VMware Communities: Virtualizing Non-IT Systems in an IT ...

VMware

Up to Discussions in Higher Education

This Question is Possibly Answered

1 "correct" answer available (10 pts) 1 "helpful" answer available (6 pts)

6 Replies Last post: Jul 21, 2009 7:29 AM by jftuga

Virtualizing Non-IT Systems in an IT ESX Environment posted: Jul 8, 2009 1:23 PM

kikori

2 posts since
Jul 8, 2009

Hi Folks,

We have an established ESX 3.5 environment that is home solely to systems that are a part of our college's IT infrastructure. To be clear, these systems are managed entirely by me and other IT staff. However, there are numerous labs and research systems on campus which are managed primarily by faculty, and IT has no involvement with these systems whatsoever apart from providing basic network connectivity.

We've been tasked at looking at the possibility of virtualizing these systems and bringing them into our existing ESX environment. Is anybody doing this already, and do you have any thoughts on essentially mixing production and research environments within the same ESX cluster? What kinds of general policies, guidelines, and/or restrictions do you have for the owners of these VMs, and for the resources they consume? Ideally we might set up a separate cluster for these kinds of non-IT systems, but due to budgetary constraints, that may not be feasible. Are there any particular problems that you may have run into that we should be concerned about?

Any thoughts or suggestions would be appreciated. Thanks!

Re: Virtualizing Non-IT Systems in an IT ESX Environment

1. Jul 8, 2009 1:32 PM

in response to: kikori

weinstein5

6,351 posts since
Nov 19, 2005

Welcome to the forums - you are right ideally it would be best to set up seperate clusters but since it looks like budget might prevent that I would take a look at using resource pools inside your clusters that way you can carve up the resources being provided by the cluster and allocate so that your IT servers can be quaranteed their required resources - check out page 40 for more information in the Resource Management Guide - http://www.vmware.com/pdf/vi3_35/esx_3/r35u2/vi3_35_25_u2_resource_mgmt.pdf

If you find this or any other answer useful please consider awarding points by marking the answer correct or helpful

Re: Virtualizing Non-IT Systems in an IT ESX Environment

2. Jul 16, 2009 10:16 AM

in response to: weinstein5

azn2kew

2,941 posts since
Jun 21, 2006

Also from administration perspective, you can create folders and grant those faculties permission more appropriately to have them administer their own servers but you would handle the ESX administration to be safe. They can use VI client or RDP directly to the box themselves. Also, if you're confortable granted web base connection so they can administer it anywhere with internet connections. If you want to grant connection from home, neither publish Citrix VI Client icons, or VPN, web URL that is a good choice too. Just make sure you have granular permission and lockdown procedures and that should be good. Have you thought of using free ESX4i version for their purpose but that requires additional hardware investment.

If you found this information useful, please consider awarding points for "Correct" or "Helpful". Thanks!!!

Regards,

Stefan Nguyen
VMware vExpert 2009
iGeek Systems Inc.
VMware, Citrix, Microsoft Consultant

Re: Virtualizing Non-IT Systems in an IT ESX Environment

3. Jul 17, 2009 4:50 AM

in response to: kikori

tom howarth

7,361 posts since
Jul 25, 2005

kikori wrote:
Hi Folks,

We have an established ESX 3.5 environment that is home solely to systems that are a part of our college's IT infrastructure. To be clear, these systems are managed entirely by me and other IT staff. However, there are numerous labs and research systems on campus which are managed primarily by faculty, and IT has no involvement with these systems whatsoever apart from providing basic network connectivity.

We've been tasked at looking at the possibility of virtualizing these systems and bringing them into our existing ESX environment. Is anybody doing this already, and do you have any thoughts on essentially mixing production and research environments within the same ESX cluster? What kinds of general policies, guidelines, and/or restrictions do you have for the owners of these VMs, and for the resources they consume? Ideally we might set up a separate cluster for these kinds of non-IT systems, but due to budgetary constraints, that may not be feasible. Are there any particular problems that you may have run into that we should be concerned about?

Any thoughts or suggestions would be appreciated. Thanks!

the first thing to say is welcome to the forums,

Now one thing is that VMware ESX will only virtualise i386 processor from intel or AMD. these can be 32bit or 64bit(but you already knew that didn't you )

and to sharing research and production on the same hosts, you could utiilze resource groups in a cluster to guarentee resourse to whichever is has the higher prioirty, if there are issues of sensitivity consider vShields to protect your VMs

If you found this or any other answer useful please consider the use of the Helpful or correct buttons to award points

Tom Howarth VCP / vExpert
VMware Communities User Moderator
Blog: www.planetvm.net
Contributing author for the upcoming book "VMware vSphere and Virtual Infrastructure Security: Securing ESX and the Virtual Environment”. Currently available on roughcuts

Re: Virtualizing Non-IT Systems in an IT ESX Environment

4. Jul 21, 2009 5:22 AM

in response to: tom howarth

kikori

2 posts since
Jul 8, 2009

Hi Folks,

Sorry for my terribly slow response on this -- as you can imagine, summer is particularly busy for us as we try to get all our projects done before the start of the next semester!

I did want to thank everyone for your responses, as they are very much appreciated. We actually already have a couple of different resource pools set up (production servers and our own test/development VMs), so if we do need to incorporate two different environments into the same cluster, this will no doubt be our approach.

I didn't know about the vShield stuff though, so I will definitely take a look at that. Is that available for ESX 3.5, or do we need to upgrade to vSphere 4 first?

What I'm also after is along the lines of departmental policy or procedures, e.g., perhaps departments are charged for having their systems in such an environment, since they are no longer consuming their own department's computing resources / budget, but rather IT's. I also wonder if there are any security concerns we should be aware of. For example, with all our IT servers, we have full administrative control over all systems, we know they're up-to-date with patches, the latest VMware Tools, etc., but these non-IT systems aren't under our jurisdiction at all, and it's not uncommon for students to have full root/administrator privileges on them. Naturally, as a sysadmin, I'm wary of mixing systems that we control and systems that we don't in the same environment, even if we can segregate them with resource pools and permissions. Perhaps vShield already address these concerns? Or am I just being too paranoid?

Thanks again!

Re: Virtualizing Non-IT Systems in an IT ESX Environment

5. Jul 21, 2009 6:36 AM

in response to: kikori

jayctd

152 posts since
Jun 3, 2009

I think you are right to be a bit wary of bringing them into the fold, I used to work for higher ed IT and worked closely with several of those departments. While I like your focus on security that would not at first be my major concern in this case (beyond the normal security) ESX does a very good job of segregating resources securely. Personally I would be more concerned on A) Working out user rights b) Working out resource pools and or virtual machine resources

Those departments are going to love to run hokey applications on purpose or by accident, they will be sucking up all avaliable ram and compute cycles in seemly random intervals. Controlling the resources they have access to I think will be the most important.

Jered Rassier

##If you have found my post has answered your question or helpful please mark it as such##

Re: Virtualizing Non-IT Systems in an IT ESX Environment

6. Jul 21, 2009 10:01 AM

in response to: jayctd

jftuga

7 posts since
Apr 22, 2008

On a guest system, you can limit the amount of CPU and memory. Right click on the server and choose Edit Settings. Choose the Resources tab. You will see options for CPU and memory. Conversely, for your critical / production servers, you can reserve a minimum amount of CPU and memory. You may find a happy medium for both your production & research environments by using these together.

-John

Go to original post

Search VMware Communities Advanced Search

Actions

View as PDF

Up to Discussions in Higher Education