Internet access from Virtual Lab

VMware specific discussions

Internet access from Virtual Lab

Veeam Logoby readie » Sun Dec 05, 2010 9:45 am

Hi,
I'm running B&R V5 and the Virtual Lab is a wonderful feature. I am testing upgrading our SharePoint server in the Virtual Lab, and it works a dream!
However, for part of the upgrade the server needs Internet Access, and I can't get that to work at all.
Our production firewall (MS TMG 2010) is on 10.2.0.32, so that is the address that the Proxy Appliance has, I think, on the Virtual Lab side. But no matter what I do, I cannot seem to get any traffic to get out of the Virtual Lab as far as the production firewall, either from real IP address or from the masquerade IP.
Is it possible?
Bob
Bob Eadie
Computer Manager at Bedford School, UK (since 1999).
Veeam user since 2009.
readie
Expert
 
Posts: 156
Liked: 30 times
Joined: Sun Dec 05, 2010 9:29 am
Full Name: Bob Eadie

Re: Internet access from Virtual Lab

Veeam Logoby Gostev » Sun Dec 05, 2010 10:56 am

readie wrote:I cannot seem to get any traffic to get out of the Virtual Lab

Exactly, Virtual Lab is actually designed to prevent this from happening... we do not want to temporary VMs to be establishing connections with computers outside Virtual Lab, as this will screw up production.

What is your use case, may be we can implement internet access from within virtual lab somehow in next releases if this becomes common request. I am guessing, you possibly want to test patches before rolling them in production? But typically everyone uses WSUS for this, and you can make backed up WSUS VM a part of virtual lab easily, so internet access will not be needed?
Gostev
Veeam Software
 
Posts: 21396
Liked: 2350 times
Joined: Sun Jan 01, 2006 1:01 am
Location: Baar, Switzerland

Re: Internet access from Virtual Lab

Veeam Logoby readie » Sun Dec 05, 2010 12:03 pm

Thanks. I am actually testing a major upgrade from MOSS Sharepoint 2007 to Sharepoint 2010.
I know I could do it live, with the confidence of snapshots to rollback if something goes wrong, but the thought of doing it in Virtual Lab, where two or three select users could then have a look at SP 2010 before we roll it out into production would be wonderful.
Good old MS have made it so that the upgrade requries internet connection to check for latest upgrade components.
??There isn't a little tweak or workaround I suppose?
If not, please regard this as a feature request.
Bob
Bob Eadie
Computer Manager at Bedford School, UK (since 1999).
Veeam user since 2009.
readie
Expert
 
Posts: 156
Liked: 30 times
Joined: Sun Dec 05, 2010 9:29 am
Full Name: Bob Eadie

Re: Internet access from Virtual Lab

Veeam Logoby ptmartin » Mon Dec 06, 2010 6:18 pm

I second this feature request ... actually I had hoped it was already there as well. I also would like to have it so a couple of folks could test-run a software upgrade offline from the live environment and internet access is a requirement of the software. I would need a way to share or give them access to the environment as well if at all possible. - Thanks!
ptmartin
Enthusiast
 
Posts: 46
Liked: 10 times
Joined: Tue Aug 17, 2010 3:35 pm
Full Name: Paul Martin

Re: Internet access from Virtual Lab

Veeam Logoby readie » Mon Dec 06, 2010 7:15 pm

Giving users access into your virtual lab is relatively easy - I'm using the static IP routing, so the vitual lab machines appear as an IP address on our production network. RDP or web browse to the machine in the virtual lab . . . it does just what it says on the tin.
Bob Eadie
Computer Manager at Bedford School, UK (since 1999).
Veeam user since 2009.
readie
Expert
 
Posts: 156
Liked: 30 times
Joined: Sun Dec 05, 2010 9:29 am
Full Name: Bob Eadie

Re: Internet access from Virtual Lab

Veeam Logoby Gostev » Mon Dec 06, 2010 8:40 pm

Hi Bob, yes what you explained works just fine, however the idea/request here is to enable VMs running in the virtual lab to connect to Internet. This is not possible today natively, but not impossible to add in future if required.
Gostev
Veeam Software
 
Posts: 21396
Liked: 2350 times
Joined: Sun Jan 01, 2006 1:01 am
Location: Baar, Switzerland

Re: Internet access from Virtual Lab

Veeam Logoby tsightler » Mon Dec 06, 2010 8:47 pm

You could cheat pretty easily with a simple tunnel from a machine on the production network to a machine in the lab. I've been thinking of doing just that for some of our machines as the lab would be more useful if Internet access was available.
tsightler
Veeam Software
 
Posts: 4772
Liked: 1740 times
Joined: Fri Jun 05, 2009 12:57 pm
Full Name: Tom Sightler

Re: Internet access from Virtual Lab

Veeam Logoby readie » Mon Dec 06, 2010 9:12 pm

Go on. Please say more about a "simple tunnel". If you can get it to work, tell us how.
I'm struggling at the moment with MS instructions how to install the prerequisites for SP 2010 without Internet connection. (You would think you can download all the files to a folder and tell it to get on with it? NO! You have to type in about a dozen CLI instructions with correct filenames etc. . . . . )
So if anyone has a workaround . . . I'd be grateful.
The Virtual Lab is SUCH a super piece of kit!! Well done Veeam. Just can't use it for what I want.
Bob
Bob Eadie
Computer Manager at Bedford School, UK (since 1999).
Veeam user since 2009.
readie
Expert
 
Posts: 156
Liked: 30 times
Joined: Sun Dec 05, 2010 9:29 am
Full Name: Bob Eadie

Re: Internet access from Virtual Lab

Veeam Logoby tsightler » Mon Dec 06, 2010 10:16 pm

Well, simple if you know about such things, perhaps not so simple otherwise.

