GUIDELINES FOR SUPPORTED MOBILITY XE DEPLOYMENTS

Transcription

1 GUIDELINES FOR SUPPORTED MOBILITY XE DEPLOYMENTS Use this dcument t plan a Mbility XE deplyment. The guide assumes yu are familiar with Mbility server pl and client installatin (as dcumented in the Quick Start Guide and Pre-Install Checklist), that yu understand Mbility XE s features and functins (as dcumented in the System Administratr Guide), and that yu have an understanding f IP-based netwrking. This guide applies t Mbility XE versins 6.7 thrugh Fr large-scale deplyments (1,000 devices and ver), this guide applies nly t Mbility XE versins 7.21 and newer. Last updated: 22nd Octber 2008 ABBREVIATIONS AND DEFINITIONS Mbility server: A single Mbility XE server. Mbility warehuse: The LDAP directry that serves as the settings and management backbne fr a Mbility server pl. Mbility reprting server: A single Mbility server that cllects data frm the ther Mbility XE servers, prcesses the infrmatin, and frwards it t the Reprting database fr strage. Reprting database: A Micrsft SQL Server database that stres reprting data. Mbility server pl: One r mre Mbility servers that share a single primary warehuse. DMZ (demilitarized zne): A netwrk lcatin separated frm the Internet by a firewall/ruter and frm internal netwrk resurces by a secnd firewall/ruter. VIP (virtual IP address): An IP address assigned by a Mbility server t a Mbility client device when the client establishes a sessin. ABSOLUTES ( SHALL, MUST, OR WILL ) Guidance using the wrds shall, must, r will, must be fllwed exactly. Nn-cnfrming deplyments are nt supprted. RECOMMENDATIONS ( CAN, RECOMMENDED OR SHOULD ) Guidance using the wrds can, recmmend, r shuld describes recmmended prcedures and cnfiguratins that have been tested and fund reliable.

2 AREAS OF RISK ( MAY ) Guidance using the wrds may r culd indicates that there is sme risk with deplying in this manner. The prduct either has nt been explicitly tested in this cnfiguratin, r there may be additinal issues r risks. The cnfiguratin may wrk, prvided that the nted cnditins and caveats are adhered t. Yu assume sme risk when deplying the prduct in such a manner. Page 2

3 WHERE TO DEPLOY MOBILITY SERVERS AND POOLS ALL POOL COMPONENTS We recmmend that Mbility server pls be designed s that all servers in the pl are lgically prximate. Cnnectivity between all server pl cmpnents must be highly available. Mbility servers must have highly available cnnectins t all ther Mbility servers and warehuses in the pl. Mbility warehuses must have highly available cnnectins t all Mbility servers and all ther warehuses in the pl. The Mbility reprting server and the Reprting database must have highly available cnnectins t all Mbility servers and warehuses in the pl. Intermittently available links are nt supprted fr use in cnnecting Mbility servers and warehuses. Bandwidth between all server pl cmpnents must be at least 10 megabits per secnd r faster. Mbility servers, Mbility reprting server, Reprting database and warehuses shuld have high thrughput access t all ther Mbility servers and warehuses in the pl. It is recmmended that cnnectins be 100 megabits per secnd. Cnnectins may be as slw as 10 megabits per secnd. Sme events such as failver fr an entire pl cause large amunts f data t be sent between the Mbility servers, Mbility reprting servers, Reprting databases and the warehuses. Latencies between all Mbility server pl cmpnents must be less than 150 millisecnds rund-trip. Mbility servers, Mbility reprting server, Reprting database and Mbility warehuses shuld have lw latency, 50 millisecnd r less rund-trip time, cnnectins. Mbility servers and warehuses may have cnnectin latencies as high as 150 millisecnds rund-trip time. Increased latencies cause lnger client cnnect times, may cause significant administrative cnsle delays, and may significantly delay Netwrk Access Cntrl and Plicy actins. Mbility server pls must be lcated either behind a crprate firewall r in a DMZ. Deplying any cmpnents f a server pl n a netwrk perimeter r utside the crprate firewall is nt supprted. We recmmend installing the latest service packs f the supprted perating systems n all the server cmpnents fr full supprt. Page 3

