賽門鐵克 VMware 完整解決方案
•
0 likes•1,964 views
賽門鐵克針對 VMware 完整解決方案簡報, 其內容為 西元 2013 年 5 月更新, 歡迎自行閱讀.
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to 賽門鐵克 VMware 完整解決方案
Similar to 賽門鐵克 VMware 完整解決方案 (20)
賽門鐵克 VMware 完整解決方案
- 1. 賽門鐵克 VMware 解決方案 – 業界最完整的可用性及資安產品線 Wales Chen (陳瑞文) 資深顧問 技術暨解決方案 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 1
- 2. 如果企業準備導入虛擬化, 有一些需考慮的項目: 針對虛擬磁碟上資料的快速成長, 是否有相關對策? 如何管理這些異質儲存設備? 如果管理大量非結構性資料的儲存? 如何針對這些虛擬機器執行資料與系統備份? 針對虛擬機器內資料的回復, 你需要執行多尐步驟? 對於虛擬環境中的應用程式與資料庫, 該如何確保其高可用性? 如何實現虛擬化平台上的災難備援? 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 2
- 3. 如果企業準備導入虛擬化, 有一些需考慮的項目: 如何防止各式各樣的 “風暴” 所帶來的性能影響 (包括掃瞄風暴及備份風暴)? 如何執行虛擬機器的病毒防護? 如何確保虛擬化平台本身的安全? 對於 P2V 轉換的速度和成功率是否有足夠的信心? …… 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 3
- 4. 賽門鐵克 VMware 解決方案 Guest OS 1 Guest OS 2 Guest OS 3 APP APP APP OS OS 資料保護 OS 資訊安全 儲存管理與高可用性 VMware ESXi Host 管理 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 4
- 5. 企業在虛擬環境內有更多需注意的環節 儲存管理與 高可用性 • 確保虛擬機器 及 ESXi 主機的 HA/DR • 提高效能 • 在 VMware 環 境內的應用程 式故障移轉 資訊安全 • Hypervisor 的 保護 • 虛擬機器的保 護 • 病毒及惡意程 式掃瞄的最佳 化 • 資安規範的遵 循 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 資料保護 管理 • P2V 及 V2P 的 轉換 • 快照備份 • Guest 及 ESX 修 補程式派送與 管理 • 真正的單一檔 案還原 • 應用程式虛擬 化及串流 • 虛擬應用程式 的保護 5
- 6. 賽門鐵克對企業虛擬環境的關鍵架構增加價值 儲存管理與 高可用性 • VERITAS Cluster Server • Dynamic Multipathing • Application HA 資訊安全 • Critical Systems Protection • Symantec Endpoint Protection • CCS VSM 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 資料保護 • NetBackup • Backup Exec • Symantec System Recovery 管理 • Symantec Endpoint Management • CMS • SMS • ITMS 6
- 7. 虛擬環境的備份與還原 賽門鐵克 BE/NBU/SSR 解決方案 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 7
- 8. 企業在虛擬環境內有更多需注意的環節 儲存管理與 高可用性 • 確保虛擬機器 及 ESXi 主機的 HA/DR • 提高效能 • 在 VMware 環 境內的應用程 式故障移轉 資訊安全 • Hypervisor 的 保護 • 虛擬機器的保 護 • 病毒及惡意程 式掃瞄的最佳 化 • 資安規範的遵 循 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 資料保護 管理 • P2V 及 V2P 的 轉換 • 快照備份 • Guest 及 ESX 修 補程式派送與 管理 • 真正的單一檔 案還原 • 應用程式虛擬 化及串流 • 虛擬應用程式 的保護 8
- 9. 賽門鐵克 VMware 解決方案 Guest OS 1 Guest OS 2 Guest OS 3 APP APP APP OS OS 資料保護 OS VMware ESXi Host 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 9
- 10. 虛擬化增加一層複雜度, 而備份及還原也同時被影響 減緩傳統備份 的程序 增加了儲存 空間的使用 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 降低整個備份負 責人員的生產力 10
- 11. 需考慮的關鍵項目 #1 – 備份你的虛擬主機 虛擬主機的備份 備份面對的障礙 35% 65% Don't Backup • 虛擬主機的來來去去 • 備份代理程式的費用 • 對 I/O & 頻寬的影響 Backup 資料來源: Symantec Disaster Recovery Global Data; June 2009 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 11
- 12. 需考慮的關鍵項目 #2 – 不要備份同樣的資料兩次 A B C D E A B C D 應用程式 應用程式 作業系統 E 作業系統 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 12
- 13. 需考慮的關鍵項目 #2 – 應用重複資料刪除功能在實 體與虛擬環境 A B C D E A B C D 應用程式 A 應用程式 作業系統 作業系統 B C D E A B C D 應用程式 E 應用程式 作業系統 A E 作業系統 B C D E A B C D 應用程式 B C D E 應用程式 作業系統 應用程式 作業系統 E 重 複 資 料 刪 除 A 作業系統 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 13
- 14. 需考慮的關鍵項目 #3 – 不要像備份實體主機一樣去 備份虛擬主機 在 Source/Client 端就進行保護 傳統的 Guest 虛擬主機 部署簡單 和實體主機一樣 PROS 1 TB 1 TB 效能影響 非影像為主的還原 花時間的 DR 持續的維護 CONS *1 TB of VM systems 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 14
- 15. 需考慮的關鍵項目 #3: 使用虛擬化原廠的 API 做到更 進階的資料保護 Agentless/Off-host 保護 PROS 降低對效能的影響 精細的 Windows 還原 進階的保護 更棒的儲存效率 更快的 VM 備份 更簡單的 DR 虛擬主機 1 TB .5 TB ? CONS *1 TB of VM systems 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 15
- 16. 需考慮的關鍵項目 #3 – 不需要維護兩個獨立的備份 基礎架構 虛擬主機 實體主機 你們大夥知 道 VM Admin 在做什麼嗎 ?O ? ? 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 你們大夥知 道 Backup Admin 在做什 麼嗎?O ? ? 16
- 17. 需考慮的關鍵項目 #3 – 橫跨實體與虛擬主機的集中 備份架構 集中的備份基礎架構 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 17
- 18. 需考慮的關鍵項目 #5 – 不要只考慮備份, 也要考慮到 還原 災難備援 你的 “保單” 完整的影像為主的還原 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 單一檔案 “在稻草堆中的一根針” 大部份的還原需求 18
- 19. 針對 VMware 環境的備份, 有需要思考的問題 1. 該如何備份 Guest OS? Guest OS 1 Guest OS 2 Guest OS 3 APP APP APP OS OS OS 2. 該如何備份 Guest OS 內的 應用程式或資料庫? 3. 如果 Guest OS 發生問題, 是否可以進行還原? 可以 還原至本機, 也可以到異機 嗎? 4. 如果資料庫發生問題, 是否 可以進行回復? 可以回復 至本機, 也可以到異機嗎? VMware ESXi Host 5. 如果 ESXi Host 發生問題, 是否可以將環境進行還原? 6. 虛擬機器太大備份不完怎 麼辦? 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 19
- 20. 賽門鐵克 BE/NBU 備份解決方案 備份主機 虛擬平台 磁碟 檔案及應用程式伺服器 磁帶機 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 20
- 21. Symantec V-Ray 提供資料與應用程式的保護及復原 針對虛擬與實體應用程式的精細復原 備份主機 執行應用程式的 VMware 伺服器 1 一次完成的 虛擬訪客系統備份 在數秒鐘之內精細復原 Exchange、 SQL、SharePoint 和 Active Directory 資料： 個別信箱/電子郵件/私人或公共資料 夾 /行事曆項目/工作/使用者帳號或屬 性/SQL 資料庫 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 備份儲存 21
- 22. 重複刪除技術提升資料儲存效益 大幅減尐重複的資料 • 重複刪除技術可於不同點啟動: – Source – Target – 透過 BE/NBU 備份主機 – 可與 appliances 硬體搭配 • 優點: – 備份更尐量資料 = 縮短備份時間 – 大幅降低儲存成本與備份負擔 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 22
