virtualize all the things... ?
-
@emad-r said in virtualize all the things... ?:
The only thing I can think of you may not want to virtualize is VPN server.
cause if you want to reboot the Host hypervisor for whatever reason (maybe shutdown by disaster and not choice), it is bit tricky to diagnose and running when you cant connect especially if your working from home.I reckon the AMD AM1 platform is an excellent platform for VPN server, especially if you get motherboard that gets charged using laptop charger (AM1H-ITX) you are free to experiment and deploy whatever VPN solution you want , or purchase a commercial VPN box.
That doesn't really make much sense either. If you can move the VM to another machine... if not you'd want to have tested this prior to going remote. In reality it seems very rare for a simple system, like a VPN, to go not come back up when a hypervisor reboots.
-
@coliver said in virtualize all the things... ?:
@emad-r said in virtualize all the things... ?:
The only thing I can think of you may not want to virtualize is VPN server.
cause if you want to reboot the Host hypervisor for whatever reason (maybe shutdown by disaster and not choice), it is bit tricky to diagnose and running when you cant connect especially if your working from home.I reckon the AMD AM1 platform is an excellent platform for VPN server, especially if you get motherboard that gets charged using laptop charger (AM1H-ITX) you are free to experiment and deploy whatever VPN solution you want , or purchase a commercial VPN box.
That doesn't really make much sense either. If you can move the VM to another machine... if not you'd want to have tested this prior to going remote. In reality it seems very rare for a simple system, like a VPN, to go not come back up when a hypervisor reboots.
True it is very simple, but still there is risk like when power outages occurs and stuff like that. If you lost the VPN you no longer can access, thus in my mind separating it, seems like good idea. And will make my work on Hosts and updating the servers much easier, especially since its not VM and I dont have to worry about it (shutting down). But yes I understand what you mean with careful operation there shouldn't be any issues of it being an VM machine after all.
Imagine you want to patch ESXi, and you are connected via VPN VM running in that same ESXi host. And we dont have like 300 servers, more like 1-2 server per site. so you understand how difficult it can become.
-
@emad-r said in virtualize all the things... ?:
@coliver said in virtualize all the things... ?:
@emad-r said in virtualize all the things... ?:
The only thing I can think of you may not want to virtualize is VPN server.
cause if you want to reboot the Host hypervisor for whatever reason (maybe shutdown by disaster and not choice), it is bit tricky to diagnose and running when you cant connect especially if your working from home.I reckon the AMD AM1 platform is an excellent platform for VPN server, especially if you get motherboard that gets charged using laptop charger (AM1H-ITX) you are free to experiment and deploy whatever VPN solution you want , or purchase a commercial VPN box.
That doesn't really make much sense either. If you can move the VM to another machine... if not you'd want to have tested this prior to going remote. In reality it seems very rare for a simple system, like a VPN, to go not come back up when a hypervisor reboots.
True it is very simple, but still there is risk like when power outages occurs and stuff like that. If you lost the VPN you no longer can access, thus in my mind separating it, seems like good idea. And will make my work on Hosts and updating the servers much easier, especially since its not VM and I dont have to worry about it. But yes I understand what you mean with careful operation there shouldn't be any issues of it being an VM machine after all.
Virtualization should improve all of these things, not make them worse. That's part of the critical point as to why we always virtualize without exception - because it is free and improves our safety / reliability. It provides protection. Don't think of it as virtualiation, think of it as hardware abstraction and driver containment. It's a key provider of system stability - something that is exactly what you are trying to create here.
-
@emad-r said in virtualize all the things... ?:
Imagine you want to patch ESXi, and you are connected via VPN VM running in that same ESXi host. And we dont have like 300 servers, more like 1-2 server per site. so you understand how difficult it can become.
No, I still don't understand. You are talking about adding another server to accommodate the VPN. So you are talking purely about consolidation as a concern, which it is, and not at all about virtualization as a concern (which it is not.)
-
@scottalanmiller said in virtualize all the things... ?:
@emad-r said in virtualize all the things... ?:
... it is bit tricky to diagnose and running when you cant connect especially if your working from home.
That just exposes the fragility of LAN-based security.
Hehe, true but what to say it is simple.
