lab | Tom's Notes

Playing around with Azure Stack HCI

By Tomica Kaniski in Other 27/03/2022 0 Comment

Decided to have some fun with (nested) Microsoft Azure Stack HCI in my lab.

If you want to do the same, I’ve scripted most the stuff you need, so… maybe it will be useful.

Steps to prepare a brand new, shiny, nested Azure Stack HCI lab are (roughly):

prepare your (parent) Windows Server 2022 Hyper-V host (ensure enough resources are available)
- it already hosts my Active Directory, DNS, DHCP, router, …, VMs
- everything will be saved locally to D:\AzureStackHCI
(optional) install Windows Admin Center (WAC) for easier management
- download it and install with simple command:

### install Windows Admin Center
Invoke-WebRequest 'https://aka.ms/WACDownload' -OutFile "D:\AzureStackHCI\WindowsAdminCenter2110.msi"
C:\Windows\System32\msiexec.exe /i "D:\AzureStackHCI\WindowsAdminCenter2110.msi" /qn /L*v "D:\AzureStackHCI\WindowsAdminCenter2110.log" SME_PORT=443 SSL_CERTIFICATE_OPTION=generate

### install Windows Admin Center

Invoke-WebRequest 'https://aka.ms/WACDownload' -OutFile "D:\AzureStackHCI\WindowsAdminCenter2110.msi"

C:\Windows\System32\msiexec.exe /i "D:\AzureStackHCI\WindowsAdminCenter2110.msi" /qn /L*v "D:\AzureStackHCI\WindowsAdminCenter2110.log" SME_PORT=443 SSL_CERTIFICATE_OPTION=generate

obtain the Azure Stack HCI 60-day trial ISO image from here
make VHD(X) from the obtained ISO image:

### check what's in the Azure Stack HCI ISO file
dism /Get-WimInfo /WimFile:E:\sources\install.wim
# Deployment Image Servicing and Management tool
# Version: 10.0.20348.1

# Details for image : E:\sources\install.wim

# Index : 1
# Name : Azure Stack HCI
# Description : This option installs Azure Stack HCI.
# Size : 7.996.171.122 bytes

# The operation completed successfully.

### convert ISO to VHDX
# https://github.com/x0nn/Convert-WindowsImage
$iso = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.iso"
$vhd = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"
Convert-WindowsImage -SourcePath $iso -VHDFormat "VHDX" -Edition "Azure Stack HCI" -SizeBytes 200GB -DiskLayout "UEFI" -VHDPath $vhd

### check what's in the Azure Stack HCI ISO file

dism /Get-WimInfo /WimFile:E:\sources\install.wim

# Deployment Image Servicing and Management tool

# Version: 10.0.20348.1

# Details for image : E:\sources\install.wim

# Index : 1

# Name : Azure Stack HCI

# Description : This option installs Azure Stack HCI.

# Size : 7.996.171.122 bytes

# The operation completed successfully.

### convert ISO to VHDX

# https://github.com/x0nn/Convert-WindowsImage

$iso = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.iso"

$vhd = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"

Convert-WindowsImage -SourcePath $iso -VHDFormat "VHDX" -Edition "Azure Stack HCI" -SizeBytes 200GB -DiskLayout "UEFI" -VHDPath $vhd

- note that I’m using Convert-WindowsImage.ps1 available here
- which gives me nice, generalized Azure Stack HCI VHD(X), which we will “upgrade with things” and later use for VM creation
install prerequisites into VHD(X)
- this one is fairly easy – install Windows roles and features directly to the VHD(X) itself:

### install Azure Stack HCI cluster prerequisites
$vhd = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"
$roles = @(
    "BitLocker",
    "Data-Center-Bridging",
    "EnhancedStorage",
    "Failover-Clustering",
    "FS-FileServer",
    "FS-Data-Deduplication",
    "Hyper-V",
    "Hyper-V-PowerShell",
    "NetworkATC",
    "RSAT-AD-PowerShell",
    "RSAT-Clustering-PowerShell",
    "Storage-Replica"
)
Install-WindowsFeature -Vhd $vhd -Name $roles -IncludeAllSubFeature -IncludeManagementTools

### install Azure Stack HCI cluster prerequisites

$vhd = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"

$roles = @(

"BitLocker",

"Data-Center-Bridging",

"EnhancedStorage",

"Failover-Clustering",

"FS-FileServer",

"FS-Data-Deduplication",

"Hyper-V",

"Hyper-V-PowerShell",

"NetworkATC",

"RSAT-AD-PowerShell",

"RSAT-Clustering-PowerShell",

"Storage-Replica"

)

Install-WindowsFeature -Vhd $vhd -Name $roles -IncludeAllSubFeature -IncludeManagementTools

- NOTE: If you try to install the Hyper-V role later, it may fail as we’re running Azure Stack HCI on “normal” Windows Server, so it get’s confused with nested virtualization availability. With preinstaling it, we make sure it just works.
update VHD(X) with latest patches:

### install Windows updates (into an offline VHDX image)
$vhd = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"
$packages = "D:\AzureStackHCI\Updates"
# mount image
$drive = (Mount-VHD -Path $vhd -PassThru | Get-Disk | Get-Partition | Get-Volume).DriveLetter
# install updates from folder
Add-WindowsPackage -Path "$(([string]$drive).Trim()):\" -PackagePath $packages -IgnoreCheck
# dismount image
Dismount-Vhd -Path $vhd

### install Windows updates (into an offline VHDX image)

$vhd = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"

$packages = "D:\AzureStackHCI\Updates"

# mount image

$drive = (Mount-VHD -Path $vhd -PassThru | Get-Disk | Get-Partition | Get-Volume).DriveLetter

# install updates from folder

Add-WindowsPackage -Path "$(([string]$drive).Trim()):\" -PackagePath $packages -IgnoreCheck

