topic Re: Panorama VM is misaligned. in General Topics

Panorama VM is misaligned.

plim01 — Fri, 24 May 2013 10:46:35 GMT

Hi everyone,

I have installed the Panorama from the OVF file that Palo Alto provide. But when the VM is deployed, it is misaligned. Did anyone solve this issue already?I have tried to align it with MBRAlign in ESX, but after that the alignment the VM will not startup anymore.

Does anyone have any idea how to solve this?

Re: Panorama VM is misaligned.

ericgearhart — Fri, 24 May 2013 17:23:00 GMT

To clarify he means the OVF geometry doesn't align properly when he deploys the VM onto his VMware ESX host... this can have an impact on I/O performance

In a SAN environment, the smallest hardware unit used by a SAN storage array to build a LUN out of multiple physical disks is a called a chunk or a stripe. To optimize I/O, chunks are usually much larger than sectors. Thus a SCSI I/O request that intends to read a sector in reality reads one chunk.

On top of this, in a Windows environment NTFS is formatted in blocks ranging from 1MB to 8MB. The file system used by the guest operating system optimizes I/O by grouping sectors into clusters (allocation units).

Also, operating systems on x86 architectures create partitions with a master boot record (MBR) that consumes 63 sectors. This is due to legacy BIOS code from the PC that used cylinder, head, and sector addressing instead of logical block addressing (LBA). Without LBA, the first track is reserved for the boot code, and the first partition starts at cylinder 0, head 1, and sector 1. This is LBA 63 and is therefore unaligned.

An unaligned partition results in a track crossing and an additional I/O, incurring a penalty on latency and throughput. The additional I/O (especially if small) can impact system resources significantly on some host types. An aligned partitions ensures that the single I/O is serviced by a single device, eliminating the additional I/O and resulting in overall performance improvement.

This link has a really pretty graphic if you're into that:

Guest OS Partition Alignment | VMware vSphere Blog - VMware Blogs

Re: Panorama VM is misaligned.

ericgearhart — Fri, 24 May 2013 17:23:47 GMT

Can you possibly pull the OVF into VMware converter and then deploy it from there? I thought VMware Converter had some alignment functionality built into it.

Re: Panorama VM is misaligned.

plim01 — Mon, 27 May 2013 06:35:47 GMT

Hi Egearhart,

Thanks for clarify my question. and yes i have think about using converter to do it, but there is no alignment functionality built into it. I have try to use the alignment tool from VMware/NETAPP, but than the panorama VM will not start anymore.

Re: Panorama VM is misaligned.

SabreAce33 — Fri, 19 Jul 2013 21:46:58 GMT

This was a problem for us as well. PA was unable to offer any useful assistance, unfortunately. We ended up having to use an NFS share.

Re: Panorama VM is misaligned.

mschuricht — Fri, 19 Jul 2013 23:11:09 GMT

Can you explain the performance problems you experienced with the misalignment?

At what logging rate were the problems encountered?

Re: Panorama VM is misaligned.

ericgearhart — Wed, 24 Jul 2013 13:16:33 GMT

- I haven't experienced I/O problems with VM mis-alignment with Panorama, I was just providing some background on what the original poster was referring to, just to try help clarify.

Re: Panorama VM is misaligned.

plim01 — Tue, 13 Aug 2013 12:15:24 GMT

I have opened a call and palo alto is aware of the issue and say they will provid a solution in the new version.

Re: Panorama VM is misaligned.

SabreAce33 — Tue, 13 Aug 2013 12:18:30 GMT

Awesome, let us know if you hear something definitive. I'll be keeping an eye on the release notes.

Re: Panorama VM is misaligned.

mschuricht — Tue, 13 Aug 2013 13:30:41 GMT

We will look into this request and consider it as a potential feature request for a future release. This does not guarantee if or when we would release a version with changed alignment.

Please move forward with the deployment today since there does not appear to be a performance issue that you are running into and the request seems to be associated with best practice for more efficient read/writes.

