June 26, 2017 at 13:12Secure workstation based on VDI Huawei FusionCloud Desktop Solution 6.1
We continue to publish materials from the forum “Joint Security of Cloud Solutions for Business” , which we held together with Kaspersky Lab and HUAWEI on May 31 in Moscow. We present the report of Ivan Yudichev from Huawei, "A secure workstation based on VDI Huawei FusionCloud Desktop Solution 6.1."
My name is Ivan Yudichev, I am engaged in Huawei cloud projects and public sector support. I have been doing cloud projects for quite some time, I started when I worked at the customer, somewhere in 2010. Then there was Microsoft, then there was VMware, then, finally, Huawei, where we continue to develop the good traditions of server virtualization and VDI. But today I will talk more about VDI.
For several years, Huawei has intensively developed its cloud product portfolio and these efforts have not been in vain. Today, IDCs, which are difficult to catch in some inadequate assessments, have placed us in Major Players. Three years ago, no one could even think about this, but today our solution in many respects is at the level of, or even better known manufacturers on the market. Let's dwell on the key features in more detail.
Solution architecture. VDI itself is deployed into some kind of cloud environment, theoretically it can work by providing remote access using traditional computers, but when we talk about virtualization of the working environment, usually we are talking about the cloud. And if we are talking about VDI in this section, then the architecture of the solution is as follows. At the lower level there is equipment - servers, storage systems, a network, which are then abstracted using the cloud. Further on, on this cloud platform, we deploy, respectively, the entire set of software, which allows, firstly, deploying virtual machines for users, and secondly, serving as a connection broker for users so that these machines can distribute and automate the process. The basics of VDI, I think, are familiar to you.
We work intensively with partners, for example, with RUVDS, and therefore we can create some kind of, let's say, not boxed solutions, namely solutions aimed at cloud providers. That is, a partner’s personal account, while we provide the infrastructure and ensure the work of the desktop, we offer our effective desktop access protocol (HDP), while receiving all the advantages of using a local domestic cloud.
About the architecture. In principle, many of these components are interchangeable, for example, the equipment may be from another vendor. The hypervisor, theoretically, may also be different, but we still recommend using ours, because we conduct a full testing cycle and guarantee the quality of the final solution. Although, in principle, there may be options.
By thin clients. We, as a single solution provider, naturally supply thin clients as well, but if you already have some workstations that you don’t want to write off, you can safely use them. We have a software client that works under Linux, under Windows, under Mac, in this way we can save and use the existing equipment.
By guest operating systems that we support. Naturally, Windows 7, 8, 10, that is, there is full support for them today. Also, in order to avoid paying for the Microsoft VDA license, and to reduce desktop costs in CapEx, you can deploy virtual desktops based on Windows Server. This is one of the opportunities we provide. There is always a stage of certification, application testing, will they work under Windows Server or not, because there may be nuances. But 90 percent of the cases - it all works fine, both in the client operating system and in the server. And many customers use this method, deploy server operating systems, such as client. Most often, questions arise with some kind of self-written applications, for example, in Java, or plug-ins developed in-house. That is, some standard things like MS Office will almost completely work in a server environment. In my practice, there were no situations where the well-known software would not work in Windows Server. Problems arose with some highly customized software, but such things also happen when migrating from XP to 7, from 7 to 8, that is, this is a standard story.
Returning to the methods of delivery, today we still say that we have a cloud, that is, it is enough to take the thin client, connect to a remote environment, and everything will work for us. Yes, such an option is possible, of course. This is a desktop as a service, daas in this case. There are also options to build the infrastructure on your own, maintain it yourself, this is a higher degree of control, but at the same time, higher costs. There is an option to build hybrid solutions, as I have shown in the picture. That is, something can be deployed in a public cloud, something can be deployed locally. Here you need to choose the best solution for yourself. According to the experience of the best dog breeders, public desktops are suitable for almost everything, with rare, rare exceptions, if you have very specific data, which should be only in Russia, you can use the Rucloud data center in Korolev. But here I must note that our software allows different options.
Further, the software that the VDI service provides is called FusionAccess. Today, the current version is version 6.1, but even in version 6.0 there are a lot of interesting features that I’ll briefly run now. I have highlighted some of the most important, in my opinion, things.