# dismount image

Dismount-Vhd -Path $vhd

- I have previously downloaded all the Azure Stack HCI patches available to D:\AzureStackHCI\Updates
add Unattend.xml to handle the “set password at first login issue”
- it annoys me that I need to set up the initial password, so… simple Unattend.xml file, injected into VHD(X) should take care of this:

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="oobeSystem">
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="wow64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <UserAccounts>
                <AdministratorPassword>
                    <Value>UABAAHMAcwB3ADAAcgBkACEAQQBkAG0AaQBuAGkAcwB0AHIAYQB0AG8AcgBQAGEAcwBzAHcAbwByAGQA</Value>
                    <PlainText>false</PlainText>
                </AdministratorPassword>
            </UserAccounts>
        </component>
    </settings>
    <cpi:offlineImage cpi:source="wim:c:/sources/install.wim#Azure Stack HCI SERVERAZURESTACKHCICORE" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
</unattend>

<?xml version="1.0" encoding="utf-8"?>

<Value>UABAAHMAcwB3ADAAcgBkACEAQQBkAG0AaQBuAGkAcwB0AHIAYQB0AG8AcgBQAGEAcwBzAHcAbwByAGQA</Value>

<PlainText>false</PlainText>

</AdministratorPassword>

</UserAccounts>

</component>

</settings>

<cpi:offlineImage cpi:source="wim:c:/sources/install.wim#Azure Stack HCI SERVERAZURESTACKHCICORE" xmlns:cpi="urn:schemas-microsoft-com:cpi" />

</unattend>

### inject Unattend.xml (into an offline VHDX image)
$vhd = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"
# mount image
$drive = (Mount-VHD -Path $vhd -PassThru | Get-Disk | Get-Partition | Get-Volume).DriveLetter
# inject Unattend.xml
Copy-Item -Path ".\Unattend.xml" -Destination "$(([string]$drive).Trim()):\"
# dismount image
Dismount-Vhd -Path $vhd

### inject Unattend.xml (into an offline VHDX image)

$vhd = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"

# mount image

$drive = (Mount-VHD -Path $vhd -PassThru | Get-Disk | Get-Partition | Get-Volume).DriveLetter

# inject Unattend.xml

Copy-Item -Path ".\Unattend.xml" -Destination "$(([string]$drive).Trim()):\"

# dismount image

Dismount-Vhd -Path $vhd

- NOTE: Make sure you don’t use clear-text passwords in Unattend.xml file!
create Azure Stack HCI VMs
- I’m creating two VMs from our prepared VHD(X), with a couple of additional data disks, few network adapters for different purposes, nested virtualization enabled, etc.:

### create vms
$vms = "AZS1", "AZS2"
foreach ($vm in $vms) {
    # prepare paths
    $vmpath = "D:\AzureStackHCI\VMs"
    $vhd = "D:\AzureStackHCI\VMs\$vm\Virtual Hard Disks\$vm"
    $vhdt = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"

    # prepare folders
    New-Item -Name $vm -Type Directory -Path $vmpath -Force
    New-Item -Name "Virtual Machines" -Type Directory -Path "$vmpath\$vm" -Force
    New-Item -Name "Virtual Hard Disks" -Type Directory -Path "$vmpath\$vm" -Force
    
    # copy boot disk
    Copy-Item -Path $vhdt -Destination "$($vhd)_0.vhdx"

    # create vm
    New-VM -Name $vm -MemoryStartupBytes 64GB -VHDPath "$($vhd)_0.vhdx" -SwitchName Corporate -Generation 2 -Path $vmpath
    Set-VM -VMName $vm -AutomaticStartAction Nothing -AutomaticStopAction ShutDown -CheckpointType Standard
    Set-VMProcessor -VMName $vm -Count 16 -ExposeVirtualizationExtensions $true
    New-VHD -Path "$($vhd)_1.vhdx" -SizeBytes 480GB -Dynamic
    Add-VMHardDiskDrive -VMName $vm -Path "$($vhd)_1.vhdx"
    New-VHD -Path "$($vhd)_2.vhdx" -SizeBytes 480GB -Dynamic
    Add-VMHardDiskDrive -VMName $vm -Path "$($vhd)_2.vhdx"
    New-VHD -Path "$($vhd)_3.vhdx" -SizeBytes 480GB -Dynamic
    Add-VMHardDiskDrive -VMName $vm -Path "$($vhd)_3.vhdx"
    New-VHD -Path "$($vhd)_4.vhdx" -SizeBytes 480GB -Dynamic
    Add-VMHardDiskDrive -VMName $vm -Path "$($vhd)_4.vhdx"
    Rename-VMNetworkAdapter -VMName $vm -NewName "Corporate"
    Set-VMNetworkAdapter -VMName $vm -Name "Corporate" -DeviceNaming "On"
    Add-VMNetworkAdapter -VMName $vm -Name "Storage_1" -SwitchName "Storage_1" -DeviceNaming "On"
    Add-VMNetworkAdapter -VMName $vm -Name "Storage_2" -SwitchName "Storage_2" -DeviceNaming "On"
    Add-VMNetworkAdapter -VMName $vm -Name "VM" -SwitchName "Corporate" -DeviceNaming "On"
    Set-VMNetworkAdapter -VMName $vm -Name "VM" -MacAddressSpoofing "On"
    Set-VMFirmware -VMName $vm -BootOrder (Get-VMHardDiskDrive -VMName $vm -ControllerNumber 0 -ControllerLocation 0)
    Start-VM -VMName $vm
}

### create vms

$vms = "AZS1", "AZS2"

foreach ($vm in $vms) {

# prepare paths

$vmpath = "D:\AzureStackHCI\VMs"

$vhd = "D:\AzureStackHCI\VMs\$vm\Virtual Hard Disks\$vm"

$vhdt = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"

