Deploying Network Load Balancing

Transcription

1 C H A P T E R 9 Deploying Network Load Balancing After completing the design for the applications and services in yor Network Load Balancing clster, yo are ready to deploy the clster rnning the Microsoft Windows Server 2003 operating system in yor pilot and prodction network environments. A sccessfl deployment ensres that yor Network Load Balancing clster meets or exceeds the specifications in the design. In addition, yo mst ensre that the deployment of yor Network Load Balancing clster does not disrpt the operation of any existing applications or services. In This Chapter Overview of the NLB Deployment Process Selecting the Atomated Deployment Method Implementing a New Clster Upgrading Existing Clsters Migrating Existing Clsters Additional Resorces Related Information For more information abot the Network Load Balancing design process, see Designing Network Load Balancing in Planning Server Deployments of this kit. For more information abot designing server clsters, see Designing and Deploying Server Clsters in Planning Server Deployments.

2 566 Chapter 9 Deploying Network Load Balancing Overview of the NLB Deployment Process A Network Load Balancing clster comprises mltiple servers rnning any version of the Windows Server 2003 family of operating systems, inclding Microsoft Windows Server 2003, Standard Edition; Windows Server 2003, Enterprise Edition; Windows Server 2003, Datacenter Edition; and Windows Server 2003, Web Edition. Clstering allows yo to combine application servers to provide a level of scaling and availability that is not possible with an individal server. Network Load Balancing distribtes incoming client reqests among the servers in the clster to more evenly balance the workload of each server and prevent overload on any one server. To client compters, the Network Load Balancing clster appears as a single server that is highly scalable and falt tolerant. The Network Load Balancing deployment process assmes that yor design team has completed the design of the Network Load Balancing soltion for yor organization and has performed limited testing in a lab. After the design team tests the design in the lab, yor deployment team implements the Network Load Balancing soltion first in a pilot environment and then in yor prodction environment. Upon completing the deployment process presented here, yor Network Load Balancing soltion (the Network Load Balancing clster and the applications and services rnning on the clster) will be in place. For more information abot the procedres for deploying Network Load Balancing on individal servers, see New ways to do familiar tasks in Help and Spport Center for Windows Server 2003, and then click Network Load Balancing Manager. Note As yo implement yor Network Load Balancing design, se the information for each clster host recorded by yor design team in the NLB Clster Host Worksheet (Sdcnlb_1.doc) on the Windows Server 2003 Deployment Kit companion CD (or see NLB Clster Host Worksheet on the Web at NLB Deployment Process Deploy yor Network Load Balancing soltion by implementing the decisions made by the design team. The process for deploying Network Load Balancing clsters is shown in Figre 9.1.

3 Overview of the NLB Deployment Process 567 Figre 9.1 Deploying Network Load Balancing Select the atomated deployment method Yes Implement new clster? No Implement new clster Yes Yes Upgrade existing clster? No Upgrade existing clster Migrate existing clster No Deploy more NLB clsters? NLB deployment complete Dring the Network Load Balancing design process, the design team created and docmented the design of the network configration by sing drawing and diagramming software (sch as Microsoft Visio ), and the NLB Clster Host Worksheet job aid that yor design team completed for each clster host. (This worksheet is associated with Designing Network Load Balancing in Planning Server Deployments of this kit.) The Network Load Balancing design docments describe the nmber of Network Load Balancing clsters, the placement of the Network Load Balancing clsters in yor network environment, the nmber of Network Load Balancing clster hosts, and other specifications. Before deploying Network Load Balancing in yor prodction environment, test yor deployment soltion in a lab and in a pilot deployment. For more information abot testing yor design, see Planning for Deployment in Planning, Testing, and Piloting Deployment Projects of this kit.

4 568 Chapter 9 Deploying Network Load Balancing After yo test yor design, yo can se different options for deploying each Network Load Balancing clster, based on the reqirements of yor organization. Table 9.1 lists deployment reqirements and the corresponding options for deploying Network Load Balancing clsters. For each clster in the Network Load Balancing design, select one of these options for deploying Network Load Balancing clsters. Table 9.1 Deployment Reqirements and Corresponding Options for Deploying NLB Clsters Deployment Reqirements Implement Upgrade Migrate Fresh installation of Windows Server 2003 is reqired Clsters are to be deployed on new clster hardware Two or more existing clsters to be consolidated into a single clster A corresponding clster crrently exists in the network environment Existing hardware is capable of rnning Windows Server 2003 Existing Windows registry settings to be retained When yor Network Load Balancing soltion incldes mltiple Network Load Balancing clsters, yo might need to se more than one method for deploying Network Load Balancing clsters. For each Network Load Balancing clster in yor soltion, read the corresponding section in this chapter for the deployment method yo select: Implementing New Clsters Upgrading Existing Clsters Migrating Existing Clsters Selecting the Atomated Deployment Method Begin the deployment of yor Network Load Balancing soltion by determining how to atomate yor Network Load Balancing deployment. Atomate the deployment of yor Network Load Balancing soltion to ensre the consistency of installation, to redce the time reqired to deploy yor soltion, and to assist in restoring failed Network Load Balancing clster hosts. Manally deploy yor Network Load Balancing soltion only if creating and testing the atomation files and scripts wold take more time than manally configring the clster. Figre 9.2 shows the process for determining the best method to atomate the deployment of yor Network Load Balancing soltion.

