Today Veeam released Backup Academy. It is a FREE resource to get started with backup technologies targeted at IT professionals who are just getting started with data protection. Users that complete the video series can also do a Backup Academy Exam and get a certificate when they pass.

Although created by Veeam, Backup Academy is product neutral and it is already a great source of information with video’s from well know industry experts like David Davis, Eric Siebert, Elias Khnaser, Greg Shields and Rick Vanover. Even Veeam’s competitors are encouraged to add their content to the Backup Academy.

After regestering on the Backup Academy website you will find a number of video’s on real world practices today. You’ll be able to get more info on VMware and Hyper-V backup technologies targeted at System Administrators, Virtualization Administrators and System support staff.

Visit: BackupAcademy.com and follow on twitter @BckpAcademy

See full post at: Backup Academy

At Techfield day, VMware presented to us delegates their Mobile Virtualization Platform (MVP) and as expected all these geeks where very interested to see what VMware had to offer. Unfortunately the overall feeling was that the product as demonstrated to us was a bit disappointing. Of course it is still no released product, but even then there are some points to worry about, but first let’s have a look at what VMware MVP really is.

Taken from the VMware MVP website ( http://www.vmware.com/mobile):

“Employees want to use their personal smartphone for work and are pushing IT to support those devices. This trend—sometimes called “Consumerization of IT”—challenges IT requirements for security, compliance and ease of management. VMware MVP enables enterprises to embrace this trend, by allowing IT to safely support employee owned devices. With VMware MVP, enterprises can get the security and ease of management they require, while reducing CAPEX.With VMware MVP, a personal profile and a corporate profile can securely and simultaneously run on the same device in isolated containers. Corporate applications and data are securely isolated from an employee’s personal profile.With VMware MVP, employees can connect their own mobile devices to the corporate network from a corporate profile that is provisioned and managed by the corporate IT group.”

Architecture

First important message to all those hypervisor geeks that thought of running multiple VMs on their smartphones giving them total freedom, that is not what VMware MVP is aiming for. VMware MVP want’s to create a secure environment in which you can run your business applications and uses a hybride hypervisor model to create this environment. VMware MVP will create a single secure VM environment on top of the smartphone’s native OS by inserting a MVP module into the kernel of the native OS, called the MVPkm.

See this blog for more details on how exactly MVPkm hooks into the native OS and an in-depth explanation of the pro’s and con’s of this choice. http://www.ok-labs.com/blog/entry/vmware-mvp-how-it-works/ (Author: Gernot Heiser).

VMware MVP

The take away from Gernot Heiser’s post is this:

• The hybride hypervisor model is better than the type 2 hypervisor performance wise, but it is no type 1 hypervisor either since it has no exclusive control of the hardware.
• The hybride approach’s biggest disadvantage is that it creates a new attack surface and adds nothing to the security of the guest apps.

If the architecture doesn’t provide the additional security how do we get a secure environment then? Well, VMware MVP will only run OS’es inside the VM that have been provided and adjusted (secured) by VMware. You cannot just download the latest build of the smartphone’s OS and run it inside the MVP VM.

The plan that VMware has is that the enterprise admin will download the image supplied by VMware, add the corporate applications and then deploy them to user’s phone. This deployed VM is locked and the user cannot install any other apps into it. Well actually, the admin is supposed to lock this image and prevent further installation of new apps by the user. He could leave the image unlocked but that would defeat the whole purpose of having a ‘secure image’ with approved apps only.

Biggest drawback of this approach is that as a corporate admin you will have to wait with updates not until the vendor releases them, but for VMware to receive that update and adopt it to fit in the VMware MVP. Questions that where asked but could not answered at the Techfield Day demo:

• Will VMware add extra security to the image supplied by the vendor?
• What is VMware aiming at for the update cycles, how fast are they planning to release their image after the vendor releases it? Will they only release big updates (3.3 to 3.4 upgrade for example or also 3.4 to 3.4.1 updates?
• Will Apple allow running iOS inside a VM on top of android OS? And the same question of course also goes for RIM (Black Berry). I wonder what their motivation is in working together with VMware in this as they all have their own solutions to secure their devices. Specifically with Apple I could imagine that they want their iOS running on other hardware device than an iPhone, since “user experience” would be different than on a real iPhone.