4 A 32-bit versin f Windws server must be used. Windws 2003 x64 versins are nt yet supprted. Micrsft SQL server 2005 must be used. Micrsft SQL server 2008 is nt supprted. MOBILITY SERVERS In a dmain, Mbility servers in a pl shuld be deplyed in clse lgical prximity t each ther, usually n the same subnet r n the same VLAN. If lad-balancing r failver will be used with static VIPs, all Mbility servers in the pl must be lcated n the same subnet. Mbility servers in a pl when deplyed in physically dispersed lcatins shuld be cnnected t all ther Mbility servers in the pl and t the warehuse and any standby warehuses by a high-speed, lw-latency, highly-available netwrk link as described in the previus sectin. Mbility servers shall nt be cnnected t each ther r t the primary r standby warehuses by intermittently available links. Mbility servers in a pl shuld be similar in CPU speed, number f CPUs, and amunt f RAM fr ptimal lad balancing. The Mbility server can nly be lcated n the same machine as the Mbility warehuse, the reprting server and the Reprting database in a small deplyment server installatin when there will be 100 r fewer simultaneusly cnnected client sessins at peak lad. Fr large scale deplyments, dual r quad prcessr systems shuld be used t prvide higher perfrmance. Eight prcessr systems may be used, thugh additinal cres beynd fur are f less benefit as there are three threads that prcess mst f the system lad. MOBILITY WAREHOUSE The warehuse can nly be lcated n the same machine as the Mbility server, the reprting server and Reprting database in a small deplyment server installatin when there will be 100 r fewer simultaneusly cnnected client sessins at peak lad. This is the recmmended deplyment fr evaluatins and fr mst pilt installatins. In deplyments exceeding 100 simultaneusly cnnected client sessins at peak lad, the warehuse and any standby warehuses must be lcated n dedicated machines. The warehuse can nly be lcated n the same machine as the Mbility server when there will be 400 r fewer simultaneusly cnnected client sessins at peak lad. This assumes that the Mbility reprting server and Reprting database are nt lcated n the same machine. In deplyments exceeding 400 simultaneusly cnnected client sessins at peak lad, the warehuse and any standby warehuses must be lcated n dedicated machines. Page 4

5 The warehuse may be lcated n a different subnet than the Mbility servers, separated by a ruter r firewall. In this cnfiguratin, prt 389 must be pened in bth directins t allw them t cmmunicate. Standby warehuses d real-time replicatin with the primary warehuse. Each standby warehuse must be cnnected t the primary warehuse ver a high-speed (10 megabits per secnd r faster), lwlatency (150 ms r less, rund trip), highly-available netwrk link. In additin, each Mbility server in the pl must be cnnected t every standby warehuse by a cmparable link. Data Executin Preventin must be disabled fr ns-slapd. Fr large scale deplyments, dual r quad r higher prcessr systems shuld be used t prvide higher perfrmance. REPORTING SERVER The Mbility reprting server can nly be lcated n the same machine as the Mbility server, the warehuse and the Reprting database in a small deplyment server installatin when there will be 100 r fewer simultaneusly cnnected client sessins at peak lad. The Mbility reprting server may be cllcated with a Reprting database hsting Micrsft SQL 2005 Server Express Editin in deplyments up t 1000 simultaneusly cnnected client sessins at peak lad. Fr deplyment exceeding 1000 simultaneus cnnected client sessins at peak lad, we recmmend 4GB r mre f disk space. The Mbility reprting server may be cllcated with a Reprting database hsting Micrsft SQL 2005 Server Standard r Micrsft SQL 2005 Server Enterprise Editin installatins up t 6000 simultaneusly cnnected client sessins at peak lad. In deplyments exceeding 6000 simultaneusly cnnected client sessins at peak lad, the Mbility reprting server and Reprting database must be lcated n dedicated machines. The Mbility reprting server may be lcated n a different subnet than the Mbility servers, separated by a ruter r firewall. In this cnfiguratin, the Mbility reprting server prt (default is 61616) must be pened in bth directins t allw them t cmmunicate. The Mbility reprting server and the Reprting database server must be cnfigured t be in the same time-zne. The Mbility servers, Mbility warehuses, Mbility reprting server, and the Reprting database shuld be time synchrnized t within 1 minute f each ther. If the system clcks f the Mbility reprting server, Reprting database, and/r Mbility servers becme mre than 30 minutes ut f synchrnizatin, the web user interface may prduce errneus warnings that indicate that the Reprting server is nt running when, in fact, it is. The Mbility reprting server may be deplyed in a lcatin that is physically dispersed frm the lcatins f the Mbility servers in the pl, prvided that it is cnnected t all ther Mbility servers in the pl Page 5