5 Selecting the Atomated Deployment Method 569 Figre 9.2 Selecting the Atomated Deployment Method Select the atomated deployment method Yes Implement new clster? No Implement new clster Yes Yes Upgrade existing clster? No Upgrade existing clster Migrate existing clster No Deploy more NLB clsters? NLB deployment complete Yo can atomate the deployment of Windows Server 2003 and Network Load Balancing clster hosts by sing one of the following methods: Unattended installation Sysprep Remote Installation Services (RIS) Table 9.2 compares the characteristics of the varios atomated deployment methods.

6 570 Chapter 9 Deploying Network Load Balancing Table 9.2 Comparing Atomated Deployment Methods Deployment Characteristics Unattended Installation Sysprep RIS Uses images to deploy installation Uses scripts to cstomize installation Spports post installation scripts to install applications Deployed by sing local drives on the target server Initiated by headless servers Deployed from a network share Depending on the reqirements of each clster, more than one method might be reqired to deploy all yor Network Load Balancing clsters. For more information abot these methods, see Designing Unattended Installations, Designing Image-based Installations with Sysprep, and Designing RIS Installations in Atomating and Cstomizing Installations of this kit. The nattended installation and Sysprep methods reqire that yo create script files to atomate the deployment. The Network Load Balancing specific installation and configration information is reqired in two sections of the nattended and Sysprep script files: the [MS_WLBS parameters] and [MS_TCPIP parameters] sections. For more information abot the process for configring the script files, see the Microsoft Windows Server 2003 Corporate Deployment Tools User s Gide (Deploy.chm). Deploy.chm is inclded in the Deploy.cab file in the Spport folder on the Windows Server 2003 operating system CD. For more information abot the parameters sed by the script files, see the Windows Preinstallation Environment link on the Web Resorces page at There are no special considerations for atomating Network Load Balancing deployment by sing the RIS method. For Network Load Balancing, yo need to perform specific tasks when creating the nattended installation and Sysprep script files: Review the content in the Microsoft Windows Preinstallation Reference that relates to the [MS_WLBS parameters] section. WLBS stands for Windows NT Load Balancing Service, the name of the load balancing service sed in Microsoft Windows NT Server version 4.0. For reasons of backward compatibility, WLBS contines to be sed in certain instances. Ensre that the IP addresses for the clster and all virtal clsters are entered in the IPAddress parameter nder the [MS_TCPIP parameters] section. Typically, Network Load Balancing Manager atomatically adds the clster and virtal clster IP addresses to the list of IP addresses. Both nattended installation and Sysprep reqire that yo add the addresses to the IPAddress parameter nder the [MS_TCPIP parameters] section of the script.

7 Implementing a New Clster 571 Implementing a New Clster Many of the mission-critical applications deployed within yor organization will be new applications, which reqire yo to deploy new Network Load Balancing clsters. The process for implementing a new clster involves more than installing Windows Server 2003 and Network Load Balancing on the individal application servers. Implementing a new clster might reqire additional network infrastrctre, network services, file services, database services, and secrity services. Figre 9.3 shows the steps that yo mst complete before and after the implementation of the new clster. Figre 9.3 Implementing a New Clster Yes No No Select the atomated deployment method Yes Implement new clster? Yes Upgrade existing clster? Implement new clster Upgrade existing clster Prepare to implement the clster Implement the clster Verify the clster and enable client access Migrate existing clster No Deploy more NLB clsters? NLB deployment complete

8 572 Chapter 9 Deploying Network Load Balancing Preparing to Implement the Clster Yor new clster is dependent pon the network infrastrctre and other network services in yor total soltion. Ensre that these network infrastrctre and other network services are deployed prior to implementing yor clster. Prepare for the implementation of the new clster by sing the information docmented in the NLB Clster Host Worksheet and other docmentation (sch as Visio drawings of the network environment) that yor design team completed for a specific clster host dring the design process. Coordinate with the operations team dring this step in the process to review the changes that will occr in yor organization s network environment. To prepare for the implementation of the new clster, complete the following tasks: 1. Implement the network infrastrctre reqired by the clster and by the applications and services rnning on the clster. 2. Implement any networking services reqired by the applications and services rnning on the clster. 3. Select the method for atomating any additional Network Load Balancing configration. Implementing the Network Infrastrctre Before yo implement the clster, yo mst implement the network infrastrctre that connects the clster to client compters, to other servers within yor organization, and to management consoles. The network infrastrctre components inclde: Network cables Hbs Switches Roters Firewalls Note Any references to switches in this chapter refer to Layer 2 switches.

9 Implementing a New Clster 573 When implementing the network infrastrctre, make sre to have specifications abot yor crrent network environment available. Specifically, yor hardware and software inventory and a map of network topology can be helpfl. For more information abot creating those docments, see Planning for Deployment in Planning, Testing, and Piloting Deployment Projects of this kit. Implementing Any Reqired Networking Services Network Load Balancing is independent of the other Windows Server 2003 network services. As a reslt, yo do not need to implement networking services for Network Load Balancing. However, the applications and services rnning on the clster can be dependent on other Windows Server 2003 networking services. For more information abot reqirements for implementing networking services sed by the services and applications rnning on the clster, see Additional Resorces later in this chapter. Atomating Additional Configrations In many instances, it is possible that Windows Server 2003, Network Load Balancing, or the applications and services rnning on a particlar clster might reqire additional configration after the installation is complete. Yo can se any combination of the following methods for atomating these additional configrations: Microsoft Visal Basic Scripting Edition (VBScript) Windows Management Instrmentation (WMI) Active Directory Service Interfaces (ADSI) Example: Preparing to Implement the Clster An organization is deploying a new Web application that will be accessed by a large volme of Internet sers. Becase of scaling and availability considerations, the organization will deploy the new, high-volme Web application on a Network Load Balancing clster. Figre 9.4 illstrates the organization s network environment prior to the implementation of the new clster.

