Hi, I'm trying to create certificate for SRM but I've some difficulties.

I'm creating those with a windows CA.

SRM is installed in the same server where vCenter is.

The vcenter certificate have fqdn as CN, I've defined only OU, O, S, C fields (and they're short because I've read a problem can be SubjectName >80 chars. I've added to this a SAN dns with hostname without domain (to access the vcenter with hostname only without getting certificate errors).

SRM certificate are generated starting with the same private key, The only things that change is the SAN with dns=fqdn of SRM server (that is the same of vcenter server in my case). They have CN=SRM and the OU/O/S/C field exactly equal to the vcenter certificate.

Enhanced Key Usage is :Server Authentication (1.3.6.1.5.5.7.3.1) Client Authentication (1.3.6.1.5.5.7.3.2).

I've used the same Enhanced Key Usage also for vcenter server certificate (can this be a problem?).

Installation completed without errors on the 2 sites. I log in to SRM and when I try to pair the sites I get an error :

Error:SRM server 'KUPIT-Rome' cannot do a pair operation. The reason is: Permission to perform this operation was denied.

See the error stack for details on the cause of this problem.
Error Stack
Call "DrRemoteSiteManager.ProbeDrConnection" for object "DrRemoteSiteManager" on Server "itromis10.q8int.com" failed.
Permission to perform this operation was denied.

In the soruce site vmsare-dr log there's:

2012-01-31T18:24:22.536+01:00 [10152 verbose 'SessionManager'] Logging in SRM session = '52150', VC session = '525b9', user = 'Q8INT\itadminvm', full name = 'Q8INT\itadminvm', locale = 'en_US'
2012-01-31T18:24:22.598+01:00 [04092 verbose 'SessionManager'] Local and remote versions are the same. Talking with version vim.version.version7
2012-01-31T18:24:22.661+01:00 [10152 info 'SessionManager'] VC Connection: Logging in extension by subject name
2012-01-31T18:24:22.661+01:00 [10152 info 'SessionManager'] VC Connection: Logged in session 5230c0b5-91f5-0807-554c-a51951beb753
2012-01-31T18:24:22.661+01:00 [10152 info 'SessionManager'] VC Connection: Impersonating user 'Q8INT\itadminvm'
2012-01-31T18:24:22.676+01:00 [10152 info 'SessionManager'] VC Connection: Impersonated user: 'Q8INT\itadminvm'
2012-01-31T18:24:22.676+01:00 [10152 info 'LocalVC'] [PCM] Value used for WaitForUpdatesTimeout: 900
2012-01-31T18:24:22.676+01:00 [10152 verbose 'LocalVC'] [PCM] Initialized without an active connection
2012-01-31T18:24:22.676+01:00 [04092 info 'LocalVC'] [PCM] Received reconnect notification - incrementing connection version to 1
2012-01-31T18:24:22.676+01:00 [04092 verbose 'LocalVC'] [PCM] Recreating filters for all '0' currently registered filter requests.
2012-01-31T18:24:22.676+01:00 [10152 info 'authorize'] [Auth]: User Q8INT\itadminvm
2012-01-31T18:24:22.676+01:00 [04092 verbose 'LocalVC' opID=71f1cc1f] [PCM] Starting new wait-for-updates monitor for connection version '1'
2012-01-31T18:24:22.676+01:00 [10152 info 'SessionManager'] Session '52150' successfully logged in for VC session '525b9' and user 'Q8INT\itadminvm'.
2012-01-31T18:24:22.676+01:00 [04092 verbose 'LocalVC'] [PCM] Reconnect handling complete
2012-01-31T18:24:22.676+01:00 [04092 info 'RoleRegistry'] Initializing by registering for updates to the 'roleList' property on AuthorizationManager 'AuthorizationManager'.
2012-01-31T18:24:22.676+01:00 [04092 verbose 'LocalVC'] [PCM] Using token '0' for pending filter creation
2012-01-31T18:24:22.676+01:00 [04092 verbose 'RoleRegistry'] RoleRegistry is registered for updates with token '1'.
2012-01-31T18:24:22.723+01:00 [04092 verbose 'RoleRegistry'] Updating role map with '24' roles.
2012-01-31T18:24:23.503+01:00 [08224 info 'OptionManager'] 28 setting values retrieved
2012-01-31T18:24:35.656+01:00 [05684 info 'DrRemoteSiteManager'] Probing URL itnapis10.q8int.com:80 with tunnelPath '/sdkTunnel' and thumbprint 'VC'
2012-01-31T18:24:35.672+01:00 [05684 error 'Default'] SSLStreamImpl::DoClientHandshake (0be0a5f8) SSL_connect failed. Dumping SSL error queue:
2012-01-31T18:24:35.672+01:00 [05684 error 'Default'] [0] error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
2012-01-31T18:24:35.703+01:00 [05684 info 'DrRemoteSiteManager'] Probe URL found DNS name 'itnapis10.q8int.com', thumbprint '36:4A:0B:E3:58:6B:E3:0D:57:26:1D:1E:82:1A:16:D0:6A:35:E5:85', and trusted certificate
2012-01-31T18:24:35.734+01:00 [07036 verbose 'DrRemoteSiteManager'] Local and remote versions are the same. Talking with version vim.version.version7
2012-01-31T18:24:35.750+01:00 [05684 info 'DrRemoteSiteManager'] ProbeUrl found remote server type VC
2012-01-31T18:24:35.750+01:00 [05684 info 'DrRemoteSiteManager'] Probing URL itnapis10.q8int.com:80 with tunnelPath '/sdkTunnel' and thumbprint 'VC'
2012-01-31T18:24:35.781+01:00 [05684 error 'Default'] SSLStreamImpl::DoClientHandshake (0be0b800) SSL_connect failed. Dumping SSL error queue:
2012-01-31T18:24:35.781+01:00 [05684 error 'Default'] [0] error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
2012-01-31T18:24:35.812+01:00 [05684 info 'DrRemoteSiteManager'] Probe URL found DNS name 'itnapis10.q8int.com', thumbprint '36:4A:0B:E3:58:6B:E3:0D:57:26:1D:1E:82:1A:16:D0:6A:35:E5:85', and trusted certificate
2012-01-31T18:24:35.843+01:00 [07228 verbose 'DrRemoteSiteManager'] Local and remote versions are the same. Talking with version vim.version.version7
2012-01-31T18:24:35.859+01:00 [05684 info 'DrRemoteSiteManager'] ProbeUrl found remote server type VC
2012-01-31T18:24:35.984+01:00 [10300 verbose 'DrRemoteSiteManager'] Local and remote versions are the same. Talking with version vim.version.version7
2012-01-31T18:24:36.077+01:00 [05684 info 'DrRemoteSiteManager'] VC Connection: Logging in extension by subject name
2012-01-31T18:24:36.093+01:00 [05684 info 'DrRemoteSiteManager'] VC Connection: Logged in session 5214ff66-467e-4cee-1859-f184281faa7f
2012-01-31T18:24:36.109+01:00 [05684 info 'DrRemoteSiteManager'] Probing URL itnapis10.q8int.com:80 with tunnelPath 'itnapis10.q8int.com:8095' and thumbprint 'DR'
2012-01-31T18:24:36.124+01:00 [05684 error 'Default'] SSLStreamImpl::DoClientHandshake (0bf1a3e0) SSL_connect failed. Dumping SSL error queue:
2012-01-31T18:24:36.124+01:00 [05684 error 'Default'] [0] error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
2012-01-31T18:24:36.155+01:00 [05684 info 'DrRemoteSiteManager'] Probe URL found DNS name 'itnapis10.q8int.com', thumbprint 'F7:BF:1F:7C:66:9B:EC:70:7E:AD:9B:DF:19:86:B7:FE:55:C8:2C:76', and trusted certificate
2012-01-31T18:24:36.202+01:00 [05684 info 'DrRemoteSiteManager'] ProbeUrl found remote server type DR
2012-01-31T18:24:36.233+01:00 [05684 info 'DrRemoteSiteManager'] SRM Connection: Logging in.
2012-01-31T18:24:36.436+01:00 [05684 warning 'DrRemoteSiteManager'] Failed while probing SRM server.: (vim.fault.NoPermission) {
[#1] --> dynamicType = <unset>,
[#1] --> faultCause = (vmodl.MethodFault) null,
[#1] --> object = 'dr.ServiceInstance:DrServiceInstance',
[#1] --> privilegeId = "System.View",
[#1] --> msg = "Permission to perform this operation was denied.",
[#1] --> }

On the destination site this is the log:

2012-01-31T18:24:35.587+01:00 [05920 error 'Default'] SSLStreamImpl::DoServerHandshake (0701e5f8) SSL_accept failed. Dumping SSL error queue:
2012-01-31T18:24:35.587+01:00 [05920 error 'Default'] [0] error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate
2012-01-31T18:24:35.587+01:00 [05920 error 'SoapAdapter.HTTPService'] accept failure class Vmacore::Ssl::SSLException(SSL Exception: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate) on stream (null)
2012-01-31T18:24:35.587+01:00 [05920 error 'SoapAdapter.HTTPService'] stream is NULL - no read scheduled
2012-01-31T18:24:35.712+01:00 [16880 info ''] VC Connection: Session: 5214f, user com.vmware.vcDr, Active? true
2012-01-31T18:24:35.712+01:00 [16880 verbose 'SessionManager'] Logging in SRM session = '52729', VC session = '5214f', user = 'com.vmware.vcDr', full name = 'com.vmware.vcDr', locale = 'en_US'
2012-01-31T18:24:35.790+01:00 [13744 verbose 'SessionManager'] Local and remote versions are the same. Talking with version vim.version.version7
2012-01-31T18:24:35.883+01:00 [16880 info 'SessionManager'] VC Connection: Logging in extension by subject name
2012-01-31T18:24:35.883+01:00 [16880 info 'SessionManager'] VC Connection: Logged in session 52016432-a7ab-07fa-2518-9aac0414f2f7
2012-01-31T18:24:35.883+01:00 [16880 info 'LocalVC'] [PCM] Value used for WaitForUpdatesTimeout: 900
2012-01-31T18:24:35.883+01:00 [16880 verbose 'LocalVC'] [PCM] Initialized without an active connection
2012-01-31T18:24:35.883+01:00 [13744 info 'LocalVC'] [PCM] Received reconnect notification - incrementing connection version to 1
2012-01-31T18:24:35.883+01:00 [13744 verbose 'LocalVC'] [PCM] Recreating filters for all '0' currently registered filter requests.
2012-01-31T18:24:35.883+01:00 [16880 info 'authorize'] [Auth]: User com.vmware.vcDr
2012-01-31T18:24:35.883+01:00 [13744 verbose 'LocalVC' opID=fd6362f] [PCM] Starting new wait-for-updates monitor for connection version '1'
2012-01-31T18:24:35.883+01:00 [13744 verbose 'LocalVC'] [PCM] Reconnect handling complete
2012-01-31T18:24:35.883+01:00 [13744 info 'RoleRegistry'] Initializing by registering for updates to the 'roleList' property on AuthorizationManager 'AuthorizationManager'.
2012-01-31T18:24:35.883+01:00 [13744 verbose 'LocalVC'] [PCM] Using token '0' for pending filter creation
2012-01-31T18:24:35.899+01:00 [13744 verbose 'RoleRegistry'] RoleRegistry is registered for updates with token '1'.
2012-01-31T18:24:35.899+01:00 [16880 verbose 'LocalVC'] Shutting down connection
2012-01-31T18:24:35.899+01:00 [16880 verbose 'LocalVC'] [PCM] Stopping...
2012-01-31T18:24:35.899+01:00 [16880 warning 'VixVcDomain'] VIX connection already logged out
2012-01-31T18:24:35.899+01:00 [13744 info 'RoleRegistry'] Shutting down...
2012-01-31T18:24:35.899+01:00 [13744 error 'LocalVC'] [PM] Cannot unregister callback for filter token '1' because PropertyMonitor is stopped
2012-01-31T18:24:35.899+01:00 [16880 error 'SessionManager'] Exception in login:
[#1] --> (vim.fault.NoPermission) {
[#1] --> dynamicType = <unset>,
[#1] --> faultCause = (vmodl.MethodFault) null,
[#1] --> object = 'dr.ServiceInstance:DrServiceInstance',
[#1] --> privilegeId = "System.View",
[#1] --> msg = "",
[#1] --> }
2012-01-31T18:24:35.946+01:00 [18772 info 'vmomi.soapStub[1]'] Resetting stub adapter for server TCP:itnapis10.q8int.com:80 : Closed
2012-01-31T18:24:35.946+01:00 [18772 warning 'vmomi.soapStub[1]'] Terminating invocation: server=TCP:itnapis10.q8int.com:80, moref=vmodl.query.PropertyCollector:propertyCollector, method=createFilter

Anyone have an idea of what's wrong?

Thanks

Francesco

Hi,

i got one question on SRM Storage replication

i have dual storage EMC Clarion & VNX at both sites Primary & DR

in the above case how the configuration difference would be for SRA

thanks,

SD

Hi All,

I am planning for implementation of SRM 5.1 in vShere 5.1 and have little doubt about authentication of all the components involved here, i have AD in the environment already.

We need authentication at multiple level

vCenter service, vCenter DB

SRM Service, SRM DB

SSO

etc

I want to know what is the best practice for the authentication ?

Creating a single Service Account and use it for everything vCenter, DB, SRM, SSO etc.

or how to manage this part, I am looking for some best practice in this area, please help.

thanks,

SD

We are evaluating a Cloud service that uses SRM to provide disaster recovery.

