Hyper-V Replication Certificate Question

Hi,
Possibly a common question so apologies if it's simple.
My main server is HV1.company.local
My second server will be cloud based and standalone in a workgroup, let's call it hv2 and for arguments sake I'll add the DNS entries of hv2.mydomain.co.uk
and a certificate for this address.
Certificates will obviously need to be internet facing so will go for HV1.companydomain.com for the first server.
Do I just use internal DNS to sort out the fact that the server name is .local?
Anyone with experience in this set up with best practice and any gotcha's would be much appreciated,
Cheers,
JJ

Hi Sir,
>>My second server will be cloud based
Based on my understanding of your case , first you may ensure two hosts can access the IP of each other directly (whatever dns or hosts file ).
If the network prerequisite is met , then we can think of it as a workgroup environment and build certificate-based replication for two hyper-v host :
https://social.technet.microsoft.com/Forums/en-US/c3e309b6-1d5d-4e52-b859-cf36bd5af47d/forum-faq-how-to-implement-hyperv-replica-in-workgroup-environment?forum=winserverhyperv
Best Regards
Elton Ji
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Similar Messages

Hyper-V Replication Implementation question

I have two Hyper-V 2012 servers. I want to setup replication between them but I wanted to clarify a few things. My plan is to put 3 VM's on each Hyper-v Server and then replicate them to the other servers. So Server A has 3 VM's and Server B has
3 VM's. In case of a server failure the servers on Server A will failover to Server B and vice versa. This also applies to the VHD's. I want everything to replicate between the two. And I need to make sure that the process is automatic so if storage fails
the vm's will fail over. I just want to make sure the Hyper-V Replication will work in this way.
Vincent Sprague

I need the storage replication aspect, I currently have the two servers in a cluster and the vm's failover but storage is my problem, our shared storage solution is junk and I need to find a way to get around that.
Vincent Sprague
1) For Hyper-V Replica you don't need to have shared storage as Windows will replicate source VHDX with some minor delay to a destination VHDX.
2) You may also take a look @ Storage Replica (part of the upcoming Windows Server 10) as it may do a better job for you because of the synchronous nature. See:
Storage Replica and Hyper-V
http://www.starwindsoftware.com/blog/storage-replica-with-microsoft-failover-cluster-and-clustered-hyper-v-vm-role-windows-server-technical-preview/
Good luck :)
P.S. Looks like you've already asked similar question before:
https://social.technet.microsoft.com/Forums/projectserver/en-US/c19b08aa-b395-49e0-9bf7-52981118b820/server-2012-r2-vm-replication?forum=winserverhyperv
StarWind Virtual SAN clusters Hyper-V without SAS, Fibre Channel, SMB 3.0 or iSCSI, uses Ethernet to mirror internally mounted SATA disks between hosts.

Hyper-v replication Error Hyper-V received a digital certificate that is not valid from the Replica server 'burstingreplica'. Error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp"

Hi,
When trying to initiate hyper-v replication from the main server i'm getting this error in the event logs.
Hyper-V failed to enable replication for virtual machine 'RECADemo': A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. (0x800B0101). (Virtual Machine ID 561591B6-567C-...)--I'm using certificate based auth and cert is installed/recognized on both machines.Please help.Thanks,Jaffer
Jaf

Hi,
This error occurs because the Microsoft Certificate Trust List Publisher certificate expired. A copy of the CTL with an expired signing certificate exists in the CryptnetUrlCache
folder. Please try to renew the Trust List Publisher certificate.
The related KB:
Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server
http://support.microsoft.com/kb/2328240
How to Renew the Site Server Signing Certificate (Microsoft Certificate Services)
http://blogs.technet.com/b/configmgrteam/archive/2009/02/11/how-to-renew-the-site-server-signing-certificate-microsoft-certificate-services.aspx
Manage Trusted Publishers
http://technet.microsoft.com/en-us/library/cc733026.aspx
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Will Hyper-V Replication Manager move a VM without shutting it down?