What do we support starting from version 6.0? We support Linux as a guest operating system. This is such a fairly frequent question when you started supporting Linux, and we have been supporting it since the beginning of this year. Ubuntu and RedHat distributions are supported. Thus, now there is no need to use only Windows, pay money for a license, you can use free Linux, and get even more profitable VDI due to this. That is, functionally, almost the same. Naturally, you will get the maximum set of functions on Windows, but such basic things as working with flash drives, working with printers, and audio are available, including on Linux. 80 percent of the cases are using standard functions, so you can choose both (Windows or Linux) and at the same time not feel somehow deprived.
Further, there is full support for working with 4K resolution. This can be, in principle, a multi-monitor configuration, or it can be a single monitor with Ultra HD resolution. Most often used in graphic design, or in development for CAD applications. Running a little ahead, I’ll say that in version 6.1 we also added support for graphic video editors that work in 4K mode. There were slightly specific requirements, it took six months to fully test the solution. So today it also works.
There is a watermark feature on the desktop. Let's just say, in order to read something super secret and take it with you in your head, this naturally will not save, but this function complicates the life of those who photograph confidential information on a smartphone a bit in order to put it somewhere in public space and refer to it. That is, now you can put watermarks with the date and user name, they can be not only static, but also dynamic. Traces of such signs usually remain in the photograph; it is very difficult to remove them. Thus, the life of these kind of characters is somewhat complicated.
We greatly simplified the deployment of the system core in version 6, you are unlikely to be familiar with FusionAccess version 5, but from my own experience I remember that in order to run the solution it was necessary to deploy some gigantic number of virtual machines, some of them on Linux, some on Windows Now, from version 6.0 we dramatically simplified this process, there is one installation package, one version of Linux, all virtual machines are installed from this disk, and the deployment process was reduced some five times in time.
Further, after the software is installed, there is no need to run through the various menu items. An automatic wizard starts, which allows you to configure the software with prompts to suit your requirements.
The LazyDesk function has appeared. That is how it looks. There is a thin client, a specific virtual machine is uniquely associated with it by its ID. Further, when entering the credentials into the thin client, a connection to the virtual machine automatically occurs, and there is no visual difference for the user whether he logs on to a local PC or works with VDI. This can be very convenient for some public terminals, warehouses, medical facilities, or for some remote points, where there are a lot of problems with users, it can be difficult for them to understand that you need to log in once, then log in again. In order to avoid this, you can use the LazyDesk function, firmly connect the client to the virtual machine, once credentials are driven in, once logged in, and all - a complete feeling that you are working on a local computer.
Further, from the point of view of the system administrator. This is probably a simplification for our partners, but nonetheless. The process of preparing a template for a virtual machine was reduced in time by a factor of three to four. Previously, there was a huge guide at 30 points, which had to be carefully passed, to make sure that the operating system was configured correctly, now all of this is gone. We have a wizard with three large buttons, to make me such a desktop, such and such, depending on what task you have. That is, press the button once, the scripted process goes through - everything, the virtual machine is ready, you can wrap it in a template.
Further, a very wide range of compatible peripherals. In fact, we have a large list of specific tested products, you can contact us, we will send it, show it. There are many things there, there are webcams and printers, all the main client devices that can be included in the thin client, they are most likely already tested by us. This refers to working with software and working with our thin clients.
And returning to the question of third-party thin clients and workstations, you can go through a specialized process, the certification process, and upon completion, if all the points are passed, you can get the HuaweiReady label. This means that this thin client is fully compatible, it can be used to work with VDI.
And now a few words about what appeared just recently, less than a month ago, when version 6.1 was released. If earlier desktops on server operating systems were on versions 8 and 12, then now you can use Windows Server 2016. The sixteenth version is a fully 64-bit operating system, a block is cut out there that is responsible for emulating a 32-bit environment, so here be compatibility issues, as noted earlier. That is, you need to test. That is why we put the die that this function in limited commercial use mode, that is, limited for use, not for widespread use, but only after preliminary tests. Technically, there are no problems, it also looks like Windows 10. The advantages for VDI, like any server operating system, are in licensing.
