workshop架構(gòu)設(shè)計(jì)桌面池設(shè)計(jì)

1、VMware View 客戶交流交流大綱View項(xiàng)目流程需求分析，定義架構(gòu)設(shè)計(jì)，桌面池設(shè)計(jì)協(xié)議（用RDP還是PCoIP）網(wǎng)絡(luò)接入View Manager的規(guī)劃設(shè)計(jì)vSphere 規(guī)劃設(shè)計(jì)用戶, 會(huì)話, 終端設(shè)備虛擬應(yīng)用交付View運(yùn)營管理（vCops）View后續(xù)版本需求收集與分析業(yè)務(wù)目標(biāo)項(xiàng)目目標(biāo)使用場景用戶類型桌面類型現(xiàn)有情況概念設(shè)計(jì)邏輯設(shè)計(jì)物理設(shè)計(jì)系統(tǒng)實(shí)施試運(yùn)行運(yùn)行和維護(hù)總體規(guī)劃View 項(xiàng)目整體思路VMware最佳實(shí)踐規(guī)范設(shè)計(jì)，實(shí)施健康檢查，優(yōu)化，調(diào)試解決特殊問題總體思路和需求分析first priority業(yè)務(wù)目標(biāo)您的CIOs對(duì)企業(yè)桌面的愿景是什么?為什么會(huì)選擇VDI方案?提高桌面映像

2、的管理，包括集中升級(jí)，補(bǔ)丁，備份和恢復(fù)從數(shù)據(jù)中心對(duì)桌面系統(tǒng)進(jìn)行集中管理將數(shù)據(jù)存放在數(shù)據(jù)中心，防止數(shù)據(jù)被竊取和法規(guī)遵從保證業(yè)務(wù)不受中斷保證用戶的隔離 （使用類似Terminal方式無法實(shí)現(xiàn)）做盡可能少的改變以保護(hù)現(xiàn)有用戶的使用體驗(yàn)滿足用戶移動(dòng)辦公的需要減少對(duì)現(xiàn)有桌面維護(hù)流程的修改定義項(xiàng)目期望您的期望是什么?怎樣衡量VDI項(xiàng)目是一個(gè)成功的項(xiàng)目?項(xiàng)描述期望1Users can continue to access and use applications and data pertinent to their job function.Yes/No.2Pilot users give usabili

3、ty of View solution an acceptable rating while using business related applications.User does not perceive any “l(fā)ag” while using applications pertinent to their job.3Users have an acceptable multimedia user experiennce.Same as or as close to same as physical desktop.4Performance of applications in Vi

4、ew is not adversely affected.Application launch time within 10% or better compared to legacy.5Pilot users give performance of View solution an average or higher rating.2.5 out of possible 5 in Performance metrics.6Users are able to access View solution from client access devices in the branches and

5、at HQ.Yes/No.7Number of virtual machines per core achieved with acceptable performance is at least eight.Yes/No.8Storage required per virtual desktop.No more than 5GB on average.9View user printing capabilities match or exceed legacy printing capabilities.Yes/No.Set/Measure your Expectationp定義項(xiàng)目期望Nu

6、mberDescriptionMessurement10The View solution allows maximum compression for known document formats (Office documents 2007 and 2010, PDF, TXT, images).Goal: 60% compression.11View user login time is not significantly longer than legacy desktops.User login completed no more than 10% additional time c

7、ompared to legacy.12View service is available if any View component fails.Yes/No.13Bandwidth use between virtual machines and file server (image streaming, profile streaming, application streaming).Less than 2Gbps peak.14WAN bandwidth use between session and user (remote display protocol).No more th

8、an 10Mbps for set of branch users (100).15Monitoring.Solution is compatible with current tools and no other products are required.16Troubleshooting/Stability.Number of service desk calls during pilot phase and average time-to-fix is no greater than current physical desktop support calls or time to f

9、ix.17View solution will provide a user personalization best practices architecture and guidelines or a software solution in order to prevent: Network contention because of large user profiles data.Files collision because of opening same file from several desktops (for example, from the physical and

