NetScreen, NS-5GT

 TCP Syn-Check

http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_9-4/syn_flooding_attacks.html \\

○NetScreenでのTCPのsyn-checkの設定手順の詳細

１．Telnetでnetscreenにログオン。
（ユーザ、パスワードはWebコンソールのログオンで使用しているもの）

２．ログオン後、以下コマンドを入力しEnterを押下。
有効にする場合
set flow tcp-syn-check

無効にする場合(現在はこの状態です。)
unset flow tcp-syn-check

３．２を実行後、設定を保存するために以下コマンドを入力しEnterを押下。
save

以上でtcpのsyn‐checkの設定を有効、無効に設定できます。
※この設定はWebコンソールからでは設定できませんので、
　ご注意ください。

○NetScreen上のセッションテーブルの情報を確認する場合

以下コマンドを入力すると確認できます。
get session

NetScreen上のセッションテーブルの情報を削除する場合は、
以下コマンドを入力すると確認できます。
clear session
 

> ------------------------------------------------------
> 通常TCPのセッションはSYN->SYN-ACK->ACKというフローで生成されます。
> SYN Check機能が有効な場合は、このフローに則ってSYN始まりでない新
> 規セッションは不正なものとみなし破棄します。
> このため、SYNでないものを不正に送りつけるようなアタックやネットワ
> ーク構成上の問題等に対するセキュリティとして有効です。
>
> NetScreenに関していうと、古いバージョンではデフォルト無効となって
> ましたが、OS5.1よりデフォルト有効となりました。
> 但し、無効の状態からアップグレードした場合は既存の設定が引き継が
> れます。
>
> 現状、FWとしてはデフォルト有効な機器が多いかと思いますが、一般的
> なルータではデフォルト無効かと思います。
> ------------------------------------------------------
>

Juniperの技術情報
http://kb.juniper.net/index?page=content&id=KB4444&actp=LIST
 

明日からInterop Tokyo 2009のXen Technology 2009というブースで、仮想化関連技術・製品の展示や紹介をします。

特にCitrixの展示ブースでご覧になれるものは、仮想環境における下記のような技術です。

• アプリケーション仮想化: XenApp
• デスクトップ仮想化: XenDesktop
• サーバ仮想化: XenServer
• 電源管理
• 3D CADアプリケーション
• Flushの再生
• VoIPアプリケーション
• パフォーマンステスト
• パフォーマンス監視
• スマートカードを使用した認証

その他にも、弊社のパートナーから色々な技術・製品が展示されますので、時間があるかたはぜひともご来場いただければとおもいます。

また、ShowNetとよばれるInterop Tokyo 2009のNetworkで、NetScalerとXenDesktopが使用されています。NetScalerは、ServerのロードバランシングやIPv4からIPv6への変換などをおこなっています。また、Interop会場内に設置されたHPのシンクライアント端末からXenDesktopで配信されるDesktopに接続することができます。

Cloud Networking is secure and robust

You can create a complete end-to-end network from one cloud network, running on XenServer, through a VPN to another network in a different cloud. All servers and hosts communicate securely over SSL VPN. Amazon Machine Images are secured by the Amazon infrastructure using security groups.

The proof of concept speaks for itself. Between the Softlayer cloud and the Amazon EC2 cloud is running a site-to-site SSL VPN using Vyatta. All of the images in this architecture are running on XenServer. This proof of concept gives rise to many networking architectures for cloud computing.

The reason for using Vyatta site-to-site SSL VPN between the Softlayer and Amazon EC2 clouds is there needs to be a secure network between the two for the transfer of data. The Vyatta AMI (Amazon Machine Image) can also function as a complete router, firewall and DNS cache. The Vyatta SSL VPN router provides security with scalability. Suppose I wanted to separate the Vyatta SSL VPN from a Vyatta OSPF router, I would just launch another instance of the Vyatta AMI.

As you can see from the network diagram and video, complete routing from the Softlayer cloud to the Amazon cloud network is seamless, without having to buy any proprietary hardware. In fact, it is very low cost compared to traditional network solutions. Virtualized networking is here, it is fast, secure and cheap.

A CloudBurst happens when Citrix Workflow Studio determines that one of the devices in the Softlayer Cloud has reached a high watermark. WFS then instructs the NetScaler VPX to start sending traffic to the Cloud - CloudBurst.

