Migrating a Windows Server

Scenarios

Server Migration Service (SMS) is a P2V/V2V migration service that helps you migrate x86 physical servers or VMs in on-premises, private, or public cloud environments to Huawei Cloud. You can use Elastic Cloud Servers (ECSs) or Flexus instances as the target servers.

This section describes how to quickly create a task for migrating a Windows server on the SMS console.

Video Tutorial

Procedure

Preparations

Before using SMS, complete the following preparations:

1. Register a HUAWEI ID and enable Huawei Cloud services.
   

   Real-name authentication is required for migrating servers to regions within the Chinese mainland.

2. Obtain the required permissions.

   If you use a Huawei Cloud account for migration, you have the required permissions by default. If you use an IAM user for migration, you need to obtain the required permissions. For more information, see Creating a User Group and Assigning Permissions.

3. Obtain an AK/SK pair for your target account.

   The AK/SK pair is used for authentication during the migration. To learn how to obtain an AK/SK pair, see How Do I Create an AK/SK Pair for an Account? or How Do I Create an AK/SK Pair for an IAM User?

   

   SMS does not support AK/SK-based authentication for federated users (virtual users).

4. Ensure that the source server OS is supported by SMS.

   See Supported Windows OSs.

5. Ensure that the following network requirements are met:
   1. The source server can connect to the Huawei Cloud API Gateway over port 443. For more information, see Connecting the Source Server to Huawei Cloud API Gateway.
      

      It is recommended that all outbound ports on source servers be opened.

   2. If you want to migrate over an IPv6 network, the source server must support IPv4/IPv6 dual-stack networks.
   3. The source server can connect to the target server. For more information, see Connecting the Source Server to the Target Server.
      • To migrate over the Internet, purchase an EIP in the target region.
      • To migrate over a private network, request a Direct Connect or VPN connection.
   4. The security group that you use to protect the target server must allow access to TCP ports 8899, 8900, and 22.

      For more information, see How Do I Configure Security Group Rules for Target Servers?

      

      • For security purposes, you are advised to only allow traffic from the source server to the target server over these ports.
      • The firewall of the target server must allow traffic to these ports.
6. Ensure that the following source server requirements are met:
   • There is at least 320 MB of space available on every partition not smaller than 600 MB, and at least 40 MB of space available on every partition smaller than 600 MB
   • The system time of the source server must be consistent with the local standard time to avoid Agent registration failures.

Step 1: Install and Start the Agent on the Source Server

Download the Agent from the SMS console, install it on the source server, and start the Agent. Enter the AK/SK pair for the Huawei Cloud account that you are migrating to and the SMS domain name. After the Agent is started, it reports information about the source server to SMS.

There are two options for Windows. Select the one that matches the source server OS.

• GUI-based Windows Agent (Python 3): Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 10, and Windows 8.1
• CLI-based Windows Agent (Python 2): Windows Server 2008 and Windows 7
  

  Windows Agent (Python 2) can also run on Windows of later versions.

1. Download the Agent installation file.
   1. Sign in to the SMS console.
   2. In the navigation pane, choose Agents.
   3. Select the Windows card, locate the Agent that matches the source server OS, and click the icon next to Agent.

      

   4. Read and agree to the service agreement, and click Yes to download the Agent installation file.
   5. SHA256 File

      How Do I Verify the Integrity of the Agent Installation File?

      

2. Install the Agent.
   The following describes how to install the Windows Agent (Python 3). For details about how to install the Windows Agent (Python 2), see Installing the Windows Agent (Python 2).

   1. Transmit the SMS-Agent-Py3.exe file to the source server.
   2. Log in to the source server as user Administrator and double-click the SMS-Agent-Py3.exe file.
   3. Click Install and wait for the installation to complete.
   4. Click Finish to open the SMS-Agent GUI.
   5. Enter the AK/SK pair for the Huawei Cloud account that you are migrating to and the SMS domain name. You can obtain the SMS domain name on the Agents page of the SMS console.

      

   6. Direct Connection

      If you need to use an HTTP/HTTPS proxy, select Use Proxy and enter the IP address, port number, username, and password of the proxy server.

