Internet access from Virtual Lab

[readie]

Hi,
I'm running B&R V5 and the Virtual Lab is a wonderful feature. I am testing upgrading our SharePoint server in the Virtual Lab, and it works a dream!
However, for part of the upgrade the server needs Internet Access, and I can't get that to work at all.
Our production firewall (MS TMG 2010) is on 10.2.0.32, so that is the address that the Proxy Appliance has, I think, on the Virtual Lab side. But no matter what I do, I cannot seem to get any traffic to get out of the Virtual Lab as far as the production firewall, either from real IP address or from the masquerade IP.
Is it possible?
Bob

[Gostev]

I cannot seem to get any traffic to get out of the Virtual Lab

Exactly, Virtual Lab is actually designed to prevent this from happening... we do not want to temporary VMs to be establishing connections with computers outside Virtual Lab, as this will screw up production.

What is your use case, may be we can implement internet access from within virtual lab somehow in next releases if this becomes common request. I am guessing, you possibly want to test patches before rolling them in production? But typically everyone uses WSUS for this, and you can make backed up WSUS VM a part of virtual lab easily, so internet access will not be needed?

[readie]

Thanks. I am actually testing a major upgrade from MOSS Sharepoint 2007 to Sharepoint 2010.
I know I could do it live, with the confidence of snapshots to rollback if something goes wrong, but the thought of doing it in Virtual Lab, where two or three select users could then have a look at SP 2010 before we roll it out into production would be wonderful.
Good old MS have made it so that the upgrade requries internet connection to check for latest upgrade components.
??There isn't a little tweak or workaround I suppose?
If not, please regard this as a feature request.
Bob

[ptmartin]

I second this feature request ... actually I had hoped it was already there as well. I also would like to have it so a couple of folks could test-run a software upgrade offline from the live environment and internet access is a requirement of the software. I would need a way to share or give them access to the environment as well if at all possible. - Thanks!

[readie]

Giving users access into your virtual lab is relatively easy - I'm using the static IP routing, so the vitual lab machines appear as an IP address on our production network. RDP or web browse to the machine in the virtual lab . . . it does just what it says on the tin.

[Gostev]

Hi Bob, yes what you explained works just fine, however the idea/request here is to enable VMs running in the virtual lab to connect to Internet. This is not possible today natively, but not impossible to add in future if required.

[tsightler]

You could cheat pretty easily with a simple tunnel from a machine on the production network to a machine in the lab. I've been thinking of doing just that for some of our machines as the lab would be more useful if Internet access was available.

[readie]

Go on. Please say more about a "simple tunnel". If you can get it to work, tell us how.
I'm struggling at the moment with MS instructions how to install the prerequisites for SP 2010 without Internet connection. (You would think you can download all the files to a folder and tell it to get on with it? NO! You have to type in about a dozen CLI instructions with correct filenames etc. . . . . )
So if anyone has a workaround . . . I'd be grateful.
The Virtual Lab is SUCH a super piece of kit!! Well done Veeam. Just can't use it for what I want.
Bob

[tsightler]

Well, simple if you know about such things, perhaps not so simple otherwise.

It's super simple, and very safe, to provide basic web access with Linux and a proxy server (or a Windows system with OpenSSH running). We simply use a statically mapped IP to allow one of the host in the virtual lab to be reachable from the production network. We then SSH to the machine in the virtual lab from a machine on the production network and use the "-R" option to forward a port on the machine in the virtual lab over the SSH tunnel to our proxy server. Then, on other systems in the virtual lab we simply configure them to use the SSH tunnel on the virtual lab machine as their proxy server, which provides access via the reverse tunnel to the "real" proxy server. Works great! Especially if you already have Linux boxes in your environment (or Windows boxes running SSH).

But of course, this only provides web access, any only for those systems that can use a proxy. We've been thinking of taking this idea to the extreme by using the same basic concept but with OpenVPN. Our thought was to create a special Linux VM to use as a "virtual lab internet gateway". Make sure this system is accessible via "static mapping" and have a host on the production network create an OpenVPN tunnel to the "internet gateway" to route the two networks. Configure your hosts in the virtual lab to use this box as their default gateway instead of the proxy appliance and they have internet access.

Of course, you'd need to be careful setting up full networking, you don't want to mess up any routing and conflict with your production network, and you don't even want those hosts being able to talk to your production DNS servers or other hosts, so a "full network tunnel" setup is best left to networking professionals who understand that stuff, but the proxy setup is quite safe and, if your know about SSH, takes just a minute or two.

[Gostev]

OK, this does indeed sound complex.

