Virtualization Infrastructure

Syndicate content
News digest about virtualization technologies, products, market trends. Since 2003.
Updated: 1 hour 26 min ago

Citrix will lead the desktop virtualization market says Morgan Stanley

Fri, 07/30/2010 - 15:26

Last week virtualization.info reported about an analysis released in June by Goldman Sachs which forecasted a neat leadership of Citrix over VMware in the desktop virtualization market by 2013. Apparently Goldman Sachs is not the only one to believe so.

Even earlier than that, at the end of May, in its own intelligence report Morgan Stanley forecasted the desktop virtualization market revenue at $1.5B by 2014 and the market share breakdown in this way:

We identify large enterprises, govt, and education as the target segments, leaving SMB penetration as upside, and est. penetration of ~13% (47M PCs) to be virtualized by 2014, out of an estimated total installed base of 370M. We assume pricing declines 8%/year and that VMW and CTXS maintain 80% share through 2014.

we believe CTXS will likely hold the lion’s share of the market at 48% in 2014 vs. 36% for VMW. This implies a $735M rev. opportunity for CTXS in 2014, and $300-500M of potential rev. upside over the next 4 years.


we believe VMW’s View product is evolving and the gap with XenDesktop will close over time. While some of the desktop rev. is in CTXS cons., and cannibalizes XenApp, it’s largely accretive to VMW, and could add $1B to $1.5B to cons. over the next 4 years.

The two reports are surprisingly similar in terms of market share. This means that while VMware is a recognized leader in the server virtualization market, well ahead of competition says Gartner, it can’t persuade investment firms about its capability to execute in the desktop virtualization space.

The events of the last months didn’t help the company to change this perception: VMware delayed its client hypervisor, Client Virtualization Platform (CVP), several times at the point that the project seems indefinitely postponed now; its Desktop Business Unit lost the Vice President and General Manager, Jocelyn Goldfein; and the company’s top executives suddenly are very skeptic about the future of VDI, to the point that they can’t forecast the adoption rate by the end of 2011.



Labels: Citrix, VDI, VMware

Citrix announces Q2 2010 earnings, only 1/3 of XenDesktop customers use ESX now

Fri, 07/30/2010 - 14:56

Earlier this week Citrix announced its Q2 2010 financial results.

The company announced $458M in total revenue, with more than $100M in cash flow.

New license sales were $149 million, up 15% from last yearLicense updates increased 13%.
Tech services grew 35%, online SaaS revenue (from the GoTo business unit) was $89 million, up 18% year-on-year.

In the Americas region Citrix revenue grew 17% from last year, in EMEA 11% year-on-year, and in APAC 31%.

Easy to expect the company reports a major growth for the XenDesktop business: in Q2 Citrix closed 18 transactions for over $1M each, 13 for over $18M and some for $5M. Some of these deals have more than 25,000 seats. 
During the quarter 3,500 customers purchased XenDesktop: 1,000 are new customers, the others are XenApp customers that used the XenDesktop Trade-up program.

This conversion of existing XenApp customers is especially interesting: Citrix reports that 20% of renewable XenApp licenses in Q2 were instead converted in XenDesktop licenses. In Q1 2010 the conversion rate of renewable XenApp licenses was 10% only. Plus, the average XenDesktop deals are 3x bigger than the XenApp ones. 
If the trend continues one may envision a future where XenApp as a stand-alone product doesn’t exist anymore.

Another very interesting point is that only 1/3 of the XenDesktop customers now use VMware ESX as the backend hypervisor. Unfortunately Citrix doesn’t specify the XenServer and Hyper-V breakdown.

Overall, The XenDesktop revenew is equal to $290M, 15% more than last year.

For Q3 Citrix expects total revenue to be in the range of $450M to $460M.
For full year 2010 the company instead expects total revenue will be in a range of $1.81B to $1.83B.

During the call Mark Templeton, Citrix CEO, claimed that Xen is now powering 2/3 of all public clouds worldwide, including of course Amazon EC2.
Of course he also mentioned how part of these Xen installations are being converted in XenServer installations, including the one that powers The Rackspace Cloud.

Templeton also reports that Citrix has now more than 460 cloud providers that signed up to deliver the Citrix Cloud Solutions framework.

