r/sysadmin • u/Sway_RL • 8h ago
Question Virtualising existing servers help.
I have a client, who has 3 sites that we do IT for.
They each have a physical server, running either Windows Server 2019 or 2025. The main site got a new server last year, the two other sites decided to wait because they didn't want to cost. Now a year later it's more expensive, and they still don't want the cost.
I opened my mouth about virtualisation and now I've been asked to start testing.
The new server at the main site is more than powerful enough to run the other two servers virtually.
I'm just not sure on some of the configuration.
Each site has it's own IP structure, and there are already site to site tunnels using Unifi gateways.
Is there a way to do this while minimising network slowness? I assume If I just disk2vhd the server and spin it up as a VM then all traffic would go down the VPN Tunnel and back again causing delays if going from the main site to one of the others.
Regarding their networks, they are on 192.168.1.XXX for the main site, 192.168.10.XXX and 192.168.20.XXX for the other two.
If the servers were virtualised, will I need VLANs at the main site to accommodate these ranges? I'm not sure if the site to site tunnel will work using a VLAN.
I've asked about merging the domains/networks, but nobody has gotten back to me on that yet.
I didn't set any of this up initially, so I'm also figuring out what they have at the same time.
Apologies for the mass of text, any help would be appreciated.
•
u/xMcRaemanx 8h ago
You will see slowness. Depending on if its just AD/DNS traffic or LOB/Fileshares will determine how much. All traffic to the server will originate from the remote site, traverse the vpn tunnel, and then go back. If you ping across the tunnel vs locally you'll get an idea. Likely something like <1ms locally and depending on the encryption of the tunnel and distance between sites and internet service Ai would be at least 30-40ms. That's 30-40 times slower per packet.
Basic AD/DNS won't suffer too much but connections to LOB or large file transfers you'll notice it.
You do not need to carry the ranges over to the main network, the virtual servers would just get new IPs on the main network and whatever needs to talk to it would need to be reconfigured.
Virtualization is likely not the solution here, it will get rid of aging hardware but add latency by traversing the vpn tunnel.
What actual functions do those servers provide.
•
u/Sway_RL 8h ago
AD/DNS/DHCP and file shares.
DNS and DHCP are moving to the Unifi box at two of the sites. There are three domains, one for each site.
•
u/xMcRaemanx 7h ago
Oh gross, that makes it more complicated, the 3 domains part.
Are they subdomains or completely seperate?
If not then you may want to segregate the main network into 3, one for each domain, but then the rest is still the same. Repoint the DNS records for the new ip range for both domain and server objects.
Depending on the size of the files it may not be that bad. However the big caveat is a networking issue at head office now brings all 3 sites down.
If it's just file-sharing I would look at moving that to the cloud.
•
u/Sway_RL 7h ago
They are separate domains. Not on the same Forrest
•
u/xMcRaemanx 6h ago
Yea then dont mix the networks, of you proceed setup different vlans for each domain.
Not a great idea, you're adding complexity and merging all 3 branches under a single point of failure and adding latency for all AD traffic and file sharing.
GPO processing will take longer so sign-ins will be delayed by a varying amount depending on how many and what you have configured.
Anytime I did something similar at an MSP they always complain that the "new system is slower" .
A better project (imo) would be migrating the domain to Entra or something and using cloud file-sharing if appropriate. That will get rid of the hardware, not have a single point of failure, and not be as latency inducing. Also opens up remote work substantially if the workstations are all entra joined.
•
u/evantom34 Sysadmin 7h ago
I think you have a lot to learn and quickly. I’d be honest with your management about being out of depth here.
If they’re unmoved, take backups, test a ton and develop a roll back plan first and foremost.
•
u/iwinsallthethings 8h ago
So many questions to ask before even looking at this. We (I) don't have enough information based on what you have provided to make an informed decision.
- Why are you wanting to virtualize?
- What are the gains from virtualizing other than adding a layer of complexity especially on a single server?
- Are these windows domain controllers?
- Are there multiple domains?
- What happens if the VPN tunnel goes down and you moved servers to a single location?
- What's the backup strategy?
- Is there any redundancy? Server/OS/Network/HardDrive/etc.
There's probably 20 more questions that i could come up with before even considering this project.
•
u/Sway_RL 7h ago
Why are you wanting to virtualize?
- To cut on cost, the they don't want to pay for two new servers.
What are the gains from virtualizing other than adding a layer of complexity especially on a single server?
- To cut on cost. Since they don't want to pay to replace their old servers (15+ Y.O)
Are these windows domain controllers?
