Simplified Storage Storage Directions And Trends Simple SANs

Simplified Storage, Storage Directions And Trends Simple SANs SAN Security Rahul Auradkar Partner Program Manager Keith Hageman Technical Evangelist

Agenda n SAN Complexities & Adoption Blockers n n n SAN Deployment/Configuration SAN Security … Windows Server 2003 Storage Technologies Industry Initiatives with Microsoft Platforms n n SAN Simplification with Windows SAN Security

Storage Solution Adoption Trends Half the cost of SAN Low Cost SAN i. SCSI NAS DAS Gateways SME LE

SAN Complexities & Adoption Blockers

Obstacles to Faster SAN Adoption Absence of O. S. SAN Facilities Security Path Fail-over Snap-Shot LUN Management Expensive Storage Networking Hardware Multiple Storage Management Interfaces

Build-a-SAN Studies n 5 attempts of 6 -9 people n n n SAN Configuration n n Server, HBA, Switch & Storage Array – 1 each Goal – Build-a-SAN in under 4 hours n n n Technical – server and storage aware Not specifically SAN trained Cable server to switch to storage array Zone switch Create LUN, format, assign drive letter Write data to volume Results – 100% failure

Windows Server 2003 Storage Technologies

Windows Server 2003 Storage Goals n Data Protection and Recovery n n n Availability, Scalability, and Performance n n Volume Shadow Copy Services (VSS) Automated System Recovery (ASR) Multipath IO (MPIO) Distributed File System (DFS) File and System Performance (SMB, NFS, Chkdsk, Vrfydsk) Interoperability n n Virtual Disk Service (VDS) SAN friendliness (SAN Boot, Flexible Volume Mounting, Storport, SNIAbased HBA Management API) Best Platform for Storage Solutions

Requestors Applications Volume Shadow Copy Service Virtual Disk Service Writers User Mode Microsoft Answer Windows Server 2003 Storage Stack (Point-in-time copies) (RAID, disk access, Enclosures) SW Provider HW Providers Removable Storage Manager (tape and optical media management) WMI Kernel Mode File Systems Partners Volume Snapshot Volume Management Multipath I/O DSM Tape Changer SCSIPort Storport i. SCSIprt Miniport(s) MS MPIO DSM Disk i. SCSI Initiator Microsoft Class IDEPort Miniport

Volume Shadow Copy Service (VSS)

VSS Components n Volume Shadow Copy Service n n Coordinators all components Requestors n Invokes VSS to a create shadow copy n n n Writers – Represents Apps and Windows Services (i. e. , SQL, Exchange, AD, etc. ) n n n Backup applications Shadow copy management applications Differentiates VSS from competitors Participate in shadow copy creation process Providers n Create shadow copies n n System provider Hardware snapshots

VSS Requestors Backup Requestors Shadow Copy Management Applications Aelita Comm. Vault Shadow Explorer 1. 3* Bak. Bone Net. Vault 7. 1 Datacore SANmelody CA Bright. Stor ARCserve Backup v 11 Datacore SANsymphony CA Bright. Stor Enterprise Backup v 10. 5* EMC Snapview Integration MS Exchange* Comm. Vault Galaxy* Falcon. Stor Snapshot Agent for VSS Comm. Vault Qinetix* HP Fast Recovery Solutions Dantz Microsoft Vrfydsk (Resource Kit) EMC ERM 2. 1. 1* Net. App EMC Legato Networker 7. 1 Xiotech/CA* IBM Tivoli Storage Manager 5. 2 HP Data Protector 5. 1* Microsoft NTBackup St. Bernard Open File Manager 9. 1 Ultrabac Veritas Backup Exec 9. 1

VSS Writers Windows Server 2003 service writers (in-box) COM+ Certificate Server Cluster Server DHCP Server Event Log Removable Storage Terminal Server File Replication Service Active Directory WINS WMI IIS SFP Registry SQL 2000/MSDE Application writers with increased functionality Exchange 2003 (SP 1 Incr/Diff) SQL Server 2000 (in-box)

VSS Providers Hardware Providers Software Providers EMC CLARii. ON Datacore EMC Symmetrix Microsoft Falcon. Stor (i. SCSI) Storage. Craft Equal. Logic (i. SCSI) Veritas Storage Foundation for Windows HP EVA HP XP (32 & 64 -bit) IBM ESS IBM Fast. T Intransa (i. SCSI) LSI Logic Net. App NEC Storage. Tek SVA XIOtech 3 D XIOtech Magnitude

