(This is a work in progress...)
v2, 24-May-13
v3, 13-Aug-13  (VM not dependent on number of CPUs)
v4, 11-Oct-13  Add link to "Maintaining MAC Address", "EVC/CPU Compatibility"


In the SafeNet HASP licensing system, licenses are tied to machine characteristics depending on
whether the machine is virtual or physical.  For a physical machine, the licenses are tied to
the motherboard ID and Hard Disk ID.  If either of those change, there is no effect on the licenses.
Only if both of those change will the licensing system invalidate the licenses.  On virtual machines,
however, the licenses are tied to the type of CPUs, VM UUID, and MAC address.  Moreover, if
*any* of those change, the license is invalidated.  As you can see, licensing is stricter on
virtual machines.

Attempting to use the SafeNet HASP licensing system on virtual machines (VMs) is problematic.
It is too easy for changes to the VM or the physical machine (PM) on which the VM runs to
invalidate a license.  Such changes result in a "clone" error and the license server on the
machine no longer serves any licenses.  Further complicating this is that when used in a
cluster, cluster policy may cause the VMs to migrate to different PMs.

The only way to really prevent clone errors is to run the license manager on an unchanging
physical machine.  But if we must work with VMs and VM clusters, here are some strategies
to help prevent or lessen the chances of getting a clone error.

A simple list of high-level strategies to help prevent clone errors:

1) Set VM affinity to lock a virtual machine to a physical server

   Create a VM-HOST affinity rule to lock a License Manager VM to a physical host.
   If the VM never moves then its characteristics never change.

2) Mask VM CPUs so that all CPUs appear identical

   This presumes that all CPUs can be masked so as to present a common set of characteristics.
   Licenses would have to be activated *after* such masking.

3) Don't explicitly clone the virtual machine.

4) Do not use multiple network interfaces with virtual machines.

   The machine fingerprint depends on the primary network card.  If network card order changes,
   the machine will have a different fingerprint and the license will break.

5) Turn off virtual machine migration for the cluster

   If the virtual machine never moves in the cluster, its characteristics would never change.
   Not terribly useful.  One of the reasons for using VM clusters is to best use
   physical resources and turning off machine migration prevents that.  Also, there is no
   guarantee that the cluster remains on the same dedicated physical hardware.


Note that deactivating licenses before a change and reactivating afterwards will not avoid clone
errors as was once thought.  Even though there may be no active licenses on the machine after the
change, the clone error is still present.  Activating a license on such a machine will simply make
the clone error instantly visible (and may actually be necessary in order to clear the clone error).



These strategies depend on control of the underlying physical hardware.  If you have a cluster
of virtual machines in the cloud, and do not have control as to which physical machines the cluster
uses, or their characteristics, there is little you can do to prevent clone errors.

References:

"Using DRS Affinity Rules"
http://pubs.vmware.com/vsphere-50/index.jsp#com.vmware.vsphere.resmgmt.doc_50/GUID-FF28F29C-8B67-4EFF-A2EF-63B3537E6934.html

"VM-Host Affinity Rules"
http://pubs.vmware.com/vsphere-50/index.jsp#com.vmware.vsphere.resmgmt.doc_50/GUID-2FB90EF5-7733-4095-8B66-F10D6C57B820.html

"Enhanced vMotion Compatibility (EVC) processor support (1003212)"
http://kb.vmware.com/kb/1003212

"vMotion CPU Compatibility - Migrations Prevented Due to CPU Mismatch - How to Override Masks (1993)"
http://kb.vmware.com/kb/1993

"CPU Compatibility and EVC"
http://pubs.vmware.com/vsphere-50/index.jsp#com.vmware.vsphere.vcenterhost.doc_50/GUID-03E7E5F9-06D9-463F-A64F-D4EC20DAF22E.html

"EVC and CPU Compatibility FAQ (1005764)"
http://kb.vmware.com/kb/1005764

"Maintaining and Changing the MAC Address of a Virtual Machine"
http://www.vmware.com/support/ws55/doc/ws_net_advanced_mac_address.html


"Clone Detection for a Virtual Machine"
Sentinel HASP Software Protection and Licensing Guide, v.5.00, App D, p 283
http://c3.safenet-inc.com/downloads/A/3/A3F6DCC5-2E4A-4D84-A348-2A632F04040D/Sentinel_HASP_Software_Protection_and_Licensing_Guide.pdf