Current status

It was at VMworld 2008 that VMware first talked about their ideas on Mobile Virtualization Platform and got a lot of people very excited. Now we’re 2.5 years down the road and what have we got?

• MVP will only run on android right now and inside the VM it will also run android only
• MVP will only support a single SIM, which means you still have to walk around with two smartphones if you want to keep a separate private and business number
• The management framework that would deploy these images to the users smartphones could not be demoed yet since it is not ready and no comment could be made about  what stage it is in.

All these unanswered questions give a lot of concerns. Personally I think VMware shouldn’t even try to release it if only Android on Android is supported. They should at least have one other OS they can run it on and run inside the VM to prevent that after release, all that is remembered by people who evaluate the product that it only runs on android. It will be very hard to invite those people again to evaluate the product when in a big update a new OS is added to the list.

My biggest concern is that the security gap they are trying to fix won’t be fixed by adding a hypervisor into the equation, but should be done by really securing those business apps. There are some real good management tools available that can protect a smartphone, lock down applications and secure your e-mail. Have a look at GOOD ( http://www.Good.com) for example. Others have already mentioned it would be better to go down the road of application virtualization instead of a hypervisor.

I’m wondering how long it will take for VMware to finally release a version 1 product and if it will ever be released. What they have shown us now wasn’t much and looked like a lot of work still needs to be done. I see a parallel here with the VMware Client Hypervisor (CVP) that eventually got canceled and merged into VMware View’s offline mode. Maybe, eventually VMware MVP will be merged with ThinApp and make mobile application virtualization possible.

Be aware that the Tech Field Day event is fully sponsored by the companies we visit, including flight and hotel, but we are in no way obligated to write about the sponsors.

See full post at: Thoughts on VMware Mobile Virtualization Platform

About half a year ago, I came across the website of Virtual Computer.com on which I read about a new Client Hypervisor called NxTop. Now the time is here to report about it, since the release is near. The complete product consists of the NxTop Enginer (the hypervisor) and NxTop Center for management. The NxTop Engine is not a desktop hypervisor that is running on top of an OS, like we already know from VMware Workstation, VirtualBox, Virtual PC, etc. but more like VMware ESXi or XenServer on your desktop pc. The desktop boots straight into the hypervisor and just like with ESXi and XenServer, all hardware is now managed by the Hypervisor.

NxTop Engine Architecture

As you can see in the image above, the way NxTop works is very much like Xen and this immediately gives away that indeed NxTop is build on Xen. It has its Domain0, now called “Control Domain” and uses Para virtualization as virtualization technique. By using Linux drivers a wide choice of hardware can be used, which is especially interesting in the graphics department. On YouTube (and below this post) you can find a demo that shows playing Doom3 in one VM, showing off their superb graphics performance and running Google Earth in a second VM flawlessly. To be honest, this is still a lab environment and 3D graphics will not be available in the first release, but graphics performance in this release is very good, the youtube demo shows what to expect next. I know how difficult it was for VMware Workstation and VirtualBox to deliver this kind of graphics performance and these guys are now delivering it in their first release, although only for Intel based graphics chipset for now. The trick behind it is their use of Linux drivers in the hypervisor which enables near native performance. In my opinion this is one of the killer features that will help early adoption.

Another interesting part to look at is their “Control Domain”. In this domain a number of separated zones can be found. There is the Management Zone that integrates with NxTop Center, the management environment that helps you control all clients, more on this later. There is a Driver Zone through which all communication with the driver will run and a little more interesting is the Security Zone.

NxTop Engine

Security

This Security Zone will take care of a number of tasks. It will make sure that there is a “Trusted boot” or in other words, it will make sure that the boot process hasn’t been tampered with. Should someone try to change the boot process to try and inject malicious drivers, the Secure Zone will detect this and shutdown the whole system, making it useless to the intruder.

The Secure Zone also encrypts all the VMs disks (VHD format, soon OVF format too) making full use of the TPM chip many desktops have nowadays. This will protect the data on the hard disk in case the disk gets ripped out of the desktop or laptop. The Security Zone will also handle a whipe (low level format) of the hard disk in case the desktop or laptop gets stolen. A great feature is that at every boot and at a regular interval set by the admin, NxTop will try to call home over any connection available and check with NxTop Center if there are updates or other messages. One of the messages can be the signal that the system has been stolen or is reported missing and that the disk should be wiped, just like with Blackberries or Windows Mobile phones.