Further, with version 6.1, a universal webcam driver appeared. Previously, the only way to interact with a webcam was to use Windows DirectShow filters. Now there is an option to access the camera directly, and this thing is very popular when working with corporate VoIP applications, such as Cisco Jabber, or Skype, that is, you can now work with the camera directly and use its capabilities, not to mention that it reduces loss of performance.
There was an opportunity to combine graphic cards into pools, that is, the graphics support itself worked even earlier, but each time it was necessary to manually assign a graphics adapter to a virtual machine. Now this is not necessary, all graphics cards are in the pool and are automatically picked up from it if necessary, if the task is to start such a virtual machine (graphics). Upon completion of work with it, respectively, the graphics adapter returns to the pool. Such a solution is very convenient when, for example, there are about a dozen engineers who work in CAD systems, but at the same time there can be five or even fewer nVidia M60 cards. That is, it allows you to save a few on the cost of the schedule, increase control and facilitate management.
The resolution of 4K when editing video, as I said, is now fully certified, verified, works.
There was a function of redirecting audio and video when working with thin clients. Previously, a VoIP application client was installed in a virtual machine, a virtual desktop, audio and video were processed there. The sound is sent to the data center, it is processed there, returned back. This process overloads the channels. In order to avoid this, there is a function of redirecting sound and video, while an application or a plug-in is installed on the thin client, and later on the sound and video go directly from the thin client, bypassing this loop to the data center and back, that is, do not contact The data center every time you need to call someone, and ultimately this feature allows more users to sit on the same channel. Now we have conducted tests with Cisco Jabber, but theoretically any software can work, you just need to test, verify.
There is a separate plugin for Skype for Business. In the thin client, in the case of Skype, a plugin is installed. In the case of Cisco Jabber, as mentioned earlier, the entire application is installed directly into the thin client.
Further, another interesting feature that we have had is the rollback function to the original version of the desktop. Traditionally, the work is as follows: the user works in his working environment, modifies system files, makes entries in the registry, then, suppose he stopped working with this desktop, disconnected from it, logged off. Previously, this virtual machine had to be destroyed, a new one deployed, now it is possible to write all the changes that the user makes to a separate file. After the user no longer needs the virtual machine, it turns off accordingly, the file is deleted, and the machine is ready for work again. That is, it slightly reduces the time for introducing new machines into operation and reduces, in principle, the parasitic costs of deployment, redeployment of typical virtual machines.
The WAN Optimization feature has appeared. Its essence is that when the channel is not very good, unstable, weak, it may be enough for office work, but if you start the video in the window, the channel after that can simply lie down. And, unfortunately, even video cannot be turned off, because the interface simply lost responsiveness. So, to prevent this from happening, there is a WAN Optimization function, it automatically detects that the video in the virtual machine has eaten the entire channel, the interface has lost responsiveness and as a result it’s just a window, it stops rendering, the interface comes to life and you can continue to work accordingly.
The function of managing user profiles has appeared. In principle, it was possible to manage profiles earlier using the Windows Roaming Profile, but this solution has certain disadvantages, because the Windows Roaming Profile itself needs to be configured. It sometimes does not work very stably when the connection is lost, but with the central server where the profiles are stored, that is, there may be a short shutdown, after the server returns to working mode, it happens that the desktop does not render, you have to re-log in, which doesn’t It’s convenient. Here in order to avoid this, either if you do not want or cannot configure the Roaming Profile in Active Directory, or if you just do not want to use Active Directory, for example, for test users where there are enough local machines, you can use the built-in Profile Management.
I mentioned LiteAD, it can be used for some applications where a full-fledged Active Directory is clearly redundant, maybe it's some kind of closed test environment, or a company of ten people, why does it need AD. You can use the built-in functions of FusionAccess, that is, the built-in system catalog with user management through the FusionAccess interface. This allows you to quickly, efficiently deploy a working environment for a not very large number of users.
As for licensing. If you purchase this product in your own data center, then it is licensed in two types. There is a named license, there is a connection license. Accordingly, there are three types of licenses. Standard is an ordinary desktop, that is, just a virtual machine in which the user is working. SBC, Server-based Computing are essentially terminals. That is, SBC is a license to use the VDI terminal mode of operation. Advanced, respectively, allows you to use both standard mode and terminal mode, the most complete edition. It is important to note that when using the FusionSphere cloud platform only for deploying VDI, the platform is provided for free.
