Tag: Hyper-V over SMB

Hyper-V Gernal Access dinied error

Hyper-V over SMB: Set SMB Constrained Delegation via PowerShell

When you are having configured a Hyper-V over SMB configuration, which means the virtual machines are running on Hyper-V host and are stored on a SMB file share, and you try to manage the virtual machine remotely from Hyper-V Manager or Failover Cluster Manager, you will run into access denied errors. The same error can also happen if you try live migrate the virtual machine. This error is caused because you are using the credentials from the machine which Hyper-V or Failover Cluster Manager is running on to access the file share via the Hyper-V host. This “double-hop” scenario is not by default not allowed because of security reasons. You can find more about Kerberos Authentication on TechNet.

To avoid this error you have to configure the SMB Constrained Delegation in Active Directory to allow this scenario for specific “double-hops”. In Windows Server 2012 Microsoft made setting up Kerberos constrained delegation much easier by introducing resource-based Kerberos Constrained Delegation. This it wasn’t that easy to deploy and required some step. In Windows Server 2012 R2 Microsoft introduced new Windows PowerShell cmdlets to configure SMB Constrained Delegation directly from PowerShell. These cmdlets are offered by the Active Directory PowerShell module.

On your management box or where ever you want to configure SMB Constrained Delegation you have to install the Active Directory PowerShell module. (You don’t need the module on the Hyper-V host or SMB file servers)

 
Install-WindowsFeature RSAT-AD-PowerShell

Now you can use the following cmdlets.

  • Get-SmbDelegation –SmbServer FileServer
  • Enable-SmbDelegation –SmbServer FileServer –SmbClient HyperVHost
  • Disable-SmbDelegation –SmbServer FileServer [–SmbClient HyperVHost] [-Force]

For example if you are running a two node Hyper-V cluster and you use a Scale-Out File Server cluster (SOFS01) as virtual machine storage, the configuration could look like this.

 
Enable-SmbDelegation –SmbServer SOFS01 –SmbClient HyperV01
 
Enable-SmbDelegation –SmbServer SOFS01 –SmbClient HyperV02

Because these cmdlets only work with the new resource-based delegation, the Active Directory forest must be in “Windows Server 2012” functional level. A functional level of Windows Server 2012 R2 is not required.

And as I mentioned before you can also use System Center Virtual Machine Manager (VMM) to manage your storage, which uses a different approach and does not need the configuration of Kerberos Constrained Delegation.

 



Add Windows-based File Server

Manage SOFS Cluster and File Shares from Virtual Machine Manager

In the past months I did several blog posts about Hyper-V over SMB and Storage Spaces. In small environment management of such a Scale-Out File Server Cluster can be a simple thing because you don’t have a lot of changes, you setup the thing once and this will work for some time. In larger enterprise fabric and storage management is a huge topic, now with Hyper-V over SMB you don’t have to do any zoning or configure iSCSI initiators but you still have to set the right permission on the file share. This is where System Center Virtual Machine Manager comes into play.

Virtual Machine Manager also you to not only manage your iSCSI or fiber channel storage appliances via SMI-S, you can also manage your Scale-Out File Server.

First you have to add the Scale-Out File Server to the SCVMM fabric management. You can simple add a resource and Add a Storage Device. This will open a wizard where you can not only select SAN or NAS storage, but you can also select Widows-based file server.

Add Windows-based File Server

Enter the FQDN of your Fileserver Cluster

Enter Fileserver FQDN

This will scan your File Server Cluster and will show you already existing file shares. You can now match Storage Classifications with the existing file shares.

File Server Fileshares and Classification

After you have connected your Scale-Out File Server you can now create new File Shares and Storage Spaces directly from the Virtual Machine Manager Console.

Create File Shares

After you have created the file share you now have to add the permission for the Hyper-V host to the File Share. Virtual Machine Manager does automatically take care of that if you add the File Share to the Hyper-V Host or if you have a Hyper-V Cluster to the Cluster Object.

Add File Share to Hyper-V host

Now you can start using the file shares for placing Virtual Machines on it. The File Shares classifications will also be available in the VM Clouds.