To get your own cloud, go here

Configurations used

Vyatta SSL VPN (V1) - Datacenter Configuration
Vyatta SSL VPN (V2) - Cloud Configuration
XenApp VPN Client - Cloud Configuration

Links for this solution

Vyatta for XenServer - go here
Amazon EC2 - go here
XenServer is Free! - go here
XenApp - go here
Workflow Studio - go here
XenApp VPN Client - go here
Dell Server - go here
IP Addresses - go here

Watch This

Read more news like this.

Its powerful AppExpert!

Cloud Networking is fast

You can create a complete end-to-end network from the datacenter to the cloud. All cloud servers communicate securely over SSL VPN.

Between the datacenter and the Amazon EC2 cloud is a site-to-site SSL VPN built with Vyatta. On the XenApp server in the cloud runs the Citrix Accelerator which connects back to the Citrix Branch Repeater/WANScaler at the datacenter, to accelerate data connections. The Citrix Accelerator makes cloud computing fast, Vyatta makes it secure.

The reason for using Vyatta site-to-site SSL VPN between the datacenter and Amazon EC2 cloud is there needs to be a secure network between the two for the transfer of data. The Vyatta AMI (Amazon Machine Image) can also function as a complete router and firewall. The Vyatta SSL VPN router provides security with scalability.

As you can see from the network diagram and video, complete routing from the datacenter to the Amazon cloud network is seamless. Data resides at the datacenter and is accessed, over the SSL VPN, by the Application running in XenApp. The remote user connects to XenApp, runs the application, and the application delivers the data to the remote user, quickly and securely.

To get your own cloud, go here.

Configurations used

Vyatta SSL VPN (V1) - Datacenter Configuration
Vyatta SSL VPN (V2) - Cloud Configuration
Windows VPN Client - Cloud Configuration

Links for this solution

Vyatta - go here
Amazon EC2 - go here
XenServer is Free! - go here
XenApp - go here
XenApp VPN Client - go here
Dell Server - go here
IP Addresses - go here

Watch This

Read more news like this.

Its powerful AppExpert!

VMware has released a series of KB articles outlining the requirements and best practices for installing vSphere, upgrading to vSphere, and upgrading ESX 3.0 virtual machines to ESX 4.0 hardware.  (Quoting them.)

So I'm guessing this should simplify the process, right? I know there were a few bumps in the update process for XenServer 5.0 Update 3 until we fleshed out the directions to be explicit about HA. Surely they've learned from this, and simplified their update process.

So let's see how they've focused on ease-of-use...

 4. If a SAN is connected to the ESX Server, detach the fiber before continuing with the upgrade.

 Walking from machine to machine in your data center pulling fiber connections, and reconnecting them after the upgrade?  Now that's automation.  That's ease-of-use.

How-toや一般的な情報などから、徐々に日本語文書の作成を始めています。 

http://support.citrix.com/product/xens/v5.0/technote/?lang=ja&sortBy=CREATIONDATE

まだまだ数は少ないですが、ご参照ご活用ください。

Knowledge Center Japan

Microsoft, Intel & Citrix: Dynamics of Enterprise Virtualization

An interactive discussion led by Doug Brown

--------------------------------------------------------------------------------------

Attend this lively discussion with virtualization experts David Greschler, Iddo Kadim & Simon Crosby on the dynamics of enterprise virtualization. Register here.

You can register here. I hope to see you and the Citrix Angels there.

Follow me on Twitter.

If there are other Citrix accounts or Citrix employees you follow on Twitter, please post them in the comments.

In continuation of our virtualization performance tests with large enterprise application platforms running on XenServer, we recently completed an extensive series of performance and scalability tests with Microsoft SQL Server 2008 on XenServer 5. In the past, we successfully demonstrated the enormous server consolidation and management benefits of virtualizing Citrix XenApp 4.5 and 5.0 as well as Microsoft Exchange 2007 using XenServer. Test results for these can be found on the white paper section of XenServer/Essentials at Citrix.com:  http://citrix.com/English/ps2/products/documents_onecat.asp?contentid=683148&cid=White+Papers.

The results of tests for SQL Server 2008 on XenServer were equally as impressive.