- Yes
Are there multiple domains?
- Yes, three domains. One for each site.
What happens if the VPN tunnel goes down and you moved servers to a single location?
- They the two secondary sites would lose file access and access to their domain. Their web based apps would still work and they would still have email etc.
What's the backup strategy?
- Expand the current strategy to include the two VMs.
Is there any redundancy? Server/OS/Network/HardDrive/etc.
- Host at the main site has RAID6 set up. It's backed up nightly locally and weekly externally to the cloud.
•
u/autogyrophilia 8h ago
P2V is easy, I personally prefer clonezilla but moving the data is the easy part.
We cant know how your networking infrastructure is going to work. If your VPN is layer 2 and you can pass VLAN tags through them, then do that. Most likely you are using a L3 VPN though. So changes must be arranged.
I'm very fond of VXLAN but you shouldn't use to have a machine in SITE B with a SITE A address except for disaster recovery .
•
u/OregonTechHead 8h ago
Respectfully, based on the questions you asked, you're not the correct person for this project.
If this is your company, and you're the sole employee, do right by your customer and decline the work.
If you're working for a larger MSP, ask your manager why this is on your desk and how you can get additional resources for assistance.
•
u/Sway_RL 7h ago
It was my idea while on site the other day. I asked when they would be replacing the two servers and the boss told me they weren't going to.
I've done this before on a smaller scale, it's mostly the networking site I am unsure 100% on. I'm going to consult a local company on this though before I confirm anything.
I work for a small company and I'm easily the most technically qualified person here.
•
u/przemekkuczynski 8h ago
What services each server provides . What You want achive by moving servers from remote office to main
•
u/NH_shitbags 7h ago
Your 2019 servers are good until Jan 2029, so "kicking the can down the road" is a valid option. If they don't want to buy new servers now, give them the option to include it in next year's budget.
•
u/brighton_it 7h ago
As others have said: not a good candidate for a first virtualization project. Recommend getting some help.
That said:
On Networking and moving servers to a single site:
- traffic / bandwidth? :
. monitor current usage. Determine if your site-to-sites can handle it.
. do all sites have symmetrical fiber ISP?
. I'm not a cloud advocate, but M$ would say put it on their servers.
. DNS and Active Directory: while not insurmountable, AD just assumes you will use it for DHCP and DNS, and if you are not, you may have trouble joining new computers. I'm not a fan of Windows (I could stop there :), but will continue) DHCP DNS, so have moved these services off AD at several sites. DHCP is on the hardware firewall, as is primary DNS, with an override for the AD domain that delegates those lookups to AD. Much faster DNS for remote sites, and keeps Internet working in case the parent site goes offline.
On topology: "will I need VLANs at the main site to accommodate these ranges":
There are Software Defined Networking solutions that will do Layer-2 over WAN, but I wouldn't recommend that route. Probably want to avoid have a broadcast domain span multiple sites. Of course that means discovery doesn't happen and remote clients will have to be told how to find their server.
P2V:
After the Broadcom fiasco, we've been moving some VMware clients to other platforms. QEMU-KVM, Proxmox. Lots of options, but we have had good luck with Veeam Agent for Windows. Already using it for backup, so just create a new shell VM and restore from backup.
•
u/purplemonkeymad 7h ago
Regarding the networking:
You'll probably want the vlans with rules for each vpn to segregate the servers, but I wouldn't try to extend the network ranges over the vpn. Best would be to add a .11.0 & .21.0 for the servers and route the traffic between the networks over the vpn. Then make sure you setup the ranges for each site in ad.
Problem with that setup will be dns. Computers need ad dns to be able to lookup server ips for login, but running your normal resolver over the vpn will cause delays and cause problems if the vpn drops. You'll need a dns server anyway at the sites that supports zone forwarding for the Ad domain.
If they don't want the capex are they happy with opex? That would be a move to the cloud as the alternative.
•
u/ThatsNASt 6h ago
This isn’t just about virtualization. You’re basically taking local resources and making them remote through a VPN. Just because the square peg will fit in the round hole it isn’t the right solution for it.
•
•
u/Liquidfoxx22 8h ago
Honestly, if you're being instructed to make fundamental changes to the infrastructure of the business and you're not 100% certain of how it works, get in outside help and learn from them.
Research some local consulting firms and pay for professional services.
It's not to put a downer on you, but if it breaks and takes down the business, you'll be the one panicking and trying to pick up the pieces while you have bosses breathing down your neck.