During the Q&A session Templeton also provided a juicy comment on competition, specifically about Quest:

Question from Bhavan Suri – William Blair & Company L.L.C.
And then just one quick question on competition on the desktop virtualization side — and I’m not even going to talk about [indiscernible] (1:09:21) anymore – but have you seen Quest at all and do you know they’ve also been highlighted quite effectively as a big Microsoft partner in the VDI space, and how should we think about Microsoft’s relationship with them vis a vis you, and how you guys, whether you run into them or not competitively?

Answer from Mark Templeton
Well, first of all, I don’t have total visibility, and with that as a caveat, I’d say anecdotally, Quest gets considered in some cases but they get eliminated very early on. And I’d say when it comes to the strategic conversations, as they go up to the executive suite and these conversations are really about the kinds of business initiatives I talked about, technology things and some of the things I said in the prepared comments. Quickly, everyone drops out because this full range of virtual app models and virtual desktop models are really required to end up with a strategic kind of engagement with the customer. So that’s how the competitives look and our win-loss rate is remarkable on the win side, in the high-90s, 90 percentile, and the losses are miniscule.

Thanks to Seeking Alpha for the earnings call transcript.



Labels: Citrix

Quest acquires Surgient

Fri, 07/30/2010 - 12:09

In March 2009 virtualization.info published an article titled Quest uses Surgient, why not acquire it? suggesting that such acquisition would fit the Quest expansion plans and would be the natural evolution of a pre-existing relationship between the two.

Quest answered today to that question by announcing in fact the acquisition of Surgient for an undisclosed sum.

Surgient is one of the very first startups that populated the (almost empty) virtualization ecosystem in 2003.
The company initially launched a hosted virtual lab automation (VLA) solution. In 2008 it changed its business model, allowing customers to install the product on premises and reshaping its strategy to market the platform as a VM lifecycle solution rather than a VLA solution.
In 2010 Surgient changed again: it dropped the concept of VM Lifecycle Automation entirely and fully embraced the private cloud automation hype.

Quest will include Virtual Automation Platform (VAP) in the Vizioncore portfolio. There, the Surgient technology will be probably merged with another orchestration product that Quest owns: vControl, launched in September 2009.

Both Surgient and Vizioncore brands will disappear in one month from now, as Quest already announced the plan to rename the former as Quest Software Desktop Virtualization Group starting September 1st.

The acquisition is expected to be closed within the Q3 2010.

The virtualization.info Virtualization Industry Radar has been updated accordingly.



Labels: Acquisitions, Quest, Surgient, Vizioncore

Dell and HP to resell Oracle VM

Fri, 07/30/2010 - 11:46

Yesterday Oracle announced a major deal with Dell and HP: the two OEMs will certify and resell the Oracle VM virtual infrastructure, along with Oracle Solaris x86 and Oracle Enterprise Linux.
Those customers that will buy Dell’s and HP’s Oracle solutions will have full access to the Oracle Premier Support.

It sounds odd considering the Oracle’s tagline adopted after the acquisition of Sun, Software. Hardware. Complete., to push the idea of an end-to-end computing stack available from a single vendor. But it’s understandable that this is an attempt to increase the Oracle VM market share.
And, market share or not, Oracle VM Server now officially becomes the fourth hypervisor available out-of-the-box in industry standard servers, side by side with Citrix XenServer, Microsoft Hyper-V and VMware ESX.

It will be interesting to see how this will impact the Oracle presence one year from now.



Labels: Alliances, Dell, HP, Oracle

Microsoft releases Linux Integrated Services 2.1 for Hyper-V

Fri, 07/30/2010 - 11:27

In April Microsoft announced the beta program for the Linux Integrated Services (LIS) 2.1 for Hyper-V.
Among the many new features, the package introduced support for up to 4 vCPUs inside Novell SUSE Linux Enterprise Server (SLES) and Red Hat Enterprise Linux (RHEL) guest operating systems.

Yesterday Microsoft finally released it.

Besides the 4 vCPUs support for SLES 10 SP3 and 11, as well as for RHEL 5.2-5.5, LIS 2.1 also includes:

  • Driver support for synthetic devices
    LIS 2.1 supports the synthetic network controller and the synthetic storage controller that were developed specifically for Hyper-V.
  • Fastpath Boot Support for Hyper-V
    Boot devices take advantage of the block Virtualization Service Client (VSC) to provide enhanced performance.

