An SSL VPN (Secure Sockets Layer virtual private network) is a form of VPN that can be used with a standard Web browser. In contrast to the traditional Internet Protocol Security (IPsec) VPN, an SSL VPN does not require the installation of specialised client software on the end user’s computer. -www.bitpipe.com
Not all customers want to setup site-to-site VPNs using IPSEC or Route-based VPNs between their on-premises data centre to an SDDC on VMware Cloud on AWS. Using a client VPN such as an SSL VPN to enable a client-side device to setup an SSL VPN tunnel to the SDDC.
This article goes through the requirements and steps needed to get OpenVPN up and running. Of course, you can use any SSL VPN software, OpenVPN is a freely available open source alternative that is quick and easy to setup and is used in this article as a working example.
Review the following basic requirements before proceeding:
In this section you’ll deploy the OpenVPN appliance. The steps can be summarised below:
Make a note of the IP address of the appliance, you’ll need this to NAT a public IP to this internal IP using the HTTPS service later. My appliance is using an IP of 192.168.1.201.
In this section you’ll need to create a number of firewall rules as summarised in the tables further below.
Here’s a quick diagram to show how the components relate.
|Rule #||Rule name||Source||Destination||Services||Action|
|1||Allow the OpenVPN appliance to access vCenter only on port 443||OpenVPN appliance||vCenter||HTTPS||Allow|
The rule should look similar to the following.
|Rule #||Rule name||Source||Destination||Services||Action|
|2||Allow port 443 access to the OpenVPN appliance||Any||OpenVPN appliance||HTTPS||Allow|
|3||Allow the OpenVPN-network outbound access to any destination||OpenVPN-network||Any||Any||Allow|
The two rules should look similar to the following.
I won’t go into detail on how to create these rules. However, you will need to create a few User Defined Groups for some of the Source and Destination objects.
|Rule name||Public IP||Service||Public Ports||Internal IP||Internal Ports|
|NAT HTTPS Public IP to OpenVPN appliance||18.104.22.168||HTTPS||443||192.168.1.201||443|
You’ll need to request a new Public IP before configuring the NAT rule.
The NAT rule should look similar to the following.
We need to configure OpenVPN before it will accept SSL VPN connections. Ensure you’ve gone through the initial configuration detailed in this document
If you don’t know the Infrastructure Subnet you can obtain it by going to Network & Security > Overview
The desktop client is only required if you do not want to use the web browser to initiate the SSL VPN. Unfortunately, we need signed certificates configured on OpenVPN to use the browser. I don’t have any for this example, so we will use the desktop client to connect instead.
For this section I will use my laptop to connect to the VPN.
Now that the SSL VPN client is installed we can open an SSL VPN tunnel.
Open up a HTTPS browser session and use the internal IP address of vCenter. You may need to add a hosts file entry for the public FQDN for vCenter to redirect to the internal IP instead. That’s it! You’re now accessing vCenter over an SSL VPN.
It’s also possible to use this method to connect to other network segments. Just follow the procedures above to add additional network segments and rules in the Compute Gateway and also add additional subnets to the Access Control section when adding/editing users to OpenVPN.
Learn more with these resources:
This article details all of my and Atlantis’ activities at VMworld US. Read more to get an introduction of what we will be doing and announcing and a sneak peek at our upcoming technology roadmap that solves some of the major business issues concerning performance, capacity and availability today. It is indeed going to be a VMworld with ‘no limits’ and one of the great innovations that we will be announcing is Teleport. More on this later!
I’ll be at in San Francisco from Saturday 23rd August until Thursday 28th August where I’ll be representing the USX team and looking after the Hands on Labs, running live demos and having expert one on ones at the booth. Come and visit to learn more about USX and how I can help you get more performance and capacity out of your VMware and storage infrastructure. I’d love to hear from you.
Atlantis is a Gold sponsor this year with Hands on Labs, a booth and multiple speaking sessions. Read on to find out what we’ll be announcing and where you can find my colleagues and me.
I’ll mostly be located at booth 1529, you can find me and my colleagues next to the main VMware booth, just head straight up pass the HP, EMC, NetApp and Dell stands and come speak to me on how USX can help you claim more performance and capacity from these great enterprise storage arrays.
Speak to me about USX data services and I’ll show you some great live demos on how you can reclaim up to 5 times your storage capacity and gain 10 times more performance out of your VMware environment.
Here’s one showing USX as storage for vCloud Director in a Service Provider context and also for Horizon View.
If that’s not enough then come and speak to me about some of these great innovations:
We have three breakout sessions this year, two of them with our customers UHL and Northim Bank where Dave Rose and Erick Stoeckle respectively will take you through how they use USX in production.