10、virtual desktop).Yes/No.18View solution will provide a mechanism for AV updates on virtual desktops (frequent and non-frequent updates).Yes/No.使用場景Windows 7 遷移減少遷移成本最大程度地減少應(yīng)用程序不兼容問題延長現(xiàn)有桌面軟件的使用期限合同工/EOIT/BYOPC部署和管理員工所擁有資產(chǎn)上的桌面映像集中控制桌面和數(shù)據(jù)分離公司和個(gè)人桌面遠(yuǎn)程辦公室/分支機(jī)構(gòu)通過集中管理桌面和用戶降低成本集中控制敏感數(shù)據(jù)簡化桌面和應(yīng)用程序部署業(yè)務(wù)流程外包通過集中管理

11、桌面應(yīng)用程序和用戶降低成本集中控制敏感數(shù)據(jù)簡化桌面和應(yīng)用程序部署業(yè)務(wù)連續(xù)性/災(zāi)難恢復(fù)支持最終用戶從遠(yuǎn)程位置操作確保桌面全天候可用快速部署新桌面移動(dòng)用戶無論是否連接網(wǎng)絡(luò)都可以訪問桌面增強(qiáng)脫機(jī)用戶的安全性和控制利用本地設(shè)備資源使用場景不同使用場景的區(qū)分包括下列關(guān)鍵因素:離線桌面.允許用戶自己安裝軟件.使用大量的圖形軟件.Internet 訪問(企業(yè)外部).是否使用瘦客戶機(jī)，家用PC或者KIOSK模式.分支機(jī)構(gòu) (WAN 接入).使用VoIP 或者 Microsoft OCS.使用消耗大量CPU和內(nèi)存的應(yīng)用程序.使用打印機(jī)，掃描儀和USB設(shè)備.用戶可以按照使用的應(yīng)用程序不同進(jìn)行分組. (例如, 市場

12、部同事都用同一個(gè)安裝好一系列軟件的模板).陳舊的Terminal Services應(yīng)用.設(shè)計(jì)階段需要收集的關(guān)鍵數(shù)據(jù)收集下列領(lǐng)域的評(píng)估數(shù)據(jù):用戶和用戶使用場所.登陸和注銷的時(shí)間和行為.外設(shè).使用的客戶端設(shè)備配置.應(yīng)用程序.桌面的負(fù)載.現(xiàn)有的虛擬架構(gòu)的標(biāo)準(zhǔn).存儲(chǔ)的容量和性能.網(wǎng)絡(luò)的容量和性能.基礎(chǔ)服務(wù)的容量和性能(AD, DNS, DHCP, file/print, email).安全架構(gòu)現(xiàn)有的防病毒/防火墻/VPN方案及配置,可擴(kuò)展性和性能.災(zāi)難恢復(fù) 桌面系統(tǒng)的 RTOs and RPOs運(yùn)維 現(xiàn)有的打補(bǔ)丁/系統(tǒng)管理/監(jiān)控的方案配置，可擴(kuò)展性和性能.人數(shù) IT工作人員, VCP個(gè)數(shù), 崗位和職責(zé)

13、.設(shè)計(jì)階段需要收集的關(guān)鍵數(shù)據(jù)資源評(píng)估參數(shù)CPU 利用率Processor:% Process Time內(nèi)存Memory: Available in megabytes(Note that inventory data is necessary to calculate memory used)Memory: Peak Commit Charge(To assist with sizing the Windows page file)存儲(chǔ)通量存儲(chǔ)的IOPSPhysical Disk: Bytes Transferred/secPhysical Disk: Transfers/sec網(wǎng)絡(luò)通量Net

14、work Interface: Bytes Transferred/sec查看現(xiàn)有物理桌面環(huán)境下的資源使用情況Liquidware Labs Stratusphere or Lakeside Software Systrack VMP can be used to get the performance number; or you can use windows sysinternal tool PerfmonTips: View 架構(gòu)設(shè)計(jì)設(shè)計(jì)的工作流架構(gòu)設(shè)計(jì)中的關(guān)鍵組件單元設(shè)計(jì)一個(gè)常規(guī)的桌面單元包括 500-2000個(gè)虛擬桌面，分布在2個(gè)8節(jié)點(diǎn)的ESX/ESXI 群集上。由分布在外面的管理