10 574 Chapter 9 Deploying Network Load Balancing Figre 9.4 Network Environment Before Implementing New Clster Internet Roter-01 Roter-02 To the organization s perimeter network (crrently empty) Segment that connects management adapters to organization s resorces and operations consoles DC-01 DC-02 SQLCLSTR-01 Firewall-01 To the organization s private network In addition to deciding that the new Web farm will rn on a Network Load Balancing clster, the design team also made the following configration decisions: No single roter, switch, or Internet Information Services (IIS) Web farm server failre will prevent sers from rnning the Web application. Web application will store data in a clstered SQL server rnning Microsoft SQL Server 2000 on a server clster. Web application exectables Active Server Pages (ASP), Hypertext Markp Langage (HTML) pages, and other exectable code will be stored on a file server rnning on a server clster. Acconts sed for athenticating Internet sers will be stored in Active Directory directory service.

11 Implementing a New Clster 575 As the first step in the organization s deployment of the Web application, the IIS 6.0 Web farm, and Network Load Balancing, the organization mst restrctre the network infrastrctre to spport the new Web farm and clster. Figre 9.5 illstrates the organization s network environment after preparing for the implementation. Figre 9.5 Network Environment After Preparing to Implement a New Clster Internet Roter-01 Roter-02 Firewall-02 Firewall-03 Switch-01 belongs to VLAN-01 Switch-02 belongs to VLAN-01 To the organization s perimeter network (crrently empty) DC-01 DC-02 SQLCLSTR-01 FILECLSTR-01 Segment that connects management adapters to organization s resorces and operations consoles Firewall-01 To the organization s private network Table 9.3 lists the deployment steps that were performed prior to the implementation of the new clster and the reasons for performing those steps.

12 576 Chapter 9 Deploying Network Load Balancing Table 9.3 Deployment Steps Prior to Implementation of the New Clster Deployment Step Add Firewall-02 and Firewall-03 Add Switch-01 and Switch-02 Add network segments on Switch-01 and Switch-02 Configre Switch-01 and Switch-02 to belong to the same VLAN Add SQLCLUSTR-01 Add FILECLUSTR-01 Add DC-01 and DC-01 Reason Provide redndancy and load balancing. Provide redndancy and load balancing. Connect the IIS 6.0 Web farm to the network. Provide load balancing of client reqests by sing Network Load Balancing. Provide database spport for the Web application on a Microsoft server clster. Provide secred storage for the Web application exectables and content on a Microsoft server clster. Provide storage and management of ser acconts sed in athenticating Internet sers. Implementing the Clster To implement the new clster, complete the following tasks: 1. Install and configre the hardware and Windows Server 2003 for each clster host. 2. Install and configre the first Network Load Balancing clster host. 3. Install and configre additional Network Load Balancing clster hosts. Note When yor Network Load Balancing soltion incldes mltiple Network Load Balancing clsters with rond robin DNS, complete these tasks for each Network Load Balancing clster in the soltion. For more information abot combining mltiple Network Load Balancing clsters with rond robin DNS, see Scaling NLB Soltions in Designing Network Load Balancing in this book.

13 Implementing a New Clster 577 Installing and Configring the Hardware and Windows Server 2003 The first step in performing the implementation of the new clster is to install and configre the hardware and Windows Server 2003 for each clster host. Install and configre all clster host hardware at the same time to ensre that yo eliminate any configration errors prior to installing and configring the Network Load Balancing clster. To install and configre Windows Server 2003 on the clster host hardware, yo mst be logged on as a ser accont that is a member of the local administrators grop on all clster hosts. Install and configre the clster host by sing the information docmented in the NLB Clster Host Worksheet that yor design team completed for that host dring the design process. To install and configre the hardware and Windows Server 2003 on each clster host in the new clster, complete the following tasks: 1. Install the clster host hardware in accordance with the manfactrer s recommendations. 2. Connect the clster host hardware to the network infrastrctre. 3. Install Windows Server 2003 with the defalt options and specifications from the worksheet for the clster host. 4. Install any additional services (sch as IIS 6.0 or Roting and Remote Access) by sing the design specifications for the service. For detailed instrctions on installing additional services, see the resorces related to the corresponding service in Additional Resorces later in this chapter. 5. Configre the TCP/IP property settings and verify connectivity for the clster adapters. Cation Configre the dedicated IP address at this time. The clster IP address and any virtal IP addresses for port rles are added later in the deployment process throgh Network Load Balancing Manager. 6. If a separate management network is sed, configre the TCP/IP property settings and verify connectivity for the management adapter. Althogh not reqired, it is recommended that yo se a separate management network adapter to provide a commnication path that is isolated both from the clster adapter and from the clients. For more information on the benefits of inclding a management network adapter in yor design, see Selecting the Nmber of Network Adapters in Each Clster Host in Designing Network Load Balancing in this book. 7. Configre each server to be a member server in a domain created specifically for managing the clster and other related servers. Althogh not reqired, creating a domain for management of the clster provides a centralized method of controlling secrity to the clster. Management of clsters installed in a workgrop is more difficlt and time-consming. When the clster resides in a perimeter network, create a separate forest for the exclsive prpose of managing servers (inclding clster hosts) in the perimeter network.