  • Timesync
    The clock inside the virtual machine will remain synchronized with the clock on the host.
  • Integrated Shutdown
    Virtual machines running Linux can be gracefully shut down from either Hyper-V Manager or System Center Virtual Machine Manager.
  • Heartbeat
    Allows the host to detect whether the guest is running and responsive.
  • Pluggable Time Source
    A pluggable clock source module is included to provide a more accurate time source to the guest.

The first version of Hyper-V was released two years and one month ago. The first version of LIS (formerly called Integration Components for Linux) was released in September 2008.
While Microsoft may have had just a few inquiries for this feature, it’s still true that the company is trying to compete against VMware in the enterprise market where companies need high performance virtual machines for both Windows and Linux guest operating systems. it’s absolutely stunning that Microsoft took two whole years to introduce 4 vCPUs support for Linux VMs. Hopefully customers won’t have to wait another two to have 8 vCPUs support.

Also, Microsoft didn’t provide any update about its plan to submit LIS to the Linux kernel maintainers for inclusion in a future release.



Labels: Microsoft

VMware validates end-to-end FCoE configuration from Cisco and NetApp

Fri, 07/30/2010 - 11:08

A couple of days ago VMware officially validated an end-to-end Fibre Channel over Ethernet (FCoE) hardware configuration provided by Cisco and NetApp.

The solution includes Cisco Nexus 5000 Series switches and NetApp FAS3100 and FAS600 series SANs, now included in the vSphere 4.1 hardware compatibility guide.

To be fair, the three companies already presented a hardware configuration that could support end-to-end FCoE n December 2009, with a paper titled Designing Secure Multi-Tenancy into Virtualized Data Centers.
In that document anyway FCoE was suggested as an optional alternative to standard Ethernet or Fibre Channel, which doesn’t imply VMware was supporting the protocol at that time.



Labels: Cisco, NetApp, VMware

Linux Professional Institute launches Virtualization and High Availability exam

Fri, 07/30/2010 - 10:42

The Linux Professional Institute (LPI) just announced the LPI-304 exam, titled Virtualization and High Availability.

The exam is elective for the vendor-neutral Linux Professional Institute Certification (LPIC)-3 and includes virtualization (Xen, KVM, OpenVZ, VirtualBox), load balancing, cluster management and cluster storage.

Interestingly, LPI has assigned a weight of 10 to the questions about virtualization theory and the ones about Xen, while just 7 to the ones about KVM, and just 3 to the questions about other solutions (OpenVZ and VirtualBox).

Like every other LPI exam, the LPI-304 is available at Prometric and VUE testing centers.



Labels: LPI, Training

Storage vMotion vs SAN Replication

Thu, 07/29/2010 - 18:30

Duncan Epping at Yellow Bricks yesterday posted a brief but very interesting article about the best approach to pursue when a company is about to replace its SAN arrays: Storage vMotion or SAN Replication.

Epping breaks down the pros and cons of both approaches:

SAN Replication

  • Can utilize Array based copy mechanisms for fast replication (+)
  • Per LUN migration, high level of concurrency (+)
  • Old volumes still available (+)
  • Need to resignature or mount the volume again (-)
    • A resignature also means you will need to reregister the VM! (-)
  • Downtime for the VM during the cut over (-)

Storage vMotion

  • No downtime for your VMs (+)
  • Fast Storage vMotion when your Array supports vStorage APIs for Array Integration (VAAI) (+)
    • If your Array doesn’t support VAAI migrations can be slow (-)
    • Induced cost if VAAI isn’t supported (-)
    • Only intra Array not across arrays (-)
  • No resignaturing or re-registering needed (+)
  • Per VM migration (-)
    • Limited concurrency (2 per host, 8 per VMFS volume) (-)


Labels: VMware

Virtual Computer appoints its SVP of Marketing

Thu, 07/29/2010 - 18:23

The US startup Virtual Computer earlier this week announced its new Senior Vice President of Marketing: Andrew McKay.

