Posts made by taurex

I wonder if the new feature in Server 2019 called SMB WriteThrough would help in this situation. https://www.veeam.com/blog/new-smb-client-parameter-windows-server.html

DataCore's Hyper-Converged VSAN. Apparently quite reasonably-priced but I haven't heard much else about it.

Is adding all of the devices and the servers in the data centre to a ZeroTier network an option? You wouldn't even need to set up a traditional S2S VPN for that.

Honestly, anything higher than the 1080p resolution on a 13-inch laptop is a gimmick. The screen size is simply too small for any practical case of higher resolution. And even with 1080p, I have to scale my 13.3-inch laptop to 150%.

@justin867

There is no such thing as the best backup product. For instance, Veeam is great but it doesn't back up network shares. Unitrends is good too but its appliance needs Hyper-V installed as a role and so on. It all comes down to finding the right product to suit particular needs, rather than trying to look for ones with all bells and whistles.

Regardless, you simply can't properly propose or suggest anything related to backups without knowing organisational RTO/RPO for the said services (file servers). Business continuity and disaster recovery documentation should include these objectives. Otherwise, work with the finance dept to find out how much downtime are they're able to sustain without much harm to the business and go from there.

AFAIK, only internal licenced O365 users can have access to a shared mailbox. The client needs to keep their domains (and emails) on the same O365 tenant alongside each other to make it work. Seems like a desirable feature, though.

Just don't make the common mistake many IT enthusiasts do. Always run apps on the fastest storage e.g the Samsung 970 Evo Plus, 970 Pro etc, not the O/S. You'll see how much difference the ultra low storage latency makes. Also, don't partition any disks, just have an entire SATA SSD for the O/S and a large and fast PCIe for all the apps, including games. AFAIK the modern Z390 motherboard even supports dual M.2 PCIe sticks so does its Ryzen analogue.

I'd recommend looking at userbenchmark.com website, specifically at their PC Builder page. Although some of you may argue their benchmark is not really that accurate, it still gives a good idea of how a PC component will perform in typical gaming, desktop or workstation roles.

@scottalanmiller said in Infrastructure Needed for Hypervisor Cluster:

XS is one specific vendor that sells licenses. So they have a financial incentive to push the 3+ host model. And their standard shared storage mechanism only works well with 3+. So they chose a system based around that, so that they recommend it is expected.

But products like DRBD and Starwind are engineered all around the 2 node model. They scale up, but their intent is focused on two nodes.

HPE Simplivity works normally with 2 nodes so does Datacore's VSAN. Although both require/should have a witness. I was looking into Simplicity to run a vSphere cluster some time ago but after HPE had bought them their support hit rock bottom at some stage. DataCore is a bit of a dark sheep, I wonder if anyone on ML ever used them at all. I'd look at Starwind and VMware VSANs first, both have large vendor and IT community support. Unless the OP wants to do some KVM with DRBD, Gluster, Ceph etc.

I'm pretty happy about AnyDesk I use. It runs very stable and responsively even on slow links. However, it does lack the remote command line capabilities of ScreenConnect (aka ConnectWise Control). I might be switching to SC or MeshCentral2 because of this.

@krisleslie Are you viewing the camera streams on the same VM by any chance? This is known to slow down Unifi NVR server performance, should be a remote machine. From my experience, the Windows version even with RAM disk doesn't handle IO from multiple streams anywhere nearly as good as its Linux equivalent. You'd be much better off running it on the supported Linux distro of your choice IMO. Your server specs would be massive overkill for 25 cameras if you were running it on Linux.

Are you recording most of your streams at full 30 FPS? Are you able to reduce it to 15 FPS and record motion only? This should cut down Unifi NVR's IOPS quite a bit.

@Pete-S Good to know. Thanks for the link.

You should disable time sync in the Hyper-V integration services on all your DC VMs but make sure your Hyper-V host is syncronising its time with the same external source. When your VMs are restarting they can only fall back to the hypervisor's time since there is no real CMOS for obvious reasons.

Check if UDP port 123 is not blocked by the VM's Windows firewall, on your network or by your ISP.

You need to run a local DNS service for internal names resolution. Either Windows Server DNS or BIND would do the trick. Synology has a DNS (BIND-based) server app if you've got one of their NASes.

@magicmarker +1 to Google Keep. Love the show checkboxes option:)

@romo Your site-to-site VPN doesn't work either, correct? Are you sure none of the routers is behind a Carrier Grade NAT (CG-NAT)? Are they all public IPs you have on both ends? L2TP doesn't work if its server is behind a NAT.

When you use a policy based VPN you need to start passing some traffic through the tunnel to bring it up. Have you tried pinging a device on the other router's network tunnelled through the VPN?

What's the output of show log | match 'xl2tpd|pppd'?

@romo Have you defined ipsec interfaces with set vpn ipsec ipsec-interfaces interface eth[.]? I don't see it in your VPN config output. Also, If your static IP address gets issued by your ISP via PPPoE, you'll need to change the outside L2TP address to 0.0.0.0.

@romo I don't see ipsec match-ipsec set in your L2TP rule.

Do you also have WAN_IN firewall rules set up?

@romo Could you show your firewall rules in the config output, please?

@jaredbusch Jared, I was talking about @Romo's site-to-site VPN config. He has two tunnels and I suggested to use a route based VPN instead. I also asked if @Romo was using public IPs on both ends or not. Because if he's behind CG-NAT, the current config wouldn't work.