Since we are just starting to think about it and sice we have Veeam Backup and Replicator already, we will find ourself with two replication technology to choose between and so an obvious question arises: what is more efficent and manageble between the two?

Thanks in advance.

Hello Folks,

I am looking out for below information for designing a solution leveraging VMware SRM.

1.)  How much compute (Processors,memory.space) I need to configure for each SRM virtual machine at both sites.

2.)  Does SRM comes inbuilt with any database or i need to purchase it? Assuming we need to procure sql 2008 is it recomended to install sql on same VM thats host SRM software or shd be make datbase run in isolation.

3.) For designing DR for exchange 2010 , AD , which will be best fit storage based replication or vsphere replication or native application based replication.

I've looked all around for specific  limits to the size of a VM that can be protected via SRM w/vSphere Replication, but I do not see such documentation. I did see the release notes of 5.0.2 stating being able to handle vmdks > 255G better now.

I originally used 5.0.1  and had a lot of problems trying to sync a 3TB Guest 2,  1.5TB vmdks but i finally go tit working, though it took days and multiple attempts to accomplish.

Now a customer is asking for 16TB to be protected. Not sure how the breakdown of VMDK's will be, but I came up with some rough numbers ranging from an initial sync ranging from 12-21 weeks.

anyone have any experince with large drives a vSphere Rpelication?

Hi All,

We have just installed SRM on our enviroment and I am trying to test recovery plans at the moment. It would be a great help if anyone could answer the below:

Our enviroment is 2 esxi5.1 hosts in the production site and 2 esxi5.1 hosts in the disaster recovery site.

1. On the protected site can you vMotion a server to another host without affecting the replication job?

2. If I have a recovery plan with 2 servers and I run a test of the plan one server will be booted up on esxi_host1 and the other is booted up on esxi_host2. This means if I want them to use a isolated network they cannot communitcate. Is there a way to choose what hosts to use on the DR site during a test of a recovery plan?

Regards,

Jonathan

Hi,

I am stumpted on the final part of the vCenter Virtual Replication Adapter OVA installer.

I've installed SRM and the EqualLogic Virtual Storage Manager - the final part is the VMWARE VRA - on the final screen is asks me for a "vCenter Extension Installation" - something I am not familiar with.

It has two drop down options - a) vCenter Extension Service - or - b) Select Provider

I cannot select A, and if I select B, then wizard gets to the end with an error

"The virtual machine <machinename> has a required vService dependency 'vCenter Extension Installation' which is not bound to a provider"

This is not something I've configured before and am a little bit lost on where to go next.

Any ideas? Images attached....

Dear All, I am implementing SRM 5.1.1 into production and I have some doubts/ questions in my mind. I would really appreciate if somebody can clarify these for me... Please?

Site A (Protected):

1. vCenter 5.1 VM
2. SSO VM
3. vCenter DB & SRM DB VM
4. SRM VM

Site B (Recovery):

1. vCenter 5.1 VM
2. SRM VM

Questions:

1. Should I create another DB and SSO server for vCenter at site B? Or it can use the ones at site A? If it uses SIte A DB and SSO, will SRM work when we do planned DR or during disaster?
2. Should vCenter be in linked mode or Separate at each site?
3. If we have 3^rd Site (Say Site C) which is also a recovery site. Can we configure SRM in such a way that Site A VMs (Protected Site VMs) and failover to both Recovery Sites? ALso Do I need 3rd vCenter, SSO, DB at 3rd Site?

Many Thanks,

AG

Hello,

I'm implementing SRM 5.1 with NetApp (With SnapMirror) and I have several questions:

- Replication of volumes through the array manager, run correctly

- How do the replication of virtual machines with RDM? can also be done through array manager (with SnapMirror) or better do it with vSphere Replication. Can be performed by vSphere Replication?

- Do any advice for replication of virtual machines in a cluster of Microsoft?

thanks for all!

Hello, we are planning to set up recovery site on our environment. Because of it's price we are not going to use array-based replication. We have 2 windows server 2008 R2 servers as a cluster of file services. To set it up we used bus sharing SCSI drives.(didn't use LUN Mappings). is there would be any problem if I replicate using VR replication these servers to other site? I mean does SRM 5.1 VR replication method supports replication of bus sharing SCSI disks?

Thank you in advance!!

HI,

I have a production site and a DR site which has 2 servers each location. I need to run some applications in DR site as well. actually it is not a completely DR site. It is just like a secondary site. But i want to replicate VMs from production to DR site and DR site to Production site using SRM. so both sites will have other site's VMs. Will this be possible to do with single 25 pack SRM license. less than 10 VMs on each side.

please help me.