McKay is the co-founder and former Senior Vice President of Sales and Marketing of Attivio, a software company focused on enterprise search solutions.
From 2002 to 2006 McKay has been the Vice President of Sales, Technical Sales and Product Marketing at Fast Search & Transfer (FAST), acquired by Microsoft in early 2008.



Labels: Leadership, Virtual Computer

VMware to release an antivirus framework, partners with TrendMicro

Tue, 07/27/2010 - 20:17

Along with the new vShield Edge and vShield App (which apparently is a rebrand for vShield Zones), VMware is preparing a third security product, in collaboration with TrendMicro.

Internally codenamed Seraph, it seems a security framework for agent-less antivirus scanning that leverages the VMsafe API.

ApparentlyVMware originally planned to partner with both TrendMicro and McAfee for this project, but TechTarget recently reporting about the news only mentioned the former. Maybe McAfee is still in, but it’s more likely that VMware decided to drop the partnership after the security vendor announced a big security project with Citrix on XenClient, XenDesktop and XenServer.

Exactly like what McAfee and Citrix are planning to do, VMware too wants to move the antivirus endpoint agent outside the guest operating systems, reducing the unnecessary duplication of agents and the consequent I/O overload the they generate.
The agent would be moved into a dedicated virtual machine, accessing to the others through the VMsafe API, as an official presentation available online confirms:



Labels: Security, TrendMicro, VMware

VMware revamps its security offering, prepares security for the cloud

Tue, 07/27/2010 - 20:01

Earlier this month VMware announced two new variants of its vShield Zones (formerly VirtualShield) virtual firewall: vShield App 1.0 and vShield Edge 1.0, both available now as beta.

The company inherited the security product after the acquisition of Blue Lane Technologies, in October 2008. Since that time, VMware updated the product only one time, including it for free in vSphere 4.0 (but only for Advanced, Enterprise and Enterprise Plus SKUs).
The new vSphere 4.1 doesn’t bring in any update for the product, or at least there’s no mention of updates in the official release notes (for both vSphere and vShield Zones).

VMware describes vShield App as a stateful inspection firewall, capable to analyze inter-VM traffic and to attach the security policy to the virtual machine itself. It’s not clear if this means that Zones has been renamed in App or not.

vShield Edge leverages the same engine and adds routing on top, allowing administrators to inspect and filter network traffic when it leaves or enters the virtual data center.
The product also leverages the VMsafe API, creating security zone for the virtual machines that are enforced down to the vNIC.
Last but not least vShield Edge includes DHCP, VPN, NAT and load balancing services.

vShield Edge will be included in the upcoming vCloud Service Director (vCSD, formerly project Redwood), to be launched during VMworld 2010 in early September, as an official VMware presentation available online confirms:

The presentation also clarifies that products will be centrally managed by a vShield Manager 2.0, which is integrated with vCenter Server.



Labels: Security, VMware

Quest/Vizioncore releases a free SCOM management pack for VMware

Tue, 07/27/2010 - 18:34

In mid July Quest released a new version of its VMware Management Extensions (QMX) for System Center Operation Manager (SCOM) 2007 R2.
The product has been included in the Vizioncore portfolio, rebranded as  Management Pack for VMware 1.0, even if the internal build actually is 7.0.0.40, and relaunched yesterday.

It’s not clear why Quest decided to leverage the Vizioncore brand in this way: the company in fact already announced the upcoming drop of its subsidiary brand within the end of August.

Anyway, the Management Pack, available for free, allows Microsoft administrators to manage the VMware environments thanks to:

  • Alert and event management and trending inside the SCOM console
  • Performance monitoring & availability event monitoring
  • Out-of-the-box reports for host and guest metrics

With this move Quest/Vizioncore increases the already harsh competition with Veeam, which acquired nworks in June 2008 and offers VMware and Hyper-V management add-ons for both SCOM and HP Operations Manager.



Labels: Platform Management, Quest, Releases, Vizioncore, VMware

Release: VKernel Chargeback 2.0

Tue, 07/27/2010 - 17:32

Yesterday VKernel released version 2.0 of its Chargeback product.

The startup recently recognized an increased competition with VMware, which has a capacity analyzer product (vCenter CapacityIQ) and a chargeback product (vCenter Chargeback), fully overlapping the VKernel offering.
So it doesn’t surprise much to see the introduction of support for Microsoft Hyper-V (both 2008 and 2008 R2), System Center Virtual Machine Manager (SCVMM) 2008 R2 and System Center Operation Manager (SCOM) 2007 R2.