Virtual Disk Service (VDS)

VDS – What Is It? n Single interface for managing block storage whether done by n n n OS software, or RAID storage hardware, or other storage virtualization engines Vendor and technology neutral Interconnect neutral Focus is virtualization and innovation in hardware for auto-management

VDS Components

VDS Providers Windows Server 2003 providers (in-box) Basic disk (partitions, volumes) Dynamic disk (partitions, volumes, spanning, mirror, RAID-5, Stripes) Third-Party Providers Datacore SANmelody Datacore SANsymphony Hitachi Thunder IBM Fast. T EMC CLARii. ON EMC Symmetrix LSI Logic Net. App HP EVA HP MSA Storage. Tek SVA Veritas Storage Foundation for Windows 4. 0 HP VA HP XP XIOtech 3 D XIOtech Magnitude Hitachi Lightning

VDS Applications Windows Server 2003 Applications (in-box) Disk Management MMC Diskraid CLI (Resource Kit) Diskpart CLI Third-Party Applications Comm. Vault Shadow Explorer 1. 3 Datacore SANmelody Datacore SANsymphony Elip. SAN i. SCSI HP Fast Recovery Solutions IOMega Qlogic VDS SANSurfer Microsoft Automated Deployment Services Stratus Veritas Storage Foundation for Windows 4. 0

VDS 1. 1 – MS MPIO & i. SCSI n Feature additions n n n Schedule n n n Integrated MPIO management Support for i. SCSI hardware Better SDK docs, sample code, and tests for IHVs Managed code wrappers for ISVs Beta SDK – June, 2004 RTM Q 4, 2004 “Designed for Windows” logo program n VDS 1. 0 or 1. 1 (TBD) in HCT 12. 1 (W 2 K 3 SP 1)

Integration of MS MPIO & i. SCSI n n n Part of Osaka release available in beta this month Microsoft MPIO binaries are included with this release of i. SCSI as well as a generic i. SCSI DSM written and supported by Microsoft i. SCSI DSM designed to work with all SPC-2 or later compliant i. SCSI targets Additionally, Microsoft MPIO partners will have access to i. SCSI DSM source and can add functionality and release their own Microsoft MPIO i. SCSI solution to customers Logo program will be available only for i. SCSI multipath solutions based on Microsoft MPIO

Simple SANs

The Solution: Virtual Disk Service Simplify & Cost Reduce SAN Array Management Virtual Disk Services

Partner Driven Simple SAN initiative n SAN’s n n Very successful in the high-end enterprise VERY COMPLEX to deploy, expensive ($/byte), lack of end-to-end prescriptive configurations n Mid-Market solutions n n data explosion, server consolidation, cost support this BUT … Need SANs with modular arrays Ease of initial deployment, provisioning; reasonable cost for ongoing management More favorable cost to capacity – the trend-lines here are positive n Solutions n n n Customers open to networked storage from Key Industry partners Windows Server 2003 hosts Low-cost, simple fabrics that includes pre-configured switches and HBAs Integrated applications & management consoles on Windows Server 2003

SAN Config - Accelerator RADIUS Security MPIO Path Fail-over VSS Snap-Shot VDS LUN Management Affordable Storage Networking Hardware One Simple Storage Management Interface Protocol Agnostic - i. SCSI or FC Powerful O. S. Storage Networking Facilities

SANsurfer® VDS Manager n n n Windows 2003 Server application Complements VDS CLI with an easy to use GUI Functions n n n Device discovery LUN configuration RAID management Disk formatting Distributed with QLogic HBAs, switches and SAN Connectivity Kit for Windows 2003 Downloadable from QLogic. com

Complementary to VDS CLI n CLI for Windows storage experts n n Must know command strings, syntax and flags Typo’s Must know the environment QLogic VDS GUI those that don’t want to be Windows storage experts n n n One intuitive easy to use interface Uses HBA API for auto discovery of devices Maps and displays storage network topology Configure cross platform devices from one interface Point and Click Accelerates mass adoption

