Hardware Sizing and Bandwidth Usage Guide. McAfee epolicy Orchestrator Software

Transcription

1 Hardware Sizing and Bandwidth Usage Guide McAfee epolicy Orchestrator Software

2 COPYRIGHT Copyright 2011 McAfee, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies. TRADEMARK ATTRIBUTIONS AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN, WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide

3 Contents Preface 5 About this guide Audience Conventions Finding product documentation Introduction 7 Purpose of this guide Calculating Hardware Requirements 9 Types of servers used for testing Considerations for outbreak response Recommendations for events per client per ASCI Managed systems per server Agent Handler scalability Bandwidth Usage 13 Bandwidth requirements for initial deployment Agent deployment and bandwidth Bandwidth requirements to deploy managed products Methods to minimize impact when deploying products Bandwidth recommendations for repository distribution Concurrent Users 19 Concurrent users and the effect on dashboard page loading Database Sizing 21 A Appendix: Dashboard page load times 23 Index 25 McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide 3

4 Contents 4 McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide

5 Preface This guide provides the information you need to configure, use, and maintain your McAfee product. Contents About this guide Finding product documentation About this guide This information describes the guide's target audience, the typographical conventions and icons used in this guide, and how the guide is organized. Audience McAfee documentation is carefully researched and written for the target audience. The information in this guide is intended primarily for: Administrators People who implement and enforce the company's security program. Conventions This guide uses the following typographical conventions and icons. Book title or Emphasis Title of a book, chapter, or topic; introduction of a new term; emphasis. Bold User input or Path Code Text that is strongly emphasized. Commands and other text that the user types; the path of a folder or program. A code sample. User interface Hypertext blue Words in the user interface including options, menus, buttons, and dialog boxes. A live link to a topic or to a website. Note: Additional information, like an alternate method of accessing an option. Tip: Suggestions and recommendations. Important/Caution: Valuable advice to protect your computer system, software installation, network, business, or data. Warning: Critical advice to prevent bodily harm when using a hardware product. McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide 5

6 Preface Finding product documentation Finding product documentation McAfee provides the information you need during each phase of product implementation, from installation to daily use and troubleshooting. After a product is released, information about the product is entered into the McAfee online KnowledgeBase. Task 1 Go to the McAfee Technical Support ServicePortal at 2 Under Self Service, access the type of information you need: To access... User documentation Do this... 1 Click Product Documentation. 2 Select a product, then select a version. 3 Select a product document. KnowledgeBase Click Search the KnowledgeBase for answers to your product questions. Click Browse the KnowledgeBase for articles listed by product and version. 6 McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide

7 1 Introduction 1 This document helps you determine the level of server hardware, system core, memory, storage, and network bandwidth that McAfee recommends for the server-based components of your epolicy Orchestrator software deployment. This information can help you make hardware purchasing and provisioning decisions. Purpose of this guide McAfee has performed tests on different server-class systems to help you decide the hardware requirements for epolicy Orchestrator deployment. What is the goal? Assess and recommend the hardware required to support and manage environments of varying sizes. What is being measured and determined? Number of agent communication transactions processed over a period of time. Peak transaction rates for each server configuration. Recommendations for the number of client systems a server can manage. Which products were tested? The following McAfee products were tested: Agent Application Control Change Control Change Reconciliation Gateway Endpoint Encryption for Files and Folders Endpoint Encryption for PC GroupShield for Microsoft Exchange Host Data Loss Prevention Host Intrusion Prevention Host Intrusion Prevention Content 3816 McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide 7

8 1 Introduction Purpose of this guide Integrity Control MOVE-AV for VDI (MOVE) Network Access Control Network Security Platform Policy Auditor Rogue System Detection Security for Microsoft SharePoint SiteAdvisor Enterprise Plus VirusScan Enterprise 8.8 VirusScan Enterprise DAT 6334 VirusScan Enterprise Engine 5400 Vulnerability Manager Web Gateway What effect does the product have on events and performance? An event from VirusScan Enterprise is essentially the same size as an event from McAfee Host Intrusion Prevention. Performance is determined by how many events a product generates. 8 McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide

9 2 Calculating 2 Hardware Requirements McAfee provides hardware recommendations for the server-based components of your epolicy Orchestrator deployment. Use these recommendations when allocating server hardware to host the epo server. Contents Types of servers used for testing Managed systems per server Types of servers used for testing McAfee conducted tests on a four-core epolicy Orchestrator server with an eight-core database. The following are specifications for the epolicy Orchestrator server, the database server, and the network. epolicy Orchestrator server specifications Four-core server system, Intel Xeon X GHz 1 GB of RAM per core Windows 2008 Server R2, 64-bit RAID 5 array with internal SAS drives Database server specifications Eight-core server system, Intel Xeon E GHz 1 GB of RAM per core Windows 2008 Server R2, 64-bit SQL Server 2008, Service Pack 2, 64-bit RAID 5 array with internal SAS drives McAfee recommends that in larger environments (>50,000 nodes), you store the Data and Logs databases on separate spindles in a RAID 1+0 configuration. Agent Handler specifications Four-core server system, Intel Xeon X GHz 1 GB of RAM per core Windows 2008 Server R2, 64-bit RAID 5 array with internal SAS drives McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide 9

10 2 Calculating Hardware Requirements Managed systems per server Network specification 1000Base-T Ethernet Considerations for outbreak response When applying this data to your own environment, you must consider your outbreak response requirements, including the response time and the number of systems. Response time The time period during which all systems must check in to the epo server. The three factors that define the response time in epolicy Orchestrator are: Agent-to-server communication interval You can configure the response time when setting the agent-to-server communication interval (ASCI). Agent wake-up call The agent wake-up call is initiated manually, but you can determine the response time by setting this period as the Agent randomization interval. Global updating Once configured, global updating initiates updating automatically when packages are checked in. You can configure the response time by setting the randomization interval. Although this information includes data for one to eight-hour response times, McAfee recommends a response time of no greater than six hours. Number of systems The number of managed systems that are required to check in within the response time. Recommendations for events per client per ASCI McAfee recommends < 25 events per client per ASCI. Use this formula to calculate the number of client events per ASCI in your environment. Total number of events / number of client systems / ASCI per day (24/ASCI) With your environment set up according to this recommendation, you can use the chart and table under Managed systems per server to calculate the number of client systems your server can manage with a given response time. Managed systems per server The data in the following chart and tables shows the response times for managed systems. These recommendations are conservative, based on test results that were significantly higher, in order to accommodate instances of increased load. The calculations here are for an environment with <99 events per client per ASCI. For the best performance, McAfee recommends an environment with <25 events per client per ASCI. 10 McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide

11 Calculating Hardware Requirements Managed systems per server 2 Although the data is provided for one- to eight-hour response times, McAfee recommends a response time no greater than six hours. Figure 2-1 Managed systems' response time Table 2-1 Client systems managed by epolicy Orchestrator Required response time (hours) Four-core epolicy Orchestrator server Eight-core SQL server 1 66, , , , , , , ,800 Table 2-2 CPU usage of epolicy Orchestrator and database server Required response time (hours) Four-core epolicy Orchestrator server Eight-core SQL server 1 ~100% 2 ~20% McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide 11

12 2 Calculating Hardware Requirements Managed systems per server Agent Handler scalability Adding distributed Agent Handlers to your managed environment can help you scale your network. However, as the following figure shows, adding numerous Agent Handlers might result in diminishing returns. This is the result of the fact that Agent Handlers must be in constant contact with the epolicy Orchestrator database, and this connection can consume a significant amount of bandwidth. Figure 2-2 Number of managed systems by number of Agent Handlers Table 2-3 Client systems managed by epolicy Orchestrator with 1 hour ASCI Number of distributed Agent Handlers Four-core Agent Handler Eight-core SQL server 1 64, , , , ,200 Due to the bottleneck on the database server, McAfee recommends distributing up to three Agent Handlers to epolicy Orchestrator for a network site if the database server has eight cores or fewer. If the ASCI value is more than one hour, multiply the number of client systems by your ASCI value. 12 McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide

13 3 Bandwidth 3 Usage This section identifies and describes the network traffic generated by epolicy Orchestrator and its components in a managed environment. It also covers product tuning information to help you balance bandwidth resources with the needs of the product. Use this information when customizing your deployment strategies and policy settings, to maximize network efficiency and ensure that you do not exceed the bandwidth limitations of your environment. Contents Bandwidth requirements for initial deployment Bandwidth requirements to deploy managed products Bandwidth recommendations for repository distribution Bandwidth requirements for initial deployment When implementing epolicy Orchestrator in your environment, you must distribute agents, components, and security products to manage and protect the systems on the network. Agent deployment and bandwidth During the initial setup of the managed environment, deploying the agent generates enough network traffic that we recommend planning the deployment. Although the installation package for the agent is smaller than those of other products (such as VirusScan Enterprise), the agent must be deployed to each client system you want to manage. This table shows the total bandwidth used on an epo server, client system, and database server for agent deployment. Table 3-1 Agent deployment Agent deployment Total Tx Rx epolicy Orchestrator server Client system Database server Actual deployment The first and most extensive use of bandwidth occurs when the agent installation package is deployed to client systems. You can deploy the agent installation package from the epolicy Orchestrator console to sites, groups, or systems in the System Tree. Regardless of the method you use, deploying the agent installation package over the network generates traffic to each system. Base the agent deployment on the number of client systems you plan to manage, their location in the network topology, and the amount of bandwidth you have available between the epo server and these systems. McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide 13

14 3 Bandwidth Usage Bandwidth requirements to deploy managed products McAfee recommends deploying agents: In stages Do not push network utilization over 80% at any time for a given segment of resources. To individual sites or groups This is especially important if you have more bandwidth-limiting factors such as slower connections between geographic locations. Location of network impact Agent-deployment traffic occurs directly between the epolicy Orchestrator server and the systems to which the agent is deployed. Bandwidth requirements to deploy managed products Deploying security products such as VirusScan Enterprise to client systems can be the most bandwidth-intensive part of setting up a managed environment. Like the agent, security software must be installed on each system you plan to manage. This table shows the total bandwidth (in megabytes) used to deploy specific managed products, as well as the data transmitted and received by the epolicy Orchestrator server, a client system, and the database server. Table 3-2 McAfee product deployment Product Deployment epo server SQL server Client system Total Tx Rx Total Tx Rx Total Tx Rx Disk space Agent Endpoint Encryption for Files and Folders Endpoint Encryption for PC GroupShield Enterprise Host Data Loss Prevention Host Intrusion Prevention McAfee Network Access Control MOVE-AV Security for Microsoft SharePoint McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide

15 Bandwidth Usage Bandwidth recommendations for repository distribution 3 Table 3-2 McAfee product deployment (continued) Product Deployment epo server SQL server Client system Total Tx Rx Total Tx Rx Total Tx Rx Disk space Policy Auditor Rogue System Detection Site Advisor Enterprise Solidcore VirusScan Enterprise Methods to minimize impact when deploying products Consider these suggestions to minimize traffic generated by deploying products. Deploy the product to segments of the System Tree, rather than all systems at once. For example, schedule the deployment task to run for one group at a time. Use randomization intervals to distribute the deployment to a group over a period of time. Schedule the deployment task to run at local time, which is the default setting. This is helpful if your enterprise has offices in different time zones. Create and configure distributed repositories to localize network traffic during product deployment. Before running the deployment task, replicate the deployment package from the master repository to the distributed repositories. The deployment task generates traffic between the agent and the nearest repository only. However, after an installation, the agent sends properties to the server. Updating from the closest distributed repository localizes the traffic for product deployment. Bandwidth recommendations for repository distribution If the epo server is managing systems across the Wide Area Network (WAN), McAfee recommends that you create distributed repositories on each Local Area Network (LAN) for client updates. McAfee recommends that you create at least one distributed repository per LAN. Number of distributed repositories Systems in LAN Network Bandwidth (LAN) 100 Mbps 1 Gbps 1, , , , , , McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide 15