Chargeback 2.0 also introduces support for allocated and actual resource usage.
For some reason there’s no mention of support for VMware vSphere 4.0 or the new 4.1 despite the last version tracked by virtualization.info, 1.4, was released in February 2009.



Labels: Chargeback, Releases, VKernel

Convirture releases ConVirt 2.0 Enterprise Edition

Tue, 07/27/2010 - 15:10

In March Convirture released version 2.0 of its open source management console ConVirt (formerly XenMan) for multiple hypervisors, including Xen and KVM.
At that time the company also announced an upcoming Enterprise Edition that is finally available today.

This edition introduces the following features:

  • dynamic resources allocation (through the use of resource pools)
  • high availability (through hosts and virtual machines fail-over)
  • virtual machines backup (both scheduled and on-demand)
  • network and storage automated configuration (VLAN and SAN setup across multiple hosts)
  • role-based access control
  • alerting and email notification
  • CLI and APIs

Pricing starts at $1,495 per host for up to 10 hosts.

While interesting, Convirture may have problems in selling this Enterprise version of ConVirt now that Rackspace launched OpenStack.
It’s not because ConVirt cannot compete with OpenStack, but because one of the key points of the Rackspace message is that the hosting provider is committed to deliver just one edition of OpenStack, subtly criticizing those companies that offer open source editions with less features that the commercial counterparts:

We will not produce “open core” software.

We are committed to creating truly open source software that is usable and scalable. Truly open source software is not feature or performance limited and is not crippled. There will be no “Enterprise Edition”.



Labels: Convirture, KVM, Platform Management, Releases, Xen

After Microsoft, VMware too lines up the channel

Tue, 07/27/2010 - 13:43

Microsoft is not the only one that is pushing its channel to sell more virtualization. While at Redmond the company is preparing a new 20% deal registration incentive program that will start in October, VMware launches a new Accumulative Volume Purchasing Program (VPP).

The program provides incremental, tier-based discounts for VMware partners to offer their customers over a rolling two-year period.
Partners receive financial incentives when they purchase VMware products in volume with discounts on eligible license products, through a 4-level discount range:

Level

Points

Discount

1

250-599

4%

2

600-999

6%

3

1,000-1,749

9%

4

1750+

12%



Labels: VMware

A private cloud is still a giant computer for VMware

Tue, 07/27/2010 - 13:27

Who remembers the VMware’s marketing message in 2008? It was all about a giant computer where VMware provided the operating system, called Virtual Datacenter OS or VDC-OS.

The VDC-OS rapidly disappeared because it had too many similarities with the mainframe, and was slowly replaced by the ubiquitous private cloud computing concept we have today. Despite the name change, the idea of a giant computer remains.

Yesterday InformationWeek published an exclusive interview with the VMware’s CEO Paul Maritz. He provided interesting information, like the desire to abandon mainframes for some of the largest banks in the world:

“We’re starting to get—for the first time ever—some very significant companies saying, ‘We have decided in principle—we don’t know when, but we have decided—to move off of the mainframe.’ This is one of the world’s three largest banks telling us this,” Maritz said.

CONTINUE READING ON cloudcomputing.info…



Labels: IaaS, VMware

Citrix, Juniper, HP, Yahoo and Nicira on the future on networking in virtual infrastructures

Mon, 07/26/2010 - 19:22

Virtualization and cloud computing are changing the way we design data centers. The more powerful CPUs Intel and AMD produce, the more virtual machines per core administrators can host on a single hypervisor. But the higher consolidation ratio we achieve the more issues we have with memory, storage and networking components, that are quickly becoming the new virtual infrastructure bottlenecks.

Virtualization vendors try to overcome memory limitations with several overcommitment techniques, like the new Memory Compression from VMware and the upcoming Dynamic Memory from Microsoft, while storage vendors try to develop more virtualization-friendly SANs controllers able to facilitate acrobatics like long-distance virtual machines live migrations, like the EMC VPLEX
Excluding Cisco and HP, established networking vendors don’t seem equally busy in addressing the new challenges that exist in virtual and cloud computing infrastructures.