15、單元進(jìn)行管理.在左圖中, 每臺(tái)ESX/ESXI 主機(jī)包括2路8核的CPU, 一共提供16核128個(gè)虛擬桌面的運(yùn)行. 這個(gè)單元包括兩個(gè)群集共計(jì)2048個(gè)桌面的運(yùn)行。View management building block大規(guī)模部署設(shè)計(jì)1萬個(gè)桌面由5個(gè)桌面單元（每個(gè)單元2000個(gè)桌面）和一個(gè)管理單元構(gòu)成View management building block桌面池設(shè)計(jì)桌面池的設(shè)計(jì)和使用場景進(jìn)行對(duì)應(yīng), 定義桌面池的類型及屬性Use CasePool AttributeOptionsDesign DecisionUser makes few/many changes to the operat

16、ing system during the week.Use View ComposerYes/NoView Composer can significantly reduce storage requirements and enables single image management. mended if the users have restricted access to the underlying operating system.If users have access to install applications and change the operating syste

17、m, this reduces the storage saved with Composer.User data and profile is/is not stored on the network.User wants to install applications locally.User has a current virtual desktop.Desktop persistenceFloatingDedicatedFloating is mended as this decouples the user from a specific desktop and provides m

18、anagement and resource efficiency.Dedicated desktops are required where users have applications or data that they want to install or keep on a specific desktop. Similarly if a user has a desktop today that they use and manage, it could be allocated as a dedicated desktop.Dedicated desktops complicat

19、e management and disaster recovery because of the need to recover that specific desktop if anything happens to it.設(shè)計(jì)例子詳細(xì)定義每個(gè)桌面池的屬性每個(gè)桌面池最多512個(gè)虛擬機(jī)的軟限制。主要是從維護(hù)角度桌面的配置（邏輯設(shè)計(jì)）定義虛擬桌面的配置桌面的硬件配置（物理設(shè)計(jì)）定義虛擬桌面的虛擬硬件配置（包括硬件版本）最佳實(shí)踐浮動(dòng)還是專有桌面? if users want to have specific data, applications keep on a specific deskto

20、p. If users data and profile in network, they dont touch OS/app change, use floating pool.是否采用連接克隆? (桌面是IT管理還是用戶自己管理？). 如果用戶需要修改系統(tǒng)設(shè)置，頻繁安裝各種軟件，不推薦使用鏈接克隆。離線模式桌面的硬件配置需要根據(jù)客戶端設(shè)備來進(jìn)行設(shè)計(jì)(占用客戶端資源的比例).離線桌面在View5.0中尚不支持Hardware 版本8.VMware不推薦給桌面虛擬機(jī)配置多個(gè)vCPU.配置多個(gè)vCPU? 為單個(gè)虛擬機(jī)配置多個(gè)CPU將對(duì)ESX協(xié)調(diào)CPU的時(shí)間輪換產(chǎn)生影響. 提高單個(gè)虛擬機(jī)的CPU無

21、疑為降低ESX主機(jī)的虛擬機(jī)整合比. VMware推薦盡量少設(shè)置多個(gè)vCPUs 除非是必須需要多個(gè)CPU來處理比如多媒體轉(zhuǎn)換播放的應(yīng)用.另外，1 vCPU多個(gè)核比多個(gè)單核的vCPU效率更高.配置更多的內(nèi)存? 給虛擬及配置更多的內(nèi)存會(huì)對(duì)存儲(chǔ)的使用造成很大的基于vmswap 文件和Windows paging files的浪費(fèi).分配太少內(nèi)存又會(huì)影響到用戶的體驗(yàn). 我們推薦盡量減少對(duì)內(nèi)存的過量分配，減少系統(tǒng)的pagefile的大小，采用disposable磁盤減少pagefile的占用和盡量避免暫停虛擬機(jī)。(swapfile = configured reservation，pagefile 大小一般