- 23. 在資料來源重複刪除 • 在備份資料透過網路傳送前就先 進行資料重複刪除 • 優點: Client/Source – BE/NBU 內建, 容易使用 – 減尐網路頻寬的消耗 – 減尐後端儲存空間需要 • 適合以下環境: Media server/Target – 外點或遠端辦公室 – 虛擬主機資料備份 – 異動量較低的檔案, 資料夾或資料庫 Dedupe appliance = Deduplication engine 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 23
- 24. 在備份主機重複刪除 • 備份資料存到磁碟或磁帶前 在 Media Server 進行重複刪 除 (In-line 模式) Client/Source • 優點: – 整合於 BE/NBU, 容易操作 – 不會影響前端主機運作 Media server/Target – 可彈性搭配磁碟 (SATA / IDE / SCSI 等) – 減尐後端儲存空間消耗 • 適用於: Dedupe appliance – 一般企業機房 = Deduplication engine 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 24
- 25. 與重複刪除設備整合 • 在設備端精簡備份資料, 但由 備份軟體集中管理 • 優點: Client/Source – 改善VTL 的缺點, BE/NBU 可直接 有效管理設備端儲存 – BE/NBU 備份策略提供集中化管理, 包含複寫控管 Media server/Target – 改善效能 Dedupe appliance = Deduplication engine 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 25
- 26. 啟動針對你的 VM Guest 備份的重複資料刪除功能 1 TB of VM 系統 • 增加營運的效益 傳統 Guest 在 Guest 中 執行 Dedupe – 跨越實體與虛擬主機的保護 Virtual Machine Virtual Machine – 針對無磁帶 DR 的最佳化複製功能 1 TB 10 GB 1 TB 10 GB – 更快速的備份 – 最多可節省 99% 的頻寬 – 降低儲存空間的使用量 • 其重複資料刪除功能簡單好用 – 支援任何 VM 種類 – 完整應用程式保護的能力 = 重複資料刪除的處理 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 BEFORE AFTER 26
- 27. 透過 BE/NBU 強化 VMware 的保護 • 轉型 VM 保護方式 – Agent-less 的保護方式簡化部署及管理 1 TB of VM 系統 傳統方式 BE/NBU + Dedupe* Virtual Machine Virtual Machine – 直接從備份或媒體類型中, 還原單個 虛擬主機或檔案 – 縮短備份時間 50-90% • 儲存 & 複製的更尐 1 TB 1 TB 1 TB .03 TB – 透過區塊最佳化的協助, 可減尐最多 30% 的空間 – 和 VM 最佳化的重複資料刪除機制結合 = 重複資料刪除的處理 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 BEFORE Savings 97% AFTER 27 27
- 28. 賽門鐵克對企業虛擬環境的關鍵架構增加價值 儲存管理與 高可用性 • VERITAS Cluster Server • Dynamic Multipathing • Application HA 資訊安全 • Critical Systems Protection • Symantec Endpoint Protection • CCS VSM 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 資料保護 • NetBackup • Backup Exec • Symantec System Recovery 管理 • Symantec Endpoint Management • CMS • SMS • ITMS 28
- 29. 虛擬環境的資訊安全 賽門鐵克 SEP/SCSP/CCS VSM 解決方案 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 29
- 30. 企業在虛擬環境內有更多需注意的環節 儲存管理與 高可用性 • 確保虛擬機器 及 ESXi 主機的 HA/DR • 提高效能 • 在 VMware 環 境內的應用程 式故障移轉 資訊安全 • Hypervisor 的 保護 • 虛擬機器的保 護 • 病毒及惡意程 式掃瞄的最佳 化 • 資安規範的遵 循 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 資料保護 管理 • P2V 及 V2P 的 轉換 • 快照備份 • Guest 及 ESX 修 補程式派送與 管理 • 真正的單一檔 案還原 • 應用程式虛擬 化及串流 • 虛擬應用程式 的保護 30
- 31. 賽門鐵克 VMware 解決方案 Guest OS 1 Guest OS 2 Guest OS 3 APP APP APP OS OS OS 資訊安全 VMware ESXi Host 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 31
- 32. 虛擬化不代表環境就沒有資安風險 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 32
- 33. 在虛擬環境內, 弱點仌舊存在 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 33
- 34. 賽門鐵克防護機制 深層防護 Intrusion Prevention 網路 Antivirus 檔案 Download Insight SONAR 行為模式 Power Eraser 修復 信譽評等 當惡意程式嘗試感 染整個網路時進行 阻擋 當檔案進入系統時 進行掃瞄並移除惡 意程式 在 2011 年阻擋了 37 億個攻擊 在 2011 年阻擋了 14 億個攻擊 移除難清理的感染 透過群眾的智慧決定 檔案及網站的安全性 在應用程式執行時進 行監控並辨識可疑的 行為 在 2011 年阻擋了 4 千 4 百萬個攻擊 在 2011 年阻擋了 2 千 9 百萬個攻擊 在 2011 年阻擋了 1億7千3百萬個攻擊 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 34
- 35. 業界最完整的虛擬化功能 vShield 透過 5 大功能進行最佳化 1 Virtual Client Tagging 2 Virtual Image Exception Scan Cache Hypervisor 3 Offline Image Scanner 4 Shared Insight Cache 5 Resource Leveling 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線
- 36. VMware vShield Endpoint 的緊密結合 vShield Shared Insight Cache • 掃瞄的越多對 I/O 的影 響越小 • 掃瞄的重複資料刪除 • 避免掃毒風暴 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 36
- 37. Production Network CVE Sylink vSIC 元件概觀 vShield Manager SVA vShield Network SEPM 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 37
- 38. vSIC 溝通流程: 未知檔案 VM (client) SEP 12.1.2 Scan Request Get EFA Update Scan Check if file: Submit the EFA: thein 掃瞄此檔案: chache chache: Extended File Sending some The file is attribute. 執行 AV 掃瞄 EFA attribute Adding for Clean The file is Check the 動作 via the vShield hash, clean unknown reputation “plumbing” statut, AV defs and whitelist sequence flag number vShield drivers (part of VMTOOLS) vShield Manager 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 SVA 38
- 39. vSIC 溝通流程: 已知檔案 VM (client) SEP 12.1.2 Scan Request Get EFA Check Submit EFA: if in 跳過此檔案: chache: Extended File Sending some attribute. AV 終止掃瞄 EFA attribute The file is Check然後移 需求, for via the vShield known reputation 到下一個檔 “plumbing” and whitelist 案進行處理. flag vShield drivers (part of VMTOOLS) vShield Manager 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 SVA 39
- 40. vSIC 對 I/O 的影響會隨著時間越來越小 • 因為不需要再重新對檔案進行 hashing 動作, 對於掃毒所造成的 I/O 影響 相對降低 • 在更新定義檔後的第三次掃瞄動作, 我們已將大部份已知的安全檔案排 除在掃瞄動作外 vSIC IO Usage MB/Runs 36500 36000 I/O (MB) IO volume 35500 90% less I/O 35000 34500 vSIC IO Usage 34000 33500 33000 32500 32000 31500 1 2 Scan over time 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 3 透過新的定義檔進行掃瞄 40
- 41. 賽門鐵克 VMware 解決方案 Guest OS 1 Guest OS 2 Guest OS 3 APP APP APP OS OS 此外, vCenter Server 是否也需要考慮進來? OS VMware ESXi Host vCenter Server ESXi Host 是否也需要保護? 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 41