The other breakout session is focused on VVols, VASA, VSAN and USX Data Services and will be delivered by our CTO and Founder Chetan Venkakesh (@chetan_). If you have not had the pleasure to hear Chetan speak before, then please don’t miss this opportunity. The guy is insane and uses just one slide with one picture to explain everything to you. He is a great storyteller and you shouldn’t miss it – even if it’s just for the F bombs that he likes to drop.
Chetan will also do a repeat 20-minute condensed session in the Solutions Exchange for a brain dump of Atlantis USX Data Services. Don’t miss this! Chetan will take you through the great new technology in the Atlantis kitbag.
|STP3212 – Unleashing the Awesomeness of the SDDC with Atlantis USX||Chetan Venkatesh – Founder and CTO, Atlantis Computing||Tuesday, Aug 26, 11:20 AM – 11:40 AM||Solutions Exchange Theater Booth 1901|
|INF2951-SPO – Unleashing SDDC Awesomeness with Atlantis USX: Building a Storage Infrastructure for Tier 1 VMs with vVOLS, VASA, VSAN and Atlantis USX Data Services||Chetan Venkatesh – Founder and CTO, Atlantis Computing||Wednesday, Aug 27, 12:30 PM – 1:30 PM||Somewhere in the Moscone (TBC)|
|EUC2654 – UK Hospital Switches From Citrix XenApp to VMware Horizon Saving £2.5 Million and Improving Patient Care||Dave Rose – Head of Design authority, UHL
Seth Knox – VP Products, Atlantis Computing
|Wednesday, Aug 27, 1:00 PM – 2:00 PM||Somewhere in the Moscone (TBC)|
|STO2767 – Northrim Bank and USX||Erick Stoeckle , Northrim Bank
Nishi Das – Director of Product Management, ILIO USX, Atlantis Computing Inc.
|Thursday, Aug 28, 1:30 PM – 2:30 PM||Somewhere in the Moscone (TBC)|
You can find the hands on labs in the Hands on Labs hall, I’ll also be here to support you if you’re taking this lab. The Atlantis USX HOL is titled:
This HOL consists of three modules, each of which can be taken separately or one after the other.
Modules 1 and 2 are read and click modules where you will follow the instructions in the lab guide and create the USX constructs using the Atlantis USX GUI.
Module 3 however uses the Atlantis USX API browser to quickly perform the steps in Module 1 with some JSON code.
All three modules will take you approximately an hour and a half to complete.
I had an interesting time writing this lab which was a balancing exercise in working with the limited resources assigned to my Org VDC. Please provide feedback on this lab if you can, it’ll help with future versions of this HOL. Just tweet me at @hugophan. Thanks!
Note that performance will be an issue because we are using the VMworld Hands on Labs hosted on Project NEE/OneCloud. This is a vCloud Director cloud in which the ESXi servers that you will see in vCenter are actually all virtual machines. Any VMs that you run on these ESXi servers will themselves be what we call nested VMs. In some cases you could actually see 2 more or nested levels. How’s that for inception? Just be aware that the labs are for a GUI, concept and usability feel and not for performance.
If you want to see performance, come to our booth!
|Atlantis USX – Deploying together with VMware VSAN to deliver optimized local storage|
|Using Atlantis USX, IT organizations can pool VSANs with existing shared storage, while optimizing it with Atlantis USX In-Memory storage technology to boost performance, reduce storage capacity and provide storage services such as high availability, fast cloning and unified management across all datacenter storage hardware.The student will be taken through how to build a Hybrid virtual volume that optimizes VMware VSAN allowing it to delver high performing virtual workloads from local storage.
|A customer has built a resilient datastore from local storage using VSAN. This is then pooled by Atlantis USX to provide the Deduplication and I/O optimization that server workloads require. A joint whitepaper of this solution has already been written here:http://blog.atlantiscomputing.com/2014/02/atlantis-ilio-usx-and-vmware-vsan-join-forces-on-software-defined-storage/
Estimated module duration: 45 minutes
|Atlantis USX – Build In Memory Storage|
|With Atlantis USX In-Memory storage optimization, processing computationally extensive analytics becomes easier and more cost effective allowing for an increased amount of data being processed per node and reduced the time to complete these IO intensive jobs, workloads may include Hadoop, Splunk, MongoDB.During this lab the student will be taken through how to build an Atlantis USX virtual volume using local server memory.
|The use case for this lab is increasing application performance by taking advantage of the storage optimization features in Atlantis USX.Estimated module duration: 30 minutes|
|Atlantis USX – Using the RESTful API to drive automation and orchestration to scale a software-based storage infrastructure|
|Atlantis USX has a powerful set of RESTful APIs. This module will give you insight into those APIs by using them to build out a Virtual Volume. In this module you will:
|The intent of this lab is to provide an example of how to use the Atlantis USX RESTful API to deploy USX at scale.Estimated module duration: 15 minutes|
That’s right! I’ll be giving some of these away at the booth, make sure you stop by to see the new reality in software defined storage!