6 and t the warehuse and any standby warehuses by a high-speed, lw-latency, highly-available netwrk link as described in the previus sectin. The Mbility reprting server and the Reprting database cmmunicate in real-time with a large vlume f data. The Mbility reprting server and the Reprting database must be cnnected t each ther ver a high-speed (100 megabits per secnd r faster), lw-latency (10 ms r less, rund trip), highly-available netwrk link. The Mbility reprting server must nt be cnnected t the Mbility servers r t the primary r standby warehuses r t the Reprting database by intermittently available links. Fr large scale deplyments, dual r quad r higher prcessr systems shuld be used fr the Mbility reprting server and the Reprting database t prvide higher perfrmance. In a large pl, the data that is entered int the Reprting database fr each NMS is serviced under a separate thread and there may be up t 10 active Mbility servers submitting lg data (as well as tw standby Mbility servers that are nt actively submitting lg data). Therefre, 10 prcessrs will prvide the highest level f reprting server scalability. REPORTING DATABASE The Reprting database can nly be lcated n the same machine as the Mbility server, the warehuse and the Reprting database in a small deplyment server installatin when there will be 100 r fewer simultaneusly cnnected client sessins at peak lad. In deplyments up t 1000 simultaneusly cnnected client sessins at peak lad, a Micrsft SQL 2005 Server Express Editin installatin may be used as a Reprting database. Micrsft SQL 2005 Server Express Editin has a 4GB limit n the size f the database that can accmmdate data fr 1000 clients with the default purge age f 13 mnths. Fr deplyments exceeding 1000 simultaneusly cnnected client sessins at peak lad, a Micrsft SQL 2005 Server Standard r Enterprise Editin installatin shuld be used as the Reprting database. The Reprting database may be lcated n a different subnet than the Mbility servers and the Mbility reprting server, separated by a ruter r firewall. In this cnfiguratin, the Reprting database prt (default 1433) must be pened in bth directins t allw them t cmmunicate. The Mbility reprting server and the Reprting database platfrms must be cnfigured t be in the same time-zne. The Mbility servers, Mbility warehuses, Mbility reprting server, and the Reprting database shuld be time synchrnized t within 1 minute f each ther. If the system clcks f the Mbility reprting server, Reprting database, and/r Mbility servers becme mre than 30 minutes ut f synchrnizatin, the web user interface may prduce errneus warnings that indicate that the reprting server is nt running when, in fact, it is. The Mbility reprting server and the Reprting database cmmunicate in real-time with a large vlume f data. The Mbility reprting Server and the Reprting database must be cnnected t each ther ver Page 6

7 a high-speed (100 megabits per secnd r faster), lw-latency (10 ms r less, rund trip), highly-available netwrk link. The Reprting database must nt be cnnected t the reprting server, Mbility servers, r t the primary r standby warehuses by intermittently available links. Fr large scale deplyments, dual r quad r higher prcessr systems shuld be used fr the Reprting database t prvide higher perfrmance. Fr large scale deplyments, 8GB r mre physical memry shuld be used fr the Reprting database. Nte that if mre than 4GB f memry is installed, the Reprting database shuld run n a 64-bit perating system in rder t mst efficiently access the additinal memry (native 64-bit versus AWE). Fr large scale deplyments, a high perfrmance disk subsystem with RAID10 shuld be used fr the Reprting database. SPECIAL CONSIDERATIONS WHEN DEPLOYING IN A DMZ Mbility servers lcated in a DMZ shuld be standalne servers that are nt members f the crprate dmain. (Micrsft als recmmends that Windws servers in a DMZ nt be dmain members. See chapter 11 in the Windws 2003 Security Guide.) If Mbility servers in the DMZ need t be members f a Micrsft Active Directry (AD) dmain, it will require pening additinal prts specified by Micrsft. Therefre, we recmmend that netwrks using NTLM authenticatin setup a RADIUS server t allw the Mbility servers t authenticate dmain users frm the DMZ. The perimeter firewall must be cnfigured t allw inbund traffic n UDP prt 5008 (an alternative prt may be used) t rute t the servers in the Mbility server pl. The DMZ must be cnfigured t handle and rute the full scpe f VIP addresses in the Mbility server pl. We recmmend that the Mbility server pl be lcated n a subnet large enugh t accmmdate all VIPs fr the pl. The three mst cmmn DMZ scenaris fr this are: A multi-hmed Mbility server with 2 r mre physical netwrk interface cards. Typically, ne subnet uses public addresses and ne private, with the VIPs defined n the private side. A single-hmed Mbility server n a DMZ that has a large subnet with many addresses available. A single-hmed Mbility server n a DMZ that has nly a few public addresses, but is supernetted with a private subnet fr the VIPs. ICMP and web acceleratin traffic riginates frm a Mbility server s IP address, nt frm the Mbility client s VIP address. Take this int accunt when cnfiguring DMZ ruting rules. AUTHENTICATION Page 7