14 578 Chapter 9 Deploying Network Load Balancing Installing and Configring the First Clster Host After yo have installed and configred the hardware for the clster, yo are ready to install and configre the first clster host. The first clster host acts as a master copy when yo se an image-based deployment method (sch as RIS, Sysprep, or a third-party prodct) to deploy the remaining clster hosts. An image-based deployment is faster and ensres consistency when implementing the remaining clster hosts, by redcing or eliminating manal configration. In addition, the same imagebased deployment method can be resed after the deployment to restore failed clster hosts. Depending on the type of image-based deployment, different methods are sed to cstomize the clster host after the image has been restored. For example, Sysprep can allow yo to interactively cstomize the image or se a configration file sysprep.inf to cstomize the image. For more information on cstomizing the restored image, see Designing Unattended Installations, Designing Image-based Installations with Sysprep, and Designing RIS Installations in Atomating and Cstomizing Installations of this kit. Perform the following task on the first clster host by sing the NLB Clster Host Worksheet that yor design team completed for the first clster host: 1. If yo did not se the atomated installation process to create the new clster, start Network Load Balancing Manager and create a new clster. Tip Yo can start Network Load Balancing Manager by rnning Nlbmgr.exe. 2. Install the applications and services on the first clster host. Examples of Windows Server 2003 services to be installed at this time inclde IIS or Terminal Services. For more information abot installing Windows Server 2003 services, see the chapters that discss those services in the Microsoft Windows Server 2003 Deployment Kit. Examples of applications to be installed at this time inclde, Web applications or Windows applications that rn on Terminal Services. For more information abot installing the applications rnning on yor clster, see the docmentation that accompanies yor application. 3. Enable monitoring and health checking on the first clster host. A Microsoft Operations Manager (MOM) Management Pack exists for Network Load Balancing. When yor organization ses MOM to monitor and manage the servers within yor organization, inclde the MOM Management Pack for Network Load Balancing on the clster hosts. For location of additional information abot monitoring and health checking the applications and services rnning on the clster, review the resorces in Additional Resorces later in this chapter.

15 Implementing a New Clster Verify that the first Network Load Balancing clster host responds to client qeries by directing reqests to the clster IP address. Test the first clster host by specifying the clster IP address or a virtal clster IP address in the client software that is sed to access the application or service rnning on the clster. For example, a client accessing an IIS application wold pt the clster IP address or virtal clster IP address in the Web browser address line. Important Create an entry in DNS for the clster only after yo have completed the deployment of the entire clster. Prematrely pblishing the applications and services in DNS might reslt in overwhelming the clster hosts before all clster hosts are installed Installing and Configring Additional Clster Hosts After yo have installed and configred the first clster host, yo are ready to install and configre the remaining clster hosts in the clster. The first clster host acts as a master copy when yo se an image-based deployment method (sch as RIS, Sysprep, or a third-party prodct) to deploy the remaining clster hosts. Perform the following tasks on the remaining clster hosts by sing the NLB Clster Host Worksheet that yor design team completed for each clster host: 1. Create an image of the first clster host that has jst been deployed (discssed in the previos section) as reqired by one of the following image-based atomated installation methods: Sysprep For more information abot creating Sysprep images, see Designing Image-based Installations with Sysprep in Atomating and Cstomizing Installations of this kit. RIS For more information abot creating RIS images, see Designing RIS Installations in Atomating and Cstomizing Installations. Third-party prodcts For more information abot creating images with third-party prodcts, see the docmentation provided with the third-party image deployment software. 2. Restore the image of the first clster host (created in step 1) to one of the remaining clster host, following the directions provided in the docmentation for the image-base installation method yo sed. 3. Configre any compter specific information (sch as compter name and IP address) on the newly deployed clster host.

16 580 Chapter 9 Deploying Network Load Balancing 4. Enable monitoring and health checking for the additional clster host. Use the same methods as described for the first clster host. 5. Verify that the additional clster host responds to client reqests. Use the same methods as described for the first clster host. 6. Complete steps 2 throgh 5 for each remaining clster host in the Network Load Balancing clster. 7. Ensre that the clster is load balancing reqests across all clster hosts (based on the port rles of the clster). The time reqired to create and test the images sed in an image-based deployment can be prohibitive. It might take yo less time to install and configre the remaining clster hosts in the same way that yo installed and configred the first Network Load Balancing clster host. For example, yo cold deploy a clster that consists of three clster hosts. If yo decide to deploy the clster hosts sing a method other than image-based deployment, yo mst ensre that yo can restore a failed clster host. Example: Implementing the New Clster The organization mentioned in Example: Preparing to Implement the Clster earlier in this chapter is now ready to implement the new IIS 6.0 Web farm that ses Network Load Balancing for load balancing and falt tolerance. The network infrastrctre and additional networking services have been deployed in preparation for the implementation. In this step, the organization installed and configred the first clster host as a model for the remaining clster hosts. Then the organization deployed the remaining clster hosts by sing an image-based deployment method. Figre 9.6 illstrates the network environment after the implementation of the new IIS 6.0 Web farm and Network Load Balancing.