16 3 Bandwidth Usage Bandwidth recommendations for repository distribution Systems in LAN Network Bandwidth (LAN) 100 Mbps 1 Gbps 20, , Recommendations for the server If WAN bandwidth is 6 Mbps, approximately two distributed repositories are updated per minute. McAfee recommends following these steps to avoid network bandwidth saturation. 1 Create an incremental replication task for each distributed repository in each LAN. 2 According to bandwidth (WAN) in Mbps, set each task to run sequentially at the minimum of the minutes of the corresponding randomization interval, to avoid overlap. Bandwidth (WAN) 6 Mbps 1 5 Mbps 2 4 Mbps 3 3 Mbps 4 2 Mbps 5 1 Mbps 6 Randomization interval (minutes) Recommendations for each client 1 Add the local distributed repository to the repository list in the agent policy. 2 Select the repository by Ping Time. 3 Create an agent update task with a randomization interval according to this table. Table 3-3 Recommended interval (minutes) for 1 Gbps network bandwidth Systems in LAN Distributed repositories in LAN , , , , , , , , Table 3-4 Recommended interval (minutes) for 100 Mbps network bandwidth Systems in LAN Distributed repositories in LAN , , McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide

17 Bandwidth Usage Bandwidth recommendations for repository distribution 3 Table 3-4 Recommended interval (minutes) for 100 Mbps network bandwidth (continued) Systems in LAN Distributed repositories in LAN , , , McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide 17

18 3 Bandwidth Usage Bandwidth recommendations for repository distribution 18 McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide

19 4 4 Concurrent Users The epolicy Orchestrator server is able to handle multiple user (http) requests. McAfee has calculated the results of the average page load time versus the number of concurrent user requests with data of 100,000 managed nodes plus 13,000,000 events and 100,000 RSD Detected System Properties. Concurrent users and the effect on dashboard page loading Page load time is the time it takes the epolicy Orchestrator server to respond to a user request to fully load a dashboard page in the web browser. Test scenario A number of users concurrently launched a specific dashboard. When the dashboard was fully loaded, each user refreshed the dashboard immediately and repeated this 20 times. The following chart shows the average dashboard page load time across all dashboards for all tested products (those listed in the "Which products were tested" section in the Purpose of this guide. A detailed listing of load times by user for each product is included in Appendix A: Complete dashboard page load time by number of users. Average dashboard load time by number of users McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide 19

20 4 Concurrent Users Concurrent users and the effect on dashboard page loading 20 McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide

21 5 Database Sizing When planning for hardware purchase, an important factor to consider is the amount of storage space you will need. Beyond the initial installation of epolicy Orchestrator to a server, the portion of your environment that experiences the most growth is the database. Consider the data in these tables to plan appropriately for your database storage needs. Table 5-1 epolicy Orchestrator installation size Requirement Size Database Database transaction log Total Table 5-2 Database size requirements Requirement Size (KB) For a client system For an event 1.74 Calculating database size requirements To calculate the size of the database, use this formula: Installed database size + (number of clients x client system size) + (number of events generated x event size). For example, in an environment with 1,000 clients and 10,000 events, the calculation is MB + (1,000 x 30.72KB) + (10,000 x 1.74KB) = MB. The following table lists the size of the database, based on the number of events generated and the number of client systems being managed. Use this data to plan appropriately for your storage needs. Table 5-3 Database size by number of events and client systems Events System nodes 500 1,000 5,000 10,000 50, , ,00 200, , , ,077 1,092 1,212 1,362 2,562 4,062 5,562 7,062 8,562 10,062 10,000 1,094 1,109 1,229 1,379 2,579 4,079 5,579 7,079 8,579 10,079 20,000 1,111 1,126 1,246 1,396 2,596 4,096 5,596 7,096 8,596 10,096 30,000 1,128 1,143 1,263 1,413 2,613 4,113 5,613 7,113 8,613 10,113 40,000 1,145 1,160 1,280 1,430 2,630 4,130 5,630 7,130 8,630 10,130 50,000 1,162 1,177 1,297 1,447 2,647 4,147 5,647 7,147 8,647 10,147 60,000 1,179 1,194 1,314 1,464 2,664 4,164 5,664 7,164 8,664 10,164 McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide 21