# prepare folders

New-Item -Name $vm -Type Directory -Path $vmpath -Force

New-Item -Name "Virtual Machines" -Type Directory -Path "$vmpath\$vm" -Force

New-Item -Name "Virtual Hard Disks" -Type Directory -Path "$vmpath\$vm" -Force

# copy boot disk

Copy-Item -Path $vhdt -Destination "$($vhd)_0.vhdx"

# create vm

New-VM -Name $vm -MemoryStartupBytes 64GB -VHDPath "$($vhd)_0.vhdx" -SwitchName Corporate -Generation 2 -Path $vmpath

Set-VM -VMName $vm -AutomaticStartAction Nothing -AutomaticStopAction ShutDown -CheckpointType Standard

Set-VMProcessor -VMName $vm -Count 16 -ExposeVirtualizationExtensions $true

New-VHD -Path "$($vhd)_1.vhdx" -SizeBytes 480GB -Dynamic

Add-VMHardDiskDrive -VMName $vm -Path "$($vhd)_1.vhdx"

New-VHD -Path "$($vhd)_2.vhdx" -SizeBytes 480GB -Dynamic

Add-VMHardDiskDrive -VMName $vm -Path "$($vhd)_2.vhdx"

New-VHD -Path "$($vhd)_3.vhdx" -SizeBytes 480GB -Dynamic

Add-VMHardDiskDrive -VMName $vm -Path "$($vhd)_3.vhdx"

New-VHD -Path "$($vhd)_4.vhdx" -SizeBytes 480GB -Dynamic

Add-VMHardDiskDrive -VMName $vm -Path "$($vhd)_4.vhdx"

Rename-VMNetworkAdapter -VMName $vm -NewName "Corporate"

Set-VMNetworkAdapter -VMName $vm -Name "Corporate" -DeviceNaming "On"

Add-VMNetworkAdapter -VMName $vm -Name "Storage_1" -SwitchName "Storage_1" -DeviceNaming "On"

Add-VMNetworkAdapter -VMName $vm -Name "Storage_2" -SwitchName "Storage_2" -DeviceNaming "On"

Add-VMNetworkAdapter -VMName $vm -Name "VM" -SwitchName "Corporate" -DeviceNaming "On"

Set-VMNetworkAdapter -VMName $vm -Name "VM" -MacAddressSpoofing "On"

Set-VMFirmware -VMName $vm -BootOrder (Get-VMHardDiskDrive -VMName $vm -ControllerNumber 0 -ControllerLocation 0)

Start-VM -VMName $vm

}

set node networking, join them to the domain, prepare for cluster (by using PowerShell Direct):

### customize AZS1
# set networking
$localAdmin = Get-Credential -UserName "AZSx\Administrator" -Message "Enter password for the local Administrator account:"
Enter-PSSession -VMName "AZS1" -Credential $localAdmin

# rename network adapters per Hyper-V adapter name
$adapters = "Corporate", "Storage_1", "Storage_2", "VM"
foreach ($adapter in $adapters) {
    Get-NetAdapterAdvancedProperty -RegistryKeyword HyperVNetworkAdapterName | Where-Object { $_.DisplayValue -eq $adapter } | Rename-NetAdapter -NewName $adapter
}

# set IP addresses (AZS1)
$ia = "Corporate"
New-NetIPAddress -InterfaceAlias $ia -IPAddress "192.168.111.51" -PrefixLength "24" -DefaultGateway "192.168.111.1"
Set-DnsClientServerAddress -InterfaceAlias $ia -ServerAddresses "192.168.111.5"
Set-DnsClient -InterfaceAlias $ia -ConnectionSpecificSuffix "lab.tklabs.eu"
Set-NetIPInterface -InterfaceAlias $ia -InterfaceMetric 1

# test if it works
$dc = Resolve-DnsName "DOM1"
Test-NetConnection $dc.IPAddress

# set other IP addresses (AZS1)
$ia = "Storage_1"
New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.111.1" -PrefixLength "30"
Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false
$ia = "Storage_2"
New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.112.1" -PrefixLength "30"
Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false
$ia = "VM"
New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.113.1" -PrefixLength "30"
Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false

# enable RDP
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

# Power Options - High Performance
(Get-WmiObject -Namespace root\cimv2\power -Class Win32_PowerPlan -Filter "ElementName = 'High Performance'").Activate()

# Rename C:
Set-Volume -DriveLetter "C" -NewFileSystemLabel "OSDisk"

# timezone
Set-Timezone "Central European Standard Time"

# Windows Update PowerShell module
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted
Install-Module PSWindowsUpdate

# domain join
Add-Computer -DomainName "lab.tklabs.eu" -Credential "LAB\Administrator" -NewName "AZS1" -Restart -Force

## additional settings
$domainadmin = Get-Credential -UserName "LAB\Administrator" -Message "Enter password for the domain Administrator account:"
Enter-PSSession -VMName "AZS1" -Credential $domainadmin

# disable SConfig on login
Set-SConfig -AutoLaunch $false

# Windows Update
Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -Verbose

### customize AZS1

# set networking

$localAdmin = Get-Credential -UserName "AZSx\Administrator" -Message "Enter password for the local Administrator account:"

Enter-PSSession -VMName "AZS1" -Credential $localAdmin

# rename network adapters per Hyper-V adapter name

$adapters = "Corporate", "Storage_1", "Storage_2", "VM"

foreach ($adapter in $adapters) {

Get-NetAdapterAdvancedProperty -RegistryKeyword HyperVNetworkAdapterName | Where-Object { $_.DisplayValue -eq $adapter } | Rename-NetAdapter -NewName $adapter

}

# set IP addresses (AZS1)

$ia = "Corporate"

New-NetIPAddress -InterfaceAlias $ia -IPAddress "192.168.111.51" -PrefixLength "24" -DefaultGateway "192.168.111.1"

Set-DnsClientServerAddress -InterfaceAlias $ia -ServerAddresses "192.168.111.5"