- 42. 該如何做 : ESXi Host 的監控及防護 Virtual Guest Server 防護 VMware ESXi Architecture • CSP 可以安裝在每一個 guest 虛擬機器內 (虛擬伺服器), 根據 每個虛擬伺服器的特定使用方式 去鎖定其作業系統/應用程式 CSP Agent OS Virtual Infrastructure 防護 vCLI vCLI for Config and Support VMkernel WMWare Management Framework Infrastructure Agents (NTP, Syslog, etc.) VM support and Resource Management VMware ESXi Agentless Systems Mgmt Agentless Hardware Monitoring • 將 CSP Agent 部署在特定的 guest VM 中, 執行 ESXi 的監控 • 監控 ESXi 的運作機制: – 透過 vCLI 存取 ESXi 日誌/設定檔案並送交給 SCSP agent – 透過 vCLI 存取 guest VM 設定檔案並送交給 SCSP agent – 啟用全新的 ESXi IDS 政策, 監控其設定及存取 – 針對 ESXi 設定建立其專屬的報表 • ESXi IDS 政策的賣點: CSP 針對 ESXi host 及 guest VM 的設定, 以 及被 VMware 存取的特定設定檔案, 透過 vCLI 介面部署代理程式進行監控及鑑識動作 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 – 透過 vCLI 監控可被存取的重要 VMware 主機設定檔案的 完整套件, 以便監控: ESXi host command line interface (CLI) 登入失敗與 成功的資訊 對 ESXi 主機的重要設定異動 管理者網頁存取 42
- 43. 該如何做 : vCenter 的監控及防護 保護 Virtualization Management Universe VMWare vCenter Server 5.0 (64 bit Windows) vCenter Server vCenter Server SQL DB Tomcat Web Service • 部署在 vCenter Server 上, 並啟用客製化 IPS/IDS 政策 的 CSP agent (遵循針對 vSphere 強化的建議作法) 可 保護並監控特定的元件 • vCenter IPS 政策的賣點: – 強化 Windows Strict 政策, 以保護包含以下的應用程式元件: vCenter Server, vCenter Orchestrator, vCenter Update Mgr. Infrastructure components e.g., SQL Express DB, Tomcat, JRE vCenter 應用程式檔案及敏感路徑 (憑證及日誌) – 限制 vCenter 對已信賴程式的網路閘口存取 – 可以自桌上型電腦, 筆記型電腦, 用戶端存取 VM’s 或甚至是 Jump 主機, 保護以下用來存取 vCenter 的工具: vSphere Client, vSphere CLI, vSphere Power CLI, vSphere Web Client LDAP 64-bit Windows OS manage VMware ESXi Architecture • vCenter IDS 政策的賣點: CSP Agent OS vCLI WMWare Management Framework VMkerne l Infrastructure Agents (NTP, Syslog, etc.) VM support and Resource Management VMware ESXi vCLI for Config and Support Agentless Systems Mgmt Agentless Hardware Monitoring 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 – vCenter Windows 偵測政策 預先制定好的 Windows Baseline Policy 偵測使用者/群組 的異動, 登入失敗, 等等. – vCenter Application 偵測政策 預先制定好的 Windows Policy performs real-time FIM of vCenter binaries / configurations and monitors vCenter logs 處理現今 vCenter 監控及日誌轉送功能內的不足之處 43
- 44. CSP 及 CCS VSM 可搭配使用避免 VM 的漏洞 郵件 伺服器 資料庫 伺服器 Domain Controller 伺服器 VM VM vCenter 網站 伺服器 VMWare ESXi Server • 在 vCenter 外 – CSP 可橫跨網路基礎架構進行 監控及阻擋相關異動 – CSP 可監控及阻擋針對 ESXi Server 的任何異動 • 在 vCenter 內 – VSM 可監控及阻擋存取異動 網際網路 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 – VSM 可監控及控管 vMotion 的功能 44
- 45. CSP 及 CCS VSM 提供完整的解決方案 CSP VSM 防護 & 阻擋 遵循 & 報表 • 針對內部及外部威脅的 漏洞阻擋 • 根據資料及功能提供專 屬的防護 • 確保重要系統的可用性 • 設定及存取異動的監控 • • • • 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 資安規範及資安條款 設定的評估及報表 限制遵循範圍的邏輯分界 詳細的行動報表 • 跨實體及虛擬資產的單 一介面 45
- 46. 賽門鐵克對企業虛擬環境的關鍵架構增加價值 儲存管理與 高可用性 • VERITAS Cluster Server • Dynamic Multipathing • Application HA 資訊安全 • Critical Systems Protection • Symantec Endpoint Protection • CCS VSM 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 資料保護 • NetBackup • Backup Exec • Symantec System Recovery 管理 • Symantec Endpoint Management • CMS • SMS • ITMS 46
- 47. 虛擬環境的儲存管理與高可用性 賽門鐵克 AppHA/VCS/DMP 解決方案 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 47
- 48. 企業在虛擬環境內有更多需注意的環節 儲存管理與 高可用性 • 確保虛擬機器 及 ESXi 主機的 HA/DR • 提高效能 • 在 VMware 環 境內的應用程 式故障移轉 資訊安全 • Hypervisor 的 保護 • 虛擬機器的保 護 • 病毒及惡意程 式掃瞄的最佳 化 • 資安規範的遵 循 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 資料保護 管理 • P2V 及 V2P 的 轉換 • 快照備份 • Guest 及 ESX 修 補程式派送與 管理 • 真正的單一檔 案還原 • 應用程式虛擬 化及串流 • 虛擬應用程式 的保護 48
- 49. 賽門鐵克 VMware 解決方案 Guest OS 1 Guest OS 2 Guest OS 3 APP APP APP OS OS OS 儲存管理與高可用性 VMware ESXi Host 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 49
- 50. 虛擬環境高可用性的考量 虛擬化 的弱點 確保 可用性 • • • 提供虛擬主機內, 對企業營業 頗為重要的應用程式之彈性 提供可驗證的 DR, 但通常很 難持續執行 針對所有作業系統平台提供 解決方案 • • • 傳統的 OS 叢集會讓 VMware HA, DRS & vMotion 運作停擺 有信心的將應用程式帶入到 雲端 針對伺服器與桌面虛擬主機 的靈活儲存需求 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 降低 複雜度 • 部署簡單 • 針對 VMware 管理/運作的 額外獨立運作 • 不是所有東西都是虛擬的, 那實體的東西該怎麼辦? 50
- 51. ApplicationHA 及 VMware HA 之間自動的合作 • 應用程式監控 – 顯示健康狀態 – 偵測 App 問題 • 透過合作進行還原 VM1 VM2 VM1 ORA SQL ORA SQL Application HA Application HA OS OS – 重啟應用程式 – 驅動 VMware HA 做進一步的還原 – 透過 App Monitor API 整合 OS OS VM2 VMware HA VMware HA VMware ESX VMware ESX • 保護不受各類損壞 – 基礎架構的毀損 – VM 啟動但 App 沒帶起來 – VM 在伺服器損壞後被帶起, 但 App 並沒有起來 – App 有起來但運作不正常 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 51
- 52. ApplicationHA 與 VMware HA 之間的協調還原 – 細節 • 應用程式的深入瞭解 VM1 – 應用程式專屬的模組, 用來啟動, 停 止, 及還原應用程式 App – 舉例: SQL DB instances, FileStream, Analysis, 儲存 mount points, 依賴性 – 建立在 SQL queries 的功能測試 • 可客製化的行為模式 – 應用程式, 作業系統重新開機或 VM重新啟動的限制 Agent Pack Application HA EXCH SQL ApplicationHA OS – 僅在虛擬主機內的修正動作 – 啟動/停止應用程式的心跳 – 在計劃的維護期間內, 關閉修正動 作 – 進入/離開維護模式 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 VMware HA VMware ESX 52