This topic has been covered a number of times before. The last one is in a roundtable hosted by the Association for Computing Machinery (ACM) last month.

The group of experts that participated the round table is particularly interesting as it includes CTOs and Vice Presidents from Citrix, Juniper, HP, Yahoo! and even the semi-stealth startup Nicira, where the founder and former CEO of VMware Diane Greene invested.

There are a lot of interesting comments that help to understand where these companies are going or at least how they view the challenge.

From Citrix (with our emphasis):

…given the progress of Moore’s law and the large number of VMs (virtual machines) we can run per server, the implicit change to networking is that the last-hop switch is necessarily a feature of the hypervisor or hardware of the server and not a traditional hardware switch in the physical network.

IaaS challenges the traditional vendor/customer roles for networking equipment. It may be that the cloud vendor purchased equipment from a specific vendor, but there is no way for that vendor to surface its unique value proposition to the IaaS customer. Does this necessarily force commoditization in network equipment? I think it does. Google, for example, reportedly already builds its own networking gear from industry-standard parts.

The key point is that you don’t have the luxury of being asked when a VM moves; you are told. The argument that [HP] makes is that we would never move a thing to a LAN segment that is not protected. People usually don’t understand the infrastructure at that level of detail. When the IT guy sees a load not being adequately serviced and sees spare capacity, the service gets moved so the load is adequately resourced. End of story: it will move to the edge. You are not asked if the move is OK, you are told about it after it happens. The challenge is to incorporate the constraints that Lin mentions in the automation logic that relates to how/when/where workloads may execute. This in turn requires substantial management change in IT processes.

From Nicira:

Originally, the leverage point was in the network because it was central. Because of this, networks have always been an obvious place to put things such as configuration state. Now the leverage point is at the edge because the semantics there are very rich. I know where a VM is, I know who’s on it, and I know when it joins and when it leaves. As a result, I don’t require traditional service discovery and often don’t need multicast. Because the leverage point is at the edge, the dynamic changes completely; and because the semantics are now more interesting at the edge, you have a clash of paradigms.

From Yahoo! (with our emphasis):

In the next two to three years our goal is to make the building of an application, its packaging, and deployment completely transparent. I want to specify SLA (service-level agreement), latency, and x-megabit-per-second throughput and receive a virtual network that satisfies the requirement.

We are moving to Xen and building a new data-center architecture with flat networks. We tried to use VLANs, but we have taken a different approach and are going to a flat layer 2 network. On top of this we are building an open vSwitch model placing everything in the fabric on the server.

From Juniper:

…At Juniper, we want to build what is in effect a stateless, high-capacity, 100,000-port switch but without backhauling everything to the “god box” in the middle.

Surprisingly, a networking vendor that has much potential in the virtualization marketing, Vyatta, was not part of the discussion.  
Despite that (and the lack of Cisco too), the roundtable is extremely interesting and definitively worth a read.



Labels: ACM, Citrix, HP, Juniper Networks, Nicira, Yahoo

VMware VDI market share down to 39% in three years, Citrix up to 50% says Goldman Sachs

Thu, 07/22/2010 - 19:06

Despite the great Q2 performance reported two days ago by VMware, not everybody believes that the virtualization vendor will continue to keep its leadership position in every market segment the near future.

Dow Jones in fact reports about a research note released last month by Goldman Sachs about VDI suggesting that Citrix will surpass VMware and lead the market in the next three years.

The financial firm wrote in the Americas Morning Summary of June 9:

We believe Citrix and VMware will dominate the VDI market for the foreseeable future, with close to 90% of the market between the two. However, momentum is diverging currently in favor of Citrix. Hence, we have updated our model to reflect increasing market share for Citrix increasing from 42% in CY2009 to 50% in CY2013. VMware’s share moves from 51% to 39% over the same timeframe. Previously we had both vendors with equal share in CY2013.

The skepticism expressed by the VMware’s executives during the Q2 2010 earnings call certainly didn’t help to counter the Goldman Sachs forecast.



Labels: Citrix, VMware

NIST publishes a draft Guide to Security for Full Virtualization Technologies

Thu, 07/22/2010 - 15:41

The Computer Security Division of the US National Institute of Standards and Technologies (NIST) published last week the first draft of a new paper titled Guide to Security for Full Virtualization Technologies.