The fourth zone inside the Control Domain is the Backup Zone. This is used, I bet you guessed it already, for backups but also for working with delta disks and with the specific user data disk. More on this later in the management part. The last zone is the ISV Zone which will offer integration for independent software vendors. A good example would be some kind of Anti-Virus software running at hypervisor level instead of inside the guest OS, just like VMware’s VMSafe.

Working with VM images and delta’s

What I like about NxTop, is how the mobile worker has been a central part in the design of the hypervisor and management around it. Typical for a mobile worker is that one minute he is there and the next he is gone. No time to wait for that 1 GB update to come down the line, there is a 2 o’clock appointment that has to be met and the mobile worker doesn’t want to wait for some stupid software download.

Guest layers

In NxTop a virtual machine is split into a number of disks. First there is the System disk which holds the OS and the set of applications. Next there are the Local disk and the User disk. The System disk is self cleaning at each reboot which protects it from changes. The Local disk will hold non-backup user settings and system settings per session. The User disk will hold the real user data and all customizations the user makes. By splitting the disks in this way, it is very easy to update the OS without touching user settings.

With NxTop the changes to or updates on the System disk are deployed using delta blocks over a SSL connection. Before downloading the delta is calculated between the image on the desktop and the master image and only this delta will be downloaded and applied to the desktop image. When the client connects to the NxTop Center server (the management server) it starts receiving updates and it is no problem if the client disconnects in the middle of a transfer. Next time, the download will simply continue. This offers great flexibility and has the least impact on the user.

Also typical for the mobile work is that the type of connection can change every time he connects. Yesterday it was over a normal LAN connection at the office, today he is zipping one of those great cappuccino’s at Starbucks and uses the free Wi-Fi to do some work, tomorrow he’ll be sitting in the park using a 3G connection. If you want to be a success in the field of client hypervisors, you will have to make the mobile worker happy, let him work the way he used to. With NxTop offering 3G USB devices and Wireless network cards support I think they have another killer feature to make a great start in this field. Although at first only Intel chip based cards are supported, but I expect others will follow soon.

NxTop

Management through NxTop Center

This last part might be a bit of a turn down for the folks of Virtual Computer, since they worked so hard on NxTop Center to make it look good, but I’m not going to write very much about it. To me the most surprising and revolutionary part of the NxTop product (NxTop Engine and NxTop Center) was the client hypervisor. The management part is something that has to be there, has to work well and offer nice features, but it is not part of the revolution, the real change lies in the NxTop Engine. Let me emphasize that NxTop Center is good and works well and you should definitely contact Virtual Computer to learn more about it. Also I expect you, the reader, to see the potential of the NxTop Engine thanks to this blogpost, understand the technique underneath and start thinking of how this would fit into your organization.

I will limit the review of NxTop Center to a list of some of the features and a few screenshots, to get more detailed info contact Virtual Computer through their website: http://www.virtualcomputer.com.

Features of NxTop Center

Policies on the VMs which enables you to

• define expiration of the image,
• which type of USB devices are allowed,
• force backups to NxTop Center
• Lock Out to force people to connect to NxTop Center daily, weekly, monthly
• OS profiles to preserve anti-virus updates, Windows updates, Windows Search Updates, Flash Player, etc, etc.

NxTop Center policies

NxTop Center policies

-          Which VM is allowed to connect to what type of networks

-          Manage users and groups and assign VMs to users and groups

-          Manage multiple versions of a VM

NxTop Center multiple OS versions

-          Specify hardware requirements

NxTop Center specific hardware requirements for the VM

-          Not only deploy full VMs but also applications.

NxTop Center Applications

-          Remotely manage computers, diagnostics and remote control.

NxTop Center Remote management

-          Two licensing models will be available

• 5-20 users which you pay per pc per month.
• Or traditional licensing per pc including maintenance.

-          Building VMs is done on the NxTop Center server using the Microsoft Virtual Server engine. The use of Microsoft Virtual Server, makes the NxTop Center server unsuited for running on top of a hypervisor like ESX, XenServer or Hyper-V. Virtual Computer is working on a version that can run inside a VM.

Some youtube video’s about Virtual Computer:

See full post at: The next step in virtualization: Virtual Computer’s NxTop