Scenario
Let say I have two sites (Primary And DR). I have my production VM's running on my Primary Site. If I protect them with Hyper-V Replica the VM is replicated and I can bring the VM up manually in the DR site. So I know that process work. I am trying
to minimize the outage of an app and the time it takes to bring the VM up and running. I have a database server in the primary site. I want to be able to move the VM hosting the database server to the secondary site without shutdown or with minimal downtime.
Question
Can I use Hyper-V Replication Manager to migrate the VM with the database from the Primary Site to the DR site without downtime for the SQL server? When I mean downtime for the SQL server is that clients can continue to connect to the database and access
the data in the database while I am migrating the VM.
This is needed to maintain availability during DR testing of the Production environment.
Thanks,
Carlos

Hi Carlos,
For DR drills you can use the test failover. A
test failover can spin up a test virtual machine for the production virtual machine. This VM can run in an isolated environment and does not affect the production environment. Your SQL server will have no outage while DR testing.
A test failover can be executed on an individual virtual machine or a recovery plan. This can orchestrate the drill as close to a real failover which recovers the application in a planned manner.
Hope this pointer helps.
More detailed tutorials are available at http://msdn.microsoft.com/en-us/library/windowsazure/dn440569.aspx

Hyper-V Replication over Dedicated LAN and "is alive" checks over Corporate LAN

I am testing Hyper-V replication to see if it will be a suitable replacement for the ArcServer RHA product. One thing I am struggling with is configuring the replication to use the dedicated LAN, but still have the host servers verify over the corporate
LAN.
I have seen the blogs on how to use a dedicated route and editing the hosts file to get replication to use the dedicated LAN, but that also changes the LAN in which the host servers communicate. It seems to me that if the corporate LAN were to go down
on the master server, I wouldn't be able to fail over the virtual machines to the replica server without first having to connect into the master server through the dedicated LAN of the replica server to shut down the virtual machines.
I need to be able to fail over to the replica server if the corporate network connection on the master server drops without having to go through the extra steps of connecting into the master server first.
Is it possible for the two items to be separated? Can I tell Hyper-V to replicate using one specific IP destination on the dedicated LAN and have the replica server check to see if the master is live over the corporate LAN?

Hi Telrick,
>> It seems to me that if the corporate LAN were to go down on the master server, I wouldn't
be able to fail over the virtual machines to the replica server without first having to connect into the master server through the dedicated LAN of the replica server to shut down the virtual machines.
I want to say that there are "planned fail over" and "unplanned fail over " , the latter applies the primary server crashing (you can select "failover" on "replica server " then the VM will start up ,after the primary
server online again you can do "reverse" )
The point is that you can not use hyper-v replica as a backup (it will lost little data which have not yet been replicated to replica server when "unplanned fail over" happens )
Best Regards
Elton Ji
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

DPM 2012 R2 and Hyper-V Replication, huge conflict and failure to backup

I have recently created new 2012 R2 servers with DPM 2012 R2 in attempts to upgrade an environment.
When attempting to create Protection Groups for Hyper-V VM, DPM will consistently omit any VM that happens to have Hyper-V Replication enabled, whether that server is the primary VM instance or a replica VM instance. ALL other Hyper-V VMs are listed,
only those with Replication enabled are omitted. This happens on both DPM 2012 R2 servers, exactly the same results - all VMs without Hyper-V Replication enabled are listed, none of the VMs with replication enabled are visible in the list.
Obviously we need to be able to backup VMs with Hyper-V replication since replication is only a tiny portion of a DR strategy, it doesn't cover ANY recovery scenario other than the loss of the primary VM - it doesn't allow for restoring any missing or damaged
files or undoing any other changes to the VM.
The DPM 2012 R2 server have the latest update rollup (#4) applied and the protection agents have also been updated.
Looking for some hints since DPM 2012 R2 is supposed to support backing up both the primary and replica VMs, especially when the Hyper-V host if Server 2012 R2.
Might have to use Windows Server Backup or Veeam's free Hyper-V backup since aside from enabling Hyper-V replication to keep a couple snapshots, DPM isn't a viable backup options in combination with Hyper-V replication.

As per the following blog:
http://blogs.technet.com/b/dpm/archive/2014/04/25/backing-up-of-replica-vms-using-dpm.aspx
you should be able to backup Hyper-V VMs even if they are replica VM.
When you configure DPM to protect both primary and recovery hosts, VM will appear on any of the Servers as it will have the same GUID.
So, protect primarya nd recovery hosts using different DPM or if you want to protect both primary and recovery using same DPM, make sure that you check both servers so as to discover VM.
Regards, Trinadh [MSFT] This posting is provided AS IS with no warranties, and confers no rights. If you found the reply helpful, please MARK IT AS ANSWER. Looking for source of information for DPM? http://blogs.technet.com/b/dpm/ http://technet.microsoft.com/en-in/library/hh758173.aspx

Windows Server 2008 Standard 64 bit edt support Hyper-v replication

Dear Team.
Windows Server 2008 Standard 64 bit edt support Hyper-v replication or not.
If my primary physical server down so my secondary server act as primary server.

