Tag: VM

Last updated by at .

Dec062018December 6, 2018December 7, 20181Commentby Thomas Maurer
Azure Stack VM Update Management

Using Azure Update Management on Azure Stack

Posted in Cloud, Microsoft, Microsoft Azure, Microsoft Azure Stack, Virtualization, Windows, Windows Admin Center, Windows Server, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019

At Microsoft Ignite 2018, Microsoft announced the integration of Azure Update and Configuration Management on Azure Stack. This is a perfect example how Azure services from the public cloud can be extended into your datacenter using Azure Stack. Azure Update and Configuration Management brings Azure Update Management, Change Tracking and Inventory to your Azure Stack VMs. In the case of Azure Stack, the backend services and orchestrator like Azure Automation and Log Analytics, will remain to run in Azure, but it lets you connect your VMs running on Azure Stack.

Azure Update and Configuration Managemen Schemat

Today, the Azure Update and Configuration Management extension, gives you the following features:

  • Update Management – With the Update Management solution, you can quickly assess the status of available updates on all agent computers and manage the process of installing required updates for these Windows VMs.
  • Change Tracking – Changes to installed software, Windows services, Windows registry, and files on the monitored servers are sent to the Log Analytics service in the cloud for processing. Logic is applied to the received data and the cloud service records the data. By using the information on the Change Tracking dashboard, you can easily see the changes that were made in your server infrastructure.
  • Inventory – The Inventory tracking for an Azure Stack Windows virtual machine provides a browser-based user interface for setting up and configuring inventory collection.

If you want to use Azure Update Management and more on VMs on-premise (without Azure Stack) or running at another Cloud Provider, you can do this as well. Have a look at Windows Admin Center, which allows you to directly integrate with Azure Update Management. However, there will be a difference in pricing.

Read More

Nov282018November 28, 2018November 28, 20181Commentby Thomas Maurer
Azure Live Migration

Azure uses Live Migration for VMs

Posted in Cloud, Hyper-V, Microsoft, Microsoft Azure, Virtualization, Windows Server, Work

If you have worked with Azure in the past, you might have been aware that Azure didn’t have live migration for VMs hosted in Azure for a long time. This had an impact for customers in terms of VM up-time during host maintenance. You basically got emails, that the host your VMs were running is going into maintenance during a specific time, and you will have a possible outage. Microsoft Hyper-V, which is the Hypervisor in Azure, had Live Migration for a long time. Today, Microsoft revealed that they are using Live Migration in Azure since early 2018 to move virtual machines in cases of rack maintenance and software and BIOS updates, as well as hardware faults.

But Microsoft didn’t stop there, they made even better using Machine Learning. Predictive ML helps Microsoft to detect proactively failure and do failure predictions. And in case a hardware failure is predicted, Microsoft can move the virtual machines from that host without downtime, using live migration.

To further push the envelope on live migration, we knew we needed to look at the proactive use of these capabilities, based on good predictive signals. Using our deep fleet telemetry, we enabled machine learning (ML)-based failure predictions and tied them to automatic live migration for several hardware failure cases, including disk failures, IO latency, and CPU frequency anomalies.

 

We partnered with Microsoft Research (MSR) on building our ML models that predict failures with a high degree of accuracy before they occur. As a result, we’re able to live migrate workloads off “at-risk” machines before they ever show any signs of failing. This means VMs running on Azure can be more reliable than the underlying hardware.

Microsoft talks in a blog post more about Live Migration in Azure and goes more in details about the challenges and how live migration in Azure works. It is great to see Microsoft adding features to improve VM resiliency with features like live migration and machine learning technology.


Sep042018September 4, 2018September 4, 20181Commentby Thomas Maurer
Azure Stack Backup with Azure Backup Server

Protect Azure Stack Tenant Workloads with Azure Backup Server

Posted in Cloud, Hardware, Microsoft, Microsoft Azure, Microsoft Azure Stack, Virtualization, Work

If you are running Azure Stack in your datacenter, you also want to backup workloads running on Azure Stack. This blog post covers how you can backup Azure Stack tenant workloads with Azure Backup Server. Azure Backup allows you to protect on-premise workloads running on different platforms as well as on Azure Stack and store long-term data in Azure.

Why protecting Azure Stack workloads with Azure Backup Server

Microsoft Azure Backup Server is included as a free download with Azure Backup that enables cloud backups and disk backups for workloads like SQL, SharePoint and Exchange regardless if these workloads are running on Hyper-V, VMware, Physical servers or Azure Stack. It also provides a central console to protect these workloads. If you compare this to the Azure Backup Agent, where you have to configure the agent on every single server. The Azure Backup Server also allows you to not only do file backup, but also backup of applications like SharePoint, SQL Server, Exchange and more. This gives you flexibility and centralized management to back up your infrastructure as a service (IaaS) workloads on Azure Stack.

