Piszki Lab | EN

My case study in the clouds…

2014/05/29
by Piotr Pisz
0 comments

Horizon Workspace: BIG-IP F5 and multiple gateway-va.

Preparation of fault-tolerant installation of Horizon Workspace 1.8, required at the beginning the creation of the database cluster, built on the basis of pgPool and vPostgres  In the next step We prepare more gateway-va machines, and build the appropriate configuration of balancing traffic between them using the F5 BIG-IP. In this case, F5 is also responsible for the whole sphere of security (described in this post comes from our lab and is based on two F5 BIG-IP VE (ie fully virtualized)). If you do not have F5 LTM, you can use the Proxy-HA balancing, and security to pass on to other layers (eg, Trend Micro Deep Security ).

f5-3

As shown in the diagram, traffic from the Internet to the portal through F5 is directed to two gateways, and upon movement from inside (Intranet), NAT is performed directly to the FQDN address. This solution works without problems (and its configuration poses no problem), but before you proceed to perform the following steps, make sure that your DNS configuration (including the FQDN of the gateway-va) are correct .

Continue Reading →

2014/05/21
by Piotr Pisz
0 comments

Horizon Workspace: FQDN and SSL certificates in access from the Internet.

This entry is the result of weekly battles associated with the development of a method that will change the FQDN of the gateway-va, so that we can get to the Horizon Workspace from the Internet. Why is this action rises to the rank of the problem? According to the documentation , all virtual machines included in the Workspace must be configured with the correct DNS records (A / PTR). The gateway-va machine dont need to be configured at the start in the external FQDN, is administered during the initial configuration. Unfortunately, this is so (even in the latest version of the Horizon Workspace 1.8.1) that during the initial configuration of the whole this parameter is ignored and local DNS address is set as FQDN. This is due to the fact that the machine configurator-va must have full access to the gateway-va FQDN (for it is irrelevant whether it is local or Internet domain), otherwise you will not be able to properly configure the gateway-va. Unfortunately, change of the FQDN is not trivial (during the change required full access and a valid PTR ​​record). Fortunately, as I have sometimes written, there are people on the Internet that make life easier. One of them is Andrea Casini, who developed a good method .

To avoid trouble, at the stage of the installation, it is good to prepare a fake DNS record (but this can also be done with an already running system). So in the local DNS server (in my case: pulab.local), create a false main zone (in my case: pulab.pl) addressing local, compatible with reverse domain zone pulab.local. As a result, the gateway-va gain Internet FQDN and will be available in 100% locally. If you perform NAT from web to the local address ,is enough to create a “fake” zone inverted, so that the PTR record existed and was responsible address of the NAT (this is a change to an existing installation, the new better is a false domain).

fqdn1

Continue Reading →

2014/05/19
by Piotr Pisz
0 comments

Horizon Workspace: Manual analysis of the certificate chain

It is the day that I decided to put to the Internet our laboratory installation of Horizon Workspace. I equipped a wildcard certificate issued by Rapid SSL (GeoTrust), created the appropriate chain file and proceeded to action. Of course, in the case of Horizon Workspace nothing is simple when it comes to changing the FQDN and upload new SSL certificates for gateway-va. At the outset, collided with a “Certificate does not chain up to the root.”

ssl1

Continue Reading →

2014/05/14
by Piotr Pisz
0 comments

Horizon Workspace: Invalid Suite Token (404 Not Found)

Today I tested switching between virtual IP address on pgPool-II . When I found that it worked, I decided to switch the Horizon Workspace to prepared vPostgres cluster. And I made ​​a mistake. I clicked on “Test Connection”, all shone on the green, so I clicked on without thinking “Save” (and everything stopped working). Did not notice, that the password was substituted accidental “star”. And so I changed the password for the database, such as never know. From the Horizon Workspace Configurator was no longer to unscrew:

horizondb1

 

Continue Reading →

2014/05/12
by Piotr Pisz
0 comments

vCloud Director 5.5: The Host Spanning configuration on this host is not up to date.

Recently we practiced how to move root disks between the ESXi hosts. The whole procedure is simple and works very well, requires only after the fact make small adjustments in the environment. Among other things, this procedure causes jitter settings related to vCD Network Isolation . The result of which is the following alert:

vcd1

Continue Reading →

2014/04/28
by Piotr Pisz
0 comments

Horizon Workspace: High Availability vPostgres Cluster

In connection with the launch of the Horizon Workspace 1.8 (the need to perform an upgrade), and start-up testing of our new solution based in part on the Workspace, I decided to completely remodel the environment in which it operates. At first she went database. For some time, we are owners of VMware vFabric components, including vPostgres, of which we are very happy (because who would not be happy with owned production support for PostgreSQL database). In the prepared solution, I used three installations of vPostgres Appliance 9.3.2, two instances operating mode is the main and replica (as a final backup), and a third-party acting actively. Nodes operating in activ/activ mode, are replicated by pgPool-II (installed separately on CentOS). In such a scheme pgPool-II is a SPOF, so it is best to prepare two systems and use the load balancer (in our case, on the production is BIG-IP F5). Or use two installations pgPool-II enabled Watchdog and floating between machines “virtual” IP address (this is the installation in LAB). I describe the solution is the most versatile, can be successfully used to run a cluster of PostgreSQL for vCloud Automation Center (and probably in the future to vCSA 6.0 which will support an external PostgreSQL database).

postgres_cluster

Continue Reading →