Hi,
Windows Server 2008 Hyper-V do not Support Hyper-V replica.
This is a new Feature in Hyper-V for Windows Server 2012.
http://technet.microsoft.com/en-us/library/hh831410.aspx#BKMK_Replica
Regards
Sebastian

Limit Hyper-V Replication Data Transfer Rate

Hello,
i need to limit data transfer rate for Hyper-v replication because between two Datacenter have bandwidth limitation.
Please suggest

You can use the New-NetQoSPolicy cmdlet to set the throttling limits -
http://technet.microsoft.com/en-us/library/hh967468.aspx. Based on the destination port (the port on which the replica server has been configured to receive replication traffic - maybe it's port 80 in your case) or the destination subnet, you can specify
a throttling value (-ThrottleRateActionBitsPerSecond) or assign a weight (MinBandwidthWeightAction).
Eg: New-NetQosPolicy "Replica traffic to 8080" –DestinationPort 8080 –ThrottleRateActionBitsPerSecond 100000
or check the link to Thomas blog
http://www.thomasmaurer.ch/2013/12/throttling-hyper-v-replica-traffic/

Hyper-V Replication Question

Hello,
I just completed watching some YouTube videos and reading some helpful websites but still had a quick question. I have a .110 network in LocationA and a .60 network in LocationB.
Both locations use static IP addresses. I can ping both locations from each other. If I want to replicate a VM from the .110 network or LocationA to the .60 network which is LocationB would this be possible since both locations have different networks? If
I want to replicate from the .110 network, would my .110 network settings on the VM still be configured on the VM in the .60 network? If this is the case then when I turned on the replicated VM it would not be able to join the network without modifying the
NIC settings. I was hoping someone could explain this process a little better or more in-depth so I have an idea of what I'm doing.
On a different note as long as your two host servers are Server 2012 R2, can you replicate Server 2003 and Server 2008 systems or is it only for 2012 R2 VMs? Any and
all information is helpful. Thank you!
Pat

Hello Pgrantland,
I was checking some documents about this wonderful feature and I found this:
2.3 To enable replication for a virtual machine
9. A dialog box appears indicating that replication was successfully enabled. In this dialog, click the Settings button
and provide settings to configure the network that the virtual machine will connect to on the Replica server. The Replica virtual machine does not automatically connect to any network on the Replica server (after a failover) by default,
so these settings are important. You can configure the network settings so that the virtual machine will connect to a different network after a failover to the Replica server than it used when it was on the primary server.
Step 2: Enable Replication
https://technet.microsoft.com/en-us/library/d5d9e9f2-0f21-4d82-aa90-45e194de5ac9#BKMK_2_3
These steps are configured before you finish the wizard to enable Hyper-V replica on a VM.
Regarding the other question as far as I know a VM is just a VM from the Hyper-V side, the replica does not look what OS you are running.
The only thing is that if you a re planing a VM to be replicated check that the hardware elements configured on the settings of you VM are able to be replicated.
There are scenarios on which hardware configured on a VM makes that the VM is not supported for replica and you cannot replicated as long as those elements are configured on the VM.
For example "Fibber Channel adapter" (Virtual SAN) and "Virtual hard disk sharing" are not supported to replicate.
Hope this information help you to reach your goal. :D
5ALU2!

Certificate-based 2012 R2 Hyper-V Replication (powershell)

I have certificate-based replication working between two Server 2012 R2 workgroup servers. Through Hyper-V Manager I can resolve any issues with replication, particularly in the scenario where I failover and wish to reverse replication. Take
a DR scenario where I the primary goes offline, I initiate failover, start the replica VM, and wish to reverse replication after the primary has come back online following the power simulated power loss, but via powershell. I'm missing a key step, but I don't
know what.
1. PRIHOST goes down and the VM REPME1 is now offline.
2. On REPHOST, I initiate start-vmfailover and start-vm REPME1.
3. Power is restored to PRIHOST and is back up. VM REPME1 is in the inventory but powered off. PRIHOST remains the Primary for replication. REPHOST is still the Replica. Replication has failed, which is expected.
4. I try to reverse replication with set-vmreplication -reverse, but I get an error "Could not reverse replication for virtual machine 'REPME1'. (Virtual machine ID ...) The operation cannot be performed while the virtual machine is in its current state.
The name of virtual machine is REPME1 and its ID is ...
5. When I reverse replication in the Hyper-V Manager immediately following it synchronizes back the changes successfully and replication returns to normal.
I suspect that I'm missing a step.
-Michael Kelsey

