Windows DNS Zone transfer's not working (non-AD)

My Scenario is this, NS1 (primary zones) is in Colo #1 in Portland, NS2 (secondary zones) is in Colo #2 in Colorado.  I host a variety of zone files, some big, some small for different groups, all internet facing, none of these are AD integrated zones..  I had to re-ip NS2 due to an ISP acquisition.  After changing the IP's and updating the records, 2/3 of the domains work great, but 1/3 are giving 2003 Event ID 6523 "Zone xyz.com failed zone refresh check.  Unable to connect to master DNS server at x.x.x.x to receive zone transfer.  Check that the zone contains correct IP address for the master server or if network failure has occurred.

For the most part the zone files that were working were small, and the ones that were not were larger, however that wasn't always true.  Doing an nslookup from NS2's console to NS1, doing a ls xyz.com was also not working as expected.

I noticed that in the logs outbound from NS2 that UDP DNS requests were working, but TCP DNS requests were failing.  I had the firewall of NS1 opened to both TCP and UDP, and now everything is syncing just fine.

HINT: I also learned using a test address in a DNS zone with the IP of 0.0.0.0 makes Windows DNS think the zone file is invalid, so don't use that as a lazy address for testing.

How to make vCloud keytool Self Signed Certificates that last more than the default of 120 days

For my testing lab, I get tired of replacing the SSL self signed cert every 4 months, this should make it last for 9999 days, or 27 years.  It also assumes you installed Java jre version 1.6.0_29 .  Obviously you may need to modify this to fit your environment, using a self signed cert is bad for security, plus as I’m doing below using the same cert for both http and consoleproxy is also bad for security.  And using a password of password isn’t something I do even in my lab.

Step 1: Create New Certs

./usr/java/jre1.6.0_29/bin/keytool –keystore /opt/vmware/certificates.ks -storetype JCEKS -storepass password -validity 9999 -genkey -keyalg RSA -alias http

./usr/java/jre1.6.0_29/bin/keytool -keystore /opt/vmware/certificates.ks -storetype JCEKS -storepass password -validity 9999 -genkey -keyalg RSA -alias consoleproxy

Step 2: Stop vCloud Service

service vmware-vcd stop

Step 3: Go through configure wizard to replace certificates

./opt/vmware/vcloud-director/bin/configure

Step 4: Service should restart at end of the configure command, so there really is no step 4 other than to bring up your vCloud web page and examine the certificate to see your new extended certificate.

Setting up MRTG for bits instead of bytes

I always have to look this up, so I’m blogging the cfgmaker command I like to use for windows.

perl cfgmaker community@10.10.10.10 -–global "WorkDir: c:\MRTG\MRTGDATA" --global "options[_]: growright,bits" --output FW1.cfg

Initially only the last 24 will show bits, but as data grows the other charts converts from bytes to bits.

If you use a Scheduled Tasks

Run:    C:\Perl64\bin\perl.exe mrtg FW1.cfg

Start in:   C:\MRTG\mrtg-2.xx.x\bin

Advanced settings to run ever 5 minutes for 23 hours and 55 minutes

If you already have MRTG setup and working and you want to move from bytes to bits, you can always just modify your .cfg file and remove the comment marks on the second line.

#  to get bits instead of bytes and graphs growing to the right
# Options[_]: growright, bits

So it should look like

#  to get bits instead of bytes and graphs growing to the right
Options[_]: growright, bits

Quick and Dirty Junos for dummies I learned today while configuring my SRX240

1) If you don’t have the commands on your device you expect, update your junos.

2) If you login as root over the serial port, type “cli” to get out of linux mode and into junos.

3) To reboot type “request system reboot”

4) Transparent mode on Junos is painful.  You need to configure a management IP on a irb interface and a “bridge-domains” to make it all work.

5) When in configure mode, type “run ping 8.8.8.8” to execute commands

6) Type show | display set if you want your commands piped into a command line friendly format.

7) When in configure mode, type “sho” to show the config, or “sho interfaces” to display only that sections information.

I think my cloud might be slightly over provisioned

VMware HA policy restricting VM deployment well before ESXi Hosts have reached capacity.

This can happen due to the default mechanic for slot size calculation in VMware HA.  The default slot size is calculated based on the size of your largest VM in the cluster, and in this example I’m talking about memory because that is generally the first HA bottleneck, not CPU.  If your like me and you have a single large 8GB VM and a bunch of small 256MB VM’s, your cluster admission policy will stop deployments even when ESX host memory usage is below 50%.  To increase your slot size, which you can see here:

You can see the Slot size is 8332 MB, I’d prefer it was down around 1024 to be closer to reality.

To make the change, go into the Advanced Options of HA

And set das.slotmeminmb to a value of 1024

Now when you go back and look at the current slot allocation “Advanced Runtime Info” you see that you have gone from 112 slots to 966

HA should again work as expected, but you should know that even though this will allow you to essentially overcommit your HA settings and HA working properly for your large VM in a disaster is no longer guaranteed due to the custom settings.

Here is the  text from the vSphere Availability Guide

Slot Size Calculation is comprised of two components, CPU and memory. 

VMware HA calculates the CPU component by obtaining the CPU reservation of each powered-on virtual machine and selecting the largest value. If you have not specified a CPU reservation for a virtual machine, it is assigned a default value of 256 MHz. You can change this value by using the das.vmcpuminmhz advanced attribute.)

VMware HA calculates the memory component by obtaining the memory reservation, plus memory overhead, of each powered-on virtual machine and selecting the largest value. There is no default value for the memory reservation.

If your cluster contains any virtual machines that have much larger reservations than the others, they will distort slot size calculation. To avoid this, you can specify an upper bound for the CPU or memory component of the slot size by using the das.slotcpuinmhz or das.slotmeminmb advanced attributes, respectively.

Isilon NFS load balancing & vCD 1.5 (cloud director)

Recently setting up an Isilon with the new scale vCloud we spent alot of time discussing what options we had to load balance across the Isilon nodes. The recommended best practice is to statically setup a matrix of multiple datastores to the separate nodes individually. However, two unique items about this setup prevent this from being overly useful. Our Isilon is presented as one large storage pool that isn't subdivided. The way vCD works, it fills the first pool, then moves onto the second one. Knowing these two things vCD would fill the first datastore, but then never move onto the second one. I decided to just use Smart Connect Basic features that come with the Isilon. The ESX servers will then use DNS to dynamically connect to the separate Isilon nodes.