17 Implementing a New Clster 581 Figre 9.6 Network Environment After Installing the New Clster Internet Roter-01 Roter-02 Firewall-02 Firewall-03 Switch-01 belongs to VLAN-01 Switch-02 belongs to VLAN-01 IIS-01 IIS-02 IIS-03 IIS-04 IIS-05 IIS-06 IIS-07 IIS-08 NLBClster-01 DC-01 DC-02 SQLCLSTR-01 FILECLSTR-01 Segment that connects management adapters to organization s resorces and operations consoles Firewall-01 To the organization s private network Table 9.4 lists the deployment steps that were performed to implement the new clster and the reasons for performing those steps.

18 582 Chapter 9 Deploying Network Load Balancing Table 9.4 Deployment Steps for Implementing the New NLB Clster Deployment Step Add IIS-01, IIS-02, IIS-03, IIS-04, IIS-05, IIS-06, IIS-07, and IIS-08 server hardware. Install Windows Server 2003 and Network Load Balancing on IIS-01 by sing nattended installation. Create an image of IIS-01 to se as a model for RIS deployment. Deploy the image on IIS-02, IIS-03, IIS-04, IIS- 05, IIS-06, IIS-07, and IIS-08. Verify the Web farm responds to client reqests. Reason Server hardware needs to be connected to network infrastrctre in preparation for Network Load Balancing deployment. Unattended setp is chosen becase of the limited nmber of hosts to be deployed. RIS allows the servers to be reimaged in the event of a server failre. Image deployment ensres a consistent configration on all servers in the Network Load Balancing clster. Verification ensres that the Web farm is properly configred and that Network Load Balancing is load balancing. Verifying the Clster and Enabling Client Access The final step in implementing yor new Network Load Balancing clster is to ensre that yo have properly implemented and configred yor clster. In Installing and Configring the First Clster Host earlier in this chapter, yo verified yor implementation of individal servers. Now yo mst ensre that the entire clster is secre and is properly monitored and health checked. To verify the clster and enable client access, complete the following tasks: 1. Verify the clster host restoration process. 2. Verify that identified secrity threats are mitigated. 3. Perform monitoring and health checking on the complete clster. 4. Verify proper operation of applications and services rnning on the clster. 5. Enable client access to the clster.

19 Implementing a New Clster 583 Verifying the Clster Host Restoration Process Before placing the clster into a pilot or prodction environment, yo need to verify clster host restoration to ensre that yo can properly restore a clster host that has failed. To verify the clster host restoration process, complete the following tasks: 1. Remove a clster host from the clster by performing a drainstop on the clster host. A drainstop prevents a clster host from handling new client reqests. While draining, a clster host contines to complete any otstanding reqests and remains in the clster ntil all active reqests are completed. Then the clster host stops all clster operation. 2. Remove all disk volmes and disk partitions on the clster host. 3. Restore the clster host based on the installation method selected earlier in the deployment process. 4. Restart the clster host. 5. Verify that the System event log of each clster host contains no errors and that the restored clster host responds properly to client reqests. Verifying That Identified Secrity Threats are Mitigated Yo need to verify that all the identified secrity threats are properly handled in yor new Network Load Balancing soltion. To verify that the identified secrity threats are mitigated, complete the following tasks: 1. Connect a client compter to the network sch that the clients access the clster by sing the same rote path that a typical client compter wold se to connect to the clster. For example, when clients connect to the clster throgh a series of firewalls and roters to connect to the clster over the Internet, ensre the client compter sed for testing connects to the clster throgh the same firewalls and roters. 2. Log on to the client compter with the ser rights identified in yor secrity threats. 3. For each identified secrity threat, reprodce the steps that reslt in the secrity compromise of the clster. 4. Docment the reslts and report the findings to the design team. 5. With the assistance of the design team, resolve any otstanding secrity isses. Important Resolve all secrity threats before proceeding frther in the deployment process.

20 584 Chapter 9 Deploying Network Load Balancing Monitoring and Health Checking the Complete Clster Yor next step in completing the implementation of yor new clster is to enable monitoring and health checking on the entire clster. In Installing and Configring the First Clster Host and Installing and Configring Additional Clster Hosts earlier in this chapter, yo enabled monitoring and health checking on individal clster hosts. However, in this step yo are ensring that the clster is monitored as a complete nit. Enable monitoring and health checking on the clster before allowing sers to access the clster in a pilot or prodction environment. As clients begin to access the applications and services in yor clster, contine to provide monitoring and health checking as described in Installing and Configring the First Clster Host earlier in this chapter. Verify that the clster performs as expected with live client traffic. After the deployment process is complete, ensre that yor operations staff contines the monitoring and health checking process in their long-term operations processes as part of yor ongoing operations. Verifying Proper Operations of Applications and Services Before placing the complete clster into a pilot or prodction environment, yo need to verify that applications and services are rnning correctly on the clster. To verify proper operations of applications and services on the new clster, complete the following tasks: 1. Temporarily connect a client compter to the same switch sed by the clster. 2. From the client compter, verify that the applications respond to client reqests as expected. 3. Disconnect the client compter from the switch. Enable Client Access to the Clster Yor last step in the implementation of yor new clster is to allow clients access to the applications and services rnning on the clster. Be sre that yo sccessflly complete all previos steps in the process before enabling sers to access the clster in a pilot or prodction environment.