My name is Ivan Yudichev, I am engaged in Huawei cloud projects and public sector support. I have been doing cloud projects for quite some time, I started when I worked at the customer, somewhere in 2010. Then there was Microsoft, then there was VMware, then, finally, Huawei, where we continue to develop the good traditions of server virtualization and VDI. But today I will talk more about VDI.
For several years, Huawei has intensively developed its cloud product portfolio and these efforts have not been in vain. Today, IDCs, which are difficult to catch in some inadequate assessments, have placed us in Major Players. Three years ago, no one could even think about this, but today our solution in many respects is at the level of, or even better known manufacturers on the market. Let's dwell on the key features in more detail.
Solution architecture. VDI itself is deployed into some kind of cloud environment, theoretically it can work by providing remote access using traditional computers, but when we talk about virtualization of the working environment, usually we are talking about the cloud. And if we are talking about VDI in this section, then the architecture of the solution is as follows. At the lower level there is equipment - servers, storage systems, a network, which are then abstracted using the cloud. Further on, on this cloud platform, we deploy, respectively, the entire set of software, which allows, firstly, deploying virtual machines for users, and secondly, serving as a connection broker for users so that these machines can distribute and automate the process. The basics of VDI, I think, are familiar to you.
We work intensively with partners, for example, with RUVDS, and therefore we can create some kind of, let's say, not boxed solutions, namely solutions aimed at cloud providers. That is, a partner’s personal account, while we provide the infrastructure and ensure the work of the desktop, we offer our effective desktop access protocol (HDP), while receiving all the advantages of using a local domestic cloud.
About the architecture. In principle, many of these components are interchangeable, for example, the equipment may be from another vendor. The hypervisor, theoretically, may also be different, but we still recommend using ours, because we conduct a full testing cycle and guarantee the quality of the final solution. Although, in principle, there may be options.
By thin clients. We, as a single solution provider, naturally supply thin clients as well, but if you already have some workstations that you don’t want to write off, you can safely use them. We have a software client that works under Linux, under Windows, under Mac, in this way we can save and use the existing equipment.
By guest operating systems that we support. Naturally, Windows 7, 8, 10, that is, there is full support for them today. Also, in order to avoid paying for the Microsoft VDA license, and to reduce desktop costs in CapEx, you can deploy virtual desktops based on Windows Server. This is one of the opportunities we provide. There is always a stage of certification, application testing, will they work under Windows Server or not, because there may be nuances. But 90 percent of the cases - it all works fine, both in the client operating system and in the server. And many customers use this method, deploy server operating systems, such as client. Most often, questions arise with some kind of self-written applications, for example, in Java, or plug-ins developed in-house. That is, some standard things like MS Office will almost completely work in a server environment. In my practice, there were no situations where the well-known software would not work in Windows Server. Problems arose with some highly customized software, but such things also happen when migrating from XP to 7, from 7 to 8, that is, this is a standard story.
Returning to the methods of delivery, today we still say that we have a cloud, that is, it is enough to take the thin client, connect to a remote environment, and everything will work for us. Yes, such an option is possible, of course. This is a desktop as a service, daas in this case. There are also options to build the infrastructure on your own, maintain it yourself, this is a higher degree of control, but at the same time, higher costs. There is an option to build hybrid solutions, as I have shown in the picture. That is, something can be deployed in a public cloud, something can be deployed locally. Here you need to choose the best solution for yourself. According to the experience of the best dog breeders, public desktops are suitable for almost everything, with rare, rare exceptions, if you have very specific data, which should be only in Russia, you can use the Rucloud data center in Korolev. But here I must note that our software allows different options.
Further, the software that the VDI service provides is called FusionAccess. Today, the current version is version 6.1, but even in version 6.0 there are a lot of interesting features that I’ll briefly run now. I have highlighted some of the most important, in my opinion, things.