8 WHEN DEPLOYING IN A DMZ Mbility server pls deplyed in a DMZ shuld be cnfigured t use RADIUS authenticatin. We recmmend using Cisc, Juniper, Micrsft r ther RADIUS servers that supprt LEAP, PEAP r EAP-TLS authenticatin t Active Directry. The internet firewall must be cnfigured t allw traffic (the default radius prt 1812) between the radius server and the clients. Yu may need t cnfigure an additinal firewall that is between the DMZ and intranet where the dmain cntrllers are lcated. CAPACITY Mbility server capacity infrmatin is based n the fllwing assumptins: Machines hsting Mbility servers have tw r mre 2 GHz prcessrs, 2 GB RAM, and are cnnected t a gigabit netwrk backbne with lw latency. Machines hsting the Mbility warehuse (primary r standby) have an NTFS-frmatted hard drive with at least 5 GB f free disk space after all users and devices have been registered. Machines are running Micrsft Windws Server 2003 SP1 (supprted fr all versins prir t 7.21) r SP2 (nly supprted in versin 7.21 r later) r Windws 2000 Server SP4 (supprted n all versins prir t 8.5) with all security patches applied. There are n additinal prcesses r services running n the machine beynd thse installed by the perating system. Additinal prcesses r services running n a Mbility server will decrease peak active cnnectin capacity. Mbility XE 8.50 Perfrmance Maximum TCP thrughput in Megabits/sec* Clients per server 1 server pl 5 server pl 10 server pl Page 8

9 With n TCP traffic the maximum VIP capacity per server is 850 simultaneus calls** The maximum traffic per Mbility server t the Mbility reprting server is 44 kilbits/sec*** *Tested n servers running with dual prcessr 2.1 GHz Xen prcessrs, with 4 gigabytes f RAM and a gigabit netwrk interface card. **Depending n the cdec and assuming nly a vice stream, n vide. ***Tested n servers running with dual prcessr 2.0 GHz AMD prcessrs, with 4 gigabytes f RAM and a gigabit netwrk interface card. The maximum thrughput per Mbility client is 200 megabits/sec**** ****Tested n XP and Vista clients running with dual prcessr 2.3 Xen prcessrs with 3 gigabytes f RAM and a gigabit netwrk interface card. The Bradcasts Blck frm Client and Blck t Client settings are selected (n). Disabling these settings can cause a traffic strm f bradcasts (typically frm NetBIOS) sent t every cnnected client, severely reducing system capacity. Fr imprved perfrmance Mbility servers and warehuses in the pl shuld be n the same subnet. NOTES The Thrttling Threshld r Thrttling Nn paged memry settings may need t be adjusted as advised by yur NetMtin Wireless supprt engineer. A separate management netwrk is recmmended t help insure that lad balancing data is nt drpped, and t allw fr faster update intervals and mre accurate lad balancing decisins. SINGLE SERVER CAPACITY Based n the abve assumptins, peak Mbility server capacity ratings are as fllws: A single Mbility server cnnected t an external warehuse can service up t 1,000 active cnnectins (Mbility XE versin 6.7 r earlier) r up t 1,500 active cnnectins (Mbility XE versin 7.0 r later). Due t cntentin fr memry and CPU, NetMtin Wireless des nt supprt running a cllcated warehuse (primary r standby), Mbility reprting server and Reprting database n a Mbility server with mre than 100 peak active client cnnectins. Due t cntentin fr memry and CPU, NetMtin Wireless des nt supprt running a cllcated warehuse (primary r standby) n a Mbility server with mre than 400 peak active client cnnectins. Fr Mbility versins 8.5 and higher, due t cntentin fr memry and CPU, NetMtin Wireless des nt supprt running a small deplyment server (Mbility reprting server, Reprting database and warehuse cllcated n a Mbility server) with mre than 100 peak active client cnnectins. Page 9

10 Yu may experience higher memry utilizatin n yur servers if yur clients have heavier netwrk activity resulting in smaller cnnectin capacity. SERVER POOL CAPACITY A Mbility XE versin 6.7 pl can service up t 6 Mbility servers with 5,000 peak active client cnnectins, and 10,000 users and devices registered in the warehuse. A Mbility XE versin 7.0 r later pl can service up t 12 Mbility servers with 15,000 peak active client cnnectins, and 35,000 users and devices registered in the warehuse A Mbility XE versin 8.50 pl can service up t 12 Mbility servers, a Mbility reprting server and a Reprting database with peak cnnectins and up t 60,000 users and devices in the warehuse*. *Tested n servers running with dual prcessr 2.1 GHz Xen prcessrs, with 4 gigabytes f RAM and a gigabit netwrk interface card. A Mbility server pl must have nly ne primary warehuse. A Mbility server pl shuld have at least ne standby warehuse fr system redundancy. Fr maximum Mbility server capacity, Mbility reprting server, Reprting database and warehuses must be deplyed n dedicated machines. A Mbility server pl must have enugh available peak capacity t service the entire peak lad if ne server has a hardware failure. Large deplyments may exceed the number f lgical addresses available n a subnet. See Technical Nte 2188 ( fr reslutin methds. WAREHOUSE SETUP AND CONFIGURATION The warehuse sftware (Sun ONE LDAP Directry / Sun Java(TM) System Directry Server) must have the fllwing patches and cnfiguratin changes applied in all large deplyments: WAREHOUSES INSTALLED PRIOR TO MOBILITY XE VERSION 7.0 The warehuse must be upgraded t Service Pack 4 f the Sun Java System Directry Server fllwing the instructins in Technical Nte 2195 ( Warehuses installed with Mbility XE versin 7.0 r later applied this service pack autmatically. WAREHOUSES INSTALLED PRIOR TO MOBILITY XE VERSION 7.10 Page 10