Set-DnsClient -InterfaceAlias $ia -ConnectionSpecificSuffix "lab.tklabs.eu"

Set-NetIPInterface -InterfaceAlias $ia -InterfaceMetric 1

# test if it works

$dc = Resolve-DnsName "DOM1"

Test-NetConnection $dc.IPAddress

# set other IP addresses (AZS1)

$ia = "Storage_1"

New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.111.1" -PrefixLength "30"

Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false

$ia = "Storage_2"

New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.112.1" -PrefixLength "30"

Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false

$ia = "VM"

New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.113.1" -PrefixLength "30"

Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false

# enable RDP

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

# Power Options - High Performance

(Get-WmiObject -Namespace root\cimv2\power -Class Win32_PowerPlan -Filter "ElementName = 'High Performance'").Activate()

# Rename C:

Set-Volume -DriveLetter "C" -NewFileSystemLabel "OSDisk"

# timezone

Set-Timezone "Central European Standard Time"

# Windows Update PowerShell module

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force

Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted

Install-Module PSWindowsUpdate

# domain join

Add-Computer -DomainName "lab.tklabs.eu" -Credential "LAB\Administrator" -NewName "AZS1" -Restart -Force

## additional settings

$domainadmin = Get-Credential -UserName "LAB\Administrator" -Message "Enter password for the domain Administrator account:"

Enter-PSSession -VMName "AZS1" -Credential $domainadmin

# disable SConfig on login

Set-SConfig -AutoLaunch $false

# Windows Update

Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -Verbose

### customize AZS2
# set networking
$localAdmin = Get-Credential -UserName "AZSx\Administrator" -Message "Enter password for the local Administrator account:"
Enter-PSSession -VMName "AZS2" -Credential $localAdmin

# rename network adapters per Hyper-V adapter name
$adapters = "Corporate", "Storage_1", "Storage_2", "VM"
foreach ($adapter in $adapters) {
    Get-NetAdapterAdvancedProperty -RegistryKeyword HyperVNetworkAdapterName | Where-Object { $_.DisplayValue -eq $adapter } | Rename-NetAdapter -NewName $adapter
}

# set IP addresses (AZS2)
$ia = "Corporate"
New-NetIPAddress -InterfaceAlias $ia -IPAddress "192.168.111.52" -PrefixLength "24" -DefaultGateway "192.168.111.1"
Set-DnsClientServerAddress -InterfaceAlias $ia -ServerAddresses "192.168.111.5"
Set-DnsClient -InterfaceAlias $ia -ConnectionSpecificSuffix "lab.tklabs.eu"
Set-NetIPInterface -InterfaceAlias $ia -InterfaceMetric 1

# test if it works
$dc = Resolve-DnsName "DOM1"
Test-NetConnection $dc.IPAddress

# set other IP addresses (AZS2)
$ia = "Storage_1"
New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.111.2" -PrefixLength "30"
Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false
$ia = "Storage_2"
New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.112.2" -PrefixLength "30"
Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false
$ia = "VM"
New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.113.2" -PrefixLength "30"
Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false

# enable RDP
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

# Power Options - High Performance
(Get-WmiObject -Namespace root\cimv2\power -Class Win32_PowerPlan -Filter "ElementName = 'High Performance'").Activate()

# Rename C:
Set-Volume -DriveLetter "C" -NewFileSystemLabel "OSDisk"

# timezone
Set-Timezone "Central European Standard Time"

# Windows Update PowerShell module
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted
Install-Module PSWindowsUpdate

# domain join
Add-Computer -DomainName "lab.tklabs.eu" -Credential "LAB\Administrator" -NewName "AZS2" -Restart -Force

## additional settings
$domainadmin = Get-Credential -UserName "LAB\Administrator" -Message "Enter password for the domain Administrator account:"
Enter-PSSession -VMName "AZS2" -Credential $domainadmin

# disable SConfig on login
Set-SConfig -AutoLaunch $false

# Windows Update
Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -Verbose

### customize AZS2

# set networking

$localAdmin = Get-Credential -UserName "AZSx\Administrator" -Message "Enter password for the local Administrator account:"

Enter-PSSession -VMName "AZS2" -Credential $localAdmin

# rename network adapters per Hyper-V adapter name

$adapters = "Corporate", "Storage_1", "Storage_2", "VM"

foreach ($adapter in $adapters) {

Get-NetAdapterAdvancedProperty -RegistryKeyword HyperVNetworkAdapterName | Where-Object { $_.DisplayValue -eq $adapter } | Rename-NetAdapter -NewName $adapter

}

# set IP addresses (AZS2)

$ia = "Corporate"

New-NetIPAddress -InterfaceAlias $ia -IPAddress "192.168.111.52" -PrefixLength "24" -DefaultGateway "192.168.111.1"

Set-DnsClientServerAddress -InterfaceAlias $ia -ServerAddresses "192.168.111.5"

Set-DnsClient -InterfaceAlias $ia -ConnectionSpecificSuffix "lab.tklabs.eu"

Set-NetIPInterface -InterfaceAlias $ia -InterfaceMetric 1

# test if it works

$dc = Resolve-DnsName "DOM1"

Test-NetConnection $dc.IPAddress

# set other IP addresses (AZS2)

$ia = "Storage_1"

New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.111.2" -PrefixLength "30"

Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false

$ia = "Storage_2"

New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.112.2" -PrefixLength "30"

Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false

$ia = "VM"

New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.113.2" -PrefixLength "30"

Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false

# enable RDP

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

# Power Options - High Performance

(Get-WmiObject -Namespace root\cimv2\power -Class Win32_PowerPlan -Filter "ElementName = 'High Performance'").Activate()

# Rename C:

Set-Volume -DriveLetter "C" -NewFileSystemLabel "OSDisk"

# timezone

Set-Timezone "Central European Standard Time"