Cloud Storage Resouces

As you can see, System Center Virtual Machine Manager can make your life a lot easier and helps you manage your whole datacenter fabric, from Compute, network up to storage. In 2013 I did several presentations on Fabric Management with System Center Virtual Machine Manager and two of them are online. You should check out the following posts:

Fabric Management with System Center Virtual Machine Manager (German)

Fabric Management with System Center Virtual Machine Manager at the TechDays Basel (German)



Windows Server 2012 SMB Direct RDMA Copy

Hyper-V over SMB: SMB Direct (RDMA)

Another important part of SMB 3.0 and Hyper-V over SMB is the performance. In the past you could use iSCSI, Fiber Channel or FCoE (Fiber Channel over Ethernet). Now SMB 3.0 has a lot of performance improvements to make the Hyper-V over SMB scenario even work. But if you need even more performance you can use new feature which came with Windows Server 2012 and is of course also present in Windows Server 2012 R2 called SMB Direct, which supports the use of network adapters that have Remote Direct Memory Access (RDMA) capability.  Network adapters with RDMA offer some great enhancements such as very low latency, increased throughput and low CPU utilization since the functionality is offloaded to the network card.

Advantages

  • Increased throughput: Leverages the full throughput of high speed networks where the network adapters coordinate the transfer of large amounts of data at line speed.
  • Low latency: Provides extremely fast responses to network requests, and, as a result, makes remote file storage feel as if it is directly attached block storage.
  • Low CPU utilization: Uses fewer CPU cycles when transferring data over the network, which leaves more power available to server applications.

(Source TechNet)

Technology and Requirements

At the moment there are different versions of network adapters with RDMA capabilities, currently these are iWARP, InfiniBand or RoCE.

  • iWARP, is a simple solution which does not really need any more configuraiton
  • InfiniBand,
  • RoCE (RDMA over Converged Ethernet), which needs also Switches to be configured in the right way for bandwidth management (DCB/PFC)

On the software side you need Windows Server 2012 or Windows Server 2012 R2 with SMB 3.0. SMB Direct is not supported in previous versions of SMB and Windows Server.

Setup of SMB Direct

Well SMB Direct or RDMA if oyu will is enabled by default, so Windows Server will make use of it when ever possible. But there are some things you have to make sure.

  • Which type of RDMA am I using, is it iWARP, InfiniBand or RoCE. Some of them maybe require additional configuration on the network. If you are using RoCE RDMA seems to work without configuration but you can run into performance issues as my fellow Microsoft MVP Didier van Hoye descripes in his blog post.
  • Install the latest NIC drivers
  • Install the latest firmware
  • Enable SMB Multichannel if you disabled it. SMB Direct will be also disabled when you disable Multichannel.
  • In a Failover Cluster make sure that the RDMA NICs are also marked as client access adapters.
  • SMB Direct doesn’t work with NIC Teaming or Virtual Switches
  • On the file server you should also tune performance by disabling hyper threading, Disabling processor C States and setting the power profile to full power.

Verify SMB configuration

Verify if RDMA is enabled, first cmdlet checks if it’s enabled on the server it self, second one checks if it’s enabled on the network adapters and the third checks if the hardware is RDMA capable.

 
Get-NetOffloadGlobalSetting | Select NetworkDirect
Get-NetAdapterRDMA
Get-NetAdapterHardwareInfo

Verify that SMB Multichannel is enabled, which confirms the NICs are being properly recognized by SMB and that their RDMA capability is being properly identified.

On the client:

 
Get-SmbClientConfiguration | Select EnableMultichannel
Get-SmbClientNetworkInterface

On the server:

 
Get-SmbServerConfiguration | Select EnableMultichannel
Get-SmbServerNetworkInterface
netstat.exe -xan | ? {$_ -match "445"}

And as already mentioned in the SMB Mutlichannel blog post, you can verify the SMB connections:

 
Get-SmbConnection
Get-SmbMultichannelConnection
netstat.exe -xan | ? {$_ -match "445"}

And of course you have some great performance counters.

SMB Direct Performance Counters

If you run some copy jobs you can see the amazing performance (if your storage is fast enough). Here you can also see a print screen with Mellanox ConnectX-3 Ethnernet adapters which are using RoCE in Windows Server 2012. You can see that you don’t see any TCP traffic in the Task Manager on the RDMA NICs.

Windows Server 2012 SMB Direct RDMA Copy

Get more information about SMB Direct on Jose Barretos blog SMB3.info or on Microsoft TechNet.