You can also pick up some of the usual freebies like T-shirts, pens, notepads etc.
There are also Google Glasses, Chromecasts, quad copters and others. We’re also working on something special. Watch this space.
Come and speak to me and my colleagues to learn how USX works. We will be running live demos of the following subjects:
SF Giants Game, Mon, Aug 25th at 19:00. Please contact your Atlantis Representative or ping me a note if you haven’t received an invite.
USX Partner Training & Breakfast, Wed, Aug 27th at 08:00. Please contact your Atlantis Representative or ping me a note if you’re an Atlantis Partner but have not received an invite.
If you’re at VMworld or in the SF Bay area then let’s meet up and expand our networks.
|Event Date||Hours||Event Name||Where||Register|
|Sat, Aug 23rd||19:00 – 22:00||VMworld Community Kickoff||Johnny Foley’s, 243 O’Farrell Street||http://twtup.com/6878fiv3e9fjrqz|
|Sun, Aug 24th||13:00 – 16:00||#Opening Acts||City View at Metreon||https://openingacts2014.eventbrite.com/?ref=wplist|
|Sun, Aug 24th||15:00 – 17:00||#v0dgeball Charity Tournament||SOMA Rec Center – Corner of Folsom and 6th Streets||http://tweetvite.com/event/v0dgeball2|
|Sun, Aug 24th||16:00 – 19:00||VMworld Welcome Reception||Solutions Exchange, Moscone Center||n/a|
|Sun, Aug 24th||20:00 – 23:00||#VMunderground||City View at Metreon||https://vmunderground.eventbrite.com/?ref=wplist|
|Mon, Aug 25th||19:00 – 23:00||#vFlipCup VMworld Community TweetUp||Folsom Street Foundry||http://twtvite.com/vflipcup14|
|Tues, Aug 26th||16:30 – 18:00||Hall Crawl||Solutions Exchange, Moscone Center||n/a|
|Tues, Aug 26th||19:00 – 22:00||#VCDX, #vExpert Party||E&O Restaurant & Lounge, 314 Sutter St||Invite only|
|Tues, Aug 26th||20:00 – 23:00||#vBacon||Ferry Building, 1 Sausalito||http://tweetvite.com/event/vBacon2014|
|Wed, Aug 27th||17:00 – 19:00||VMware vCHS Tweetup||111 Minna|
|Wed, Aug 27th||19:00 – 22:00||VMworld Party||Moscone Center||n/a|
Follow me and my colleagues on Twitter for live updates during VMworld and send us messages and questions, we’d love to hear from you.
Hugo Phan @hugophan
Chetan Venkakesh @chetan_
Seth Knox @seth_knox
Mark Nijmeijer @MarkNijmeijerCA
Gregg Holzrichter @gholzrichter
Toby Colleridge @tobyjcol
Sometimes an opportunity comes along that is just too damn exciting to pass.
This is a short post on my latest move to Atlantis Computing from Canopy Cloud. My new role is primarily with the USX team to help drive the adoption of USX into large Enterprises and Service Providers. USX is Atlantis Computing’s newest technology which does for server workloads what ILIO did for EUC. Quite simply my job is to make USX a success. I’ll be helping the virtualization community understand Atlantis Computing’s USX and ILIO technologies, working with customers and partners and also with our technology partners, such as VMware, NetApp, VCE, Fusion-IO and IBM. Even though USX is new, the technology is based on ILIO which has been shipping since 2009 and is powering the largest VDI deployments in the world.
Today was officially my first day and it was a pretty interesting one. It started with a customer meeting with a large bank in London and then to BriForum, both in a listening capacity but I couldn’t help myself and ended up talking about both ILIO and USX to some techies at the bank and then some people that came to the stand at BriForum. There is definitely hot interest with using RAM to accelerate storage in both EUC and server workloads.
Atlantis Computing’s ILIO and USX technologies are truly software defined and in simple terms enables the in-line optimisation of both IOPS and capacity BEFORE the IOPS and blocks hits the underlying storage. For example the blue graph represents IOPS to the storage array for 200 VDI VMs without ILIO, the red graph represents IOPS to the same storage array with ILIO, a saving of 80%.
In addition because storage is deduped in-line, there is also massive capacity savings on the underlying storage too. Dedupe occurs in-line, there is no requirement for dedupe to blocks written to disk as data is deduped before being written to disk, hence no overhead caused by a dedupe job on the storage processor or spindles.
In-line de-duplication is not the only capability within the Atlantis Computing technology, some of the others are:
I won’t go into each one in this post, I’ll save that for another day. I’m very excited with my new role at a new company and hope to blog a lot more often as I learn more about Atlantis Computing and of course storage virtualization and optimisation in general.
If you want to read more, some of these resources help explain the tech. Oh and we offer a completely free ILIO license for use in POCs/Lab environments, be sure to check it out!