Hi all

I am attempting to install the pluggins for SRM so I can start using SRM and testing it before putting it into production.

Our EMC colleague gave me 3 pluggins to install.

These two had to be installed on the vCentre which was done successfully:

emc-vsi-pm-5.3.0-vmware-vsphere-WINDOWS-x86

emc-vsi-sv-5.3.0-vmware-vsphere-WINDOWS-x86

I was then given this and told to install once the top two where installed:

emc-vsi-sra-5.3.0-vmware-vsphere-WINDOWS-x86

But of course it doesnt work and returns message which is attached.

We had an EMC person which was suppose to assist us with this but this did not happen and due to time constraints I have to continue and try it myself.

Our set up

vCentre 5.0 in primary site

vCentre 5.0 in recovery site

SRM 5.0 installed on own server in primary site

SRM 5.0 installed on own server in recovery site

Both sites are linked through SRM successfully.

EMC symmetrix

I have mapped folders, datacentres in the SRM between sites but I am now at the array replication part.

Any help would be great.

Hope I have covered enough information...

Hello,

We're currently looking to begin implementing a SRM solution between our two sites. We've opted to initially use VSphere replication rather than Storage replication for cost reasons. One concern that has been raised while planning this is the performance or resource overhead to our hosts resulting from using the VSphere replication appliances. Can anyone point me to some documentation regarding this, or give me some metrics regarding what kind of overhead we would see? Any info or advice is appreciated.

Thanks,

Hi,

We've recently had to rebuild our VC server which was also a SRM server.

I thought I had got it all done but when I try to configure one of the servers for replication I get the following error

Configure a virtual machine for replication

xxx-FP01

Attempt to configure vSphere Replication for already replicated VM 'xxx-FP01' while creating group 'xxx-FP01'. There is another virtual machine 'xxx-FP01' that has the same instance UUID '5022631c--21e7-1970--04cd-aeda-9d7f0813' as the one that you try to configure.

The existing vSphere Replication is configured for protection site 'xxx-vc02.-mydomain.ie', please refer to the documentation for troubleshooting options.

Any help would be greatly appreciated.

TIA

Kevin

Dear All,

I need help on my situation, testing failover for replicated LUNs on Clarion Storage keeps give failure while creating snaps for LUNs, I tried all solutions such as decreasing number of LUNs on each CG to be 8 LUNs, I increased number of CG because of that I checked each LUN to make sure that it contains VM files on it, but the testing keep fail

What I need to know how I can fix this issue???, also is this affect the real failover, which mean when I do real failover it will fail???, another thing can I do manual test for failover, which mean can I do the snaps for LUNs in recovery site and mount it to ESXi hosts and power on the VMs to check it is working without using test on SRM????

Waiting urgent feedback

Thanks all

Hi,

We like the automation capabilities that SRM gives us for DR and it works really well but we would like to try and perform some form of ping test on each of the recovered virtual machines and email the result.  This would save us time when we perform our checks after the recovery.

Does anyone know if there is a way to perform this type of task using Powercli utilising the list of recovered virtual machines rather than having a static list that needs to be manually updated when a new VM is added or removed?

Cheers

Chris

Hi Folks,

Currently, my company has 2 datacenters. One in NY and one in MA. A decision has been made to close the MA data center and I have been tasked with getting the virtual environment moved over to the NY DC. While, I'd love just to physically move the ESXI hosts via UPS , the other decision that was made was to add new esxi hosts to the NY dc. We will be upgrading the network link between the two sites.

My first thought and maybe a bad one, was to use Converter and try to V2V from one DC to the other. Now, I'm wondering if maybe SRM can do this? I know it's not the purpose for SRM, so maybe my assumption is far-fetched. If SRM can be used, can it just be with host replication? I'm not sure if array based replication is an option yet.

If I'm missing something and there is an easier way, please enlighten me

Thanks

- MN

Hi,

We've performed a couple of failover tests recently using SRM but noticed that a number of the virtual machines power up but have their network cards disconnected.  This appears to be random, affecting different operating systems and including both e1000 NICs and VMXNet3 NICs.

Does anyone have any ideas as to why this would happen and what we can do to rectify it?

Cheers

Chris

Hi All,

I'm trying to add a tab in the vSphere Client side to HomeView.Applications.SiteRecoveryManager.RecoveryPlans
Probably I'm using wrong names for SiteRecoveryManager and RecoveryPlans.

I added a tab successfully to InventoryView.DataCenter so my script is OK.

Can any body help with this subject?

Thanks,

Dror