What do we support starting from version 6.0? We support Linux as a guest operating system. This is such a fairly frequent question when you started supporting Linux, and we have been supporting it since the beginning of this year. Ubuntu and RedHat distributions are supported. Thus, now there is no need to use only Windows, pay money for a license, you can use free Linux, and get even more profitable VDI due to this. That is, functionally, almost the same. Naturally, you will get the maximum set of functions on Windows, but such basic things as working with flash drives, working with printers, and audio are available, including on Linux. 80 percent of the cases are using standard functions, so you can choose both (Windows or Linux) and at the same time not feel somehow deprived.
Further, there is full support for working with 4K resolution. This can be, in principle, a multi-monitor configuration, or it can be a single monitor with Ultra HD resolution. Most often used in graphic design, or in development for CAD applications. Running a little ahead, I’ll say that in version 6.1 we also added support for graphic video editors that work in 4K mode. There were slightly specific requirements, it took six months to fully test the solution. So today it also works.
There is a watermark feature on the desktop. Let's just say, in order to read something super secret and take it with you in your head, this naturally will not save, but this function complicates the life of those who photograph confidential information on a smartphone a bit in order to put it somewhere in public space and refer to it. That is, now you can put watermarks with the date and user name, they can be not only static, but also dynamic. Traces of such signs usually remain in the photograph; it is very difficult to remove them. Thus, the life of these kind of characters is somewhat complicated.
We greatly simplified the deployment of the system core in version 6, you are unlikely to be familiar with FusionAccess version 5, but from my own experience I remember that in order to run the solution it was necessary to deploy some gigantic number of virtual machines, some of them on Linux, some on Windows Now, from version 6.0 we dramatically simplified this process, there is one installation package, one version of Linux, all virtual machines are installed from this disk, and the deployment process was reduced some five times in time.
Further, after the software is installed, there is no need to run through the various menu items. An automatic wizard starts, which allows you to configure the software with prompts to suit your requirements.
The LazyDesk function has appeared. That is how it looks. There is a thin client, a specific virtual machine is uniquely associated with it by its ID. Further, when entering the credentials into the thin client, a connection to the virtual machine automatically occurs, and there is no visual difference for the user whether he logs on to a local PC or works with VDI. This can be very convenient for some public terminals, warehouses, medical facilities, or for some remote points, where there are a lot of problems with users, it can be difficult for them to understand that you need to log in once, then log in again. In order to avoid this, you can use the LazyDesk function, firmly connect the client to the virtual machine, once credentials are driven in, once logged in, and all - a complete feeling that you are working on a local computer.
Further, from the point of view of the system administrator. This is probably a simplification for our partners, but nonetheless. The process of preparing a template for a virtual machine was reduced in time by a factor of three to four. Previously, there was a huge guide at 30 points, which had to be carefully passed, to make sure that the operating system was configured correctly, now all of this is gone. We have a wizard with three large buttons, to make me such a desktop, such and such, depending on what task you have. That is, press the button once, the scripted process goes through - everything, the virtual machine is ready, you can wrap it in a template.
Further, a very wide range of compatible peripherals. In fact, we have a large list of specific tested products, you can contact us, we will send it, show it. There are many things there, there are webcams and printers, all the main client devices that can be included in the thin client, they are most likely already tested by us. This refers to working with software and working with our thin clients.
And returning to the question of third-party thin clients and workstations, you can go through a specialized process, the certification process, and upon completion, if all the points are passed, you can get the HuaweiReady label. This means that this thin client is fully compatible, it can be used to work with VDI.
And now a few words about what appeared just recently, less than a month ago, when version 6.1 was released. If earlier desktops on server operating systems were on versions 8 and 12, then now you can use Windows Server 2016. The sixteenth version is a fully 64-bit operating system, a block is cut out there that is responsible for emulating a 32-bit environment, so here be compatibility issues, as noted earlier. That is, you need to test. That is why we put the die that this function in limited commercial use mode, that is, limited for use, not for widespread use, but only after preliminary tests. Technically, there are no problems, it also looks like Windows 10. The advantages for VDI, like any server operating system, are in licensing.
Further, with version 6.1, a universal webcam driver appeared. Previously, the only way to interact with a webcam was to use Windows DirectShow filters. Now there is an option to access the camera directly, and this thing is very popular when working with corporate VoIP applications, such as Cisco Jabber, or Skype, that is, you can now work with the camera directly and use its capabilities, not to mention that it reduces loss of performance.