      Parameter	Description
      Proxy server IP	Enter the IP address of the proxy server, not that of the target server. The input format is https://your-proxy-addr.com. Replace your-proxy-addr.com with the actual proxy server address. HTTPS is recommended.
      Port	Enter the proxy port opened on the proxy server.
      External user name	If a username is required to use the proxy software, set it to the username. If no username is required, leave it blank.
      Password	Enter the password for the proxy username. If none is required, leave this parameter blank.

   7. (Optional) If the EPS service has been enabled for your Huawei Cloud account, after you entered the AK/SK pair, the Agent will list all enterprise projects your account is allowed to access. You can select the enterprise project you would like to migrate the source server to. This enables you to isolate permissions, resources, and finance during the migration. For details, see Migrating a Server into an Enterprise Project.
   8. Click start.
   9. Carefully review the Privacy Statement and click Yes if you want to continue. If Upload success. Waiting for the SMS instruction is displayed, the Windows Agent is started. You can then proceed to configure the target server on the SMS console.

Step 2: Configure the Target Server

You can configure the target server on the SMS console only if the source server meets the following conditions:

• The source server is Connected to SMS.
• The migration is in the Migration Feasibility Check stage.
• The migration is in the Pending target configuration status.

1. Sign in to the SMS console.
2. In the navigation pane on the left, choose Servers.
3. In the server list, locate the source server to be migrated, and click Configure Target in the Migration Stage/Status column or choose More > Configure Target in the Operation column.
   

   If you do not find the record for your source server, check that the account you currently use is the migration account.

4. On the Configure Basic Settings page, configure parameters by referring to Table 1.

   Table 1 Basic parameter settings

   Area	Parameter	Sub-parameter	Description
   Migration Template	Migration Template	-	You can use the default migration template provided by the system. You can also create a migration template. After you choose a migration template, the system will populate Network Type, Migration Rate Limit, Migration Method, Enable Continuous Synchronization, Resize Disks and Partitions, Region, and Project based on the template.
   Network Settings	Network Type	Public	An EIP must be bound to the target server. Public is the default value of Network Type.
   		Private	A Direct Connect connection, VPN connection, VPC peering connection, VPC subnet, or Cloud Connect connection must be provisioned. The private IP address of the target server will be used for migration.
   	IP Version	IPv4	IPv4 can be used for data migration.
   		IPv6	On a dual-stack network, IPv6 can be used for migration. For details about migration over IPv6, see Migrating Servers over an IPv6 Network.
   	Migration Rate Limit	-	You can limit the migration rate based on the source bandwidth and service requirements. If you do not want to limit the migration rate, set this parameter to 0. Traffic limiting is unavailable if: The migration uses an IPv6 network. Traffic Control (TC) is missing from the source server.
   Migration Drill	-	-	Migration drills help you fully assess the feasibility and identify potential risks of a migration task beforehand. The system verifies if security group ports are set correctly, domains connect normally, and necessary permissions are available. If issues are identified, the system offer fixes to minimize risks and disruptions during migration. After this function is enabled, the system automatically launches a migration drill before starting the full replication. The entire migration drill takes 5 to 15 minutes, and you pay for the pay-per-use resources used during this period. You can review the drill results in the task details. For details, see Viewing the Migration Drill Status and Report.
   Migration Settings (Optional)	Migration Method	Windows block-level	Migration and synchronization are performed by block. This method is very efficient and is the only migration method for Windows servers.
   	Enable Continuous Synchronization	No	After the full replication is complete, SMS will automatically launch the target server without synchronizing incremental data. To synchronize incremental data, you will need to click Sync in the Operation column.
   		Yes	After the full replication is complete, the migration will enter the continuous synchronization stage. During this stage, incremental data will be periodically synchronized from the source server to the target server, and you will be unable to use the target server since it has not been launched yet. To finish this stage, you will need to click Launch Target in the Operation column.
   	Resize Disks and Partitions	Disable	The disk and partition settings from the source server will be retained on the target server.
   		Enable	You can resize disks and partitions for the target server. For details, see Resizing Disks and Partitions.
   	Start Target Upon Launch	No	The target server will be stopped after the migration is complete.
   		Yes	The target server will be started after the migration is complete.
   	Measure Network Performance	No	Network performance will not be measured.
   		Yes	Before the full migration starts, the system will measure the packet loss rate, network jitter, network latency, bandwidth, memory usage, and CPU usage for the source server. For details, see How Do I Measure the Network Performance Before the Migration?
   	Transit IP Address	-	For a migration over a private line, you can configure the transit IP address.
   Verify Data Consistency	If this option is enabled, the system will automatically verify data consistency after the full replication is complete. This is a quick verification, and only the file size and last modification time will be verified. You can modify the verification policy when you launch an incremental synchronization. Note that consistency verification cannot be performed for servers with Btrfs file systems. Enable Hash Verification: If this option is enabled, the system will generate and compare hash values for each file to be verified. Hash verification is recommended when individual files are large and important. Enabling this option will increase CPU and disk I/O overheads for the source server and extend the verification time. CAUTION: Hash values cannot be calculated for files in use, so these files will be skipped during the verification. Enabling this option requires you to specify the verification scope, and only files in the specified scope will be verified. Verification Scope Under Exclude paths, enter the paths you want to exclude from the verification. A maximum of 30 paths can be entered. Use commas (,) to separate the paths. For example, /root/data,/var. Leaving it empty will initiate a full verification. Under Include paths, enter the paths you want to verify. NOTICE: If the entered paths are incorrect or empty, 0 will be displayed for them in the verification results. The more data you need to verify, the longer the verification will take. It is wise to narrow the verification scope to only key paths. The following paths will be excluded from consistency verification by default: Linux: /bin, /boot, /dev, /home, /etc, /lib, /media, /proc, /sbin, /selinux, /sys, /usr, /var, /run, and /tmp Windows: top-level directories of partitions, for example, C:\ and D:\ If you need to include any of the preceding excluded paths in the verification, refer to Modifying the Default Excluded Paths.