Testing was done with readily-available load test programs, DBHammer for SQL and SQLIO, using three hardware configurations we described simply as small, medium and large. We compared results of XenServer with that of native, physical SQL servers running anywhere from one to eight instances of SQL Server 2008, all on single servers. Multiple instance SQL servers were compared to virtual host servers running an equal number of SQL Server VMs. Finally, we did comparison tests using the latest available release (as of Q1 2009) of another virtualization platform provider, described as Vendor X. The following is a highlight of the results: 

Small Configuration:

• When comparing a single instance native server with a single XenServer VM, XenServer's virtualization overhead was less than 8%. By comparison, overhead for Vendor X was 36%.
• In the two instance native vs. two VM tests, XenServer out-performed both the native server and Vendor X by a considerable margin.

Medium configuration:

• XenServer continued to virtualize with less than 8% overhead in the single instance/single VM test and outperformed both the native server and Vendor X in the two and four instance/VM tests.
• Note: Vendor X did not participate in the single instance/single VM test due to published maximum VM size limitations.
  

 
Large configuration:

• Native servers outperformed XenServer in the two instance/VM test, however XenServer outperformed native servers in the four and eight instance/VM tests.
• Vendor X outperformed XenServer in the four instance/VM test, the only test in the entire SQL Server 2008 test series where they did so. However, Vendor X performance degraded considerably once the number of VMs doubled from four to eight, while XenServer's performance actually improved.     
• Note: XenServer did not participate in the single instance/single VM test due to published maximum VM size limits. Vendor X did not participate in both the single and two instance/VM tests due to published maximum VM size limits.

Once again, XenServer continues to demonstrate the ability to virtualize the most demanding of enterprise application platforms with relative ease. The key benefit of using XenServer virtualization with Microsoft SQL Server lies in the low virtualization overhead, making XenServer an effective server management tool in SQL Server 2008 farms running primarily single instance servers. However, the benefits of virtualization and the strength of XenServer specifically are most pronounced with multiple instances of SQL Server. Multiple XenServer VMs are increasingly more productive than physical SQL servers as the number of instances increase. 

The results for all tests in the project along with a detailed description of the tools and methodologies can be found at: http://citrix.com/%2Fsite%2Fresources%2Fdynamic%2Fsalesdocs%2FSQL_Server2008_XS5_WP.pdf

During Citrix Synergy 2009 last week in Las Vegas I was part of the team which delivered the Learning Labs on XenServer. Besides presenting on XenServer 5.5 (more on that here: [\~joels:/2009/05/21/Citrix XenServer 5.5 and Workload Balancing Video]) I also did a learning lab on Testing XenApp on XenServer and/or a different virtualization platform.

With EdgeSight for Load Testing (ESLT) now included in XenApp, it's really straightforward for partners and customers to do their own testing/bake-off and find out that XenApp is an excellent workload to virtualize on XenServer.

To make it even easier to do this, my colleague Adam Lotz created the XenApp Server Virtualization Test Toolkit, which includes:

• Documentation for setting up a test environment
• Microsoft Office Transform file
• ESLT scripts, including the one we used for our internal testing
• Tolly Group report with the results of the XenApp on XenServer 5.0 vs. VMware ESX 3.5 testing

The Toolkit can be downloaded on the XenServer Resource Kit page here.

On the Resource Kit page you can also find the Web-Based Console for XenServer, which I blogged about [here] as well as the latest version of the XenServer v2xva Conversion Utility. With the upcoming release of XenConvert 2.0 (released together with XenServer 5.5) the v2xva will become obsolete, since that functionality will be included.

We will be starting another round of testing XenApp soon (on new releases) and will update the toolkit if necesarry.

Happy testing!

Joel

With the release of XenServer 5.5 just around the corner, it is time for video demonstrations of some of the new features. In the video below you will see demo's of the following new features:
- Active Directory Authentication
- Enhanced Storage Features
- XenCenter Enhancements

Which will all be available in the free version of XenServer.

Also included in the video is a demonstration of Workload Balancing, which will be part of Citrix Essentials for XenServer Enterprise and Platinum. The demo includes:
- Workload Balancing Installation
- Workload Balancing Congfiguration
- Using Workload Balancing
- Workload Balancing Reporting

The running time of the whole video is approximately 23 minutes.