11 Install the memry leak patch fllwing the instructins in Technical Nte 2209 ( This is required fr any warehuse installed prir t Mbility XE versin 7.1. WAREHOUSES INSTALLED PRIOR TO MOBILITY XE VERSION 7.21 The Warehuse Optimizatin Prcedure must be run n all warehuses installed prir t Mbility XE versin 7.21, fllwing the prcedures in Technical Nte 2224 ( Increase the warehuse default cache sizes fllwing the instructins in Technical Nte 2202 ( WAREHOUSE BACK UP The Mbility warehuse directry tree (default lcatin C:\Prgram Files\Sun) must be excluded frm autmated backup sftware. Backing up the warehuse while it is in use can degrade perfrmance and crrupt the system. T back up the warehuse, fllw the instructins in Technical Nte 2129 ( Fr fault tlerance, we strngly recmmend that all Mbility XE deplyments cnfigure at least ne standby warehuse in additin t the primary warehuse, fllwing the prcedures in Technical Nte 2130 ( After setting up warehuse replicatin, fllw the prcedures in Technical Nte 2203 ( t limit the size f the replicatin change lg. WAREHOUSE CAPACITY Due t CPU and memry cntentin, the warehuse must nt be cllcated n a Mbility server with 100 r mre peak, active client cnnectins. In these deplyments, the primary warehuse and any backup warehuses must be installed n dedicated servers, nt cllcated with a Mbility server. Deplyments f 1,000 r mre devices must have at least ne standby warehuse. A warehuse that has been updated with the apprpriate patches and cnfiguratin settings can supprt up t 60,000 bjects, where an bject is a registered device r user. A warehuse may be able t handle mre than 60,000 bjects, but there will be perfrmance degradatins in the Mbility cnsle. A warehuse with mre than 1,000 devices/users must have its cache size increased t imprve the perfrmance f lk-ups, fllwing the prcedures in Technical Nte 2202 ( Page 11

12 Warehuse replicatin must be actively mnitred between the primary and standby warehuses, especially in large deplyments. Optins fr mnitring the status f warehuse replicatin are dcumented in Technical Nte 2145 ( REPORTING SERVER CAPACITY Due t CPU and memry cntentin, the reprting server must nt be cllcated n a Mbility server with mre than 100 peak, active client cnnectins. In these deplyments, the Mbility reprting server and Reprting database must be installed n dedicated servers, nt cllcated with a Mbility server. Machines hsting the Mbility reprting servers shuld be cnnected t the Reprting database ver a gigabit netwrk backbne with lw latency. Machines hsting the Mbility reprting servers must be cnnected t the Reprting database ver a 100Mb/sec netwrk backbne with lw latency. Fr deplyments with 1,500 r fewer simultaneusly cnnected client sessins at peak lad, the recmmended system requirements fr the reprting server shuld be adequate. Fr deplyments with 6,000 r fewer simultaneusly cnnected client sessins at peak lad, the reprting server shuld be hsted n a platfrm with 2 r mre prcessr cres f at least 2Ghz, at least 4GB f system memry and at least 2GB f free space n the hard disk n which the reprting server is installed. Fr deplyments with up t 15,000 simultaneusly cnnected client sessins at peak lad, the reprting server shuld be hsted n a platfrm with 4 r mre prcessr cres f at least 2Ghz, at least 4GB f system memry and at least 6GB f free space n the hard disk n which the reprting server is installed REPORTING DATABASE CAPACITY Due t CPU and memry cntentin, the Reprting database must nt be cllcated n a Mbility server with mre than 100 peak, active client cnnectins. In these deplyments, the Reprting database must be installed n dedicated servers, nt cllcated with a Mbility server. Machines hsting the Reprting database shuld be cnnected t the Mbility reprting server ver a gigabit netwrk backbne with lw latency. Machines hsting the Reprting database servers must be cnnected t the Mbility reprting server ver a 100Mb/sec netwrk backbne with lw latency. Fr deplyments with 1,500 r fewer simultaneusly cnnected client sessins at peak lad, the Reprting database shuld be hsted n a platfrm with a prcessr cre f at least 2Ghz, at least 4GB f system memry and at least 15GB f free space n the hard disk n which the Reprting database data files reside. Fr deplyments with 6,000 r fewer simultaneusly cnnected client sessins at peak lad, the Reprting database shuld be hsted n a platfrm with at least tw prcessr cres f at least 2Ghz, at Page 12