There was an opportunity to combine graphic cards into pools, that is, the graphics support itself worked even earlier, but each time it was necessary to manually assign a graphics adapter to a virtual machine. Now this is not necessary, all graphics cards are in the pool and are automatically picked up from it if necessary, if the task is to start such a virtual machine (graphics). Upon completion of work with it, respectively, the graphics adapter returns to the pool. Such a solution is very convenient when, for example, there are about a dozen engineers who work in CAD systems, but at the same time there can be five or even fewer nVidia M60 cards. That is, it allows you to save a few on the cost of the schedule, increase control and facilitate management.
The resolution of 4K when editing video, as I said, is now fully certified, verified, works.
There was a function of redirecting audio and video when working with thin clients. Previously, a VoIP application client was installed in a virtual machine, a virtual desktop, audio and video were processed there. The sound is sent to the data center, it is processed there, returned back. This process overloads the channels. In order to avoid this, there is a function of redirecting sound and video, while an application or a plug-in is installed on the thin client, and later on the sound and video go directly from the thin client, bypassing this loop to the data center and back, that is, do not contact The data center every time you need to call someone, and ultimately this feature allows more users to sit on the same channel. Now we have conducted tests with Cisco Jabber, but theoretically any software can work, you just need to test, verify.
There is a separate plugin for Skype for Business. In the thin client, in the case of Skype, a plugin is installed. In the case of Cisco Jabber, as mentioned earlier, the entire application is installed directly into the thin client.
Further, another interesting feature that we have had is the rollback function to the original version of the desktop. Traditionally, the work is as follows: the user works in his working environment, modifies system files, makes entries in the registry, then, suppose he stopped working with this desktop, disconnected from it, logged off. Previously, this virtual machine had to be destroyed, a new one deployed, now it is possible to write all the changes that the user makes to a separate file. After the user no longer needs the virtual machine, it turns off accordingly, the file is deleted, and the machine is ready for work again. That is, it slightly reduces the time for introducing new machines into operation and reduces, in principle, the parasitic costs of deployment, redeployment of typical virtual machines.
The WAN Optimization feature has appeared. Its essence is that when the channel is not very good, unstable, weak, it may be enough for office work, but if you start the video in the window, the channel after that can simply lie down. And, unfortunately, even video cannot be turned off, because the interface simply lost responsiveness. So, to prevent this from happening, there is a WAN Optimization function, it automatically detects that the video in the virtual machine has eaten the entire channel, the interface has lost responsiveness and as a result it’s just a window, it stops rendering, the interface comes to life and you can continue to work accordingly.
The function of managing user profiles has appeared. In principle, it was possible to manage profiles earlier using the Windows Roaming Profile, but this solution has certain disadvantages, because the Windows Roaming Profile itself needs to be configured. It sometimes does not work very stably when the connection is lost, but with the central server where the profiles are stored, that is, there may be a short shutdown, after the server returns to working mode, it happens that the desktop does not render, you have to re-log in, which doesn’t It’s convenient. Here in order to avoid this, either if you do not want or cannot configure the Roaming Profile in Active Directory, or if you just do not want to use Active Directory, for example, for test users where there are enough local machines, you can use the built-in Profile Management.
I mentioned LiteAD, it can be used for some applications where a full-fledged Active Directory is clearly redundant, maybe it's some kind of closed test environment, or a company of ten people, why does it need AD. You can use the built-in functions of FusionAccess, that is, the built-in system catalog with user management through the FusionAccess interface. This allows you to quickly, efficiently deploy a working environment for a not very large number of users.
As for licensing. If you purchase this product in your own data center, then it is licensed in two types. There is a named license, there is a connection license. Accordingly, there are three types of licenses. Standard is an ordinary desktop, that is, just a virtual machine in which the user is working. SBC, Server-based Computing are essentially terminals. That is, SBC is a license to use the VDI terminal mode of operation. Advanced, respectively, allows you to use both standard mode and terminal mode, the most complete edition. It is important to note that when using the FusionSphere cloud platform only for deploying VDI, the platform is provided for free.