Other components of Essentials for XenServer are:
- Lab- and Stage Management
- Provisioning Services
- StorageLink Technology
- Workflow Orchestration

Demo's for these features can be found on the Citrix blog as well as on youtube:

http://www.youtube.com/citrixdemo

http://community.citrix.com/blogs/citrite/petersc/2009/02/20/Video+Tutorials+Posted

(Workflow Studio)

Enjoy!

Joel

Gosh, it's three and a half years since Xen 3.0 first shipped.  Time flies when you're having fun.  Xen.org has announced the availability of Xen 3.4, which offers the community the results of a couple of major evolutions of the Xen code base and its community, as it has become a major player in the industry (I've seen IDC and Yankee surveys that validate that Xen is used for ~20% of virtualized server sockets today, with an accuracy of +- 3%.  It's going to be an exciting year...  Anyway, back to Xen 3.4.  Here are some major categories:

-          Xen Client Initiative (XCI) - Xen 3.4 contains a first release of the Xen client hypervisor to offer the community a compact client hypervisor with tons of features for testing and further development.  For the first time the Xen project is moving away from providing simply the hypervisor, and leaving it to vendors/users/developers to build their own system.  This release contains the whole enchilada, including Dom0, the management tool stack and Xen.  In other words, everything you need to be up and running with a Xen client system.

-          Reliability - Availability - Serviceability (RAS) - From a server-side perspective, Xen 3.4 has a raft of new  features to avoid and detect system failures, provide maximum uptime by isolating system faults, and provide system failure notices to administrators to properly service the hardware/software. The combinations of these services provide for a robust Xen hypervisor with fault-tolerant and back-up capabilities built-in.

-          Power Management - Xen 3.4 substantially improves the power saving features with a host of new algorithms to better manage the processor including schedulers and timers optimized for peak power savings.  Many of these changes are applicable to both client and server machines, but for example one of the features that I like on the client side scheduler is an ability to synchronize clock ticks to VMs for which the timer frequency is known, to maximize  CPU idle time and maximally utilize CPU awake time.  This is good for battery life on client systems where in general users are up for disappointment when they realize that more VMs (read: more security/flexibility) can easily translate into worse battery life.  This is the key reason that I decided to ditch a type-2 client side product recently, because my Mac battery wouldn't make it through a flight.

You can find the bits at the Xen.org website at: http://www.xen.org/download

Xen.org is pleased to announce the latest release of the Xen hypervisor, the open source industry standard for virtualization. Xen.org is a global community of independent and industry developers, university researchers, users, and virtualization gurus who regularly contribute to the shared design, development, support, and improvement of the Xen hypervisor platform.

The new release, Xen 3.4, furthers the vision of creating a powerful, efficient, and ubiquitous virtualization hypervisor. As part of the Xen community's commitment to continuous improvement, the new hypervisor offers significant enhancements in the following areas:

•    Xen Client Initiative (XCI) Enhancements-Xen.org continues develop industry virtualization standards for desktop and client devices. Xen 3.4 contains the initial XCI code release providing a base client hypervisor for the community to extend and improve. This new version of the Xen hypervisor expands the hardware options for the leading open source virtualization platform.

•    Reliability - Availability - Serviceability (RAS)- In addition, Xen now delivers a collection of features designed to avoid and detect system failures, provide maximum uptime by isolating system faults, and provide system failure notices to administrators to properly service the hardware/software. The combination of these services provide for a robust Xen hypervisor with fault-tolerant and back-up capabilities built-in.

•    Power Management - Xen 3.4 improves the power saving features with a host of new algorithms to better manage the processor including schedulers and timers optimized for peak power savings.

Xen 3.4 is currently available via free download to developers by visiting the Xen.org website at: http://www.xen.org/download

Momentum in the Xen Community

The Xen community remains strong and active.  On average, Xen.org receives more than 750 new code submissions to the source tree each month from developers across the world working on an array of solutions within the hypervisor. Industry leading companies such as Intel, AMD, HP, IBM, Oracle, Red Hat, Sun, Fujitsu, and Novell are part of the vibrant Xen.org community and contribute to the development of the hypervisor code. The Yankee Group's Third Annual Virtualization Survey reports a significant increase of commercial Xen-based solutions which represent 17 percent of total market share. This includes a Citrix XenServer share of 11 percent, plus an additional six percent from other open source suppliers.