-
@scottalanmiller said in virtualize all the things... ?:
@emad-r said in virtualize all the things... ?:
Imagine you want to patch ESXi, and you are connected via VPN VM running in that same ESXi host. And we dont have like 300 servers, more like 1-2 server per site. so you understand how difficult it can become.
No, I still don't understand. You are talking about adding another server to accommodate the VPN. So you are talking purely about consolidation as a concern, which it is, and not at all about virtualization as a concern (which it is not.)
Agree. Makes no sense. Move the VPN VM to another host before updating the original.
-
@emad-r said in virtualize all the things... ?:
Imagine you want to patch ESXi, and you are connected via VPN VM running in that same ESXi host. And we dont have like 300 servers, more like 1-2 server per site. so you understand how difficult it can become.
Um... this is where things like cluster aware updating come in handy.
-
@jimmy9008 said in virtualize all the things... ?:
@scottalanmiller said in virtualize all the things... ?:
@emad-r said in virtualize all the things... ?:
Imagine you want to patch ESXi, and you are connected via VPN VM running in that same ESXi host. And we dont have like 300 servers, more like 1-2 server per site. so you understand how difficult it can become.
No, I still don't understand. You are talking about adding another server to accommodate the VPN. So you are talking purely about consolidation as a concern, which it is, and not at all about virtualization as a concern (which it is not.)
Agree. Makes no sense. Move the VPN VM to another host before updating the original.
What if you only have 1 enterprise grade server in one site ? and you can just purchase another 3000$ server cause you ran out of budget, but you can get the AM1 AMD platform for 300$ and make it VPN server
-
@emad-r said in virtualize all the things... ?:
@jimmy9008 said in virtualize all the things... ?:
@scottalanmiller said in virtualize all the things... ?:
@emad-r said in virtualize all the things... ?:
Imagine you want to patch ESXi, and you are connected via VPN VM running in that same ESXi host. And we dont have like 300 servers, more like 1-2 server per site. so you understand how difficult it can become.
No, I still don't understand. You are talking about adding another server to accommodate the VPN. So you are talking purely about consolidation as a concern, which it is, and not at all about virtualization as a concern (which it is not.)
Agree. Makes no sense. Move the VPN VM to another host before updating the original.
What if you only have 1 enterprise grade server in one site ? and you can just purchase another 3000$ server cause you ran out of budget, but you can get the AM1 AMD platform for 300$ and make it VPN server
Why does having one server matter?
-
@emad-r said in virtualize all the things... ?:
@scottalanmiller said in virtualize all the things... ?:
@emad-r said in virtualize all the things... ?:
... it is bit tricky to diagnose and running when you cant connect especially if your working from home.
That just exposes the fragility of LAN-based security.
Hehe, true but what to say it is simple.
Is it? Seems complex to me
-
@emad-r said in virtualize all the things... ?:
@jimmy9008 said in virtualize all the things... ?:
@scottalanmiller said in virtualize all the things... ?:
@emad-r said in virtualize all the things... ?:
Imagine you want to patch ESXi, and you are connected via VPN VM running in that same ESXi host. And we dont have like 300 servers, more like 1-2 server per site. so you understand how difficult it can become.
No, I still don't understand. You are talking about adding another server to accommodate the VPN. So you are talking purely about consolidation as a concern, which it is, and not at all about virtualization as a concern (which it is not.)
Agree. Makes no sense. Move the VPN VM to another host before updating the original.
What if you only have 1 enterprise grade server in one site ? and you can just purchase another 3000$ server cause you ran out of budget, but you can get the AM1 AMD platform for 300$ and make it VPN server
I still don't see the logic. What's the connection between virtualization and all that cost? Why are you not virtualizing on the $300 AM1 board?
-
Does your edge device not support IPSEC or other VPN technologies? Seems like you could save yourself some money by putting in Ubiquiti equipment to facilitate this type of maintenance.
-
@emad-r said in virtualize all the things... ?:
@jimmy9008 said in virtualize all the things... ?:
@scottalanmiller said in virtualize all the things... ?:
@emad-r said in virtualize all the things... ?:
Imagine you want to patch ESXi, and you are connected via VPN VM running in that same ESXi host. And we dont have like 300 servers, more like 1-2 server per site. so you understand how difficult it can become.
No, I still don't understand. You are talking about adding another server to accommodate the VPN. So you are talking purely about consolidation as a concern, which it is, and not at all about virtualization as a concern (which it is not.)