13 least 4GB f system memry and at least 60GB f free space n the hard disk n which the Reprting database data files reside. Fr deplyments with up t 15,000 simultaneusly cnnected client sessins at peak lad, the Reprting database server shuld be hsted n a platfrm with at least 4 prcessr cre f at least 2Ghz, at least 8GB f system memry and at least 120GB f free space n the hard disk n which the Reprting database data files reside. In rder t achieve the highest level f database scalability, the disk subsystem fr the Reprting database server shuld exhibit the fllwing characteristics: Hardware RAID shuld be used. Sftware RAID must nt be used. RAID Level 10 shuld be used. Write-back cache must nt be used in the disk cntrllers fr the drives n which the Reprting database data files are stred. Each f the fllwing entities shuld be stred n a different physical hard drive SQL Server Prgram Files and Windws Operating System Mbility Reprting database data file (MbilityDB.MDF) Mbility Reprting database lg file (MbilityDB.LDF) SQL Server s tempdb database files CONFIGURATION GUIDELINES SERVER OPERATING SYSTEMS Mbility server sftware is nly supprted n Micrsft Windws server perating systems. Windws Server 2000 and Windws Server 2003 are supprted up thrugh Mbility versin 8.0. We fully supprt 32-bit Windws Server 2003 SP2 and Windws Server 2003 R2 Standard and Enterprise editins in Mbility versin 8.5. We have nt tested any ther versins f the Windws 2003 Server and cannt guarantee supprt. Windws Server 2000 is nt supprted past Mbility versin 8.0. Mbility server sftware is nt supprted n any Micrsft Windws client perating system (Windws Vista, Windws XP Prfessinal). Windws Server 2008 is nt supprted in the current shipping versins f Mbility XE. Page 13

14 We recmmend installing a dedicated Reprting database (Micrsft SQL Server 2005 Enterprise Editin) n a n a 64bit perating system fr enhanced perfrmance. On the Mbility server, set the Windws Firewall filters t permit UDP 5008 nly n the external-facing netwrk interface. Disable r uninstall all nn-essential perating system services and applicatins, such as IIS. The NSA, in cnjunctin with Micrsft, has published guidelines fr hardening the Windws Server perating system. NetMtin Wireless has tested Mbility XE versin 7.2 using these guidelines. The guidelines are published at See Technical Nte 2225 ( fr guidance n installing Mbility XE n a hardened Windws server. SERVER OS PATCHES, FIXES, AND UPDATES Befre applying a service pack r security patch, cntact NetMtin Wireless technical supprt t verify cmpatibility; r verify cmpatibility in a test envirnment. Back up Mbility servers s that they can be easily restred in the event f an incmpatibility. NetMtin Wireless regularly applies and tests new service packs and security patches in its test envirnments. Althugh mst security patches and service packs have nt caused cmpatibility prblems, it is nt safe t assume they are all cmpatible with Mbility XE. If we learn f any incmpatibilities, we will pst a bulletin n the supprt sectin f ur web site, where we will annunce plans and schedules fr reslutin. MOBILITY SERVER NETWORK CONFIGURATION We recmmend that Mbility servers be single-hmed with gigabit adapters. Multi-hmed server installatins are supprted but nt recmmended. The best reasn fr a multi-hmed server is t have a dedicated management netwrk. Mbility servers can be dual- r multi-hmed, but each netwrk interface must be lcated n a different subnet. Mbility servers d nt supprt multiple interfaces n the same subnet. The Mbility server is a prxy server, nt a NAT r a ruter. A multi-hmed Mbility server cannt be cnfigured, by itself, t rute nly encrypted r unencrypted traffic thrugh a single interface. Custmers wh need t frce traffic ver a specific interface must cnfigure ther netwrk r DMZ cmpnents (firewalls/ruters and NATs) t accmplish this. A multi-hmed Mbility server can have nly ne default gateway, with static rutes defined t access netwrks ver the nn-default netwrk interface. Page 14