# Windows Update PowerShell module

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force

Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted

Install-Module PSWindowsUpdate

# domain join

Add-Computer -DomainName "lab.tklabs.eu" -Credential "LAB\Administrator" -NewName "AZS2" -Restart -Force

## additional settings

$domainadmin = Get-Credential -UserName "LAB\Administrator" -Message "Enter password for the domain Administrator account:"

Enter-PSSession -VMName "AZS2" -Credential $domainadmin

# disable SConfig on login

Set-SConfig -AutoLaunch $false

# Windows Update

Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -Verbose

create the Azure Stack HCI cluster:

### create Azure Stack HCI cluster
# prepare and clean disks
$servers = "AZS1", "AZS2"
$cluster = "AzSCluster"
$clusterIp = "192.168.111.50/24"

Invoke-Command ($servers) {
    Update-StorageProviderCache
    Get-StoragePool | Where-Object { $_.IsPrimordial -eq $false } | Set-StoragePool -IsReadOnly:$false -ErrorAction SilentlyContinue
    Get-StoragePool | Where-Object { $_.IsPrimordial -eq $false } | Get-VirtualDisk | Remove-VirtualDisk -Confirm:$false -ErrorAction SilentlyContinue
    Get-StoragePool | Where-Object { $_.IsPrimordial -eq $false } | Remove-StoragePool -Confirm:$false -ErrorAction SilentlyContinue
    Get-PhysicalDisk | Reset-PhysicalDisk -ErrorAction SilentlyContinue
    Get-Disk | Where-Object { $_.Number -ne $null } | Where-Object { $_.IsBoot -ne $true } | Where-Object { $_.IsSystem -ne $true } | Where-Object { $_.PartitionStyle -ne "RAW" } | ForEach-Object {
        $_ | Set-Disk -IsOffline:$false
        $_ | Set-Disk -IsReadOnly:$false
        $_ | Clear-Disk -RemoveData -RemoveOEM -Confirm:$false
        $_ | Set-Disk -IsReadOnly:$true
        $_ | Set-Disk -IsOffline:$true
    }
    Get-Disk | Where-Object { $_.Number -ne $Null } | Where-Object { $_.IsBoot -ne $True } | Where-Object { $_.IsSystem -ne $True } | Where-Object { $_.PartitionStyle -eq "RAW" } | Group-Object -NoElement -Property "FriendlyName"
} | Sort-Object -Property "PsComputerName", "Count"
# Count Name                      PSComputerName
# ----- ----                      --------------
#     4 Msft Virtual Disk         AZS1
#     4 Msft Virtual Disk         AZS2

# check if cluster can be created
Test-Cluster -Node $servers -Include "Storage Spaces Direct", "Inventory", "Network", "System Configuration"

# create cluster
New-Cluster -Name $cluster -Node $servers -StaticAddress $clusterIp -NoStorage

# check cluster
Get-Cluster -Name $cluster | Get-ClusterResource
# Name                        State  OwnerGroup    ResourceType
# ----                        -----  ----------    ------------
# Cluster IP Address          Online Cluster Group IP Address
# Cluster Name                Online Cluster Group Network Name
# Virtual Machine Cluster WMI Online Cluster Group Virtual Machine Cluster WMI

# set cluster quorum (file share witness)
Set-ClusterQuorum -Cluster $cluster -FileShareWitness "\\DOM1.lab.tklabs.eu\Witness_AZSCluster$"
# Cluster              QuorumResource
# -------              --------------
# AzSCluster           File Share Witness

Get-Cluster -Name $cluster | Get-ClusterResource
# Name                        State  OwnerGroup    ResourceType
# ----                        -----  ----------    ------------
# Cluster IP Address          Online Cluster Group IP Address
# Cluster Name                Online Cluster Group Network Name
# File Share Witness          Online Cluster Group File Share Witness
# Virtual Machine Cluster WMI Online Cluster Group Virtual Machine Cluster WMI

### create Azure Stack HCI cluster

# prepare and clean disks

$servers = "AZS1", "AZS2"

$cluster = "AzSCluster"

$clusterIp = "192.168.111.50/24"

Invoke-Command ($servers) {

Update-StorageProviderCache

Get-StoragePool | Where-Object { $_.IsPrimordial -eq $false } | Set-StoragePool -IsReadOnly:$false -ErrorAction SilentlyContinue

Get-StoragePool | Where-Object { $_.IsPrimordial -eq $false } | Get-VirtualDisk | Remove-VirtualDisk -Confirm:$false -ErrorAction SilentlyContinue

Get-StoragePool | Where-Object { $_.IsPrimordial -eq $false } | Remove-StoragePool -Confirm:$false -ErrorAction SilentlyContinue

Get-PhysicalDisk | Reset-PhysicalDisk -ErrorAction SilentlyContinue

Get-Disk | Where-Object { $_.Number -ne $null } | Where-Object { $_.IsBoot -ne $true } | Where-Object { $_.IsSystem -ne $true } | Where-Object { $_.PartitionStyle -ne "RAW" } | ForEach-Object {

$_ | Set-Disk -IsOffline:$false

$_ | Set-Disk -IsReadOnly:$false

$_ | Clear-Disk -RemoveData -RemoveOEM -Confirm:$false

$_ | Set-Disk -IsReadOnly:$true

$_ | Set-Disk -IsOffline:$true

}

Get-Disk | Where-Object { $_.Number -ne $Null } | Where-Object { $_.IsBoot -ne $True } | Where-Object { $_.IsSystem -ne $True } | Where-Object { $_.PartitionStyle -eq "RAW" } | Group-Object -NoElement -Property "FriendlyName"

} | Sort-Object -Property "PsComputerName", "Count"

# Count Name PSComputerName

# ----- ---- --------------

# 4 Msft Virtual Disk AZS1

# 4 Msft Virtual Disk AZS2

# check if cluster can be created

Test-Cluster -Node $servers -Include "Storage Spaces Direct", "Inventory", "Network", "System Configuration"

