Pano Logic Pano System 2.8

Pano Logic's Pano System provides all the management infrastructure and thin client hardware needed to implement an enterprise grade VDI (Virtual Desktop Infrastructure) using VMware ESX Server. Some thin clients include an operating system of their own, but the Pano Device thin clients are completely dumb terminals, so they don't need patching, maintenance or integration with your enterprise directory. If your company is considering using virtual machines (VMs) to provision Windows desktops to end users, then Pano System is well worth looking at.

One of the main reasons for using a suite like Pano System is that it adds a sophisticated connection broker to the basic VDI plumbing provided by VMware. The idea is to register VMs with the connection broker — called Pano Manager — and then create groups, called DVM Collections, each of which has a set of policies that tell Pano Manager how to assign the VMs to users.

For example, one collection might assign specific VMs to specific users, while another might have a pool of generic VMs that are assigned to users as required.

Pano Devices are small, completely dumb, terminals.

Measuring just 89mm by 89mm by 50mm and weighing 500g, Pano Devices are remarkably small, even compared to normal thin clients. All the cable connector sockets — VGA, audio, Ethernet, power and USB (x3) — are recessed in the rear of the unit, and the only moving part is the illuminated power switch located in the top right corner. Available in matte black and silver, the Pano Devices are hard to beat for good looks and style.

Each Pano Device consumes 3.5 watts of power, which is considerably less than any desktop PC and most thin clients. Pano Devices are also stateless, so they don't store any data of any kind. The beauty of this approach is that deployment is simple: you just connect the thin clients to monitor, mouse, keyboard and LAN — the rest of the installation is handled from the Pano Manager console.

All communication with the Pano Device — such as keyboard, mouse and USB devices — is encrypted using a 128-bit RSA algorithm. The only exception is pixel data for the VGA display, which is not encrypted. Pano Devices don't use Microsoft Remote Desktop Protocol (RDP).

If you don't want to connect from a thin client, you can use an optional Pano Remote USB key ($30/~£20), which sets up an RDP-based connection to the appropriate VM. In this case all the data between the VM and user is encrypted using normal SSL technology. Pano Remotes can be used with any Windows XP or later device on the same LAN as the Pano Manager system.

Administrators can set policies in Pano Manager to control access to local printers and drives. Likewise, policies can control the transfer of clipboard data between the VM and a computer running the Pano Remote.

Remote users connecting from outside the company firewall are accommodated using a Pano Remote USB stick and the Pano Gateway software. This is a Microsoft IIS-compatible web application hosted on a Windows Server 2008 system running Terminal Services Gateway. We didn't test this step, but installing Pano Gateway simply involves running the Windows Server 2008 Add Role wizard to configure the Windows server, and then downloading and unzipping the Pano Gateway web application. Some minor adjustments to your firewall may also be required.

To get the best from Pano System, your datacenter should be equipped with shared storage, the VMware vCenter Server management suite and a directory service such as Microsoft Active Directory.

Minimal installations can be created using a single VMware ESXi host server. However, some of Pano System's more valuable features are only available if used with vCenter Server and a directory service. For example, a directory is required to authenticate users — without it, you'd be limited to a policy that ties virtual desktops to Pano Devices rather than to users. Similarly, vCenter Server allows VMs to be grouped into folders, and Pano Manager assigns polices to each folder. So without vCenter you'll only be able to use one Pano System policy in your environment.

Installation & setup
We tested Pano System using vCenter Server 2.5 and ESX Server 3.5. In terms of components, a Pano System deployment normally comprises a number of Pano Device thin clients and the Pano Manager connection broker, which is supplied as a preconfigured virtual machine.

We installed the Pano Manager by downloading it from Pano Logic's website and importing it into our vCenter setup using the VMware Virtual Infrastructure Client. Installation time was minimal: this step took us about five minutes. The first time we booted Pano Manager, a wizard asked us to enter a password for the root and admin users, and configure the network settings such as IP address and DNS server settings. All this took another couple of minutes. Next we needed to log into the appliance's web-based management page to complete the setup. The management page is an Adobe Flash app, so we needed to add the Flash Player to our web browser before we could complete the installation.

Once connected to Pano Manager with our browser we needed to configure it with suitable credentials to access our Active Directory service and our vCenter Server. At this stage the Pano System was up and running, and we were ready to configure it to manage some of our VMs.

At the moment, Pano System only supports VMs running Windows XP. Pano Logic is working on support for Windows 7-based VMs, but there's no date set for this update. VMs need to have the Pano Direct Service software installed, which includes an applet that runs in the Windows System tray at the bottom right-hand corner of the screen.

The Windows XP VMs should also be patched with a few Microsoft DLLs to ensure remote sound and other features work properly. This patching is handled as much as possible by the Pano Direct Service installation utility. In some cases the utility needed us to track down individual DLLs from desktop PCs. For example, we needed to copy 'usbd.sys' from a physical Windows XP system to our XP VM.

The Pano Direct Service installation utility also needed us to supply the Windows XP SP3 CD-ROM so it could add several files, including 'ksuser.dll', 'stream.sys' and 'wdmaud.drv'.

Although tracking down all these files was a little time consuming, once we had them in hand we could apply them to our VMs quite easily.

Creating a collection of DVMs (Desktop Virtual Machines) via a Pano Manager wizard.

The installation documentation is comprehensive and proved very helpful. It guided through the process of creating a DVM Collection, which is done using a wizard launched from the web-based Pano Manager console. We used the wizard to create a collection of permanently assigned desktops, and were able to browse our Active Directory to select the users to link to this collection. The wizard also has an option to automatically deploy new VMs using a normal vCenter template, and we could define a vCenter script that would be used to customise each new VM — for example, to run Microsoft Sysprep on the new VM to generate new SIDs. We also updated an existing VM with the Pano Direct Service software and assigned it to a user in our Active Directory so that they would always be allocated their own VM, regardless of whether the user connected from a Pano Device or via a Pano Remote USB key.

Updating permissions for a collection of permanently assigned DVMs.

Pano System is pretty straightforward to install and configure. It took us a few hours to install the entire Pano System suite and configure a VM, which is about twice as long as it would have taken to manually clone and prepare a couple of Windows XP VMs using the basic vCenter Server tools.

In use
Once it's up and running, Pano System's ability to automatically deploy VMs to new users with minimal administrator intervention is valuable. We also like being able to prevent people copying clipboard data to local PCs. Such savings in administrative overhead, coupled with much better control of end-user access, make Pano System easy to recommend.

Pano Devices are not suitable for every type of multimedia application. For example, although the thin clients can handle some types of USB device, USB gadgets that stream data to the PC, such as some types of Skype handset and webcams, are not supported and might not work properly. Similarly, when using Pano Remote USB keys to connect to VMs, the Pano System architecture relies on Microsoft RDP 6, which is not suitable for bidirectional audio such as voice telephone calls. Also, RDP is not really up to the job of handling streamed video from the likes of YouTube or Windows Media Player.

A starter kit comprising five Pano Devices with power adapters, one Pano Remote USB Key, one Pano Dual Monitor USB Video Adapter and driver CD, one Pano System Media Kit with a DVD containing the Pano Manager virtual appliance and the Pano Direct Service installation software costs £1,899 (ex. VAT).