Re: Panorama VM is misaligned.

plim01 — Tue, 13 Aug 2013 13:35:33 GMT

This is the reply from the engineer where i am in contact with regarding the misalignment.

----------------------------------------------------------------------------------
Account: G-Star Raw C.V.

Comment: [Recipients: Patrick Lim]

Hi Patrick,

Just wanted to let you know that this has been fixed in a new base-image.

I'm currently waiting for a confirmation of when that will become available for public download.

Re: Panorama VM is misaligned.

mschuricht — Tue, 13 Aug 2013 13:47:05 GMT

I asked engr to take a look at the effort of an alignment change based on this thread and a couple other requests. This does not guarantee when or if a new base image will be released since it requires QA testing and verification.

I think there may have been a misunderstanding about this between Engr and Support based on some comments in an enhancement bug. I'll speak with support to make sure this is being communicated correctly.

Please contact and rely on your SE regarding forward looking statements. They will be able to put you in touch with a PM who, under NDA, can make forward looking statements.

Re: Panorama VM is misaligned.

mikand — Wed, 14 Aug 2013 08:59:52 GMT

I can understand that cool features might be under NDA until publically announced... but I fail to see why aligned vmware-image would fall into the NDA traphole?

Re: Panorama VM is misaligned.

mschuricht — Wed, 14 Aug 2013 13:29:43 GMT

Anything forward looking which is a feature and not a bug would require NDA. We want to set expectations appropriately since any forward looking info can affect new or existing customer actions/decisions.

Changing the alignment is not a bug.

Re: Panorama VM is misaligned.

SabreAce33 — Wed, 14 Aug 2013 14:02:30 GMT

If you want to set expectations appropriately, please note in Panorama documentation that it doesn't properly support NetApp SAN storage. While changing the alignment certainly isn't a bug, it ought to be a feature. Misaligned storage doesn't make my server guys happy and it means we had to stand up an NFS infrastructure just for Panorama. We're able to adjust the alignment of many other network/security VM appliances, why not Panorama?

Our related feature request is under FR ID: 2686.

Re: Panorama VM is misaligned.

mikand — Wed, 14 Aug 2013 20:13:02 GMT

Perhaps you should buy the M100 box and then dont have to think about if its aligned or not 😉

On the other hand hopefully the QA testings will be worth waiting for (given the history for previous oopsies regarding QA and PaloAlto).

Re: Panorama VM is misaligned.

eugenep — Thu, 15 Aug 2013 07:26:30 GMT

Here is how we aligned our panorama vm.

Deploy the OVF as per instructions found in Chapter 12 of the Palo Alto Networks Administrator's Guide Release 5.0.
Upgrade the Virtual Hardware. (Only if needed in your environment)
Change SCSI Controller Type to VMware Paravirtual.
Align VM partitions using mbralign.
Delete the backup files created by mbralign.
Boot into linux rescue CD. (I used CentOS)
Copy grub from rescue cd into file system
Fix the GRUB as per belo steps
1. Type the command chroot /mnt/sysimage
2. Type the command grub. At the grub prompt enter the following three commands:
  root (hd0,0)
  setup (hd0)
  quit
Exit and Power off the VM.
Change SCSI Controller Type back to BusLogic Parallel.
Start the VM.
Login using admin/admin.
Update the IP address of the VM
configureset deviceconfig system ip-address <ip address> netmask <netmast> default-gateway <gateway ip address>.commitexit
Configure the rest via the Web UI.

Re: Panorama VM is misaligned.

mikand — Thu, 15 Aug 2013 07:49:15 GMT

Will this workaround survive a Panorama update?

Re: Panorama VM is misaligned.

plim01 — Thu, 15 Aug 2013 07:54:34 GMT

Palo Alto engineer, is this workaround supported?

Re: Panorama VM is misaligned.

eugenep — Thu, 15 Aug 2013 23:21:16 GMT

While I haven't performed an update, I don't see how it will not survive one. Once you're VM is aligned, on and working, you can do whatever you want in there.

Thanks