- 53. ApplicationHA 功能概要 • VCS + ApplicationHA 提供應 用程式的協調還原 VM1 VM1 VM2 ORA – VCS 會透過 agents 管理 VM 的可 用性 VM2 SQL ORA SQL App HA OS App HA OS OS – 監控應用程式, 顯示健康狀態, 偵測 應用程式問題 VCS OS VCS – 重新啟動應用程式. 如有需要, 驅動 VCS 執行 VM 重新開機動作 • 透過精靈介面, 進行應用程式的 自動搜索及設定 UI datacent er_1 APA APA APA SQL SQL SAP SQL SQL APA WAS WAS WAS cluster_ 1 • 多層級的 HA (虛擬企業服務) 支 援 • 虛擬化及應用程式管控的專屬 操作介面 Start host_2 Stop vm_1 Restart SQL_1 vm_2 – 在 VM 內執行應用程式的虛擬化 , 啟動, 與停止 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 ORA_1 53
- 54. ApplicationHA-SRM 整合所帶來的價值 針對兩地在執行測試或真正的還原時, 提供應用程式的監控 Site B Test Recovery • 在兩地之間, 自動化的應用程式監控 • 在分別兩地, 不需要仰賴 VMware HA • 針對兩地, 透過儀表板方式監控 Site A Real Recovery 針對 SRM audit trail 中應用程式的偵測 • 透過 SRM audit trail 取得應用程式狀態 • 提供相關證據給稽核人員及管理階層使用 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 54
- 55. 透過 vCenter 進行應用程式及資料庫的管理及監控 已選擇的 VM 應用程式狀態 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 應用程式動作 詳細的監控 55
- 56. 瞭解虛擬機器內的應用程式運作狀態 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 56
- 57. 使用 AppHA, VCS, 與 VBS 做到點對點的 HA 採購部門 人資部門 採購VBS AppHA 財務部門 財務VBS 人資VBS AppHA AppHA AppHA VCS AppHA AppHA AppHA AppHA VCS AppHA AppHA VCS Veritas Operations Manager CFS HA 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 SF HA 57
- 58. 多層次的應用程式 及服務 會計部門 Veritas Operations Manager Web server Service Group Service Group Web Web VM VM Symantec ApplicationHA ApplicationHA Application app app Service Group app Veritas Cluster Server HA App IP VCS Database Service Group DB IP FS VVR Veritas Cluster Server HA/DR VCS 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 58
- 59. ApplicationHA 與 VCS 分別適用於不同的情境 Application HA Veritas Cluster Server VM2 VM2 VM2 VM2 VM2 VM2 SQL SQL SQL SQL SQL Application HA Veritas Cluster Server Veritas Cluster Server Veritas Cluster Server Veritas Cluster Server OS OS OS OS OS VIRTUALIZATION PLATFORM SQL Application HA Improve Storage Performance OS VMware HA VMware HA VMware HA VMware ESX VMware ESX DYNAMIC MULTI-PATHING VMware ESX • 重要的工作負載需要應 用程式的監控及還原 • ApplicationHA – 賽門鐵 克與 Vmwawre 的整合 HA 解決方案 • 透過避免 VM 重新開機, 降低還原 時間 • 允許實體到虛擬的故障移轉 • 降低 OS 上 patch 的計劃時間 • 可支援 vMotion, DRS 及 Site Recovery Manager • 設定簡單且可透過 vCenter 進行 管理 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 • 強化的儲存效能及路徑的 高可用性 • 讓你以對的價格選擇正確 的儲存設備 59
- 60. 虛擬化平台上之儲存高可用性的需求與挑戰 效能 & 可用性 異質儲存架構 能見度 & 報表 RAID10, SRDF, Thin , SSD drive • 針對高度密集的 VM 環境 提供可辨識 SAN 的平衡負 載機制 • 在災難發生時提供主動式 儲存連線故障移轉 • 可自由選擇任何適合的儲 存設備 • 儲存設備資訊的能見度有其 需求 • 支援任何儲存設備層級 • 資料中心遭遇的 I/O 瓶頸需 要解決 儲存伺服器有 I/O 瓶頸! 被單一儲存設備廠商綁住 沒有效能瓶頸方面的能見度! 在 ESX 上的設備命名很複雜! 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 我有用對儲存層級嗎? 60
- 61. Any Storage DMP for VMware: 模組化架構針對各類儲存設備進行最佳化 • Array Support Library (ASL) VMware ESX – 提供各種設備的 ASL Module (Ex: VMAX, NTAP) – 可偵測陣列種類 (A/A, A/P, ALUA) Guest Guest Guest Guest – 可挖掘出陣列相關資訊 (Tier, RAID, Repl) ESX Hypervisor • Array Policy Module (APM) ASL1 DMP – 硬體為主的 DMP plug – 自動載入的模組 APM2 ASL2 APM1 – 瞭解陣列的故障移轉行為 – 允許 controller 執行無影響升級動作 • DMP 支援 50 種以上的陣列家族 & 超過 1 千種以上的陣列型號 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 61
- 62. Usability 透過 vCenter 整合的集中管理介面 • Plugin 提供 DMP 儲存及效能上的能見度 • 提供主動式管理及基礎架構上的資訊 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 62
- 63. Usability 可用路徑管理 • 透過 vCenter 執行可用路徑及政策管理 • 可隨時更改平衡負載的運作方式 • 啟動 / 停止各別路徑 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 63
- 64. Visibility 儲存管理的細節 • 精細的效能評鑑 • 針對基礎架構元件層級的能見度 • 提供表格或圖表方式的 I/O 狀態 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 64
- 65. 透過 vCenter 的資料中心儲存能見度 • 跨 vCenter 資料中心的儲存能見度 • 可輕易辨識出各個陣列或 LUN 的儲存負載狀態 • 將各個虛擬機器所使用的 I/O 負載進行關聯 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 65
- 66. 賽門鐵克對企業虛擬環境的關鍵架構增加價值 儲存管理與 高可用性 • VERITAS Cluster Server • Dynamic Multipathing • Application HA 資訊安全 • Critical Systems Protection • Symantec Endpoint Protection • CCS VSM 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 資料保護 • NetBackup • Backup Exec • Symantec System Recovery 管理 • Symantec Endpoint Management • CMS • SMS • ITMS 66
- 67. 虛擬環境的管理 賽門鐵克 Altiris 解決方案 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 67
- 68. 企業在虛擬環境內有更多需注意的環節 儲存管理與 高可用性 • 確保虛擬機器 及 ESXi 主機的 HA/DR • 提高效能 • 在 VMware 環 境內的應用程 式故障移轉 資訊安全 • Hypervisor 的 保護 • 虛擬機器的保 護 • 病毒及惡意程 式掃瞄的最佳 化 • 資安規範的遵 循 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 資料保護 管理 • P2V 及 V2P 的 轉換 • 快照備份 • Guest 及 ESX 修 補程式派送與 管理 • 真正的單一檔 案還原 • 應用程式虛擬 化及串流 • 虛擬應用程式 的保護 68
- 69. 伺服器所面臨的挑戰 外部的因素 伺服器的成長 複製度 IT 自動化趨勢 •• 階層式應用程式架構 硬體的價位/效能比 • 虛擬化 • •應用最佳作法 資訊安全的漏洞 •• •持續擴張的企業 降低 IT 花費 多種作業系統 • •經濟狀況的下滑 標準化 vs. 差異性 • 增加服務品質 Source: Market Overview: The IT Management Software Market, Forrester, March 2008 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 69
- 70. 伺服器生命週期管理 轉移 及 硬體退役 資產辨識 遠端協助 與問題分析 合約管理 故障 與 效能的監控 作業系統 部署與設定 企業 永續運作 應用程式 打包與驗證 修補程式管理 軟體管理 稽核與遵循 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 70