SANsurfer VDS Manager

SAN Security

Enterprise SAN Security Phases of implementation Physical Lock-down & Protection of Data at Rest 1. Out of Band Management Access Simple Authentication 2. Switch-based proprietary device security Present today PHASE I Out of Band Authentication, Authorization and Audit (AAA) RADIUS with AD/LDAP PHASE II In-Band Audits for In-band events RADIUS with Policy Engine PHASE III In-band Fabric (FC) region of trust DH-CHAP w/RADIUS, Kerberos, AD, LDAP Corresponds to phases in the future roadmap PHASE IV PKI Security w/MS Cert Authority Enterprise Frameworks with policy control Advanced Authentication – EAP Host (HBA) to Fabric to Storage binding

SAN Security – Phase I Out-of-band User AAA IP Network Clients SAN Mgmt Console Server Host 1 Users (AD/LDAP) User AAA 3 2 Switch HBAs Storage Sub system Switch Pass Through Fabric/Fibre Channel Network Directory Lookup RADIUS SERVER Complete Out-of-band user AAA

SAN Security – Phase II, IV In-Band Device AAA IP Network Clients SAN Mgmt Console Server Host Users (AD/LDAP) 6 4 Switch Fabric Devices Dir Lookup Devices zone of trust RADIUS SERVER Fabric/Fibre Channel Network 5 HBAs Storage Sub system Fabric devices AAA & Policy 4, 5, 6 In-band Zone of trust with Advanced Policy

SAN Fabric Security Partner Support For MS RADIUS initiative >90% of Market Partner Support Brocade Qlogic (Switch and HBAs) Mc. Data Cisco Inrange In discussions Emulex In discussions (HBAs)

Enterprise SAN Security Radius Implementation n Customer Benefits n Enterprise Security Integration n Ease of security administration (user and device security management) n n Enterprise security does not address SAN Security today – but SANs a are critical piece of the Enterprise Infrastructure Seamless integration into existing networks for advanced features Eliminate SAN security complexity Single point (RADIUS) to create and administer user and device Authentication Authorization and Administration (AAA) Common mgmt of user and device profiles across LAN and SAN Advanced Policy creation and enforcement n n n Dynamic policies with Microsoft's Internet Authentication Service (RADIUS) User policy, group policy (Active Directory) Device and SAN policies (server and application policies)

Enterprise SAN Security Radius Implementation n What’s new n n Current SAN Security solutions are non-existent, insecure or isolated from the Enterprise : this integrates SAN Security into the overall Enterprise Security framework Industry leaders working together to address SAN Security – Standards based implementation Use of existing RADIUS Authentication to integrate a new class of users (SAN administrators) Use of existing policy engines (dynamic policies in RADIUS, user/group/device policies from AD)

Enterprise SAN Security Radius Implementation n Competitive advantage for Microsoft and Partners n Microsoft: n n n Microsoft will be first to market in addressing SAN Security that integrates with existing enterprise security (partnering with the leading players in the industry) Holistically address SAN security (as compared to islands of security and policy in the competitive platform offerings – Linux and Unix) Partners: n n Ability to integrate widely deployed SAN markets with market leading frameworks for Enterprise security Proliferation of SANs to smaller enterprises SAN security fits within the context of overall Enterprise Security and is not an isolated solution Partnership with widely deployed Enterprise infrastructure provider (MS)

Call To Action n Storage products are TOO hard to deploy for end users; especially MORG/SORG Make your product(s) compatible with Microsoft’s partner-driven Storage Security Initiative & Storage Simplification Initiative Request the Windows Storage Services SDKs and DDKs to develop VDS, VSS, i. SCSI, Storport and MPIO solutions

Community Resources n Community Sites n n List of Newsgroups n n n http: //www. microsoft. com/communities/chats/default. mspx http: //www. microsoft. com/seminar/events/webcasts/default. mspx Locate a local user group(s) n n http: //communities 2. microsoft. com/communities/newsgroups/enus/default. aspx Attend a free chat or webcast n n http: //www. microsoft. com/communities/default. mspx http: //www. microsoft. com/communities/usergroups/default. mspx Non-Microsoft Community Sites n http: //www. microsoft. com/communities/related/default. mspx

Additional Resources n Email n n n Web Resources: n n n VDSAPI @ microsoft. com VSSAPI @ microsoft. com Specs: http: //www. microsoft. com/storage Whitepapers: http: //www. microsoft. com/storage Related Sessions n TW 04084 – Windows Storage Services Interfaces & Adoption Trends