Agree. Makes no sense. Move the VPN VM to another host before updating the original.
What if you only have 1 enterprise grade server in one site ? and you can just purchase another 3000$ server cause you ran out of budget, but you can get the AM1 AMD platform for 300$ and make it VPN server
Many ways to crack it. For example, VPN in. Set your firewall to allow remote connections from your current external IP address (not great, but possible).
Do the work. You have the VPN for when it's up, and rule through firewall if it doesn't come back up. After patch finished, remove the firewall rule... Of course, i'd not personally do that, I'd have a second host for multiple reasons anyway...
But you don't need the physical VPN server. Why have another kit at all for a rare chance it won't come back up... If it doesn't, you probably have other issues.
-
@scottalanmiller said in virtualize all the things... ?:
@emad-r said in virtualize all the things... ?:
@jimmy9008 said in virtualize all the things... ?:
@scottalanmiller said in virtualize all the things... ?:
@emad-r said in virtualize all the things... ?:
Imagine you want to patch ESXi, and you are connected via VPN VM running in that same ESXi host. And we dont have like 300 servers, more like 1-2 server per site. so you understand how difficult it can become.
No, I still don't understand. You are talking about adding another server to accommodate the VPN. So you are talking purely about consolidation as a concern, which it is, and not at all about virtualization as a concern (which it is not.)
Agree. Makes no sense. Move the VPN VM to another host before updating the original.
What if you only have 1 enterprise grade server in one site ? and you can just purchase another 3000$ server cause you ran out of budget, but you can get the AM1 AMD platform for 300$ and make it VPN server
I still don't see the logic. What's the connection between virtualization and all that cost? Why are you not virtualizing on the $300 AM1 board?
Ahh, now I see what you mean. Btw the board costs 50$ and the CPU that goes on top costs like another 50$ the whole AM1 AMD solution box with RAM + PSU + Drive will cost you = 300$
Umm, cause it will be only used for that role and that role only, no other thing. But I get your point now. If we want to think about virtualization as "hardware abstraction and driver containment" then it makes sense what you are saying.
-
@emad-r said in virtualize all the things... ?:
If we want to think about virtualization as "hardware abstraction and driver containment" then it makes sense what you are saying.
Right, when consolidation is not a factor, then removing the value of consolidation doesn't change the equation.
-
I'm trying to figure out why you are VPNing into something that isn't your firewall? and I'm not talking about HTTPS stuff here.
-
@dashrender said in virtualize all the things... ?:
I'm trying to figure out why you are VPNing into something that isn't your firewall? and I'm not talking about HTTPS stuff here.
What do you mean? Firewalls are handy, of course, but you just open the ports and connect to the VPN server. Only in the SMB can you get firewalls big enough to do VPN as well.
Windows Server, OpenVPN servers, DirectConnect, Pertino, ZeroTier, Hamachi... all meant to be VPNs that are behind the firewall.
-
@dashrender said in virtualize all the things... ?:
and I'm not talking about HTTPS stuff here.
But they are one and the same. Literally. How do you talk about one and not the other?
-
@scottalanmiller said in virtualize all the things... ?:
@dashrender said in virtualize all the things... ?:
I'm trying to figure out why you are VPNing into something that isn't your firewall? and I'm not talking about HTTPS stuff here.
What do you mean? Firewalls are handy, of course, but you just open the ports and connect to the VPN server. Only in the SMB can you get firewalls big enough to do VPN as well.
Windows Server, OpenVPN servers, DirectConnect, Pertino, ZeroTier, Hamachi... all meant to be VPNs that are behind the firewall.
Is the OP in need of a system like that?
-
@dashrender said in virtualize all the things... ?:
@scottalanmiller said in virtualize all the things... ?:
@dashrender said in virtualize all the things... ?:
I'm trying to figure out why you are VPNing into something that isn't your firewall? and I'm not talking about HTTPS stuff here.
What do you mean? Firewalls are handy, of course, but you just open the ports and connect to the VPN server. Only in the SMB can you get firewalls big enough to do VPN as well.
Windows Server, OpenVPN servers, DirectConnect, Pertino, ZeroTier, Hamachi... all meant to be VPNs that are behind the firewall.
Is the OP in need of a system like that?
The OP isn't talking about firewalls at all.