- 71. 必要的實體與虛擬伺服器管理 Altiris™ Server Management Suite 提供 IT 管理者必要的 工具, 將實體及虛擬伺服器 的部署,控管,及監控自動 化, 以確保主機的可用性 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 71
- 72. 簡化且必要的伺服器解決方案 Server Management Suite • 硬體挖掘與資產管理 • 部署 • 軟體管理 • 修補程式管理 • 監控與警示 選項 • 備份及還原 • 應用程式依據性對應 • 端點防護 • 稽核與法規遵循 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 72
- 73. Server Management Suite 監控 與 警示 軟體派送 與 修補程式管理 系統部署 挖掘 與 資產管理 Server Management Suite 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 73
- 74. Server Management 主要成份 挖掘與資產管理 將完整及伺服器為主的設定細節存入 資料庫中 即時將資料收集並整合在單一介面並 提供報表 協助估算成長需求 協助設定管理 帶來的好處 挖掘 與 資產管理 Merrick—―透過硬體及軟體資產報表, 我們達到 100% 精準度.‖ Layfayette School—―之前, 所有伺服 器有關的動作都是手動執行. 現在透 過Altiris, 只需花一些時間就可以做到.‖ 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 74
- 75. Server Management 主要成份 系統部署 得獎的 x86 影像或腳本安裝之部署能 力 提供標準及安全的伺服器設定之應用 提供深層整合, 以便快速部署 現在包括了 Ghost™ imaging 引擎, 提 供業界領先的靈活度 系統部署 帶來的好處 挖掘 與 資產管理 HealthNow—―透過標準化的部署, 資 料中心的人員生產力增加了 200%.‖ Dell IT—―部署時間從原本的 6 個小 時降低到 20 分鐘.‖ 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 75
- 76. Server Management 主要成份 軟體派送與修補程式管理 確保設定和應用程式一致, 並在異動 發生時收到警示, 以確保一致性 軟體派送及 修補程式管理 主動管理應用程式的更新以縮小資 安危機 透過單一按鍵, 建立收集方式與政 策, 進行自動化的準確修補程式派送 系統部署 帶來的好處 挖掘 與 資產管理 MidAmerica Bank—―安裝修補程式所 造成的錯誤降低到僅有 1%.‖ OMD—―它是一個很棒的產品並且讓 我們能自動化伺服器的更新.‖ Meijer—―以修補程式的結果來看, 我們 可以做到 99% 到 100% 的伺服器.‖ 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 76
- 77. Server Management 主要成份 監控與警示 監控 與 警示 集中式的事件介面增加伺服器狀態的 能見度 軟體派送及 修補程式管理 系統部署 針對新政策與評量需要提供更簡化的 政策建立方式 整體伺服器健康狀態的收集, 可跨多個 伺服器群組取得其狀態 Smart Metrics™ 可透過一般的協 定, 有效率的提供 agent-less 監控機制 帶來的好處 挖掘 與 資產管理 Meijer—―我們可以透過圖型顯示看到 對 SQL Server 的改變會影響到哪些 主機.‖ Rockwell—自動化的伺服器節省了時 間並強化了效能及控管 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 77
- 78. Server Management 自動化 VM 的部署動作 流程自動化 將 日常 IT 運作自動化 和郵件 approval 及其它商業 系統整合 圖型設計及表格建立 套用 Altiris 動作及政策引擎 80% 非規劃的停機原因是因為 使用者及程序上的問題所造成 的, 其中包括了不良的異動管 理及使用. 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 78
- 79. Server Management 監控 VM 與 ESXi Host 的狀態 監控與警示 集中式管理介面增加能見度 精靈為主的政策建立 廣域的伺服器狀態更新 可在不安裝任何代理程式的狀 況下取得基本狀態 Smart Metrics™ 可透過標準 的協定, 進行有效率的無代理 程式之監控 IT 預算持續下降, 因此 IT 必須 更努力的找出更好的作法. 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 79
- 80. 賽門鐵克對企業虛擬環境的關鍵架構增加價值 儲存管理與 高可用性 • VERITAS Cluster Server • Dynamic Multipathing • Application HA 資訊安全 • Critical Systems Protection • Symantec Endpoint Protection • CCS VSM 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 資料保護 • NetBackup • Backup Exec • Symantec System Recovery 管理 • Symantec Endpoint Management • CMS • SMS • ITMS 80
- 81. 業界最完整的 VMware 解決方案 賽門鐵克 Availability 與 Security 解決方案 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 81
- 82. 企業在虛擬環境內有更多需注意的環節 儲存管理與 高可用性 • 確保虛擬機器 及 ESXi 主機的 HA/DR • 提高效能 • 在 VMware 環 境內的應用程 式故障移轉 資訊安全 • Hypervisor 的 保護 • 虛擬機器的保 護 • 病毒及惡意程 式掃瞄的最佳 化 • 資安規範的遵 循 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 資料保護 管理 • P2V 及 V2P 的 轉換 • 快照備份 • Guest 及 ESX 修 補程式派送與 管理 • 真正的單一檔 案還原 • 應用程式虛擬 化及串流 • 虛擬應用程式 的保護 82
- 83. 賽門鐵克對企業虛擬環境的關鍵架構增加價值 儲存管理與 高可用性 • VERITAS Cluster Server • Dynamic Multipathing • Application HA 資訊安全 • Critical Systems Protection • Symantec Endpoint Protection • CCS VSM 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 資料保護 • NetBackup • Backup Exec • Symantec System Recovery 管理 • Symantec Endpoint Management • CMS • SMS • ITMS 83
- 84. 賽門鐵克與 VMware 有著長期的合作關係 10 年以上穩定的合作關係開發出各種協作解決方案： • 資料保護 • 高可用性 • 儲存管理 • 系統管理 • 端點安全 + 為客戶增值！ 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 84
- 85. Thank you! Wales Chen (陳瑞文) Copyright © 2013 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. 賽門鐵克 VMware 解決方案 - 業界最完整的可用性及資安產品線 85
Editor's Notes
- Objective: Identify with Customers Business ObjectivesTransition: Now that you have an understanding of how this technology can support your overall initiative, let’s me walk you through how we protect your virtual environment
- Objective: Identify with Customers Business ObjectivesTransition: Now that you have an understanding of how this technology can support your overall initiative, let’s me walk you through how we protect your virtual environment
- Objective: Identify with Customers Business ObjectivesTransition: Now that you have an understanding of how this technology can support your overall initiative, let’s me walk you through how we protect your virtual environment
