2

Continuing on with my series of beginning system administration questions currently this is what I have to work with:

Dual processor 3 GHz Xeon 64-bit single core, 4 GB RAM server

  • Domain Controller
  • DNS Server
  • File Server
  • IIS - ASP.NET
  • SQL Server and Reporting Services
  • Internally accessible only

Single processor dual-core 3 GHz Xeon 64-bit, 1 GB RAM server

  • VPN
  • Team Foundation Server
  • Externally Accessible (hence why VPN)

As my role is truly software development with system administration being a sub-role, as I was adding these services I really started to realize how cramped the primary server was becoming. Especially when I found out that Team Foundation Server won't even allow itself to be installed on a Domain Controller.

At this point I really started to look into Hyper-V and virtualization. However, I'm not really sure which way would be the best to allocate the machines if I go down the virutalization route. Should I upgrade the RAM on both servers and virtualize everything?

If I go that route does it become that much of an issue for cold starts for the Domain Controllers to be virtual?

If I make one of the virtual machines handle VPN as well, does that increase the security risk to the domain since the machine would house other virtual machines also? Along this question also, what is deemed acceptable to have installed for a network on an externally facing server?

Finally what level of separation becomes more overhead than beneficial? Would it be worthwhile to have each main server role in its own VM?

Improve this question

2 Answers 2

Reset to default
5

Should I upgrade the RAM on both servers and virtualize everything?

Yes

If I go that route does it become that much of an issue for cold starts for the Domain Controllers to be virtual?

Add the domain controller role to the host Hyper-V machine. This will let you authenticate even if the VM Domain Controller is down.

If I make one of the virtual machines handle VPN as well, does that increase the security risk to the domain since the machine would house other virtual machines also?

Nope, but if you're paranoid add an additional NIC and dedicate that to the VPN VM. Each VM is just like a regular machine. Each NIC becomes a switch uplink port.

Along this question also what is deemed acceptable to have installed for a network on an externally facing server?

Generally speaking as little as possible. I'm not sure what details you are looking for here. I'd definitely make the VPN server a seperate VM. The rest of the roles/servers you want to run you can divide up as you like. The more granular you are in the roles the greater flexibility you have to divide up resources, the downside is that there is more overhead than if roles/servers were combined.

Improve this answer
7
  • Is the DC role available on the free Hyper-V edition or only on standard and above?
    – Chris Marisic
    Jul 10, 2009 at 12:22
  • The free version, "Hyper-V Server", cannot be a DC or indeed much of anything else.
    – John Rennie
    Jul 10, 2009 at 13:20
  • Sadly, I figured that would be the case.
    – Chris Marisic
    Jul 10, 2009 at 13:41
  • Hyper-V adds $28 bucks to the cost of the OS license you already have to have. In fact you have to actually buy the non hyper-v version to get the $28 taken off.
    – Jim B
    Jul 10, 2009 at 16:49
  • There is a free version of Windows 2008 that only supports Hyper-V and basically no other server roles.
    – Chris Marisic
    Jul 11, 2009 at 22:31
2

Neither of those servers look terribly powerful. In your place I would (actually I did!) look for a Poweredge 2950 or 2900 on eBay and build it up as a Hyper-V server. Make sure you get one with at least a years dell warranty on it; the warranty is transferable and you can check it on the Dell web site using the server tag number.

I wouldn't put Hyper-V on the DC. I would keep the DC and file server separate. The extra NICs needed for Hyper-V tend to cause problems on the DC because they get into the DNS database.

The real benefit of Hyper-V is management. You can use it to separate roles so for example an update to TFS that requires a rebot doesn't affect Exchange/File services/etc. It also makes server backup easy and considerably reduces the stress of service packing.

JR

Re Chris' question about synthetic NICs:

The term "synthetic" just means a virtualised device, though it's a particular type of virtualisation. See http://technet.microsoft.com/en-us/magazine/cc895595.aspx for lots on info. Search for the section headed "Device-Sharing Architecture".

Hyper-V uses a technique called para-virtualisation. There's lots of argument about to what extent it really is para-virtualised, but the point of para-virtualisation is that the device virtualisation is done by a layer that lies under even the host OS. That means the host OS can see and use the virtual devices. As long as you don't bind any of the host NICs to a virtual network they just look like normal NICs to the host. But when you bind a NIC to a virtual network it gets replaced by a synthetic (i.e. virtual) NIC even for the host.

Incidentally, this is why MS recommend you always leave one real NIC not bound to a virtual network, because performance of that unvirtualised NIC will be better than a synthetic NIC.

So it's an underappreciated aspect of Hyper-V that even the host is in effect a virtual machine.

Improve this answer
7
  • Good point about extra NICs causing confusion in DNS, tho this makes me want the DC in a VM rather than a separate machine. 2950 is a fantastic (tho end-of-life now) virtual host for small offices.
    – Kara Marfia
    Jul 10, 2009 at 12:48
  • I took a look on eBay about the 2950 like you mentioned and saw many included dual integrated nics, I've never worked with rack hardware much how upgradable are these servers for adding additional nics? I'm also glad you brought this fact up since I hadn't yet realized that I needed a standalone nic for every VM i wanted on the domain.
    – Chris Marisic
    Jul 10, 2009 at 13:32
  • @Chris: you don't need a separate NIC for each VM. Sorry if I gave that impression. The VMs use a virtual network that is bound to a physical NIC and the VMs would usually share that virtual network. MS recommend that you keep one NIC not bound to a virtual network, so you need only two NICs. You'd only need to add extra NICs if you wanted VMs to live in separate network segments, or I suppose if you wanted to team NICs for extra speed. Anyhow the 2950 has 3 PCIe slots if you did want to add extra network cards.
    – John Rennie
    Jul 10, 2009 at 14:07
  • Any extra nics that are bound to virtual switches do not even have Ip bound to them. If you are seeing the nics show up in DNS it means your hyper-v install is hosed, or someone enabled IP on those nics. I can't add a pic to a comment but you should see 1 nic with access type internet and any other nics (set up for hyper v) as access type no internet access
    – Jim B
    Jul 10, 2009 at 17:04
  • @Jim: when you bind a real NIC to a virtual network that real NIC does indeed have IP unbound, however in exchange the host sees a new synthetic NIC (on the new virtual network). It's this synthetic NIC that gets into DNS when you don't want it to. You can safely disable the synthetic NIC is the host doesn't need it.
    – John Rennie
    Jul 11, 2009 at 6:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.