Read More

Jul042018July 4, 2018August 14, 20180Commentby Thomas Maurer
Inked Azure Security Center Just in time VM access_LI

Azure – Just in Time VM access

Posted in Cloud, Microsoft, Microsoft Azure, PowerShell, Virtualization, Windows Server, Work

If you run virtual machines with public IP address connected to the internet, attackers immediately try to run attacks against it. Brute force attacks commonly target management ports, like RDP or SSH, to gain access to a VM. If the attacker is successful, he can take control over the VM and access other resources in the environment. To address that issue it is highly recommended to reduce the ports open, especially for the management ports. However, sometimes you will need to open to ports for some of the virtual machines for management tasks. Microsoft Azure has a simple way to address this issue, called Just in time virtual machine (VM) access. Just in time VM access can be used to lock down inbound traffic to your Azure VMs, reducing exposure to attacks while providing easy access to connect to VMs when needed.

How does Azure Just in Time VM Access work

In the Azure Security Center you can enable just in time VM access, this will create a Network Security Rule (NSG) to lock down inbound traffic to the Azure VM. During the initial JIT VM access configuration, you will be configuring the ports specified, which will be managed by Azure Security Center, these ports will be locked down by the Azure Security Center using an NSGs.

Configure Azure just in time VM access

Inked Configure Just in time VM access_LI

Azure JIT VM access is configured in the Azure Security Center. To configure and enable JIT on a virtual machine open up the Azure Security Center and click on Just in time VM access.

Here you will find three states, Configured, Recommended and No recommendation.

  • Configured – VMs that have been configured to support just in time VM access. The data presented is for the last week and includes for each VM the number of approved requests, last access date and time, and last user.
  • Recommended – VMs that can support just in time VM access but have not been configured to. We recommend that you enable just in time VM access control for these VMs. See Configuring a just in time access policy.
  • No recommendation – Reasons that can cause a VM not to be recommended are:
    • Missing NSG – The just in time solution requires an NSG to be in place.
    • Classic VM – Security Center just in time VM access currently supports only VMs deployed through Azure Resource Manager. A classic deployment is not supported by the just in time solution.
    • Other – A VM is in this category if the just in time solution is turned off in the security policy of the subscription or the resource group, or that the VM is missing a public IP and doesn’t have an NSG in place.

To configure you click on Recommended and select the Virtual Machine, for which you want to enable JIT.

Click on Enable JIT on VMs and configure the ports which should be managed by Just in time VM Access. Just in time VM access will recommend some default ports like RDP, SSH and PowerShell Remoting. You can also add other ports to the virtual machine if you want or need to.

Requesting Just in time VM Access for Azure Virtual Machine

Request Just in time VM access

On the Configured section, you can select the VM you want to request access to and click on Request access. You can now select the ports you want to be open for a specific time and a specific IP address. This will open up the ports and after 2-3 minutes you will be able to access the virtual machine.

To send such a request, the user which requests access to the Virtual Machine needs to have write access to the virtual machines in the Azure Role-Based Access Control (RBAC).

Auditing Azure just in time VM access activity

Of course all the request get logged and can be reviewed in the Activity Log.

Licensing of Azure just in time VM access

Azure just in time VM access is licensed over Azure Security Center and needs the Standard Tier to be enabled for the specific virtual machine.

I hope this gives you an idea how you can leverage Just in time VM access in Azure for your workloads.


Jun202018June 20, 2018August 22, 201810Commentsby Thomas Maurer
Create Ubuntu Hyper-V Generation 2 Virtual Machine

How to Install Ubuntu in a Hyper-V Generation 2 Virtual Machine

Posted in Hyper-V, Microsoft, Virtualization, Windows, Windows 10, Windows Server, Work

If you want to install Ubuntu or any other Linux inside a Hyper-V Generation 2 Virtual Machine you need to do a simple change to the VM so you can install it from ISO.  If you just create a Hyper-V Generation 2 Virtual Machine and try to start the Virtual Machine, the Virtual Machine will not boot from ISO. This is because of the Secure Boot feature which is included in Hyper-V Generation 2 Virtual Machines, and applies to all Linux operating systems running on Hyper-V.

How to Install Linux in a Hyper-V Generation 2 VM

Create a new Virtual Machine in the Hyper-V Manager

Create Ubuntu Hyper-V Generation 2 Virtual Machine

On the Hyper-V Virtual Machine Generation selection screen, choose Generation 2

Create Ubuntu Hyper-V Generation 2 VM

Attach the Ubuntu ISO Image to the virtual machine

Attach Ubuntu ISO to Hyper-V VM

After you have created the Virtual Machine using the wizard, go into the settings of the virtual machine. Switch to the Security section and choose the Microsoft UEFI Certificate Authority Secure Boot Template.

Now the Virtual Machine will boot from the Ubuntu ISO and you can install Ubuntu.