- So let’s drill into each area a bit more. Virtualization slows the backup process. Because backup is the process of copying data and moving it from one location to another, it requires server resources, specifically I/O and CPU power. This is in direct conflict with virtualized server environments which typically maximize all of a server’s resources. The result is that the backup of one virtual machine negatively impacts all the other virtual machines running on a physical server. Not only will those servers run more slowly, but the virtual machine backup itself may also be impacted. And because many virtual machines share network resources, the backup process often creates network bandwidth problems for other machines sharing that local area network.Plain and simple, virtualization increases backup storage consumption. How can virtual machine backups be different from standard physical machine backups? There are two important concepts here. First, many customers choose to backup both the individual files in a virtual machine as well as the entire machine (e.g., the VMware VMDK or Microsoft VHD). There’s a lot of duplicate data, such as OS data, in those virtual machine images that many customers backup every day. Second, even if you don’t do both of these types of backup, most customers will acknowledge virtual machine sprawl. Most or all of these servers in the so called “sprawl” need to be protected resulting in more backup storage consumption.Finally, if you are using virtual machine backups for disaster recovery, then you are probably storing full image backups from a number of days or weeks at both your data center and at your DR site. These images may give you faster recovery, but they consume a lot of storage. Do all of these VM backups need to be on disk? We would be talking about weeks of full server backup data often stored on disk.Virtualization improves the efficiency of the server team, but it can reduce the productivity of the backup team. How can this be you ask? Well, many companies often deploy different backup & recovery tools for virtual servers & applications. The result is that not all team members understand the backup process because of the increase of tools. Worse, you now need to monitor and report on backup activities across multiple applications. Did all your jobs complete with success? How much data are you protecting? Can everybody execute a recovery? You get the picture.What about recovery of specific files or directories?At EMC World 2009, a speaker stated that 80% of VM recoveries were for individual files. If you perform image-based virtual machine backups, you have no detailed file information within your backup catalog. This means that your backup administrator have to spend more time performing a recovery request. In fact, some IT teams simply refuse to perform individual file recoveries! Finally, let’s talk about the toll of administration and monitoring. How much time is your team spending making sure that they’re protecting all of the virtual machines deployed? If some virtual machines are intentionally not protected has that gap been documented with business owners? Separate backup tools for virtual and physical machines only makes this problem worse.
- Last year Symantec conducted an extensive global survey of thousands of end-users. It is astonishing the nearly two-thirds of virtual machines are not backed up! The amount of risk businesses are taking on as a result of not backing up is amazing. There are some very real historical reasons for these results:1. Virtual machine sprawl – virtual machines spread like rabbits. Often times, IT just doesn’t know about the new machine (or knows about it but doesn’t know the RPT/RTO requirements/no SLA). This is one of the top reasons virtual machines are not backed up.2. Cost of backup agents – in the past, IT would have to buy individual backup agents for each new server. Potentially costing thousands of dollars...destroying much of the cost savings created with virtualization. 3. I/O & bandwidth impact – IT may have been concerned with dragging down the host machine and/or network by moving a lot of data for backup. The whole idea of virtualization is to increase server utilization/CPU utilization/network utilization and if you are successful, there is less “slack in the system” to handle backup loads.
- Today many IT shops are backing up the same data two times in virtual environments: they backup the first time for full image recovery and then they backup a second time for more granular file, object recovery. The thinking is that when you want to recover a single email or a single calendar item from Exchange if you have only backed up the virtual machine then you will have to first restore the entire server, then recover the granular data you seek.The problem, as shown in the graphic, is you take twice as long, put twice the load on the network and you take up twice the storage capacity for the same data.Today, thanks to new capabilities from virtualization vendors and backup application vendors, there are solutions that allow you to do a single backup and still recover granular object items.