22、在256-內(nèi)存之間)桌面池電源策略. (保持虛擬桌面一直開機(jī)可以減少IO風(fēng)暴和加速用戶登陸)虛擬桌面顯存的大小是在View的桌面池里進(jìn)行設(shè)置的.如果使用PCoIP遇到一些限制, 請(qǐng)放心使用RDP！桌面操作系統(tǒng)的設(shè)計(jì)虛擬桌面的操作系統(tǒng)應(yīng)該使用最新patch版本的批量License(VL). 通常情況下：Microsoft Windows XP Professional SP3 (VL) or Windows 7 SP1 Enterprise (VL). 根據(jù)具體需要選擇32位版本還是64位版本.安裝好系統(tǒng)之后，需要對(duì)系統(tǒng)進(jìn)行優(yōu)化XP/Windows7 優(yōu)化桌面系統(tǒng)的優(yōu)化 - XP桌面系統(tǒng)優(yōu)化 W

23、indows7Windows 7 優(yōu)化請(qǐng)參考: VMware-View-OptimizationGuideWindows7-EN.pdf 并運(yùn)行pdf附件中帶的腳本. Windows 7 優(yōu)化FromMicrosofts Jonathan Bennett: 下列網(wǎng)站提供了較好的關(guān)于VDI 優(yōu)化和規(guī)劃的報(bào)告: 在Windows7中，不能像XP那樣對(duì)default user進(jìn)行定制! 建議采用腳本或者組策略來做.Tips: 桌面部署方式- Quickprep還是Sysprep采用quickprep還是sysprep?Tips: NewSID is retired. 核心提示： 不在域中，同SID沒

24、有問題。在域中，請(qǐng)確保域控沒有同SID。協(xié)議：RDP or PCoIPRDP & PCoIP比較單個(gè)RDP會(huì)話的最小帶寬是30Kbps, 放多媒體內(nèi)容則需要200Kbps. 一個(gè)好的參考是普通用戶平均需要100-150kbps. 中度和高負(fù)載用戶 (圖形密集的應(yīng)用) 在200-250Kbps.PCoIP 協(xié)議和RDP協(xié)議最大的區(qū)別在于它的自適應(yīng)性和其使用的是UDP協(xié)議。這種特性促使PCoIP能提供更好的用戶體驗(yàn)。對(duì)PCoIP, Teradici 建議對(duì)每個(gè)用戶會(huì)話提供平均250-300Kbps. 單個(gè)用戶會(huì)話最高可能會(huì)跳到500Kbps-1Mbps. 通過使用客戶端的cache和禁用無損特性，

25、能節(jié)省高達(dá)75%的帶寬。高網(wǎng)絡(luò)延遲導(dǎo)致虛擬桌面的刷新緩慢，影響用戶體驗(yàn). 對(duì)單個(gè)操作任務(wù)例如鍵盤操作，鼠標(biāo)操作，系統(tǒng)的反應(yīng)時(shí)間應(yīng)該少于150ms. 理想的操作延遲應(yīng)該在0 to 150ms之間. 當(dāng)網(wǎng)絡(luò)延遲達(dá)到200ms時(shí)，用戶體驗(yàn)會(huì)下降. 當(dāng)網(wǎng)絡(luò)延遲超過250ms后, 用戶體驗(yàn)已經(jīng)沒有保證。（最多不能超過250ms)當(dāng)你需要使用下列功能的時(shí)候，可以考慮使用RDP協(xié)議serial ports redirectionLocal drive mappingSome legacy applications(if issues with PCoIP)Multimedia on windows7（nee

26、d client support)PCoIP 仍然在快速進(jìn)化PCoIP優(yōu)化（必做）根據(jù)實(shí)際情況設(shè)計(jì)網(wǎng)絡(luò)帶寬（WAN網(wǎng)接入）網(wǎng)絡(luò)接入View的連通中注意問題每一個(gè)View Connection server 都必須和所有的vCenter和虛擬桌面保持網(wǎng)絡(luò)連通.虛擬桌面必須能解析View連接服務(wù)器的全名.(FQDN) View Clients端必須能通過RDP或者PCoIP連通虛擬桌面（直連），或者能夠連通View安全服務(wù)器（如果采用Tunneling模式）View連接服務(wù)器必須能解析所有vCenter服務(wù)器的FQDN.網(wǎng)絡(luò)應(yīng)針對(duì)PCoIP作優(yōu)化.Tips: DNS 在View環(huán)境中非常重要.確保