On an ongoing basis, university research and other high profile Xen projects   are regularly incorporated or run on the hypervisor. For example, Project Snowflock from the University of Toronto leverages the Xen hypervisor to instantaneously launch thousands of virtual machines for fast, efficient, scalable parallel processing and Project HXen extends the Type1 virtual machine monitor (VMM) functionality in Xen to a Type 2 VMM for a simplified method of deploying Xen to desktops, laptops, USB sticks and other devices where the base OS is left in place. For high availability, Project Kemari  and Project Remus provide transparent, comprehensive, high availability to ordinary virtual machines running on the Xen virtual machine monitor by maintaining a completely up-to-date copy of a running VM on a backup server, which automatically activates if the primary server fails. These are examples of the various contributions across academia and within the development community to Xen.org.

To date, thousands of companies and universities have chosen the power of open source Xen, making the Xen hypervisor their choice to provide virtualization in their IT environment. Last month, more than 100 attendees from the open source community participated in the Xen Summit sponsored by Oracle; similar events are planned in Europe and Asia this year to support the growing global community.

In addition, the Xen.org community is committed to providing more resources to its members:

•    Xen.org Solutions Searchis a new online tool enabling customers to quickly find consultants, hosting providers, developers, and solutions built on the Xen hypervisor platform. This search system profiles the growing ecosystem for the Xen hypervisor.

•    Xen.org is committing resources to expand the global footprint for support and promotion of the open source Xen hypervisor. Materials are being translated into Spanish, German, Portuguese, Chinese, and Japanese with the community Wiki now available in English, Spanish, French, Russian, German, Chinese, Korean Japanese, and Italian. Support groups for customers are also available in English, Portuguese, Japanese, and Italian.

•    Finally, Xen.org is excited to offer an event for virtualization customers and prospects in Europe called Xen Directions,being held in conjunction with LinuxTAG on June 27, 2009 in Berlin, Germany.  A variety of hands-on Xen demonstrations will be offered to the European technical audience for the first time. In 2010, Xen.org will be hosting the first event in South America as part of the FISL event in Brazil.

In the early days of virtualization most developers and IT Pro's would not trust deploying production workloads in Virtual Machines. However, as soon as it was apparent how easy it was to test apps and configurations plus prototype new environments prior to production, virtualization became a defacto standard for test and dev environments. Over time virtualization improved in performance, robustness and management to the point where IT is now comfortable deploying a significant portion of production workloads on Virtualized platforms.

Move the clock forward to today and Cloud based Infrastructure as a Service ( IaaS ). Most companies are not ready to deploy their production environments to the Cloud, however every company spends a significant amount of time and resources for testing , evaluation and PoC's prior to deployment in production on premise or at a Colo. It turns out that IaaS is a great platform for test, dev and evaluations even if it may be early for enterprise production environments. Zero capital, rapid deployment, temporary workloads and elastic capacity are all attributes of IaaS that map directly to test and dev environments.

Citrix has now established the Citrix C3 Lab with Amazon Web Services to enable; PoC's, evaluations, demonstrations, testing, training and more. Pre-built Virtual Appliances available as AMI ( Amazon Machine Image ) templates are now available for XenApp, Citrix Secure Gateway and Access Gateway. In addition we are providing C3 ( Citrix Cloud Center ) Blueprints and a community site dedicated to provide " How to " descriptions, configuration guides, videos and forums to support the Lab. The time to build XenApp environments  can literally change from days to hours or even minutes utilizing C3 Labs. The expense of buying test servers for every new test or evaluation is changed from $ thousands up front to as low as 12.5 cents per hour. The time for racking, cabling and powering is  gone. The time to install Windows OS, then patches, then XenApp, then configure, then redo ( because you didn't read the manual ) is eliminated. You can literally be up and running in a little as 15 minutes. More complex environments can also be built with multiple AMI's networked together in almost unlimited configurations.

Going forward expect to see more C3 Blueprints, more Citrix products in AMI templates, and more suggested solutions to evaluate. We may also utilize the lab for tech previews or hosting research projects to gain customer insight and feedback. Stay tuned for more and give us some suggestions.

Saving significant time and money for test and dev just may be a leading indicator for how Clouds aew adopted into IT production environments later.