- According to Enterprise Strategy Group most recent research (see appendix), 62% of companies still backup virtual machines this way. There are a lot of historical reasons for doing this, including a physical machine “mindset” in IT, uncertainty about the ability to recover granularly, and most importantly the limitations imposed by virtualization vendors. Example: VMware Consolidated Backup required a proxy server and had significant limitations for backup at the hypervisor level.The impact of this approach is significant: higher real costs (of agents) and unnecessary management complexity.Today, the virtualization vendors have improved APIs to support centralized backup and many vendors have the ability to backup at the hyper-visor level.
- In a 2010 survey, customers were asked what approach they use today for physical and virtual machine backup: one single backup infrastructure or TWO separate infrastructures. More than half of IT shops use two vendors. The survey went on to ask what is your *preferred* approach, and IT shops correctly recognized the mistake of running two separate backup infrastructures and almost three quarters (74%) of them said a SINGLE vendor is the preferred. The growth of virtualization has been a lot like the growth of many disruptive technologies. In the early days of Linux, for example, there were specialized people and niche technologies that supported the exciting new technology. Today, Linux is simply part of how IT organizations work. Similarly, some organizations have developed a divergent approach to backup for their virtual servers. This is a mistake.What some people do:Using one tool for physical serversUsing a different tool for virtual serversWhy do some people do this:Limitations in backup support from VMware & Hyper-V Poor support from major vendorsVMware guy different than Backup guyLack of awareness of support from major vendorsWhy is this approach a problem?Inconsistent data management resultsConfusion and conflict between IT organizationsTurf wars, budget battles, etc.
- How to Avoid?Explore your backup vendor solutions for virtualization. If your current backup solution doesn’t have strong support for both physical and virtual machines, find one that does.Get the virtualization & backup teams together, assign ownership & budget for backup of both physical and virtual machines.
- Too many copies. The primary. 5 snapshots. Daily incrementals. Weekly fulls. The archives.
- Client deduplicationThis method reduced the amount of data sent over the network and stored. It does increase the CPU load on the client machine but for a relatively short period of time. This is ideal for remote offices, some virtual machines, and some LAN connected machines.
- Many customers protect their VMs in the same manner as their physical machines. NetBackup offers a better way. Simply turn on deduplication at the client. The deduplication client eliminates duplicate data at the source which equates to as much as 99% less bandwidth to move that data. Why? First, because on average, most incremental backups represent only 10% of all data. Second, with deduplication, we can take that % down even more because we can eliminate redundant information across virtual and physical machine instances. So instead of moving 1 TB of VM data whenever you perform a full, you only move 10GB of data. What if you rarely perform full backups? You still get the same ratio of reduction.Of course, moving less data also means storing less data. And with NetBackup deduplication, you can efficiently replicate this data to another site, rather than writing it to tape.Finally, using NetBackup client-based deduplication is simple. It is just like any other client-based backup. And because NetBackup supports a wide number of OS types and applications with client based deduplication, it can be used with most any virtual machine type or application.Of course, there are other ways to protect VMs, ones which offer full VM recovery, and we can help there as well.
- NetBackup for VMware offers several advantages over using traditional client/agents in VMs. First, they are “agent-less” meaning the agent resides in the backup server, and not in each VM. So, they are very easy to deploy and manage. Second, almost all of the backup processing is performed by the backup server. Third, these agents support incremental backups and deduplication, both of which greatly reduce the amount of data transfer and processing. Lastly, both support fast recovery of entire VMs or individual files, directly from any backup storage.NOTE: NetBackup alsooffers deep integration for Microsoft Hyper-V.
- Objective: Identify with Customers Business ObjectivesTransition: Now that you have an understanding of how this technology can support your overall initiative, let’s me walk you through how we protect your virtual environment
- Objective: Identify with Customers Business ObjectivesTransition: Now that you have an understanding of how this technology can support your overall initiative, let’s me walk you through how we protect your virtual environment
- 17+ VMware Security Advisories in 2011
- >50% could compromise the admin VM or lead to hypervisor escapes
- Examples of volatile file are:Window search index fileTemp filesDesktop.ini filesUser edited filesEtc…The algorithm for skipping volatile file is being patent filed by SymantecVolatile file are identified by keeping a hashed state flag in SymEFA. When a file is modified SymEFA removes the hash. The next time we access the file we know that it is volatile.
- (1): The 1 SCSP virtual Agent to 1 ESXi server tie is for the MP3 release. Beyond MP3, we plan to enable the single SCSP agent to monitor multiple ESXi servers
- Notes:vCenter requires use of relational database either SQL Server or Oracle. The standard Windows Strict policy has specific containment for SQL Server though typically the database will not be co-resident on the same system as vCenter. There are no specific protection rules for Oracle (and none are being done for this effort). Oracle runs on many systems and thus rules both Windows and Unix/Linux rules would need to be developed and tested.
- Objective: Identify with Customers Business ObjectivesTransition: Now that you have an understanding of how this technology can support your overall initiative, let’s me walk you through how we protect your virtual environment
- Objective: Identify with Customers Business ObjectivesTransition: Now that you have an understanding of how this technology can support your overall initiative, let’s me walk you through how we protect your virtual environment
- When talking to customers today their pain points are normally falling into three categories, lets look at some of the pain points in more detail.