15 PKI SUPPORT We will supprt the Micrsft PKI infrastructure t authenticate persnal user certificates using the Micrsft IAS, Cisc ACS, Juniper Steel Belted and Free Radius servers. In general, any vendr s standards-based PKI may be cmpatible but has nt been validated in ur test lab. SUPPORTED BROWSERS Mbility XE versin 6.x supprts Micrsft Internet Explrer versin 6.x. Mbility XE versin 7.x supprts Micrsft Internet Explrer versins 6.x and 7.x at a reslutin f 1024x768. Mbility XE versin 8.x supprts Micrsft Internet Explrer versins 6.x and 7.x, and Firefx versin 2.x, at a reslutin f 1024x768. Custmers may use a nn-supprted brwser r use a lwer reslutin t access the Mbility cnsle, but if they encunter any prblems, they shuld revert t using a supprted brwser and reslutin. COLLOCATED APPLICATIONS Dmain cntrllers: Mbility servers must nt be cllcated with a Windws dmain cntrller. Dmain cntrllers: Mbility warehuses must nt be cllcated with a Windws dmain cntrller. Dmain cntrllers: Mbility reprting server and Reprting database must nt be cllcated with a Windws dmain cntrller. Cllcated sftware firewalls: Except fr the built-in firewall available in the Windws perating system, third-party, sftware-based firewalls shuld nt be installed n a Mbility server. NetMtin Wireless nly tests Mbility servers using the built-in Windws firewall, and we cannt guarantee cmpatibility with ther cllcated, sftware firewalls. Due t the fact that third party firewalls and the Mbility Server filter and act n netwrk packets in a very similar manner, there can be many different types f cnflicts and cmpatibility prblems. If yu chse t install a sftware firewall n a Mbility server and yu encunter prblems where the firewall is suspect, we will ask yu t turn it ff r uninstall it as a first step t reslving the prblem. Sme f the knwn incmpatibilities can ccur in the fllwing areas: inbund cnnectins, prt filtering, SIP-based applicatins, lading the TCP stack, circumvented r ineffective firewall settings, prblems after firewall upgrades r applying perating system service packs, cmmunicatins failures between server pl cmpnents, blue screens, etc. Page 15

16 Fr small, nn-prductin trials it may be pssible t cllcate the Mbility server sftware n a server running ther applicatins (file sharing, web services, etc.). Mbility servers generally shuld nt have ther cllcated applicatins running n them. If yu find a defect in the Mbility sftware caused by a cllcated third-party applicatin, yu may be required t remve the applicatin(s). If it is necessary t cllcate netwrk r system mnitring applicatins n a Mbility server expected t service a high cnnectin lad, ding s will decrease the Mbility server s scalability and capacity. LOAD BALANCING ZONES Lad balancing znes may be set up t prvide failver t a gegraphically remte site in the event f a catastrphic site failure. When using lad balancing znes, all Mbility server pl cmpnents must have access t all ther cmpnents in the pl ver a high-speed (10 megabits per secnd r faster), lw-latency (150ms r less, rund-trip), highly-available netwrk link. The Mbility reprting server and Reprting database must be placed in the same zne and must have access t all Mbility server cmpnents in the pl ver a high-speed (10 megabits per secnd r faster), lw-latency (150ms r less, rund-trip), highly-available netwrk link. Deplyments in gegraphically distributed cnfiguratins must use separate zne(s) fr each gegraphic area. The latencies frequently seen within distributed deplyments can significantly increase sme f the delays seen by client devices and in the management user interface, ntably with any features that stre r retrieve data frm the Warehuse. We recmmend deplying at least ne standby warehuse within each cnfigured zne. If mass failver capacity between gegraphic lcatins is needed, the pl must have enugh excess capacity s that the remaining servers in the pl are able t supprt the client lad if any ne gegraphic site is ut f cmmunicatin. Nte in the examples belw, increasing the latency by 50 millisecnds causes an increase in the time it takes 5000 devices t cnnect by 15 minutes. Page 16

17 5000 cnnectins Cmparative, Frced 10Mbit Half-Duplex 7,000,000 6,000,000 5,000,000 Bits / Secnd 4,000,000 3,000,000 2,000,000 1,000, Secnds 50ms 100ms 150ms Bits Per Secnd ( 60 Secnd Mving Average) In a pl with larger latencies, management f the pl shuld be dne ver a separate management netwrk and management f the pl shuld be perfrmed ver the lwest latency link pssible. 0 ms latency = 282 ms lad time 50 ms latency = ms lad time 100 ms latency = ms lad time 150 ms latency = ms lad time Page 17