What if we make our proxy appliance to optionally act as internet proxy server in virtual lab (on isolated network side), would this be sufficient for most use cases (think ports 80/443 only, no full unrestricted internet access)?

[readie]

Sounds ideal I think. Since its IP address in the Virtual Lab is the same as our production default router, I think that would work just fine without changing anything on the test machines in the Virtual Lab, provided your proxy could then communicate through our defaut router. (Our Web Proxy, MS ISA and TMG 2010 work on port 8080. You might want to add that to the list of ports?).
(Quite happy to help with any beta testing.)

[Gostev]

provided your proxy could then communicate through our defaut router.

Yes, sure it can because it has one of its interface in the production network.

(Our Web Proxy, MS ISA and TMG 2010 work on port 8080. You might want to add that to the list of ports?).

We could get environment-specific proxy port settings from Internet Explorer settings on Veeam Backup server I guess.

[readie]

Excellent - any estimate for a timescale for a version which might include this (I realise it has to fight with other feature requests).

[Gostev]

Definitely no clue for timelines at the moment (don't read this as "sometimes in a few years from now" though). Just truly no clue, this is nothing but idea that I did not even validate with development yet.

[Gostev]

Just as an update, we have tentatively scheduled this functionality for the next maintenance update (5.0.2) whenever it may be. No timelines yet because we need to gather enough hotfixes to justify the release. My current guesstimate is 3 months from now. Thanks!

[readie]

Great - thanks for the feedback.
I think once this is in, your Virtual Lab in itself is worth buying Backup and Replication for! I haven't found any other product which will allow me to experiment on my 'live' (i.e. same IPs, computer names etc.) environment without affecting users.
Bob

[ful56_uk]

hello

can you get your vm's in your test lab to access the internet?

Mark

[Alexey D.]

Mark, Tom's post describes the process.

[Gostev]

Just as an update, we have tentatively scheduled this functionality for the next maintenance update (5.0.2) whenever it may be. No timelines yet because we need to gather enough hotfixes to justify the release. My current guesstimate is 3 months from now. Thanks!

This has just been released. I have added the corresponding section to the sticky FAQ topic. Thanks all for your feedback, hope this makes vPower virtual labs even more useful for you.

[AlexD]

Hi all,

I'm hoping one of you can help me.
We have recently aquired Veeam software and I have been reading up about it and trying various processes.
At the moment I am working on Virtual Lab. I have successfully made a couple of labs but then I was given a task.
I have been told to see if I can get the Lab to have internet access so we can test Outlook Anywhere settings.

I have read the FAQ "Step by Step" guide but I didn't understand it fully.

So my question is:
Can anyone give me a more detailed step by step guide as to how to allow Virtual Labs to access the internet? (screenshots would be extreamly helpful if possible)

Sorry for the extra information. Just wanted to give you a bit of infomation as to why I want internet access on a Virtual Lab.

Thanks in advance

Alex

[foggy]

Alex, what exactly you did not understand in the description given here? It looks pretty straightforward, so I would prefer to answer your specific questions rather than giving some general instructions.

[AlexD]

I have to appologise. I am VERY new at Veeam so some of these may be really stupid questions.
So I'll run through what i have done so far

To start I'm guessing that the registry edits are to be made on the server where Backup and Replication is installed?
I navigated to HKEY_LOCAL_MACHINE\SOFTWARE\VeeaM\Veeam Backup and Replication and found there was no SureBackup folder there so I created one. (Im guessing it doesnt matter that the server is 64 bit Windows 2008 R2)
In the SureBackup folder I created the VLabProxyEnable DWORD (they are not case sensitive are they?)

After that I got confused

To customize proxy port (inside virtual lab). If the value does not exist, 8080 is used. Value must be in hex, for example 00000c38 for port 3128.

Code: Select all

allvLabProxyHTTPPort
DWORD
Port number (hexadecimal) 

I'm assume i do not need to enter this DWORD if I dont want to customise the proxy port?

To set production proxy server name. If this value does not exist, proxy appliance must have direct internet access from its production network interface.

Code: Select all

allvlabProxyServer
STRING
upstreamproxyname.domain.local

For this bit I'm guessing that i need to give the proxy appliace a static IP and then add a DNS entry on the production network?

For example I have a proxy appliance setup called Exchange_Outlook_Anywhere_Test with a static IP of 192.168.0.200.
So I would add the IP to the production DNS with a name like OutlookAnywhere.
Then i would add the string OutlookAnywhere.macaw.com

Remember to adjust proxy settings in the Internet Options on every sandboxed VMs. To do that, open Internet Options > Connections > LAN Settings > Proxy server and specify proxy appliance IP address (on the isolated network), and port number.

