PowerPath on ESXi in a large environment

Hi,

We normally advice sites with more than 50 ESXi hosts to user the “served” license so you don’t need to manually register each one of the hosts.

Thanks

Itzik Reich | Advisory vSpecialist | EMC Israel

Thanks for the reply and served is what we have decided to use. Now could you help us with the setup of the served licensing? How do we enter credentials only one time and have all hosts licensed? Does this continue to work after we change host passwords?

We have served licenses. So far, the easiest way is to use the lockbox. Granted we'll have to update the lockbox when the VMware admins change the root password but we can script this piece. The other missing component is adding the ESXi server to Powerpath Viewer and having to authenticate again. Any easy way of accomplishing this task?

I am glad Mark Wright has joined to keep me in line. As he stated the storage team has already setup the licensing as served and decided that the easist way to license the VMware ESXi hosts is to use the lockbox feature. Unfortunately it has to be scripted outside of PowerPath (easily done) and every time the VMware support team changes host root password (every 90 days) this process must be done again. As Mark stated, the other issue is that again the hosts must be authenticated again to use PowerPath viewer. There must be a better and more enterprise way of performing these actions. The site here is much greater than 50 ESXi hosts as it is over 200 globally. Please help us here to make this better for both teams.

We have the same problems too.

Served license which is itself a mess if you reinstall a host from scratch and get a new UUID. EMC licensing support needed weeks to create new licenses for us.

After the upgrade to ESXi we realized one day that most of the host were running in unlicensed mode. We opened an SR and got the explanation that it is expected behaviour that after rebooting a host you need to "autoregister" it by issuing a command using rpowermt.

We keep the SR open because for us it is not acceptable that rebooting a host results in violating the license terms.

This was my thread https://community.emc.com/message/641362#641362

I will redirect all readers to this thread. Let's collect voices and show EMC that we have a problem with this limitation.

Regards,

daniel

Maybe someone will notice the issue if I link back to your issue https://community.emc.com/message/641362#641362#641362

Or maybe we can recursively speak to each other.

Daniel:

Sorry for the delay in responding - we usually monitor the PowerPath /VE forum for these types of questions but we'll start monitoring this site as well.

I want to make sure the EMC is clear in communicating to you and all forum readers that PowerPath/VE 5.7 for VMware is NOT in an unlicensed state upon ESX reboot. Once PowerPath/VE 5.7 is installed in the ESX kernel and licensed it is always licensed across reboots until it is specifically removed. I'll make sure that our documentation and future conversations reinforce this. The Primus Solution emc281559 that Conor refers to in your thread describes how to automatically re-register the license for display, monitoring, and configuration change purposes. At no time is PPVE multipathing disabled upon ESX reboot.

I appreciate your feedback that this is not an ideal situation and we are working with VMware and internally to make the reboot process even more automated in the future.

Thanks for your interest and input in making PowerPath/VE an even better product. Should you have any additional feedback please do not hesitate to leave it here or contact me off-line.

Best Regards,

Bob Lonadier

PowerPath Product Manager

We have a document that might help answer this and other PP/VE License related questions.

See Powerlink:

Home > Products > Software P-R > PowerPath > FAQs Frequently Asked Questions: PowerPath/VE Licensing

For the lockbox-related question, some users might want to take advantage of vSphere CIM tickets.  It is documented in the Installation and Administration Guide on Powerlink:
Home > Support > Technical Documentation and Advisories > Software ~ P-R ~ Documentation > PowerPath Family > PowerPath/VE > Installation/Configuration

Look for "CIM Ticket Authentication"
Also see this VMware link:
http://www.vmware.com/support/developer/cim-sdk/4.0/smash/cim_smash_400_ticket_authentication.pdf

We have tried using the CIM ticket. If I recall the CIM ticket expires within a few minutes, and if you reboot the host you have to reregister the host. The lockbox is ok for now, however it would be really nice if we could just use a read only account to register the host. Also, why do I need to specify the root user when adding to Powerpath Viewer.