# create cluster

New-Cluster -Name $cluster -Node $servers -StaticAddress $clusterIp -NoStorage

# check cluster

Get-Cluster -Name $cluster | Get-ClusterResource

# Name State OwnerGroup ResourceType

# ---- ----- ---------- ------------

# Cluster IP Address Online Cluster Group IP Address

# Cluster Name Online Cluster Group Network Name

# Virtual Machine Cluster WMI Online Cluster Group Virtual Machine Cluster WMI

# set cluster quorum (file share witness)

Set-ClusterQuorum -Cluster $cluster -FileShareWitness "\\DOM1.lab.tklabs.eu\Witness_AZSCluster$"

# Cluster QuorumResource

# ------- --------------

# AzSCluster File Share Witness

Get-Cluster -Name $cluster | Get-ClusterResource

# Name State OwnerGroup ResourceType

# ---- ----- ---------- ------------

# Cluster IP Address Online Cluster Group IP Address

# Cluster Name Online Cluster Group Network Name

# File Share Witness Online Cluster Group File Share Witness

# Virtual Machine Cluster WMI Online Cluster Group Virtual Machine Cluster WMI

### https://docs.microsoft.com/en-us/azure-stack/hci/deploy/register-with-azure
# prerequisites
Install-Module -Name "Az.StackHCI" -Force -Confirm:$false

# registration
Register-AzStackHCI -SubscriptionId "<your_Azure_subscription_ID>" -ResourceGroupName "AzureStackHCI"
# WARNING: To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code DW84XWSHV to authenticate.
# WARNING: We have migrated the API calls for this cmdlet from Azure Active Directory Graph to Microsoft Graph. Visit https://go.microsoft.com/fwlink/?linkid=2181475 for any permission issues.

# Result                          : Success
# AzurePortalResourceURL          : https://portal.azure.com/#@<some_resource_ID>/resource/subscriptions/<your_Azure_subscription_ID>/resourceGroups/AzureStackHCI/providers/Microsoft.AzureStackHCI/clusters/AzSCluster/overview
# AzureResourceId                 : /Subscriptions/<your_Azure_subscription_ID>/resourceGroups/AzureStackHCI/providers/Microsoft.AzureStackHCI/clusters/AzSCluster
# AzurePortalAADAppPermissionsURL : https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/CallAnAPI/appId/<some_App_ID>/isMSAApp/
# Details                         : Azure Stack HCI is successfully registered. An Azure resource representing Azure Stack HCI has been created in your Azure subscription to enable an Azure-consistent monitoring, billing, and support experience.

### https://docs.microsoft.com/en-us/azure-stack/hci/deploy/register-with-azure

# prerequisites

Install-Module -Name "Az.StackHCI" -Force -Confirm:$false

# registration

# WARNING: To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code DW84XWSHV to authenticate.

# WARNING: We have migrated the API calls for this cmdlet from Azure Active Directory Graph to Microsoft Graph. Visit https://go.microsoft.com/fwlink/?linkid=2181475 for any permission issues.

# Result : Success

# AzurePortalResourceURL : https://portal.azure.com/#@<some_resource_ID>/resource/subscriptions/<your_Azure_subscription_ID>/resourceGroups/AzureStackHCI/providers/Microsoft.AzureStackHCI/clusters/AzSCluster/overview

# AzureResourceId : /Subscriptions/<your_Azure_subscription_ID>/resourceGroups/AzureStackHCI/providers/Microsoft.AzureStackHCI/clusters/AzSCluster

# AzurePortalAADAppPermissionsURL : https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/CallAnAPI/appId/<some_App_ID>/isMSAApp/

# Details : Azure Stack HCI is successfully registered. An Azure resource representing Azure Stack HCI has been created in your Azure subscription to enable an Azure-consistent monitoring, billing, and support experience.

create CSV(s) and virtual switches for child workloads (but add nodes/cluster to WAC before, if not using PowerShell)
- NOTE: I’m not using intent-based networking at this time. Nor SDN.

play around with your new cluster
(optional) clean all/redeploy if needed:

### cleanup script
Get-VM "AZS*" | Stop-VM -TurnOff -Force
Remove-VM "AZS*" -Force
Remove-Item "D:\AzureStackHCI\VMs\AZS*" -Force -Recurse

### cleanup script

Get-VM "AZS*" | Stop-VM -TurnOff -Force

Remove-VM "AZS*" -Force

Remove-Item "D:\AzureStackHCI\VMs\AZS*" -Force -Recurse

And now you have fully functional, nested, 2-node Azure Stack HCI cluster – nothing too fancy, but you can extend it how you wish! 😊

You can begin exploring the Azure Stack HCI itself, use it with Azure Arc, or perhaps install AKS on Azure Stack HCI and play around with it. Or something else.

Cheers!

P.S. You can use these scripts also for stuff other than Azure Stack HCI, of course! 😉
P.P.S. Code is also available on my GitHub page.

Azure VM with CloudFlare DNS… by Terraform

By Tomica Kaniski in Other 25/08/2020 0 Comment

I like Terraform! 🙂

Had an idea the other day – I wanted to make myself an Ubuntu virtual machine on Microsoft Azure and also create a corresponding DNS record inside my kaniski.eu domain (currently hosted at CloudFlare… like, I guess, half of the Internet). Of course, I can do all that by using both of the portals, but this time I wanted to do it with Terraform, so it can be easily brought up and down, reusable, etc.

For this, you’ll need:

Microsoft Azure subscription
CloudFlare account (with a domain attached to its DNS servers, of course)
Terraform (v0.13)
(optional) Visual Studio Code
(or you can all do it inside Azure Cloud Shell)

To configure Terraform with your Azure subscription, you’ll need:

Azure Subscription ID
Tenant ID
Client ID
Client secret

There’s a nice document about setting it all up – https://docs.microsoft.com/en-us/azure/developer/terraform/overview.