21 Implementing a New Clster 585 Enable client access to the applications and the services in the clster by creating DNS entries. Users will access yor applications and services by sing ser-friendly names or Uniform Resorce Locaters (URLs), sch as which correspond to the individal applications or services on the Network Load Balancing clster. The DNS entries allow the translation of the ser-friendly name to at least one IP address. When rond robin DNS is sed for load balancing between clsters, yo mst create a DNS entry for each clster. Table 9.5 lists the criteria for determining the nmber of DNS entries reqired for yor new clster. Table 9.5 Criteria for Determining the DNS Entries for Yor Clster Soltion Incldes One of the Following Only one Network Load Balancing clster. More than one Network Load Balancing clster with client traffic distribted across Network Load Balancing clsters by sing rond robin DNS. Reqired DNS Entries A DNS entry for the clster and a DNS entry for each virtal clster. A rond robin DNS entry for each clster and a rond robin DNS entry for each virtal clster. Example: Verifying the Clster and Enabling Client Access The organization mentioned in the examples earlier in this chapter is now ready to complete the implementation of the new IIS 6.0 Web farm. The Web farm servers are implemented and basic connectivity is provided to the Web farm. The organization has verified that Network Load Balancing is distribting client traffic evenly and that all clster hosts are servicing client reqests. In this step, the organization verifies that the Web farm and the clster fnction as a whole. Althogh operation of each clster host was verified dring the implementation process, now the organization mst ensre that the new Web farm meets or exceeds the design specifications established by yor design team before enabling client access to the applications. Figre 9.7 illstrates the network environment after the implementation of the new IIS 6.0 Web farm and Network Load Balancing.

22 586 Chapter 9 Deploying Network Load Balancing Figre 9.7 Network Environment After Implementing the New Clster Internet Roter-01 Roter-02 Firewall-02 Firewall-03 Switch-01 belongs to VLAN-01 Switch-02 belongs to VLAN-01 IIS-01 IIS-02 IIS-03 IIS-04 IIS-05 IIS-06 IIS-07 IIS-08 NLBClster-01 DC-01 DC-02 SQLCLSTR-01 FILECLSTR-01 Segment that connects management adapters to organization s resorces and operations consoles Firewall-01 To the organization s private network Table 9.6 lists the deployment steps that were performed to verify the new clster and enable client access.

23 Upgrading Existing Clsters 587 Table 9.6 Verifying the New Clster and Enabling Client Access IIS-03 taken off line. IIS-02 restored. Deployment Step Client attached to the Internet and secrity attacks performed. Monitoring and health checking enabled on IIS- 01, IIS-02, IIS-03, IIS-04, IIS-05, IIS-06, IIS-07 and IIS-08. A DNS entry created for the clster IP address of NLBClster-01. Reason Atomatic failover to other Web servers mst be proven. Restoration process for Web servers mst be proven. Mitigation of secrity threats mst be proven. Proper operation of the IIS 6.0 Web farm mst be verified dring and after the implementation process to ensre that load balancing is occrring and that system resorces are adeqate for client reqests. Clients mst have a DNS entry to access the Web applications rnning on the clster. Upgrading Existing Clsters If yor organization has applications and services that crrently rn on the Windows NT 4.0 or Microsoft Windows 2000 operating systems, yo can pgrade yor existing WLBS or Network Load Balancing clsters to take advantage of the improved secrity and performance of Windows Server 2003 and Network Load Balancing. Figre 9.8 shows the process for pgrading an existing clster.

24 588 Chapter 9 Deploying Network Load Balancing Figre 9.8 Upgrading an Existing Clster Select the atomated deployment method Yes No No Yes Implement new clster? Yes Upgrade existing clster? Implement new clster Upgrade existing clster Prepare to pgrade the clster Upgrade the clster Migrate existing clster No Deploy more NLB clsters? NLB deployment complete The Network Load Balancing pgrade process assmes the following conditions: Yor applications are rnning on an existing IIS 4.0 (on Windows NT 4.0) or IIS 5.0 (on Windows 2000). Yo are pgrading the operating system and services rnning on yor existing application servers. The system resorces of the compters in yor existing application farm are sfficient, or can be pgraded, to spport Windows Server 2003 and IIS 6.0.

