I want to perform Linux fstrim or Windows degrag retrim on a file system within VM to shrink VMware vSphere thin disks. However this should be performed only if there is no snapshot present as fstrim-ing a snapshoted file system will cause it to grow to full size on VMware vSphere thin disks.
Limitation: VM guest OS does not have access to vSphere/vCenter management interfaces.
Is there a way to detect presence of snapshot from within VM guest OS - for example via via VMware tools?
Scenario: I need to publish internal Active Directory to SaaS platforms over public Internet. I'm going to use OpenLDAP to filter access. Access to OpenLDAP will be limited by firewall IP whitelist.
I've managed to configure OpenLDAP to only allow access to required objects (groups and accounts required to SaaS platform, only required attributes).
However I cannot figure out, if I can limit which account can authenticate to proxy. So far any account in Active Directory can bind. I don't fully trust the SaaS platforms and I'd like to limit possible password guess attacks via SaaS platforms. I've tried following syntax, but still anyone can bind:
access to dn.exact="objectDN"
by * auth
access to *
by * none
Is there a way to limit accounts allowed to authenticate?
In one site, we have vSphere hosts with 2 10G NICs.
Switches are Cisco C3850 series and MPIO works like a charm - tested (failover on path level etc…).
We deployed similar configuration in another site a few days ago. Same vSphere configuration, same NICs. However this time this configuration does not work properly.
Initiators can only access Targets in the ports of the same switch (that initiator is connected to) but not in the ports of the other switch.
With tcpdump I can see that vmkernel ports do discovery to all targets (done by vSphere according to documentation), static discovery targets do appear (SAN sees that it has been poked), however paths are never created and esxcli shows 0x0004 error (transport error?) for targets in another switch. This is quite hard to investigate as well as we can't directly see HBA traffic. Software iSCSI works like a charm however (bound to same vmkernel ports).
Switches are Cisco Nexus this time (I'll update the model when I know it) and stacking is VCP (?) instead of C3850 native(?). Otherwise sites are mostly the same but IMHO differences are so minor not to make a difference. Just to point out some:
I've searched VMware documentation and I've found nothing that says that converged networking shouldn't work. We consulted our networking partner but they didn't understand how it currently worked and thought that it shouldn't work at all.
Is this configuration normal or are we depending on some implementation quirk of C3850 that doesn't work on other switches? Or is there something obviously wrong with switches?
One server should accept connection to certain a port from only one IP. However it accepts this connection from any IP even without any explicit rules. While manually disabling-enabling each rule to find the offending one would be an option, it is tedious and might affect operations.
Default Windows Firewall connection logging only shows IF a connection was allowed or dropped. I want to find out WHY it was allowed or dropped (what rules matched the connection).