Virtualization the NAS Way

Configure Microsoft Virtual Server to access resources including Virtual HDDs and Config files directly from a shared location on a NAS

Sunday, February 04, 2007

If your organization deploys virtualization servers or is planning to do so, one of the key challenges involved is to allocate storage for the
Virtualization Server's Resources. These resources include Virtual hard disks, VM Configuration Files, and so on. The biggest storage consuming components, here, are the Virtual hard disks. As these disks contain the guest OS and applications, size of this can be quite huge sometimes. So keeping them on some local storage in the server is not wise as it would eat up the space rapidly.

Imagine having created 15 Virtual Machines in your Server and that you have allocated a fixed 20 GB HDD space each for every VM. This will result in 300 GB of storage. Additionally, you might not have good backup capability in the server so in case your server goes down, all your VMs will also become unusable. So, the moral of the story is that if you are planning to deploy and use Virtualization on a production network, it is wiser to save all its resources on a NAS/SAN.

But if you are using MS Virtual Server 2005, there is a catch. It doesn't support reading its resources from a Network Share out of the box. You have to do some configuration at the Domain level to let this happen. The reason for this is simple. If you create a Network Share and give full rights to everyone, the rights allowed include only read, write and modify. But as VM resources have mainly virtual hardware such as HDD as its components, they also require I/O level access to the share. And these rights are not allowed in general. In this article, we tell you how you can allow the I/O level access.

Prerequisites
Obviously, you will require is a machine that has MS Virtual Server installed, a fileserver or NAS where you have a share with proper read-write and execute writes and ample disk-free space.

We assume that you have a Windows 2003 ADS running in the network and the FileServer/NAS and Virtual Server is the member of that domain.

To enable the Virtual Server for delegation, you have to set the option mentioned in the screenshot above while doing a Custom install of MS VS

Configuration
Step 1: To make Virtual Server capable of reading resources from the NAS, you need to do a custom installation of Virtual Server where you have to enable the installation option which says 'Run the Administration Website as the Local System account'.

Step 2: Now, go to the Domain Controller and check whether it is configured for a Microsoft Server 2003 native domain or not. And if it is not, you have to raise the functionality level of the domain. You can do it by first going to Administrative Tools>Active Directory Domains and Trusts. In the window that opens, select and right click on the entry which shows your domain name. In the right click menu, you will see the option which says “Raise Domain Functionality level” click on it and the level will be raised.

But the point to be noted is that this process is irreversible and once done, you can't change it back to the pre-Windows 2003 functionality. The only way to reverse the action is to re-create the domain. And once this setting is done, your Windows NT 4 or older domain controller will not be able to work properly with this Forest. So, before proceeding, be doubly sure. 

Step 3: Now you have to set Constrained Delegation between the NAS Box and the Virtual Server so that it can get the I/O level rights over CIFS (Common Internet File System) protocol. To do so, again go to the Domain controller and open 'Active Directory Users and Computers' here, expand the domain and then click on the 'Computers' option. You will see all the computers available in the domain including your NAS box and the Virtual Server.

Now right click on the Virtual Server and click on Properties. And if you have properly raised the functionality of the Domain, only you will see a tab called Delegations. Click on this tab. Now, select the 'Trust This computer for Delegation for Specific Services' radio button and just below this line you will see two more options. Here select the one which says 'Use any authentication protocols'.

Now click on Add and a new window will open up. Click on 'Users and Computers...' button. This will open up a search window from where you can add any machine to the list. Search for the name of your NAS box and click on OK. This will open up a list of all the services available on the NAS. Select 'cifs' and click on OK. Now apply the settings and you are done with the domain level configurations.

To allow IO level access rights to the n/w share, add Delegation for CIFS protocol to the NAS for VS

Configure virtual server
Now, the easiest way to configure the Virtual server to read resources from the shared volumes is to set the default resource and search path of the virtual server to the shared location. This will make sure that any resource files which MSVS builds or searches for are first done in the shared folder.

To do so, first open up the configuration Web page of Virtual Server and then go to the 'Server Property' link at the bottom left corner. Next select the Search Paths link. A new page will open up. Now fill in the UNC path (absolute path) of the share in both the fields and press OK.

Now on, your Virtual Server will be able to read and write resource files directly from NAS.

Page(s)   1