For accessing CloudFlare API via Terraform, you’ll need the following info from your CloudFlare account page:

e-mail address
CloudFlare zone ID
CloudFlare account ID

CloudFlare API key

Be really careful with using your Azure/CloudFlare keys (can’t be stressed enough!)!

Also note that the following code is only one way of doing it, one that suits me for this purpose, not best practice or the prettiest code ever! 🙂

The whole example (main.tf) looks like this (it can/should be improved, but that’s not really the point here and now):

# providers
provider "azurerm" {
  version = "~> 2.24"

  subscription_id = var.subscription_id
  tenant_id       = var.tenant_id
  client_id       = var.client_id
  client_secret   = var.client_secret

  features {}
}

provider "cloudflare" {
  version = "~> 2.10.0"

  email      = var.cf_email
  api_key    = var.cf_apikey
  account_id = var.cf_accountid
}

# resource group
resource "azurerm_resource_group" "example-rg" {
  name     = "example-rg"
  location = "West Europe"
}

# network
resource "azurerm_virtual_network" "example-net" {
  name                = "example-net"
  location            = azurerm_resource_group.example-rg.location
  resource_group_name = azurerm_resource_group.example-rg.name
  address_space       = ["10.11.0.0/16"]
}

# subnet
resource "azurerm_subnet" "example-sub" {
  name                 = "example-sub"
  resource_group_name  = azurerm_resource_group.example-rg.name
  virtual_network_name = azurerm_virtual_network.example-net.name
  address_prefixes     = ["10.11.12.0/24"]
}

# nics
resource "azurerm_network_interface" "myvm-nic" {
  name                 = "myvm-nic"
  location             = azurerm_resource_group.example-rg.location
  resource_group_name  = azurerm_resource_group.example-rg.name
  enable_ip_forwarding = true

  ip_configuration {
    name                          = "myvm-nic-ip-config"
    subnet_id                     = azurerm_subnet.example-sub.id
    private_ip_address_allocation = "Static"
    private_ip_address            = "10.11.12.4"
    public_ip_address_id          = azurerm_public_ip.myvm-ip.id
  }
}

# public ips
resource "azurerm_public_ip" "myvm-ip" {
  name                = "myvm-ip"
  location            = azurerm_resource_group.example-rg.location
  resource_group_name = azurerm_resource_group.example-rg.name
  allocation_method   = "Static"
}

# network security group
resource "azurerm_network_security_group" "example-nsg" {
  name                = "example-nsg"
  location            = azurerm_resource_group.example-rg.location
  resource_group_name = azurerm_resource_group.example-rg.name

  security_rule {
    name                       = "SSH"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "22"
    source_address_prefix      = "*"
    destination_address_prefix = "10.11.12.4"
  }
}

resource "azurerm_subnet_network_security_group_association" "example-sub-nsg-assoc" {
  subnet_id                 = azurerm_subnet.example-sub.id
  network_security_group_id = azurerm_network_security_group.example-nsg.id
}

# vms
resource "azurerm_virtual_machine" "myvm" {
  name                          = "myvm"
  location                      = azurerm_resource_group.example-rg.location
  resource_group_name           = azurerm_resource_group.example-rg.name
  network_interface_ids         = [azurerm_network_interface.myvm-nic.id]
  vm_size                       = "Standard_DS1_v2"
  delete_os_disk_on_termination = true

  storage_image_reference {
    publisher = "Canonical"
    offer     = "UbuntuServer"
    sku       = "19_10-daily-gen2"
    version   = "latest"
  }

  storage_os_disk {
    name              = "myvm-osdisk"
    caching           = "ReadWrite"
    create_option     = "FromImage"
    managed_disk_type = "Standard_LRS"
  }

  os_profile {
    computer_name  = "myvm"
    admin_username = var.admin_username
  }

  os_profile_linux_config {
    disable_password_authentication = true
    ssh_keys {
      key_data = file("~/.ssh/id_rsa.pub")
      path     = "/home/${var.admin_username}/.ssh/authorized_keys"
    }
  }
}

# cloudflare dns
resource "cloudflare_record" "myvm-dns" {
  zone_id = var.cf_zoneid
  name    = "myvm"
  value   = azurerm_public_ip.myvm-ip.ip_address
  type    = "A"
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

# providers

provider "azurerm" {

version = "~> 2.24"

subscription_id = var.subscription_id

tenant_id = var.tenant_id

client_id = var.client_id

client_secret = var.client_secret

features {}

}

provider "cloudflare" {

version = "~> 2.10.0"

email = var.cf_email

api_key = var.cf_apikey

account_id = var.cf_accountid

}

# resource group

resource "azurerm_resource_group" "example-rg" {

name = "example-rg"

location = "West Europe"

}

# network

resource "azurerm_virtual_network" "example-net" {

name = "example-net"

location = azurerm_resource_group.example-rg.location

resource_group_name = azurerm_resource_group.example-rg.name

address_space = ["10.11.0.0/16"]

}

# subnet

resource "azurerm_subnet" "example-sub" {

name = "example-sub"

resource_group_name = azurerm_resource_group.example-rg.name

virtual_network_name = azurerm_virtual_network.example-net.name

address_prefixes = ["10.11.12.0/24"]

}

# nics

resource "azurerm_network_interface" "myvm-nic" {

name = "myvm-nic"

location = azurerm_resource_group.example-rg.location

resource_group_name = azurerm_resource_group.example-rg.name

enable_ip_forwarding = true

ip_configuration {

name = "myvm-nic-ip-config"

subnet_id = azurerm_subnet.example-sub.id

private_ip_address_allocation = "Static"

private_ip_address = "10.11.12.4"

public_ip_address_id = azurerm_public_ip.myvm-ip.id

}

# public ips

resource "azurerm_public_ip" "myvm-ip" {

name = "myvm-ip"

location = azurerm_resource_group.example-rg.location

resource_group_name = azurerm_resource_group.example-rg.name

allocation_method = "Static"

