GroupWise SMTP Infrastructure Design:

Transcription

1 Managing an Enterprise Series : GWIA configuration and use Lawrence Kearney Enterprise and Workgroup Service Analyst [email protected]

2 Session Agenda Discussion will focus on the technical aspects of design, deployment and configuration Most information applies to large and enterprise size environments Designing and maintaining systems to compete with similar commercial service offerings Maximizing value using basic infrastructure resources 2

3 A typical enterprise environment Services normally compete for system resources 3

4 Some common issues with services How well a service does when measured Performance Stability Features Cost of ownership Scaling Security Most importantly, measure against what a service is supposed to be doing 4

5 Designing a solution Separate different messaging workloads Current messaging service needs are more complex Assessing complexities helps identify tools we can use to design solutions Resolving legacy issues may help keep on-premises systems viable 5

6 What can we do to improve services? Clever architecture and design choices Service I/O demarcations (QoS really) Service load balancing/management Application redirection/fail over Service high availability and clustering Virtualisation Service hardening Blended solutions are usually both economical and effective 6

7 Design choices Perimeter relay servers Provide I/O isolation and extend the features of your GWIAs Unsolicited bulk filtering Anti-virus services Advanced SMTP connection management Enhanced logging Policy based message management Message retention features Auditing and analysis tools Ideally provide fail over, clustering and load balancing features 7

8 Load balancing Load Balancing Software load balancing DNS round robin Perimeter relay servers GroupWise MTA routing Manual configurations Hardware load balancing Can use service aware intelligence Can be used to implement ACLs Can be used to implement SSL offloading Reverse proxies Can provide a blend of load balancing features 8

9 Demarcations and QoS Using GroupWise components User domains User post offices Service domains Gateways Identity Manager Service post offices Service post offices System, service and application accounts Mobile messaging connectivity 9

10 Demarcations and QoS Access Control Lists (ACLs) Prevent unauthorised access to services Can be used to dedicate and optimise resources Can be used to manage thin client access to services Can be implemented at many layers Server firewalls can be used as ACL components 10

11 Redirection and Failover GroupWise Internet Agent Features Multiple relay hosts for outbound messages 11

12 Redirection and Failover GroupWise Internet Agent Features Alternate Internet Agents 12

13 High Availability Clustering and virtualization Service instances versus server and OS instances 13

14 Redirection and Failover Multiple outbound relay hosts 14

15 Redirection and Failover Alternate Internet Agents: GWIA MTP Settings 15

16 Redirection and Failover Alternate Internet Agents: User Domain Settings 16

17 Redirection and Failover Alternate Internet Agents: Gateway Domain Settings 17

18 Redirection and Failover Alternate Internet Agents: Gateway Chaining 18

19 Demarcations and QoS GWIA Access Control SMTP Connection ACL s Implementing Restricted Internet Agents Use to limit inbound access to protocols and connections Required exceptions: Network addresses *@*.* Blank-Sender-User-ID 19

20 Demarcations and QoS GWIA Access Control 20

21 Demarcations and QoS GWIA Access Control 21

22 Demarcations and QoS GWIA Access Control 22

23 Demarcations and QoS GWIA Access Control 23

24 General best practices GWIA Configuration 24

25 Starting at the perimeter Load balancing inbound mail 25

26 SMTP Services for GroupWise clients Load balancing outbound mail 26

27 Real World Example System benchmark results: 90 95% reduction in unwanted at the perimeter Quantifiable delivery performance increases Unscheduled service downtime eliminated attachment sizes could be increased without remarkable performance penalties 27

28 SMTP services for unmanaged clients Unmanaged client examples Thin clients (applications, SQL and PowerShell scripts) Desktop and mobile POP and IMAP clients Other services consuming GroupWise services Blackberry Internet Service (BIS) Gmail Notify Link 28

29 Issues with unmanaged clients Additional security concerns Data leakage and loss Anti-virus and malware infections Cannot secure or audit third party local message stores Cannot remotely manage or wipe unauthorized devices 29

30 Unmanaged clients Services for Application clients 30

31 Services for application clients GWIA Access Control 31

32 Services for application clients GWIA Access Control 32

33 Services for application clients GWIA Access Control 33

34 Services for application clients GWIA Access Control 34

35 Services for application clients GWIA Access Control 35

36 Services for application clients GWIA Access Control Technical notes: 36

37 Services for application clients GWIA Access Control 37

38 Services for application clients Dedicating resources to application clients 38

39 If time permits Services for POP and IMAP clients 39

40 Demarcations and QoS GWIA Access Control 40

41 Demarcations and QoS GWIA Access Control 41

42 Demarcations and QoS GWIA Access Control 42

43 Demarcations and QoS GWIA Configuration Technical Notes: /forceinboundauth and --forceinboundauth switches Requires clients to authenticate before using SMTP services GWIA relay configuration is null for clients that authenticate Minimally SSL connections should be enforced to reduce risks 43

44 Demarcations and QoS GWIA Access Control SMTP Relay ACL s SMTP Relay truth table 44

45 Services for POP/IMAP clients What should happen inside your load balancer 45

46 Services for POP/IMAP clients SuSE Linux server configuration The /etc/suseconfig/susefirewall2 configuration file: FW_SERVICES_EXT_TCP=" FW_SERVICES_EXT_UDP=" FW_TRUSTED_NETS=" /32,tcp, /32,tcp, /32,tcp, /32,tcp, /32,tcp, /32,tcp, /32,tcp, /32,tcp, /32,tcp, ,tcp,8400" 46

47 Services for POP/IMAP clients 47

48 Bringing it all together 48

49 Additional Information Technical and configuration details: GroupWise Best Practices wiki Architecture and concept details: 49

50 Managing an Enterprise Series Thank you for your time and attendance!