5. Click Next: Configure Target in the lower right corner.
6. In the Basic Settings area, select the region you are migrating to.

   

7. In the Target Server area, choose whether to use an existing cloud server or create a new one as the target server. For details about the requirements on target servers, see Target Server Requirements.
   • Use existing

     In the list of existing servers, select one that meets the specifications requirements displayed in the Recommended Target row. Note that disks on the target server will be formatted and re-partitioned based on the updated disk settings during the migration. Ensure that data on the target server has been backed up and its disks can be formatted before the migration.

   • Create new

     The system automatically presets the name, AZ, specifications, disk specifications, EIP, VPC, subnet, and security group for the target server. You can also click Expand and Modify to manually modify the server settings.

     

     • If you select Recommended for Server Template, the system will automatically create a VPC, subnet, and security group and select an AZ and disk type for the target server. You can also manually adjust the settings recommended by the system.
       

       • If Create new is selected for VPC, SMS automatically creates a VPC for the target server based on the following rules:

         If the source server's IP address is 192.168.X.X, SMS creates a VPC and a subnet that both belong to network range 192.168.0.0/16.

         If the source server's IP address is 172.16.X.X, SMS creates a VPC and a subnet that both belong to network range 172.16.0.0/12.

         If the source server's IP address is 10.X.X.X, SMS creates a VPC and a subnet that both belong to network range 10.0.0.0/8.

       • If Create new is selected for Security Group, the system automatically creates a security group for the target server and allows traffic to the target server over certain ports:

         Windows: ports 8899, 8900, and 22

         Linux: port 22 for file-level migration

         Linux: ports 8900 and 22 for block-level migration

     • You can also choose your own server template. Then the VPC, subnet, security group, AZ, and disk settings will be preconfigured based on that template. You have the flexibility to adjust these preset settings as needed. To learn how to create a server template, see Creating a Server Template.
     • Configure advanced disk settings.
       • Data disks must be either VBD or SCSI. VBD is the default device type for data disks. For details about disk device types, see Device Types.
       • Data disks can be created as shared disks. For details about shared disks, see Managing Shared EVS Disks.
       • For target servers newly created by the system, system and data disks can be encrypted. For details about shared disks, see Managing Shared EVS Disks. To enable disk encryption, you need to create an agency to authorize EVS to access KMS. After the authorization is successful, set KMS Encryption to Select an existing key or Enter a key ID:
         • Select an existing key

           Select a key from the drop-down list. You can select one of the following keys:

           Default keys: After the KMS access permissions have been granted to EVS, the system automatically creates a default key and names it evs/default.