25 Upgrading Existing Clsters 589 Yo can pgrade a clster by taking the entire clster offline and pgrading all the hosts, or yo can leave the clster on line and perform a rolling pgrade. A rolling pgrade entails taking individal clster hosts offline one at a time, pgrading each host, and retrning the host to the clster. Yo contine pgrading individal clster hosts ntil the entire clster is pgraded. A rolling pgrade allows the clster to contine rnning dring the pgrade. The decision to se rolling pgrades is based on the applications and services rnning on yor existing clster. If the applications and services spport rolling pgrades, then perform a rolling pgrade on the existing clster. Otherwise, perform the pgrade process recommended for the applications and services rnning on the clster. For more information on the pgrade process for the applications and services rnning on yor clster, see Additional Resorces later in this chapter. Upgrade the clster by sing the information docmented in the NLB Clster Host Worksheet that yor design team completed for each clster host dring the design process. Preparing to Upgrade the Clster Network Load Balancing rns independently of other networking services provided by Windows Server On the other hand, the applications and services rnning on the clster can be dependent pon the network infrastrctre and other network services in yor existing environment. Prior to pgrading the existing clster, deploy any network infrastrctre components or networking services that are reqired by the applications and services rnning on the clster. Prepare to pgrade the clster by performing the following tasks: 1. Verify that applications and services rnning on the clster are compatible with Windows Server Upgrade the network infrastrctre as reqired by the applications and services rnning on the clster. 3. Upgrade any networking services as reqired by the applications and services rnning on the clster. Verifying Applications and Services Are Compatible with Windows Server 2003 Before yo pgrade the existing clster, ensre that the applications and services rnning on the clster are compatible with Windows Server For help in determining if yor application is compatible with Windows Server 2003, se the Windows Application Compatibility Toolkit. To download the toolkit, see the Windows Application Compatibility link on the Web Resorces page at

26 590 Chapter 9 Deploying Network Load Balancing Upgrading Necessary Network Infrastrctre Before yo pgrade the existing clster, ensre that the final configration of the clster can be spported by the network infrastrctre that connects the clster to client compters, to other servers within yor organization, and to management consoles. Perform only the network infrastrctre pgrades reqired by the applications and services rnning on the clster. Avoid performing pgrades to the network infrastrctre for other reasons at the same time that yo are pgrading the clster. This minimizes the nmber of changes to the environment and redces the likelihood of problems occrring dring the pgrade process. The network infrastrctre to pgrade incldes the following components: Network cabling Hbs Switches Roters Firewalls Note When performing this step, make sre to have specifications abot yor crrent network environment available for se. Specifically, yor hardware and software inventory, and a map of network topology can be helpfl. For more information abot creating those docments, see Planning for Deployment in Planning, Testing, and Piloting Deployment Projects of this kit. Upgrading Any Reqired Networking Services Network Load Balancing is independent of the other Windows Server 2003 network services. As a reslt, no networking services pgrades are reqired for Network Load Balancing. However, the applications and services rnning on the clster can be dependent on other Windows Server 2003 networking services. For more information abot reqirements that the services and applications rnning on the clster might have for pgrading networking services, see Additional Resorces later in this chapter. Example: Preparing to Upgrade the Clster An organization is pgrading their existing virtal private network (VPN) remote access soltion. The existing soltion has a VPN remote access server farm that spports Point-to-Point Tnneling Protocol (PPTP) and Layer Two Tnneling Protocol (L2TP). Crrently the VPN remote access server farm is rnning WLBS on Windows NT 4.0. Figre 9.9 illstrates the organization s network environment prior to preparing for the pgrade of the existing WLBS clster that hosts the VPN remote access server farm.

27 Upgrading Existing Clsters 591 Figre 9.9 Network Environment Before Preparing to Upgrading the Clster Internet Firewall-01 Firewall-02 Roter-01 Roter-02 Switch-01 Switch-02 VPN-01 VPN-03 VPN-05 VPN-07 VPN-02 VPN-04 VPN-06 VPN-08 VPNNLB-01 VPN rnning Windows NT 4.0 Segment that connects management adapters to organization s resorces and operations consoles DC-01 DC-02 Firewall-03 As the first step in pgrading the existing VPN remote access server farm, the organization installs any networking services reqired by the VPN remote access server farm. No networking infrastrctre or networking services pgrades are reqired for the pgrade. In the ftre, the organization plans to deploy Internet Athentication Service (IAS) servers to provide centralized management of remote access policies. However, the deployment of IAS is schedled to occr after the pgrade to Windows Server 2003 to prevent any nnecessary complications dring the pgrade process.

28 592 Chapter 9 Deploying Network Load Balancing Upgrading the Clster The pgrade of yor existing clster can be done one clster host at a time (a rolling pgrade) or by taking the clster offline to pgrade all the hosts at the same time (a nonrolling pgrade). It is recommended that yo perform a rolling pgrade. Otherwise, perform the pgrade process recommended for the applications and services rnning on the clster. For more information on the pgrade process for the applications and services rnning on yor clster, see Additional Resorces later in this chapter. Determine if yo can perform a rolling pgrade in yor lab prior to yor pilot or prodction deployments. If yo can perform rolling pgrades, ensre that yo perform the post-pgrade processes described in this section for each individal clster host. To perform a rolling pgrade on existing WLBS or Network Load Balancing clsters, complete the following tasks: 1. Prevent clients from accessing the clster host to be pgraded by performing a drainstop on the clster host. 2. Monitor client activity on the clster host ntil all client activity ceases. 3. Upgrade the clster host. 4. Verify that the applications and services are rnning correctly on the pgraded clster host. 5. Add the clster host back to the clster. 6. Upgrade the remaining clster hosts by performing steps 1 thogh 5 for each clster host. Preventing Clients From Accessing the Clster Host Before yo pgrade a clster host, yo mst ensre that no clients have active sessions rnning on the clster host. Dring the pgrade process, the clster host is still connected to the network infrastrctre. However, to prevent new clients from starting sessions or applications on the clster host, perform a drainstop on the clster host to be pgraded. Performing a drainstop prevents new clients from accessing the clster while allowing existing clients to contine ntil they have completed their crrent operations.