22 5 Database Sizing Table 5-3 Database size by number of events and client systems (continued) Events System nodes 500 1,000 5,000 10,000 50, , ,00 200, , ,000 70,000 1,196 1,211 1,331 1,481 2,681 4,181 5,681 7,181 8,681 10,181 80,000 1,213 1,228 1,348 1,498 2,698 4,198 5,698 7,198 8,698 10,198 90,000 1,230 1,245 1,365 1,515 2,715 4,215 5,715 7,215 8,715 10, ,000 1,247 1,262 1,382 1,532 2,732 4,232 5,732 7,232 8,732 10, ,000 1,264 1,279 1,399 1,549 2,749 4,249 5,749 7,249 8,749 10, ,000 1,281 1,296 1,416 1,566 2,766 4,266 5,766 7,266 8,766 10, ,000 1,298 1,313 1,433 1,583 2,783 4,283 5,783 7,283 8,783 10, ,000 1,315 1,330 1,450 1,600 2,800 4,300 5,800 7,300 8,800 10, ,000 1,332 1,347 1,467 1,617 2,817 4,317 5,817 7,317 8,817 10, ,000 1,349 1,364 1,484 1,634 2,834 4,334 5,834 7,334 8,834 10, ,000 1,366 1,381 1,501 1,651 2,851 4,351 5,851 7,351 8,851 10, ,000 1,383 1,398 1,518 1,668 2,868 4,368 5,868 7,368 8,868 10, ,000 1,400 1,415 1,535 1,685 2,885 4,385 5,885 7,385 8,885 10, ,000 1,417 1,432 1,552 1,702 2,902 4,402 5,902 7,402 8,902 10, McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide

23 A Appendix: Dashboard page load times The following table provides a detailed list of dashboard page load times by product and number of users. Page load time is the time it takes the epolicy Orchestrator server to respond to a user request to fully load a dashboard page in the web browser. For more information on the test scenario in which this data was generated, see Concurrent users and the effect on dashboard page loading. Table A-1 Dashboard page load times by number of users Dashboard Load time (seconds) by number of users Audit DLP: Status Summary EWS Dashboard Endpoint Encryption Executive Dashboard GroupShield for Exchange 7.0 Host IPS: Dashboard Host IPS: Triggered Signature MEG Activity Dashboard MEG Server Status MRA Rollup: Risk Advisory MRA: Threat Action Advisory MRA: Threat Dashboard MVM Summary MVM Web Assessment Summary MWG 6.x Dashboard MWG 7 Dashboard McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide 23

24 A Appendix: Dashboard page load times Table A-1 Dashboard page load times by number of users (continued) Dashboard Load time (seconds) by number of users NAC Summary NSP Network Security Platform Summary PA: Compliance Summary PA: MS Patch Status Summary PA: PCI Summary PortalShield for SharePoint Product Deployment RSD Summary SAE+: Activity SAE+: Authorize/ Prohibit Lists SAE+: Content Summary SAE+: Security Summary SAE+: Single Rating Factor Block/ Warn SAE+: Warned/ Blocked Solidcore: Application Control Solidcore: Change Control Solidcore: Integrity Monitor Threat Events Trends VSE: Current Detections VSE: Trending Data epo Summary Average Page Load Time (seconds) McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide

25 Index A about this guide 5 C conventions and icons used in this guide 5 D documentation audience for this guide 5 product-specific, finding 6 documentation (continued) typographical conventions and icons 5 M McAfee ServicePortal, accessing 6 S ServicePortal, finding product documentation 6 T Technical Support, finding product information 6 McAfee epolicy Orchestrator Software Hardware Sizing and Bandwidth Usage Guide 25

26 00