It's super simple, and very safe, to provide basic web access with Linux and a proxy server (or a Windows system with OpenSSH running). We simply use a statically mapped IP to allow one of the host in the virtual lab to be reachable from the production network. We then SSH to the machine in the virtual lab from a machine on the production network and use the "-R" option to forward a port on the machine in the virtual lab over the SSH tunnel to our proxy server. Then, on other systems in the virtual lab we simply configure them to use the SSH tunnel on the virtual lab machine as their proxy server, which provides access via the reverse tunnel to the "real" proxy server. Works great! Especially if you already have Linux boxes in your environment (or Windows boxes running SSH).

But of course, this only provides web access, any only for those systems that can use a proxy. We've been thinking of taking this idea to the extreme by using the same basic concept but with OpenVPN. Our thought was to create a special Linux VM to use as a "virtual lab internet gateway". Make sure this system is accessible via "static mapping" and have a host on the production network create an OpenVPN tunnel to the "internet gateway" to route the two networks. Configure your hosts in the virtual lab to use this box as their default gateway instead of the proxy appliance and they have internet access.

Of course, you'd need to be careful setting up full networking, you don't want to mess up any routing and conflict with your production network, and you don't even want those hosts being able to talk to your production DNS servers or other hosts, so a "full network tunnel" setup is best left to networking professionals who understand that stuff, but the proxy setup is quite safe and, if your know about SSH, takes just a minute or two.
tsightler
Veeam Software
 
Posts: 4772
Liked: 1740 times
Joined: Fri Jun 05, 2009 12:57 pm
Full Name: Tom Sightler

Re: Internet access from Virtual Lab

Veeam Logoby Gostev » Tue Dec 07, 2010 11:05 pm

OK, this does indeed sound complex. :)

What if we make our proxy appliance to optionally act as internet proxy server in virtual lab (on isolated network side), would this be sufficient for most use cases (think ports 80/443 only, no full unrestricted internet access)?
Gostev
Veeam Software
 
Posts: 21396
Liked: 2350 times
Joined: Sun Jan 01, 2006 1:01 am
Location: Baar, Switzerland

Re: Internet access from Virtual Lab

Veeam Logoby readie » Wed Dec 08, 2010 8:52 am

Sounds ideal I think. Since its IP address in the Virtual Lab is the same as our production default router, I think that would work just fine without changing anything on the test machines in the Virtual Lab, provided your proxy could then communicate through our defaut router. (Our Web Proxy, MS ISA and TMG 2010 work on port 8080. You might want to add that to the list of ports?).
(Quite happy to help with any beta testing.)
Bob Eadie
Computer Manager at Bedford School, UK (since 1999).
Veeam user since 2009.
readie
Expert
 
Posts: 156
Liked: 30 times
Joined: Sun Dec 05, 2010 9:29 am
Full Name: Bob Eadie

Re: Internet access from Virtual Lab

Veeam Logoby Gostev » Wed Dec 08, 2010 10:51 am

readie wrote:provided your proxy could then communicate through our defaut router.

Yes, sure it can because it has one of its interface in the production network.

readie wrote:(Our Web Proxy, MS ISA and TMG 2010 work on port 8080. You might want to add that to the list of ports?).

We could get environment-specific proxy port settings from Internet Explorer settings on Veeam Backup server I guess.
Gostev
Veeam Software
 
Posts: 21396
Liked: 2350 times
Joined: Sun Jan 01, 2006 1:01 am
Location: Baar, Switzerland

Re: Internet access from Virtual Lab

Veeam Logoby readie » Wed Dec 08, 2010 11:39 am

Excellent - any estimate for a timescale for a version which might include this (I realise it has to fight with other feature requests).
Bob Eadie
Computer Manager at Bedford School, UK (since 1999).
Veeam user since 2009.
readie
Expert
 
Posts: 156
Liked: 30 times
Joined: Sun Dec 05, 2010 9:29 am
Full Name: Bob Eadie

Re: Internet access from Virtual Lab

Veeam Logoby Gostev » Wed Dec 08, 2010 12:16 pm

Definitely no clue for timelines at the moment (don't read this as "sometimes in a few years from now" though). Just truly no clue, this is nothing but idea that I did not even validate with development yet.
Gostev
Veeam Software
 
Posts: 21396
Liked: 2350 times
Joined: Sun Jan 01, 2006 1:01 am
Location: Baar, Switzerland

Re: Internet access from Virtual Lab

Veeam Logoby Gostev » Tue Dec 14, 2010 2:55 pm

Just as an update, we have tentatively scheduled this functionality for the next maintenance update (5.0.2) whenever it may be. No timelines yet because we need to gather enough hotfixes to justify the release. My current guesstimate is 3 months from now. Thanks!
Gostev
Veeam Software
 
Posts: 21396
Liked: 2350 times
Joined: Sun Jan 01, 2006 1:01 am
Location: Baar, Switzerland

Next

Return to VMware vSphere



Who is online

Users browsing this forum: No registered users and 10 guests