Apr032018April 3, 2018April 3, 20184Commentsby Thomas Maurer
Hyper-V HVC SSH Direct for Linux VMs

HVC – SSH Direct for Linux VMs on Hyper-V

Posted in Cloud, Hyper-V, Microsoft, PowerShell, Virtualization, Windows, Windows 10, Windows Server, Windows Server 1803, Windows Server 2019, Work

If you are running Hyper-V on Windows 10 or on Windows Server 2016, you probably know about a feature called PowerShell Direct. I also mentioned that PowerShell Direct is one of the 10 hidden features in Hyper-V you should know about. PowerShell Direct lets you remote connect to a Windows Virtual Machine running on a Hyper-V host, without any network connection inside the VM. PowerShell Direct uses the Hyper-V VMBus to connect inside the Virtual Machine. Of course this feature is really handy if you need it for automation and configuration for Virtual Machines. As this is great for Windows virtual machines, it does not work with Virtual Machines running Linux. In the latest Windows 10, Windows Server 1803 (RS4) and Windows Server 2019 (RS5) Insider Preview builds, Microsoft enabled a tool called HVC. HVC is at tool which allows you to do some command line VM management. HVC SSH is basically SSH Direct of Linux VMs.

This allows to connect to a Linux VM using SSH over the Hyper-V VMBus. You are also able to copy file inside a virtual machines using scp.

How to connect to Linux VMs using SSH Direct

HVC SSH on Hyper-V

To connect to Linux VMs using SSH Direct (HVC) simply type hvc.exe into the command line or PowerShell. This will give you all the possible command options. Of course SSH has to big configured inside the Linux virtual machine.

To make this work, the SSH server inside the VM needs to be configured.

Final Thoughts

Pretty cool tool which will be available in the official releases of Windows 10 and Windows Server 1803, released this spring. Later this year this feature will also be included in Windows Server 2019. If you want to try it out today, give the Windows Insider Preview builds a spin.

Thanks to Ben Armstrong for pointing this out 😉


May312017May 31, 2017September 1, 20180Commentby Thomas Maurer
Azure to Azure Site Recovery

Disaster recovery for Azure IaaS virtual machines using ASR

Posted in Cloud, Microsoft, Microsoft Azure, System Center, Virtualization, VMware, Web, Windows Server, Work

Microsoft today announced the public preview of disaster recovery for Azure IaaS virtual machines. This is basically Azure Site Recovery (ASR) for the Azure-to-Azure scenario. With that you can replicate Azure virtual machines from one Azure Region to another Azure Region, without deploying any other infrastructure components such as software appliances. Cross-region DR feature is now available in all Azure public regions where ASR is available.

The Azure Documentation describes it the following way:

In addition to the inbuilt Azure infrastructure capabilities and features that contribute to a robust and resilient availability strategy for workloads running on Azure VMs, there are a number of reasons why you need to plan for disaster recovery between Azure regions yourself:

  • Your compliance guidelines for specific apps and workloads require a Business continuity and Disaster Recovery (BCDR) strategy.
  • You want the ability to protect and recover Azure VMs based on your business decisions, and not only based on inbuilt Azure functionality.
  • You need to be able to test failover and recovery in accordance with your business and compliance needs, with no impact on production.
  • You need to be able to failover to the recovery region in the event of a disaster and fail back to the original source region seamlessly.

Azure to Azure VM replication using Site Recovery helps you to do all the above.

Azure to Azure Site Recovery Setup

To set this up you have to create an Azure Recovery Vault. This Recovery vault cannot be in the same region as the source virtual machines, because if the region is down, you will not have access to the vault.

Azure ASR Configuration Settings

Form that you can choose to create a new Replication and select the virtual machines you want to replicate. You can select the virtual machines you want to replicate. At the end you choose the target location and create the needed target resources and start the replication.

This will now allow you to failover you virtual machines to another Azure region.

Azure ASR Failover

Source Microsoft

There are some limitations right now, like no support for managed disks or limited operating system support. Check out the Azure Site Recovery support matrix for replicating from Azure to Azure for more support information.

Azure Site Recovery now allows you to replicate Virtual Machines from:

Azure Site Recovery Overview

  • On-premise Hyper-V Servers
  • On-Premise Hyper-V using System Center Virtual Machine Manager
  • On-Premise Physical Servers
  • Virtual Machines from AWS
  • Virtual Machines from another Azure Region

 



  • Follow Me

  • About

    Thomas Maurer

    My Name is Thomas Maurer. Microsoft MVP. Work as a Solutions Architect and Technology Lead for itnetX, a consulting and engineering company located in Switzerland. I am focused on Microsoft Technologies, especially Microsoft Cloud & Datacenter solutions based Microsoft System Center, Microsoft Virtualization and Microsoft Azure.

    Microsoft MVP

  • Sponsor

  • Sponsor

    Starwind HCA

  • Sponsor

    Vembu BDR Suite

  • Sponsor

    Altaro Hyper-V eBook