Since I'm using workgroup servers and certificates, I tested the commands manually to observe the output, modifying the steps that require certificatethumbprint as a mandatory parameter. I did not get success on this first attempt, but I will keep
trying over the next few days as I have time.
Thank you for the exemplary script. It does indeed reveal at least one missed step, such as completing failover, which was necessary to prevent the set-vmreplication from being blocked by the VM's current state.
In my manual execution, setting the primary as replica had to be performed on the primary after coming back online, at which point both the primary and the replica degenerated to a mutual replica state. I didn't spend much time trying to correct this
condition in powershell, but in Hyper-V management I was able to re-establish replication, although it keeps pausing on the new existing primary (now replica) and the replica (now primary) doesn't indicate replication as being paused.
I will most likely need to remove replication from the VM and start over.
It appears that native Windows authentication (matching usernames and passwords) and certificates will be required to successfully reverse replication. Ultimately, since I will use a service account to enact the role reversal, I tested with a local
admin that did not exist on both systems. Setting the AsReplica in Set-VMReplication appears to use RPC as the command failed with a permission denied error.
I will append my findings. You've given me a great starting point.
-Michael Kelsey

Hyper-V Replication - Subnet Configuration Between Datacenters?

I'm designing a DR solution in a geographically separate datacenter which will use Hyper-V 2012 R2 Replication to replicate several of our VMs to another Hyper-V cluster. The VMs will run a mix of Linux and Windows, with the Windows servers being Exchange,
SharePoint, WSUS, etc.
I currently have a static IP assigned to all servers and VMs, i.e. I'm not using static DHCP reservations.
I have the ability to extend the private LAN subnet (let's call it 192.168.1.1) between the two datacenters over the public Internet using my firewall's VPN capability, but I'm wondering if there is a recommended best/better practice for this?
Is it okay to extend the subnet so in a fail-over scenario I can just power the VMs on in the DR datacenter without much manual intervention? Or would it be a better idea to configure my servers with a static DHCP reservation, so when they come up in the
DR datacenter they can pull an IP on a unique subnet?

Hello Matt,
The answer is yes for Hyper-V 2012 R2, however this feature was available only for Windows Guest OS'es in Hyper-V 2012.
This works only on synthetic network adapters, not legacy network adapters, and it requires Windows XP SP2/Windows Server 2003 SP2 and newer OS'es to be running on the virtual machine to work. This
also works with Linux virtual machines that are running the latest Linux distributions.
As a good practice is to complete the failover TCP/IP configuration on the primary virtual machine with its normal IP configuration. In that way, if the replica is ever activated, replication is
reversed, and the virtual machine is then failed back to what was the primary, and the correct IP address for the primary location can automatically be put back.
Hope this help.
Regards,
Charbel Nemnom
MCSA, MCSE, MCS, MCITP
Blog: www.charbelnemnom.com
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial
to other community members reading the thread.
This is incredible. We are running Hyper-V 2012 R2 with the latest CentOS 6.5 and synthetic network adapters. Thank you so much.
Oh, hey! I read your blog! :)

Hyper-V replication across versions (2012 to 2012 R2 and vice versa)

Does Hyper-V support cross-version replication? In other words, can Windows Server 2012 Hyper-V replicate to Windows Server 2012 R2 Hyper-V server? Vice versa? I tried looking for documentation or blog posts about this but couldn't find any.

Hi,
Base on my test, the Hyper-V 2012r2 can't replicate to Hyper-v 2012.
Additional, the following similar thread may will helpful of your question.
Windows 2008 HyperV Replica in Windows 2012 HyperV
http://social.technet.microsoft.com/Forums/windowsserver/en-US/f92b1af2-d3cd-4a5e-a850-dadf0c33d2a1/windows-2008-hyperv-replica-in-windows-2012-hyperv?forum=winserverhyperv
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

MAIL certificate question

Lately I get a question box when I open MAIL.   I have Snow Leopard, and opted to keep Mobile Me at the switch this summer.   It has been working just fine,
same as always with no change. Now I get this:    note: {   }   is a description from me for something I can not create here
Verify Certificate.
The certificate for this server is invalid. You might be connecting to a server that is pretending to be "mail.me.com" which could put your confidential infirmation at reks. Do you want to connect to the server anyway?
☐   Always trust "mail.mac.com" when connecting to "mail.me.com"
{then there is a box enclosure}
☐     {this one is bwown}   Verification Class 3 Public Primary Certification Authority - G5
{below, indented}    {an arrow like this one ↵ pointing to the right to this bluish box,} ☐     VeriSign Class 3 Extended Validation SSL SGC CA
{then a larger bluish box:     "Mail.mac.com"
Issued by: VeriSign Class 3 Extended Validation SSLSGC CA Expires: Friday, April 18, 2014.
{then a red circle with an X inside, statement in red}   This certificate is not valid (host name mismatch)
     Trust
     Details
{my choices}     Hide Certificate          Cancel     Connect {in blue}
--------------------------------end of warning--------
Thank you in advance.    What should I do?   Is anyone else getting this?   The emails still coming in are directed to my email address.
Tom