So would the IP address be 192.168.0.200 or does it have a different one on the isolated network.

Also if I set up the last string for each proxy appliance?
It then says to restart the UI and create a new Virtual Lab but surely the new virtual lab wont use the same proxy details as the string I created.

I hope this makes sense.

Thanks
Alex

[foggy]

To start I'm guessing that the registry edits are to be made on the server where Backup and Replication is installed?

Correct.

I navigated to HKEY_LOCAL_MACHINE\SOFTWARE\VeeaM\Veeam Backup and Replication and found there was no SureBackup folder there so I created one.

Right.

(Im guessing it doesnt matter that the server is 64 bit Windows 2008 R2)

Correct, it does not matter.

In the SureBackup folder I created the VLabProxyEnable DWORD (they are not case sensitive are they?)

Correct, registry values are not case-sensitive.

I'm assume i do not need to enter this DWORD if I dont want to customise the proxy port?

Correct.

For this bit I'm guessing that i need to give the proxy appliace a static IP and then add a DNS entry on the production network?

Here is the confusion. You need to specify the production proxy server address here (if used in your environment). If proxy server is not required and servers in your network have direct Internet access, then you do not need to create this entry.

So would the IP address be 192.168.0.200 or does it have a different one on the isolated network.

You should specify proxy appliance IP address on the isolated network, which is typically the same as the IP address of a default gateway in the corresponding production network.

Also if I set up the last string for each proxy appliance?
It then says to restart the UI and create a new Virtual Lab but surely the new virtual lab wont use the same proxy details as the string I created.

After you restart Veeam B&R UI, these settings will be used by each proxy appliance configured within each new virtual lab you create.

Btw, in v7 these settings will be available in Veeam B&R GUI, so no need to trouble with the registry anymore.

[foggy]

allvLabProxyHTTPPort

Btw, registry values do not have "all" in front of their names. So there should be vlabProxyServer instead of allvlabProxyServer, etc.

[AlexD]

Thanks for the clarification.

Just double checking but the virtual labs i have already created cannot be connected to the internet. I will have to replace them all with new Virual Labs for them to connect?

[foggy]

Yes, new virtual labs should be created.

[AlexD]

Ok so my network doesnt use a proxy server so the only key i need to enter is the VLabProxyEnable DWORD?

Once i have done that I create a new virtual lab and then under the connection settings of the vNIC I set the Proxy Appliance IP to be the same as the production networks Default gateway?
Once the new Virtual Lab is created I log on to each of the virtual machines in the lab and enter the Default gateway/Proxy Appliance IP as the proxy server in LAN settings of the internet options?
Then they should connect to the internet?

sorry for asking so many questions. I just want to be absolutly certain I have done it correctly before I contact tech help.

[foggy]

Sounds correct. You always can ask our support team for assistance in setting this up. If you are not confident with the steps to perform, just contact them directly and they will guide you through the process.

[dragan.bodrozic]

I have no internet in my Lab (Veeam V8) from isolated VMs.

Lab have this settings:

Lab name:Virtual Lab
ESX name:ESXSERVER1
Datastore:Storage01-01-VOL1

Appliance:
Name:Virtual_Lab
Pool name:Virtual Lab
Folder name:Virtual Lab

Production network name:VM Network - Local 1GBs
IP: 192.168.151.221
Subnet mask: 255.255.254.0 (23)
Default gateway: 192.168.151.254

DNS:
Preferred: 192.168.151.235
Alternate: 192.168.151.249

Checked allow proxy appliance to act as a internet proxy for virtual machine in this lab
HTTP port 8080 Production proxy 192.168.151.254

Network configuration type: advanced single-host

Network options:
Isolated network: Virtual Lab DC Srv 2012R2 VM Network - Local 1GBs
Masquerade IP: 192.168.100.0
Appliance IP: 192.168.151.254
DHCP: disabled

Network mapping:
VM Network - Local 1GBs --> Virtual Lab DC Srv 2012R2 VM Network - Local 1GBs

From Virtual lab appliance (login as root) I can ping 8.8.8.8 and google.com (DNS works) I can ping any computer in production network but can't ping in isolated networks.

On isolated VMs: Internet Options > Connections > LAN Settings > Proxy server 192.1268.151.254 port 8080 checked bypass proxy
From isolated VM 192.168.151.235 I can ping proxy 192.168.151.254 and all isolated VM but can't ping google 8.8.8.8
My proxy is ISA server and there is no authentication for 192.168.151.221

Am I missed something in configuration?

[foggy]

Dragan, if everything looks configured correctly, I recommend contacting support to take a closer look at the virtual lab configuration.