}

# network security group

resource "azurerm_network_security_group" "example-nsg" {

name = "example-nsg"

location = azurerm_resource_group.example-rg.location

resource_group_name = azurerm_resource_group.example-rg.name

security_rule {

name = "SSH"

priority = 100

direction = "Inbound"

access = "Allow"

protocol = "Tcp"

source_port_range = "*"

destination_port_range = "22"

source_address_prefix = "*"

destination_address_prefix = "10.11.12.4"

}

resource "azurerm_subnet_network_security_group_association" "example-sub-nsg-assoc" {

subnet_id = azurerm_subnet.example-sub.id

network_security_group_id = azurerm_network_security_group.example-nsg.id

}

# vms

resource "azurerm_virtual_machine" "myvm" {

name = "myvm"

location = azurerm_resource_group.example-rg.location

resource_group_name = azurerm_resource_group.example-rg.name

network_interface_ids = [azurerm_network_interface.myvm-nic.id]

vm_size = "Standard_DS1_v2"

delete_os_disk_on_termination = true

storage_image_reference {

publisher = "Canonical"

offer = "UbuntuServer"

sku = "19_10-daily-gen2"

version = "latest"

}

storage_os_disk {

name = "myvm-osdisk"

caching = "ReadWrite"

create_option = "FromImage"

managed_disk_type = "Standard_LRS"

}

os_profile {

computer_name = "myvm"

admin_username = var.admin_username

}

os_profile_linux_config {

disable_password_authentication = true

ssh_keys {

key_data = file("~/.ssh/id_rsa.pub")

path = "/home/${var.admin_username}/.ssh/authorized_keys"

}

# cloudflare dns

resource "cloudflare_record" "myvm-dns" {

zone_id = var.cf_zoneid

name = "myvm"

value = azurerm_public_ip.myvm-ip.ip_address

type = "A"

}

Variables used in this simple example are (terraform.tfvars):

subscription_id = ""
tenant_id       = ""
client_id       = ""
client_secret   = ""
admin_username  = ""
cf_zoneid       = ""
cf_email        = ""
cf_apikey       = ""
cf_accountid    = ""

subscription_id = ""

tenant_id = ""

client_id = ""

client_secret = ""

admin_username = ""

cf_zoneid = ""

cf_email = ""

cf_apikey = ""

cf_accountid = ""

Just note one more thing – I’m using the current version of Terraform (v0.13) and version 2 of the CloudFlare provider (notable changes between the v1 and v2 are listed at https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/guides/version-2-upgrade).

As always, running terraform init will take care of the missing providers and install them as needed. Also, running terraform plan can give us an estimation of what exactly will be done and terraform fmt will make our code look nice! 🙂

When I run this code (terraform apply), it completes successfully (of course) and provisions 9 items and, more important – gives me info about the DNS name and IP address of the provisioned VM (which I already know, but still):

Next is a series of checks:

DNS record really exists in CloudFlare DNS?

resources are really provisioned in Azure?

SSH into the VM works?

And that’s it – when you’re done, you can use terraform destroy and it’s all gone! 🙂

Cheers!

Basic SharePoint load balancing

By Tomica Kaniski in Other 20/03/2017 0 Comment

I’ve recently created a simple lab which gave me some answers around load balancing a SharePoint 2016 farm with SSL offloading.

To start, I’ve created a couple of virtual servers (on top of my “supercool home Windows Server 2016 Hyper-V PC” Smile ) – a domain controller, a SQL server and two SharePoint servers. I’ve also downloaded a KEMP LoadMaster appliance (there is also a free one here, which would have been just enough for this lab) and prepared my DigiCert wildcard certificate (there is no need for the wildcard option, but this is the one I already have, so I’ve decided to use it).

So… I’ve prepared a domain controller, joined all the other servers to the domain and then installed SQL Server 2016. After that, on SharePoint servers, I’ve ran a preparation wizard and created a new SharePoint farm from the first node… with second node joining to it later. At the end, I’ve done the “Farm configuration” wizard and was all set to do the load balancing part. (And yes – I know that clicking “Next” is lame, but… it works. Smile )

The networking configuration for this lab is pretty simple. I have two VLANs – 111 (backend, where all the servers are residing) and VLAN 101 (frontend, where my LB virtual servers are).

I’ve created a new virtual machine for the load balancer, attached it to the two mentioned networks and also added the virtual disk downloaded from KEMP’s website.

After that, I’ve done the initial configuration wizard of LoadMaster which is actually straight-forward (setting the password, IP addresses, and importing a certificate afterwards).

With this done, we can create our virtual service(s) – there is actually a great guide for configuring the SharePoint load balancing virtual servers with KEMP LoadMaster.

I’ve used the following basic (manual) settings for my virtual service:

HINT: When troubleshooting load balancing – make sure that you have only one node behind the balancer… it makes things so much easier to troubleshoot!

One last thing that wasn’t working with this “Next, Next, Next…” configuration was the Alternate Access Mappings (AAM) part – to be able to access a SharePoint farm over HTTPS and a public name, AAM should “know about it”. There is a great guide about AAM available – make sure you read it.

Default AAM settings for my farm were:

After (a lot) of troubleshooting and research, they were changed to this:

And… that’s it – it works! Smile

My totally awesome SharePoint 2016 site, located behind a load balancer and published with a trusted certificate (with SSL session terminating on my virtual KEMP load balancer), was alive:

To conclude – in all the configuration that was done, setting the AAM right was something that gave me most of the headache (load balancing/redirections not working right, troubleshooting what’s happening, etc.). Pay special attention to it! Once you figure it out, you’re done. Smile

Cheers!