I have iCloud eMail running in 10.4.11 & 10.5.8...
Do not delete the old account yet. sign up for an iCloud account if you haven't.
I understand .mac mail will still come through. Do not delete the old account yet.
You cannot use .mac or MobileMe as type of Account, you have to choose IMAP when setting up, otherwise Mail is hard coded to change imap.mail.me.com to mail.me.com & smtp.mail.me.com to smtp.me.com, no matter what you try to enter.
iCloud Mail setup, do not choose .mac or MobileMe as type, but choose IMAP...
On second step where it asks "Description", it has to be a unique name, but you can still use your email address.
IMAP (Incoming Mail Server) information:
          •          Server name: imap.mail.me.com
          •          SSL Required: Yes
          •          Port: 993
          •          Username: [email protected] (use your @me.com address from your iCloud account)
          •          Password: Your iCloud password
SMTP (outgoing mail server) information:
          •          Server name: smtp.mail.me.com
          •          SSL Required: Yes
          •          Port: 587
          •          SMTP Authentication Required: Yes
          •          Username: [email protected] (use your @me.com address from your iCloud account)
          •          Password: Your iCloud password
Also, you must upgrade your password to meet the new criteria: 8 characters, including upper and lower case and numbers. If you have an older password that does not meet these criteria, when you try to setup mail on your mac, using all of the IMAP criteria listed above, it will still give a server error message. Go to   http://appleid.apple.com         then follow directions to change your password, then go back to setting up your mail using the IMAP instructions above.
Thanks to dpepper...
https://discussions.apple.com/thread/3867171?tstart=0

EAP-TLS User Certificate Question

I've setup a test ACS server and have everything functioning correctly including the WLAN. However, is there anyway for EAP-TLS to use ONLY the machine certificate and not the user certificate? We are not currently setup with per-user certificates. I'm guessing not on this... My primary question then is with User Certificates, how do you handle the following scenerio:
I have many CoW's (computer on wheels) through out the hospital that nurses use for inputting patient information. They all have a simple generic username/password (BADDD!!!!) so with this user it won't be hard to have default_user certificate install on the machines. But what if Doctor X decideds to walk up to one of these CoW's and wants to logout and log back in with his user/password on a machine he's never used before. How do we handle making sure he's able to connect if doesn't already have a cert on this computer? I'm quite mistified by this.
Thanks
-Raun

If you are using the MS Supplicant, you need the following registry settings:
"HKLM\SOFTWARE\Microsoft\EAPOL\Parameters\General\Global\AuthMode", 2, "REG_DWORD"
"HKLM\SOFTWARE\Microsoft\EAPOL\Parameters\General\Global\SupplicantMode", 3, "REG_DWORD"
This forces it to only use hardware certificates and sets the authentication to do the correct RFC polling.
As for the other issue, MS CA user certs do not "roam". Yet. There is discussion of roaming credentials being in Windows 7, but not entirely what that means. Roaming certificates can be easier with a product like Venafi. There "Encryption Management" tools are certificate management suites. The do have roaming management, or at least did when we talked to them.
Oh, and if you use two CAs (hardware and user), the separation keeps it straight too.

Client certificate question

/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Tabla normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin:0cm;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:10.0pt;
font-family:"Times New Roman";
mso-ansi-language:#0400;
mso-fareast-language:#0400;
mso-bidi-language:#0400;}
Hello,
I am novice with certs and I have a question. I want to implement EAP-TLS in a WPA deployment and I have a question about the client-side certificate.
When I install a client certificate in a machine for a specific user, is this certificate only valid for this machine and this user? Or can I export this certificate and use it in another machine but the same user?
Thanks in advance,

From my experience, you can copy the certificate to another computer (assuming a modern OS). There are two problems with this, though:
1 - You must be able to export the entire certificate, including the private key, to be able to use the certificate on another machine. Most PKI implementations prohibit/disable this.
2 - If you can export the certificate, including the private key, then you are risking the loss of integrity of your PKI. Someone else can get that cert with the private key and impersonate the user.

Hyper-V Replication Certificate Question

Similar Messages

Maybe you are looking for