           Custom keys: You can choose an existing key or create a new one. For details about how to create a key, see Creating a Key.

         • Enter a key ID

           Enter the ID of a key shared from another user. Ensure that the key is in the target region. For details, see Creating a Grant.

         

         • Before the migration is complete, do not disable or delete the key used, or the migration will fail.
         • The encryption attribute of a disk cannot be modified after the disk is created.
         • Keys can be shared with accounts, not IAM users.
         • If KMS encryption is used, you will be billed for what you use beyond the free quota given by KMS. For details, see DEW Billing.

8. Click Next: Confirm in the lower right corner.
9. (Optional) Click Save as Server Template. In the displayed Create Server Template dialog box, enter a template name and click OK to save the target server settings as a template.
   

   Save as Server Template is available only when you select Create new for Target Server.

   Figure 1 Create Server Template
   

10. Confirm the configurations and click Save. In the displayed dialog box, read the migration conditions and click OK. In the server list, check the task status. If Task Status is Pending migration, Migration Stage is Target Configuration, and Migration Status is Ready, the target server has been configured. Then, you can proceed to the next step to start full server replication.
    Figure 2 Saving the configuration
    

Step 3: Start Full Replication

A full replication replicates all data from the source server to the target server. The replication speed depends on the outbound bandwidth of the source server or the inbound bandwidth of the target server, whichever is smaller.

After a full replication starts, do not restart the source server or Agent, or the migration will fail.

1. Locate the source server and click Start in the Migration Stage/Status or Operation column. In the displayed Start Migration window, click OK to start a full replication.
   You can also select the source server and click Start above the server list. In the displayed Start Migration window, click OK.

   Figure 3 Starting a full replication
   

   

   During the full replication, the target server is locked by default, and you are not allowed to perform any operations on it. After the migration is complete, the target server will be automatically unlocked. If you need to perform operations on the target server during the replication, unlock the target server.

2. Click the source server name to view the migration progress.
   • If Enable Continuous Synchronization is set to No when you defined the migration task, the system automatically launches the target server after the full replication is complete. If Finished and Migration completed show in the Migration Stage/Status column, the target server has been launched.
   • If Enable Continuous synchronization is set to Yes when you defined the migration task, the task stage and status change to continuous sync after the full replication is complete. In this state, the system automatically synchronizes any new or modified disk data from the source server to the target server. If you want to stop continuous synchronization and launch the target server, perform operations described in Launching a Target Server.
   

   • After the target server is launched, if there are data changes on the source server, you can synchronize the incremental data to the target server.
   • After the migration and service cutover are complete, you need to adjust the configurations of the target server based on service requirements. For details, see What Configuration Items Do I Need to Modify for the Target Server After the Migration Is Complete?

(Optional) Step 4: Synchronize Incremental Data

After the target server is launched, if there are data changes on the source server, you can synchronize the incremental data to the target server.

The data changes on the target server will be overwritten by the data synchronized from the source server. For details, see Will an Incremental Synchronization Overwrite the Existing Data on a Launched Target Server?

1. In the server list, locate the source server you want to synchronize and click Sync in the Operation column.

   

2. In the Sync Incremental Data dialog box, carefully read the tips, enable Verify Data Consistency if needed, and click OK. For details about this option, see How Do I Verify Data Consistency Between the Source and Target Servers?

   

   After the migration is complete, if you confirm that no incremental synchronizations are required, you can delete the snapshots generated for cutover and synchronization during the migration. For details, see Deleting Resources.

Viewing the Migration Drill Status and Report

If Migration Drill is enabled when you configure a migration task, you can view the migration drill status and report.

1. In the server list, click the name of the source server to expand the migration task details.
2. On the Task Progress tab, view the status and progress of the migration drill.

   

3. In the upper part of the task details page, click View Report next to Drill Status. In the report displayed on the right, you can view the drill details, check items, and check results.