29 Upgrading Existing Clsters 593 In addition, configre the Defalt state of the Initial host state to Stopped. Configring the clster host in this manner ensres the clster host cannot rejoin the clster dring the pgrade process. Becase the pgrade process reqires the clster host to restart, yo need to verify that the pgrade completed sccessflly before adding the clster host back to the clster. Tip Yo can configre the Initial host state throgh Network Load Balancing Manager or the property settings of the clster network adapter. For more information abot performing a drainstop on the sorce clster and changing the Defalt state of clster host, see Create and Manage Network Load Balancing Clsters in Help and Spport Center for Windows Server Monitoring Client Activity on the Clster Host After yo rn the drainstop on the clster host, monitor client activity on the clster host to determine when clients are no longer sing the clster host. The method for determining when clients are no longer sing the clster host is specific to the applications and services rnning on the clster host. For example, for a VPN remote access soltion, monitor for active VPN connections to the clster host. When there are no active VPN connections, the clster host is ready to be pgraded. For more information abot monitoring the applications and services rnning on the clster for client activity, see Additional Resorces later in this chapter. Upgrading the Clster Host After yo ensre that no clients are accessing the clster host, pgrade the clster host to Windows Server Ensre that dring the pgrade process yo apply the latest service packs and hotfixes. After the pgrade is complete, check the pgrade logs (Setperr.log in the windir folder of the system volme) to identify any problems that occrred dring the pgrade process. Many applications and services rnning on the clster have log files that identify problems that occr dring the pgrade process. For example, IIS 6.0 creates a separate log that docments the pgrade process for IIS components. Make certain that yo review any pgrade logs for the applications and services rnning on the clster. For more information abot these pgrade logs, see Additional Resorces later in this chapter.

30 594 Chapter 9 Deploying Network Load Balancing Verifying the Applications and Services are Rnning Correctly After the pgrade of the clster host is complete, yo need to verify that the applications and services are rnning correctly on the clster host. Yo need to do this before starting the clster service again in order to allow the clster host to rejoin the clster. The process presented here is specific to Network Load Balancing. This process might apply to the applications and services rnning on the clster, however, the applications and services rnning on the clster might have a different verification process. For more information on the verification process for specific applications and services rnning on the clster, see Additional Resorces later in this chapter. To verify that the applications and services are rnning correctly after yo pgrade the clster host, complete the following tasks: 1. Temporarily connect a client compter to the same switch sed by the clster. 2. From the client compter, verify that the applications respond to client reqests as they did prior to the pgrade. 3. Verify that the identified secrity threats are mitigated. The only action yo need to take to mitigate Network Load Balancing specific secrity threats is to ensre that nathorized clients cannot remotely administer the clster. Unless the network infrastrctre, inclding firewalls or roters, changed significantly since the start of the pgrade, the Network Load Balancing secrity threats shold still be mitigated. However, yo mst mitigate secrity threats that are niqe to the applications and services rnning on the clster. For more information abot mitigating secrity threats for specific applications and services rnning on the clster, see Additional Resorces later in this chapter. 4. Enable monitoring and health checking, if they are not already enabled. A Microsoft Operations Manager (MOM) Management Pack exists for Network Load Balancing. When yor organization ses MOM to monitor and manage the servers within yor organization, inclde the MOM Management Pack for Network Load Balancing on the clster hosts. For more information abot monitoring and health checking the applications and services rnning on the clster, see Additional Resorces later in this chapter. 5. Disconnect the client compter from the switch.

31 Upgrading Existing Clsters 595 Adding the Clster Host Back to the Clster After yo complete the pgrade and verify that the applications and services are rnning correctly, add the clster host back to the clster. Becase the clster host is still connected by cable to the existing network infrastrctre, adding the clster host back to the clster reqires yo to start Network Load Balancing on the clster host. To add the clster host back to the clster, se Network Load Balancing Manager to start the Network Load Balancing service on the clster host. In addition, configre the Defalt state of the Initial host state to match the setting that existed prior to the pgrade process. Configring the clster host in this manner ensres that the clients accessing the applications and services rnning on the clster do not enconter problems when yo restart the clster host and retrn it to the clster. The reason to configre the clster host with the same settings, instead of selecting Started, is that Network Load Balancing loads very early in the operating system boot process. The clster host can join the clster before other services are rnning. This means the clster host might receive load before other services, sch as IIS, are started. Allowing Network Load Balancing to start before other services cold reslt in the denial of service to sers ntil the service starts. Yo can se management software, sch as MOM, to monitor the services rnning on the host and to start Network Load Balancing when the appropriate services are rnning. Using management software to start Network Load Balancing is recommended to prevent sers from experiencing otages in service. For more information on performing a drainstop on the sorce clster and changing the Initial host state of clster host, see Create and Manage Network Load Balancing Clsters in Help and Spport Center for Windows Server Example: Upgrading the Existing NLB Clster The organization mentioned in the examples earlier in this chapter is now ready to pgrade the existing VPN server farms. In this step, the organization performs a rolling pgrade on each clster host in the VPN remote access server farm. Each of the VPN remote access servers were pgraded in trn ntil the entire VPN remote access server farm was pgraded. Figre 9.10 illstrates the organization s network environment after the pgrade of the clster.