27、你所有的DNS服務(wù)器都能解析所有ViewManager的FQDN. (主從DNS）ViewManager能解析vCenter的FQDN.網(wǎng)絡(luò)端口碰到過黑屏然后斷開的情況嗎?99%的可能性是因?yàn)榉阑饓蛘呔W(wǎng)絡(luò)根本不通.內(nèi)外網(wǎng)接入VMware 當(dāng)前不推薦使用tunneling PCoIP 的基于TCP的SSL VPN. 這種方案完全較少了基于UDP協(xié)議的PCoIP帶來的好處。你可以選擇基于 UDP 的VPN方案或者可以使用完全免費(fèi)的View安全服務(wù)器VPN 還是 安全服務(wù)器負(fù)載均衡當(dāng)你配置LB設(shè)備的時(shí)候，你需要知道這些信息以配置設(shè)備負(fù)載均衡使用場景例如：當(dāng)你既需要企業(yè)內(nèi)部直連又需要外部連接的時(shí)候，

28、你需要各自的連接服務(wù)器以滿足要求。Tips: 雙活View設(shè)計(jì)借助于Load balancing, 可以很方便的實(shí)現(xiàn)異地容災(zāi)和雙活View Manager設(shè)計(jì)(connection server, security server, transfer server)View連接服務(wù)器To configure the Java heap size the following changes must be made in the registry:HKLMSOFTWAREVMware, Inc.VMware VDMPluginswsnmtunnelServiceParams -Xms128m -X

29、mx1024m -Dsimple.http.poller=simple.http.GranularPoller .vmware.vdi.front.SimpleConfigurator大規(guī)模的部署VCS需要調(diào)優(yōu)以滿足要求View連接服務(wù)器配置添加vCenter的信息你可以根據(jù)具體ESX的個(gè)數(shù)來修改并發(fā)數(shù)的默認(rèn)值View連接服務(wù)器設(shè)置vCenter 全局設(shè)置改變SSO超時(shí)的設(shè)置。View5.0默認(rèn)為15分鐘Start the ADSI Edit utility on your View Connection Server host.Select or connect to DC=vdi, DC=

30、vmware, DC=int.On the object mon, OU=Global, OU=Properties, set the pae-SSOCredentialCacheTimeout attribute to the new SSO timeout limit in minutes.The default value is -1, which means that no SSO timeout limit is set. A value of 0 disables SSO.Tips: View傳輸服務(wù)器（如果使用離線桌面）配置要求全局策略View的管理員模式（文件夾）Use bes

31、t practices for managing administrator users and groups to increase the security and manageability of the View environment.Because the Administrator role contains all privileges, assign it to a single user or to a limited set of users. Choose a local Windows user or group to have the Administrator r

32、ole.Create new user groups for administrators. Avoid using Windows built-in groups or other existing groups that might contain additional users or groups.Because it is highly visible and easily guessed, avoid using the name Administrator when creating administrators.Create folders to segregate sensi

33、tive desktops. Delegate the administration of those folders to a limited set of users.Create separate administrators who can modify global policies and View configuration settings.Note that View folders are not the same as vCenter Server folders where virtual machines are placed.創(chuàng)建獨(dú)立的View管理賬戶。根據(jù)需要?jiǎng)?chuàng)建

34、多個(gè)獨(dú)立子管理員進(jìn)行不同部門的管理。vSphere規(guī)劃設(shè)計(jì)vSphere 架構(gòu)Separate Virtual Desktop,View Management workload on different clusters.將管理服務(wù)器和虛擬桌面分布在不同的群集中主機(jī)設(shè)計(jì)(CPU,Memory)CPU NeededMemory NeededPhysical CPUPhysical Memory主機(jī)設(shè)計(jì)(CPU,Memory)VMware 推薦一個(gè)群集8臺(tái)ESX (in accordance with View Composer limits), 提供大約1000臺(tái)虛擬桌面, 其中包括一臺(tái)供HA使