By “full virtualization” the authors mean what the Industry calls “hardware virtualization”: a virtualization platform based on a type-1 (bare-metal, or hypervisor) or a type-2 (hosted) virtual machine monitor (VMM) that hosts virtual machines (VMs).
The document also refers to “server virtualization” meaning “hardware virtualization for server consolidation” and to “desktop virtualization” meaning “hardware virtualization executed on a consumer desktop” and not “hardware virtualization for client consolidation”.

The 35-pages paper has three sections: the first one introduces the concept of full virtualization and its implementations. the second one presents the security recommendations for virtualization components, and the third one introduces to the discipline of secure virtualization planning and deployment.

The security recommendations are divided in specific sections: one for the hypervisor, one for the guest operating system, one for the virtual infrastructure and one for the hosted desktop virtualization platforms.

The recommendations are pretty generic. The ones about the hypervisors for example are:

  • Install all updates to the hypervisor as they are released by the vendor. Most hypervisors have features that will check for updates automatically and install the updates when found. Centralized patch management solutions can also be used to administer updates.
  • Disconnect unused physical hardware from the host system. For example, a removable disk drive might be occasionally used for backups, but it should be disconnected when not actively being used for backup or restores. Disconnect unused NICs from any network.
  • Disable all hypervisor services such as clipboard- or file-sharing between the guest OS and the host OS unless they are needed. Each of these services can provide a possible attack vector. File sharing can also be an attack vector on systems where more than one guest OS share the same folder with the host OS.
  • Consider using introspection capabilities to monitor the security of each guest OS. If a guest OS is compromised, its security controls may be disabled or reconfigured so as to suppress any signs of compromise. Having security services in the hypervisor permits security monitoring even when the guest OS is compromised.
  • Consider using introspection capabilities to monitor the security of activity occurring between guest OSs. This is particularly important for communications that in a non-virtualized environment were carried over networks and monitored by network security controls (such as network firewalls, security appliances, and network IDPS sensors).
  • Carefully monitor the hypervisor itself for signs of compromise. This includes using self-integrity monitoring capabilities that hypervisors may provide, as well as monitoring and analyzing hypervisor logs on an ongoing basis.

Nonetheless this guide can be used as good starting point to secure virtual infrastructures and should be paired with specific hardening guides released by the virtualization vendors, like the new VMware vSphere 4.0 Security Hardening Guide.



Labels: NIST, Papers, Security

VMTurbo unveils its capacity management solution for vSphere

Thu, 07/22/2010 - 14:58

In April virtualization.info covered the soft launch of a very interesting stealth startup called VMTurbo.

Without unveiling its product, the company promised a solution that could automate virtual infrastructures following constrains dictated by capacity management and platform optimization engines.
At that time, the VMTurbo's Product Marketing and Business Development Manager John Gannon said:

...we are absolutely providing capacity management functionality in our product but we're also addressing the issues of (automated) bottleneck prevention and remediation, workload balancing, rightsizing, and power management at the same time...

Now the company has finally unveiled more details about its offering and the product seems really articulated.

The VMTurbo platform is made by three components: Observe, Advise and Automate.

Observe is a performance monitoring engine.

Advise is a capacity management engine that applies to the Observe data economic scheduling algorithms, calculating how to reallocate the virtual infrastructure resources based on supply and demand. Additionally, it recommends when additional hardware should be added, or when to activate Storage vMotion.
Because Advise is a capacity management and not just a capacity planning engine, it runs continuously, adjusting its recommendations in real-time.

Automate is an orchestration engine which execute the Advise recommended optimizations. It can migrate virtual machines across hosts, clusters and data centers to balance the workloads or to shut down underutilized hardware for power saving. It can also modify the virtual hardware for each virtual machine by adding or removing vCPUs and vRAM.

The three pieces are delivered through a single virtual appliance.
While the first version of the product only supports VMware platforms, VMTurbo already plans support for additional hypervisors.

The company seems about to launch an early access program, so stay tuned for additional reports about VMTurbo.


The virtualization.info Virtualization Industry Radar has been updated accordingly.



Labels: Capacity Management, VMTurbo