- Symantec ApplicationHA leverages this API in 4.1 to add application awareness to VMware HA and coordinate recovery with it Let’s take an example to see how this works 2 ESX servers, 2 running VMs on 1 one them … Together ApplicationHA and VMwareHA protect against a wide range of failures. For eg. infrastructure failures, or scenarios where infra is up but app is down, or app is up but not functional
- Let’s double click on how the solution worksCentral to the solution is ApplicationHA’s deep understanding of the applications. Understanding an application involves understanding app specific components/processes, dependencies between them, storage it uses, how to start and stop the apps, what does it mean for the app to be up and functional, etc.This application intelligence/insight is encoded in application specific modules (or agents) that plug in to the ApplicationHA’s application framework and provide the ability to monitor the app, detect when they fail, recover, start and stop the app, etc. For instance, a SQL 2008 agent understands the multiple SQL DB instances , FileStream and Analysis service. Beyond verifying that the set of application processes for SQL are up, the SQL agent ensures that it can process SQL queries such as add/delete table entries and is truly functionalNote that the app specific insights have been derived from the agents delivered with industry leading Veritas Cluster Server technology which has been helping the world’s largest organizations ensure availability for their most critical applications for over 10 years. This application visibility and control is available for a wide range of applications across Windows and Linux. Initial release is targeting sql, exchange, etc. Similar to what we do for VCS today, we plan to update our application support for ApplicationHA every quarterThe ApplicationHA framework watches the app status from these app specific modules and communicates with VMware HA through a heartbeat mechanism when needed. If the application is up and running ApplicationHA will continue to send heartbeats at regular intervals. If the application fails, it will try to restart a few number of times. And if that doesn’t help, it will stop the heartbeat letting VMware HA know that it needs to restart the VM. The solution enables users to customize the recovery behavior. Specifically, you can set up the # of times an app or a VM recovery should be attempted before asking for user intervention. This is to ensure we don’t compound the problem and don’t end up in an endless loop. In certain situations you may want app restarts but not VM restarts In other cases, you may want to turn off automated remediation completely, say when you are doing planned maintenance activities
- VCS will be used to manage infra avail for VMs using agents, for example LDOM or KVM agents. Later I will outline how VCS will be deployed in each physical machine.Let’s move on to AppHA:From an Availability POV, we support the same operations as Lorenzo just lined out for VMware. Application visibility, app restart and VM restart.The difference is now that AppHA reports into VCS rather than to any native clustering technology.Push installation and autoregistering with the VCS-VM. Autoregistering means that AppHA configuration will be very quick and easy. Wizards will be available to configure applications via VOM . The AppHA will perform an autoregistration to the VCS-VM and add the needed configuration details to VCS to manage the VM . Traditional VCS commandline and configuration technique (main.cf) will be available.This concept also supports what we call Multi-Tier HA using a new feature known as VBS – Virtual Business Service. In the next release of VCS (and also AppHA), we are introducing VBS. Multi-Tier HA support means that we are able to control HA over several tiers, having dependencies between different tiers, and also fault propagation between different tiers, different operating systems. I will not cover VBS in detail, but I really recommend you to not miss the “HA Futures” session, where VBS will be outlined. The important thing here is to remember that we will have multi-tier HA support.We will also be able to control start and stop of individual VMs, as well as applications inside VMs.Okay, so why are we doing this then? For those of you which are familiar with VCS, you know that we did application monitoring inside a VM using the Remote Group agent. However, there are some significant differences.App HA model is much more lightweigt, quicker and easier to install, better visibility and easier management.Multi-Tier HA support
- List the key points to communicate
- New VCS agent: VMwareDisks (aka HotSwap)The agent manages the attach\detach disk operations on virtual machines in a VCS clusterThe agent reconfigures storage on the virtual machines by sending the disk attach\detach requests to the host ESXi serverIt uses gSOAP and C++ interfaces to communicate with the ESXi web-serviceThe agent resides at the lowest level of the storage stack in the service groupThe agent functions as a glue between the ESXi host and the VCS components within the guestsThe agent is cross-platform (Windows and Linux)
- Symantec’s ability to work across this heterogeneous environment gives IT organizations a way to ensure the availability ofmulti-tiered applications, because Symantec will provide visibility and coordinated start and stop for all business servicecomponents—even if the Web server sits in a VMware virtual machine, the application server in KVM on Linux, and thedatabase on physical Big Iron.Using Symantec, HA can work across heterogeneous infrastructure, using the cross-platform layer to provide end-to-endHA information about an entire business service, comprising a multi-tier application and the heterogeneous infrastructurethat supports it. Infrastructure HA aligns with and extends the core concepts of virtualization itself, by poolinginformation resources even across heterogeneous infrastructure, and making them available on-demand for infrastructureHA, or management solutions to take appropriate action to maintain service continuity.Figure 1 shows a typical data-center server infrastructure, with one set of x86 servers hosting Windows and Linux virtualmachines, another set running applications and middleware directly, and a set of “big iron” proprietary hardware runningUNIX. A single Tier 1 application, “eCommerce”, crosses all three levels, with Web services running on x86 VMs,applications on physical x86 servers under a JBoss Enterprise Application Platform, and a database—shared with otherapplications—on a UNIX platform
- Some of the significant concerns that have made customers hesitate to move mission critical applications to a virtualized environment surround a number of key issues:Identification of bottlenecks: Without visibility to path statistics at a granular level, identification of specific bottlenecks in a virtualized environment is difficult. The statistics provided by DMP through both vCenter and the remote CLI provide great detail on performance, to assist in identification of bottlenecks.Vendor lock-in: NMP provides very generic support for storage arrays, with simple algorithms that pay no attention to the performance of the storage subsystem. PowerPath/VE provides greater flexibility, but locks customers into EMC storage arrays, where they typically overpay for their storage.Enhanced device naming and extended attributes: The ability to quickly identify the storage attributes of a given device ensures that virtual machines are deployed on the right tier of storage. Additionally, the enhanced device naming allows for easier communications between the storage and server teams.
- DMP for VMware leverages the same modular architecture that DMP on Unix or Linux uses, including the ASL/APM’s.This allows DMP for VMware to easily support new arrays as needed. In order for Symantec to support a storage array, the storage array must first be certified and listed on VMware’s HCL. We can not provide support for unsupported arrays on ESX.The initial HCL for DMP for VMware is a subset of the physical arrays supported, and will be expanding over the coming months. Stress that the architecture itself supports a large number of array families and models. Adding array support is a matter of testing and validation of test results by VMware for listing on their HCL. Arrays certified with DMP will be listed on the VMware HCL in addition to the Symantec HCL (included in the standard SFHA 6.0 HCL).
- The VxDMP Plug-in for VMware vCenter provides the centralized graphical management interface for DMP. The interface shows up as a separate tab for administration and management.In this screen shot, we highlight the plug-in itself, and can also be used to highlight the availability of graphical performance metrics at all points in the product, evidenced by the bar graphs near the bottom center of the graphic. The subsequent slides focus on selected actions that may be performed through the VxDMP Plug-In.
- In this view, I/O policy changes are possible, as well as enable/disable of specific storage paths. It is also worth pointing out during this slide the visibility of the AVID device names for the EMC Clariiion as shown. Also of note are the array serial numbers, the array failover type, and the storage layout.
- In this view, we provide I/O statistics in a tabular fashion, in addition to the graphical view previously highlighted. In this particular view, the statistics show aggregate I/O to the attached storage enclosures, but additional statics on individual LUNs, array ports, and HBAs are also accessible. These statistics are the key to identification of I/O bottlenecks within the ESX environments.These I/O statistics can be set to refresh automatically by use of the Auto-Refresh drop down (15 second minimum granularity), and statistics can be reset to zero for instant analysis of real-time I/O operations.
- The DataCenter view ithin vCenter provides visibility of storage arrays attached to ESX servers within the vCenter datacenter. This provides a single view of the storage infrastructure that is being used across the vCenter datacenter, and provides detailed statistics down to the LUN and virtual machine level to provide unprecedented insight into the impact individual VM guests have on the I/O subsystem.
- Objective: Identify with Customers Business ObjectivesTransition: Now that you have an understanding of how this technology can support your overall initiative, let’s me walk you through how we protect your virtual environment
- Objective: Identify with Customers Business ObjectivesTransition: Now that you have an understanding of how this technology can support your overall initiative, let’s me walk you through how we protect your virtual environment
- Objective: Identify with Customers Business ObjectivesTransition: Now that you have an understanding of how this technology can support your overall initiative, let’s me walk you through how we protect your virtual environment
- Objective: Identify with Customers Business ObjectivesTransition: Now that you have an understanding of how this technology can support your overall initiative, let’s me walk you through how we protect your virtual environment
- Objective: Identify with Customers Business ObjectivesTransition: Now that you have an understanding of how this technology can support your overall initiative, let’s me walk you through how we protect your virtual environment