Citrix XenDesktop is a finalist in the Virtualization category for the "Best of TechEd" award from Windows ITPro magazine.

If you are attending TechED 2009 in Los Angeles, please vote for XenDesktop as the "Best of TechED" at this link -

http://windowsitpro.com/awards/teched_finalists_2009.html

(you must be logged into to MSTechEd.com and attending the event to vote).

Follow the Twitter feed for "Best of TechEd 2009" here.

Follow the official TechEd 2009 Twitter feed here

Everyone who was at Snyergy last week wanted the link to how to do snapshots in XenServer. Here is the link to Shannon's PowerShell snap-in:

http://shannon.neutex.net/2008/11/06/hot-off-the-compiler-powershell-snapin-for-xenserver-snapshots/

I will also post a 'how-to' guide on how to convert this to an activity library.

I've been getting a number of questions from the field on whether StorageLink provides the capabilities of VMware RDM for XenServer and Hyper-V. A little detail is warranted, mainly because the answer is a bit different for XenServer and Hyper-V.

XenServer: The LUN per virtual disk model in effect provides the capabilities of raw device mapping. Prior to XenServer 5.5, customers got their LUN per virtual disk via the custom storage adapters for Netapp and Equallogic. XenServer 5.5 expands this to a larger set of storage arrays, and thats where the latest evolution of StorageLink comes in. StorageLink allows a user to assign/map a set of LUNs, and expose them as raw devices to your VM, in effect, the capability that RDM provides. This applies to existing and formatted LUNs too.

(The caveat here is that the same LUN cannot be attached to two VMs at the same time. This means that this virtual disk cannot be used as a quorum disk in an MSCS cluster of Windows VMs. But then again, Windows 2008 Failover Clustering has Node Majority, and a quorum device is no longer needed)

Hyper-V: StorageLink allows you to assign/map a set of LUNs (existing or new) and expose them as pass-through devices to Hyper-V. No caveats. These LUNs can be shared between VMs. Same as RDM.

One point worth mentioning is that StorageLink does not come in the data path. Once storage volumes are set up and mapped to virtual machines, IO is done using the existing hypervisor mechanism.

皆様はCitrixの製品マニュアルをどう管理されているでしょうか？
私は非常に雑な正確なためいつもwebでhttp://support.citrix.comにアクセスし検索しています。。。
整理整頓ができる方なら、マニュアル類を一定のフォルダにためておいてすぐに参照できるようにされているかと思います。
また、全てのマニュアルをパイプ式のバインダで印刷し重要な部分にマーカーやポストイットでわかりやすい様にマークしたりされているお客様が多く、目からうろこがおちるような思いをしました。見習わなくてはいけないと思っていたこんな私のような方に朗報です！Citrix eDocsが公開されました。

http://support.citrix.com/proddocs/index.jsp?lang=ja

シングルインターフェイスで様々なマニュアルが参照できます。Citrix eDocsのURLのHomeのURLさえお気に入りに登録しておけば、ネットワークに接続している環境であれば、簡単にどのマニュアルにもアクセスできますし、全てのマニュアルを同時に検索することもできますので、大幅に作業効率がアップします。是非お使いください！！また、フィードバックを随時受付していますので下記のサイトからどんどん色々なフィードバックを送っていただければとおもいます。

http://www.surveymonkey.com/s.aspx?sm=OdJNqlUYpLiT_2bYmeV6U7gQ_3d_3d

eDocsホーム


eDocsのXenAppを展開したところ（様々なマニュアルが参照できます）

Ian Pratt recently was on stage during the keynote sessions at Citrix Synergy showing the current implementation of the Type 1 Xen client hypervisor running on a PC and Mac. He did the demonstrations with Patrick Gelsinger from Intel.

The complete 45 minute Intel presentation is at http://www.citrix.com/tv/#video/423.

To see Ian demonstrate the Windows Xen client go to 27 minutes 30 seconds. To see Ian demonstrate the Mac Xen client go to 42 minutes as Mark Templeton joins the stage.

For more information on the Xen Client Inititiave in the Xen.org open source community, go to http://wiki.xensource.com/xenwiki/General_Project_Information. The complete source code of the current XCI is at http://xenbits.xen.org/xenclient. If you have any questions on the open source Xen.org community, please let me know at stephen.spector@xen.org.