35、用. 為什么有時(shí)候你發(fā)現(xiàn)ESX的內(nèi)存使用比較高？但是上面的虛擬機(jī)內(nèi)存使用率卻不高？ESX 內(nèi)存管理技術(shù):允許過載TPSharing, Baloon, Vmkernel swap通常情況下實(shí)際CPU的使用小于60%存儲(chǔ)設(shè)計(jì) 虛擬機(jī)磁盤介紹存儲(chǔ)設(shè)計(jì)FSFCLCReplicaVMFS3264 - 12832NFS250#VM Per datastore第一次部署之后確保各個(gè)Datastore上分布的虛擬機(jī)的個(gè)數(shù)比較相當(dāng)。另外存儲(chǔ)的容量使用應(yīng)該 DOMAINviewdfsprofiles%USERNAME%Home Mapped to H drive DOMAINviewdfshome%USERNAM

36、E%Additionally, implement redirected folders by configuring the following GPO settings:User Configuration Windows Settings Folder Redirection configure application data, desktop, my documents to basic redirect to, for example: DOMAINviewdfshome%USERNAME%User Configuration Administrative Templates Sy

37、stem User Profiles Exclude Directories from Roaming Profile add the directories that have been redirected Application Data, My Documents, DesktopComputer Configuration Administrative Templates System Logon Always wait for network enabledThese settings optimize the roaming profile solution by reducin

38、g the amount of data in the profile and also verifying the desktop has network connectivity before attempting to load the roaming profile (thus removing the possibility of a temporary local profile).最佳實(shí)踐: 使用profile roaming 和 文件夾重定向1.采用 DFS/file 文件服務(wù)器2.對(duì)用戶進(jìn)行存儲(chǔ)配額限制3.控制用戶權(quán)限防病毒（掃描和更新）避免負(fù)載風(fēng)暴,如同時(shí)更新病毒定義和同時(shí)

39、掃描病毒。通常情況下VMware 推薦大的病毒升級(jí)應(yīng)該通過更新父模板虛擬機(jī)來操作.防病毒軟件不應(yīng)掃描VMware View logs.3. 采用VDI的防病毒方案：vShield endpoint + 病毒廠商提供SVM。Trend Micro - version 8.0 GAd in January Bit Defender - GAd in February Kaspersky - GA is targeted for early April. McAfee - Their GA is also targeted for early/mid April. Sophos - Early 2n

40、d HalfSymantec - Late 2nd Half (probably Q4)2012年主流防病毒廠商都會(huì)支持vSheild Endpoint虛擬機(jī)角色應(yīng)用程序操作系統(tǒng)內(nèi)核BIOS虛擬機(jī)角色應(yīng)用程序操作系統(tǒng)內(nèi)核BIOS虛擬機(jī)角色應(yīng)用程序操作系統(tǒng)內(nèi)核BIOSSVM操作系統(tǒng)VMware vSphereAV加強(qiáng)型自檢2012年，主流廠商都會(huì)支持vShield Endpoint, 請(qǐng)咨詢第三方廠商虛擬打印 兩種方式Thinprint .thinprint engin （打印重定向的技術(shù)）.support only on Windows client. . Printer redirectio

41、n installs a universal print driver in the guest, and sends print jobs over a secure session channel to the client, which does the printing on behalf of the guest. In this case the guest acquires a list of printers from the client when the session starts.2. Location based printing （網(wǎng)絡(luò)打印）With locatio

42、n-based printing, the clients MAC address is used to look up a list of local printers, and the guest prints directly to them. This requires that the client-local printers be reachable from the guest. Support all clients.VoIP 語音視頻電話View offers the ability for unified communications vendors to plug into the View Client and integrate VoIP into a View desktop without needing to run the VoIP tra