18 FAULT TOLERANCE AND HIGH AVAILABILITY T create high availability deplyments, Mbility server pls must cntain tw r mre servers beynd what is nrmally required t handle the regular lad. Additinally, highly available Mbility server pls must cntain ne r mre standby warehuses. VIRTUALIZATION VMware ESX is the nly virtualizatin envirnment supprted by NetMtin fr full system capacity and perfrmance. The ESX Virtual Guests running Mbility server cmpnents must be cnfigured t be guaranteed at least a single prcessr CPU equivalent t 2 GHz and at least 2 gigabytes f RAM. Mbility XE functinality is supprted in VMware and Micrsft Virtual Server envirnments running n tp f a desktp r server perating system, hwever capacity and perfrmance within these envirnments is lwer due t the verhead f the virtualizatin envirnment. The Mbility server, the Mbility reprting server, the Reprting database and/r warehuse may run in a virtual server envirnment, either with VMware r MS Virtual Server. NetMtin uses VMware ESX, VMware Wrkstatin, and Micrsft Virtual Server in day-t-day peratins, in bth test and technical supprt. These cnfiguratins wrk well and we are nt aware f incmpatibilities. A Mbility warehuse must nt be cllcated with a Mbility server in the same virtual server instance. In additin, the warehuse shuld nt be installed n anther virtual server instance running n the same physical machine as the Mbility server. The nly supprted cnfiguratins fr running Mbility XE system cmpnents in a virtual server envirnment are discussed in Technical Nte 2215 ( Custmers must ensure the Mbility server has sufficient CPU and memry t service their mbile deplyment. In virtualizatin envirnments ther than VMware ESX, NetMtin Wireless currently makes n quantitative claims with respect t system capacity r perfrmance when running Mbility XE. WORKING WITH IDS/IPS SYSTEMS If yu are planning t use an IDS (intrusin detectin system)/ips (intrusin preventin system) system, it must either be cnfigured t ignre encrypted Mbility traffic, r the netwrk must be cnfigured t rute nly unencrypted traffic thrugh the IDS/IPS system. CONNECTING TO A MOBILE OPERATOR S FRAME RELAY Mbility servers must nt be cnfigured t bridge the mbile peratr s frame relay cnnectin with the crpratin s trusted netwrk. Frame relay cnnectins shuld terminate with a ruter r firewall, and Mbility servers must be lcated n the trusted side f the ruter/firewall, ppsite the frame relay cnnectin. Page 18

19 MISCELLANEOUS Advanced settings shuld nly be mdified under the specific directin f NetMtin Wireless sales engineers r technical supprt persnnel. Mdifying Mbility warehuse settings using the Sun cnsle is nt supprted unless specifically directed by NetMtin technical supprt. MOBILITY XE CLIENT OPERATING SYSTEMS Mbility client sftware is nly supprted n the Micrsft client and handheld perating systems listed in the applicable versin f the Mbility XE Quick Start Guide. Mbility client sftware is nt supprted n devices running Micrsft Windws server perating systems. Yu cannt assume that all new service packs and security patches are cmpatible with Mbility client sftware. Befre applying a newly released service pack r security patch, verify cmpatibility in a test envirnment, r cntact NetMtin Wireless technical supprt. Back up yur clients s they can be easily restred in the event f an incmpatibility. NetMtin Wireless regularly applies and tests new service packs and security patches in its test envirnments. If we learn f any incmpatibilities, we will pst a bulletin n the supprt sectin f ur web site, and we will annunce plans and schedules fr reslutin. DEVICES Sme mbile cmputing devices may implement auxiliary cmpnents (e.g. fingerprint scanners) that are incmpatible with Mbility client sftware. NetMtin Wireless will investigate reprted incmpatibilities, but we cannt guarantee cmpatibility with all devices and hardware. CLEAN MACHINES Mbility client machines shuld be clean machines they shuld nt have been previusly used t test cmpetitive r similar prducts, including ther VPN clients, wireless card drivers, multiple firewalls, etc. Wherever pssible, client machines shuld have a clean OS image and all current service packs applied. Only necessary crprate applicatins shuld be installed n the device. All ther applicatins, drivers, and peripherals shuld be uninstalled and remved. Even in pilt envirnments, client devices shuld mirrr as clsely as pssible the image f devices that will be used in the final deplyment. Page 19

20 THIRD-PARTY IPSEC VPNS Mbility XE is nt cmpatible with IPSec VPNs. SSL VPNS Mbility XE is nt cmpatible with any SSL VPN vendrs nn-brwser-based clients. Prducts specifically knwn t be incmpatible with Mbility XE include: Aventail SSL VPN Cnnect Access clients Juniper Secure Applicatin Manager PERSONAL FIREWALLS When installed n the same device as the Mbility client sftware, sme persnal firewalls may nt functin prperly withut cnfiguratin changes. NETWORK ACCESS CONTROL In general, enterprise versins f anti-virus and anti-spyware sftware shuld be cmpatible with Mbility XE. In general, enterprise firewall sftware may be cmpatible with Mbility XE. In general, hme r persnal versins f anti-virus, anti-spyware, and firewall sftware are nt supprted in cnjunctin with Mbility XE. Fr a list f NAC cmpatible prducts we supprt, please see tech nte 2234 n the Netmtin Wireless supprt website. Page 20