be the case, all teachers are using the VPN constantly so this may be causing excessive network bandwidth loss).
Perhaps a misconfiguration. I dont think this is it because the vmware system is pretty straight forward.

From what we had gathered is that the VMWare View Client is not NAT Aware therefore we would need some kind of VPN connection. We spoke with VMware regarding this, and they acknowledged this as an issue and that it would be corrected in 2010 with the next build. (Freakin annoying).

Overall we would like to just strip the current Toshiba laptops down to barebones OS and run the virtual desktops. Which can solve many issues with this client.

Luckly this is not in a full operational stage, this is just a proof of concept. Not so luckly the POC Term is reaching its end, so we need to get a solution in place soon to hopefully secure the sale of this concept.

The hardware itself are two very beefy servers with 64 gb of ram each, tons of storage, and 4 processors each. So i think hardware is out of the question of blame. Its running a linux background with windows as the server managers.
On the vmware side:
Server Software: VMWare ESX Server with Virtual Center Server
Desktop Software: VMware View 4.0

On the Citrix side:
Server Software: VMWare ESX Server with Virtual Center server
Desktop: Xen Desktop

The XenDesktop peice is still working better than the VMWare side. Will end up trying to get Flash to run locally and use more of the local resources to get this peice running faster.

I may want to talk to your guy to pick his brain on this a bit.
Thanks
Tom

[tpunx99GSX]

Originally Posted by cmspaz

Fair enough. I've never had huge issues with roaming profiles in Active Directory, but then again I've never dealt with them on a large scale. Max I've supported has been 40 locally with 15 coming in over RDP.

Roaming Profiles in theory are a great thing. But in reality SUCK ASS. We have a smaller client with only 4-6 people in their office. The CEOs laptop got dropped and went kaput, She had over 26 gb in photos in her profile, damn near halted all network traffic in their office when she signed into the new computer, and was taking over 2 hours to load the profile. So i ended up taking her off roaming profiles and loaded it up manually.

[Matt D.]

We use Cisco VPN as well, disconnects are not at an issue at all. We have 7 T1s that are bundled. He said that the replica server is able to use NAT if you don't want it in the DMZ, so I still don't see how VPN is an issue.

The bad part about Citrix is once you have Xendesktop, if you want to virtualize applications then you need the Xenapp piece, which involves an entirely different licensing structure. With VMware all that stuff is included.

Don't quote me directly, just responding with what he's told me to the best of my memory. I will PM you his email address and you can pick his brain.

[tpunx99GSX]

Originally Posted by Matt D.

We use Cisco VPN as well, disconnects are not at an issue at all. We have 7 T1s that are bundled. He said that the replica server is able to use NAT if you don't want it in the DMZ, so I still don't see how VPN is an issue.

The bad part about Citrix is once you have Xendesktop, if you want to virtualize applications then you need the Xenapp piece, which involves an entirely different licensing structure. With VMware all that stuff is included.

Don't quote me directly, just responding with what he's told me to the best of my memory. I will PM you his email address and you can pick his brain.

Yeah the servers are in the DMZ, We have the Xenapp peice. \
I emailed him, Thanks again for the help Matt.

[cmspaz]

Originally Posted by tpunx99GSX

Roaming Profiles in theory are a great thing. But in reality SUCK ASS. We have a smaller client with only 4-6 people in their office. The CEOs laptop got dropped and went kaput, She had over 26 gb in photos in her profile, damn near halted all network traffic in their office when she signed into the new computer, and was taking over 2 hours to load the profile. So i ended up taking her off roaming profiles and loaded it up manually.

What business do personal photos have on her work laptop?

Yes, I'm one of those admins. She wants a personal computer, she can buy her own personal computer. I strongly disagree with personal machines being work machines as well as the reverse. She wants to have stuff like that on her laptop, she can keep it in a separate profile or not save to the server. If she needs to be on the server, she can buy a second laptop for personal use. Just causes problems on the daily, and huge (possibly compromising) issues when something goes wrong. It's just not a good practice.

But I'm not disagreeing on transferring them to new machines being a hassle, it definitely sucks.

[tpunx99GSX]

Originally Posted by cmspaz

What business do personal photos have on her work laptop?

Yes, I'm one of those admins. She wants a personal computer, she can buy her own personal computer. I strongly disagree with personal machines being work machines as well as the reverse. She wants to have stuff like that on her laptop, she can keep it in a separate profile or not save to the server. If she needs to be on the server, she can buy a second laptop for personal use. Just causes problems on the daily, and huge (possibly compromising) issues when something goes wrong. It's just not a good practice.

But I'm not disagreeing on transferring them to new machines being a hassle, it definitely sucks.

Regardless of whether your one of those admins or not. its the CEO of the company. They ultimatly decide if you have a job or not, so therefore i really dont GAF what she has on her laptop, she signs the checks.
Secondly, The pictures and videos are from her trips to India and paris, which is where her products are made. She travels the world finding good products to put her name on. and therefore needs to have the pictures of the manufacturing process on the server and backed up.
I would however LOVE to see a video of you Telling the CEO of the company you work for that he cannot have any personal information and pictures on his computer, then you being escorted out of the building.

[Matt D.]

Originally Posted by tpunx99GSX

Regardless of whether your one of those admins or not. its the CEO of the company. They ultimatly decide if you have a job or not, so therefore i really dont GAF what she has on her laptop, she signs the checks.
Secondly, The pictures and videos are from her trips to India and paris, which is where her products are made. She travels the world finding good products to put her name on. and therefore needs to have the pictures of the manufacturing process on the server and backed up.
I would however LOVE to see a video of you Telling the CEO of the company you work for that he cannot have any personal information and pictures on his computer, then you being escorted out of the building.

I am one of those IT guys, but you don't fuck with the jeebus. I put the fear of god in people so they don't make mistakes like that, but I don't flat out tell someone that they shouldn't have done it and I'm not going to help.