Both statements are true.  The CIM ticket expires, but that is a VMware security issue.  You don't have to re-register to assure kernel IO operation is working, but to have visibility by PowerPath Viewer or the PowerPath/VE CLI (rpowermt) you do. 

PowerPath/VE management operations require a higher level of authentication.  You don't have to use the ESXi root account but you do have to use a root-privileged account to make changes to the PowerPath/VE driver including licensing.

Viewer currently does not have vCenter/CIM ticket integration.

All I can say for now is that we do understand the manual (re-)registration of PowerPath/VE licenses is a pain point for customers.  We do listen to feedback and are continuing to work on improving the product.

Just wanted to jump into the thread and post that we're having the same issues and find it to be quite annoying, in case anyone from EMC is listening.  I'm overjoyed that EMC feels that the fact that multi-pathing still working is good enough and we should all be happy, but that's not acceptable to me.  We switched from unserved to served licensing when going through a ESXi 4.1 to 5.1 upgrade cycle because EMC recommended that for making our lives easier from a license management perspective.

Now we find that every time our ESXi hosts have to be reboot for patches, hardware maintenance, etc, they come back up as unlicensed.  Why is this a big deal?  Because if they're unlicensed, it breaks the EMC integration in the vCenter manager.

Additionally, we are running our rpowermt and license server on EMC's recommended vApp SuSE linux appliance, so not on the vCenter server.  This means that we not only have to use lockbox to store the host passwords, we have to update the lockbox each time those passwords are changed, which is regularly.  On top of that, we run our ESXi hosts in lockdown mode, and seeing as we're running EMC's recommended vApp server for the licensing, that server is not authorized to connect to the ESXi hosts when they're in lockdown mode.  So now, every time we reboot an ESXi server, or change its password, we have to update the lockbox, take the host out of lockdown mode, issue a command to make it retrieve its license again, put it back in lockdown mode.

If you have a sufficient number of servers, this starts to become quite annoying and time consuming.

First, thanks for providing feedback on PowerPath/VE. We recognize that the licensing experience can be better for our customers and we are actively working to make the process smoother and more integrated with the vCenter UI.

In the meantime, as mentioned earlier in this thread, the work-around to both the issues you experienced in a lock-down situation is to use the CIM ticketed ID to run rpowermt remotely to re-register the hosts without the need for a root password. Here are the steps:

Create CIM Ticket Authentication

To use CIM Ticket Authentication to authorize a vSphere host that is managed by vCenter without the need of a root password on the vSphere host.

(for more details in CIM Tickets: http://www.vmware.com/support/developer/cim-sdk/4.0/smash/cim_smash_400_ticket_authentication.pdf)

On the rpowermt server, type:

rpowermt host= [cim_sessionid= ]

#rpowermt version host=lcla111 cim_sessionid=525e2427-ce2c-d4ab-d234-2c83abcd1bda

Output such as the following appears:

EMC rpowermt for PowerPath (c) client Version 5.4 SP 2 (build 299)

EMC PowerPath (c) host=lcla111.lss.emc.com Version 5.4 SP 1 (build 33)

License search path:

/etc/emc:/etc/emc/licenses:/opt/EMCpower:/opt/EMCpower/licenses

Host file: /etc/emc/lockbox/lockbox.clb

The cim_sessionid argument can be used with any rpowermt command that communicates with the vSphere host except the following commands:

rpowermt setup

This will eliminate the need to take the host(s) out of lockdown mode to re-register the license with the host.

Let me know if you have additional questions.

Bob Lonadier

PowerPath Product Manager

Robert,

we greatly appreciate your feedback and that you take our opinions very seriously. Thanks for commenting on this threat.

Looking forward to the new integration.

If you are looking for a Beta tester let me know!!

Regards,

daniel