Panorama VM is misaligned.

[plim01]

Hi everyone,

I have installed the Panorama from the OVF file that Palo Alto provide. But when the VM is deployed, it is misaligned. Did anyone solve this issue already?I have tried to align it with MBRAlign in ESX, but after that the alignment the VM will not startup anymore.

Does anyone have any idea how to solve this?

[ericgearhart]

To clarify he means the OVF geometry doesn't align properly when he deploys the VM onto his VMware ESX host... this can have an impact on I/O performance

In a SAN environment, the smallest hardware unit used by a SAN storage array to build a LUN out of multiple physical disks is a called a chunk or a stripe. To optimize I/O, chunks are usually much larger than sectors. Thus a SCSI I/O request that intends to read a sector in reality reads one chunk.

On top of this, in a Windows environment NTFS is formatted in blocks ranging from 1MB to 8MB. The file system used by the guest operating system optimizes I/O by grouping sectors into clusters (allocation units).

Also, operating systems on x86 architectures create partitions with a master boot record (MBR) that consumes 63 sectors. This is due to legacy BIOS code from the PC that used cylinder, head, and sector addressing instead of logical block addressing (LBA). Without LBA, the first track is reserved for the boot code, and the first partition starts at cylinder 0, head 1, and sector 1. This is LBA 63 and is therefore unaligned.

An unaligned partition results in a track crossing and an additional I/O, incurring a penalty on latency and throughput. The additional I/O (especially if small) can impact system resources significantly on some host types. An aligned partitions ensures that the single I/O is serviced by a single device, eliminating the additional I/O and resulting in overall performance improvement.

This link has a really pretty graphic if you're into that:

Guest OS Partition Alignment | VMware vSphere Blog - VMware Blogs

[ericgearhart]

Can you possibly pull the OVF into VMware converter and then deploy it from there? I thought VMware Converter had some alignment functionality built into it.

[plim01]

Hi Egearhart,

Thanks for clarify my question. and yes i have think about using converter to do it, but there is no alignment functionality built into it. I have try to use the alignment tool from VMware/NETAPP, but than the panorama VM will not start anymore.

[SabreAce33]

This was a problem for us as well.  PA was unable to offer any useful assistance, unfortunately.  We ended up having to use an NFS share.

[mschuricht]

Can you explain the performance problems you experienced with the misalignment?

At what logging rate were the problems encountered?

[ericgearhart]

- I haven't experienced I/O problems with VM mis-alignment with Panorama, I was just providing some background on what the original poster was referring to, just to try help clarify.

[plim01]

I have opened a call and palo alto is aware of the issue and say they will provid a solution in the new version.

[SabreAce33]

Awesome, let us know if you hear something definitive.  I'll be keeping an eye on the release notes.

[mschuricht]

We will look into this request and consider it as a potential feature request for a future release. This does not guarantee if or when we would release a version with changed alignment.

Please move forward with the deployment today since there does not appear to be a performance issue that you are running into and the request seems to be associated with best practice for more efficient read/writes.

[plim01]

This is the reply from the engineer where i am in contact with regarding the misalignment.

----------------------------------------------------------------------------------
Account: G-Star Raw C.V.

Comment: [Recipients: Patrick Lim]

Hi Patrick,

Just wanted to let you know that this has been fixed in a new base-image.

I'm currently waiting for a confirmation of when that will become available for public download.

[mschuricht]

I asked engr to take a look at the effort of an alignment change based on this thread and a couple other requests. This does not guarantee when or if a new base image will be released since it requires QA testing and verification.

I think there may have been a misunderstanding about this between Engr and Support based on some comments in an enhancement bug. I'll speak with support to make sure this is being communicated correctly.

Please contact and rely on your SE regarding forward looking statements. They will be able to put you in touch with a PM who, under NDA, can make forward looking statements. 

[mikand]

I can understand that cool features might be under NDA until publically announced... but I fail to see why aligned vmware-image would fall into the NDA traphole?

[mschuricht]

Anything forward looking which is a feature and not a bug would require NDA. We want to set expectations appropriately since any forward looking info can affect new or existing customer actions/decisions.

Changing the alignment is not a bug.

[SabreAce33]

If you want to set expectations appropriately, please note in Panorama documentation that it doesn't properly support NetApp SAN storage.  While changing the alignment certainly isn't a bug, it ought to be a feature.  Misaligned storage doesn't make my server guys happy and it means we had to stand up an NFS infrastructure just for Panorama.  We're able to adjust the alignment of many other network/security VM appliances, why not Panorama?

Our related feature request is under FR ID: 2686.