McAfee Enterprise Mobility Management Performance and Scalability Guide

Transcription

1 McAfee Enterprise Mobility Management 12.0 Performance and Scalability Guide

2 Contents Purpose... 1 Executive Summary... 1 Testing Process... 1 Test Scenarios... 2 Scenario 1 Basic Provisioning and Sync... 2 Scenario 2 Threat Events and Application Compliance... 2 Scenario 3 Enterpirse Wi-Fi and VPN configuration (PKI)... 3 McAfee EMM 12.0 Architecture... 3 Test Environment... 4 Software... 4 Hardware... 4 System configuration... 4 External Influences on McAfee EMM 12.0 Scalability Limit... 4 McAfee epo Agent Handler Connection Limit... 5 McAfee EMM Deployment and Configuration Options... 5 Minimum Hardware Configuration... 6 Minimum McAfee EMM Server Deployment... 6 Software Configuration... 6 Performance Tuning... 6 Additional Performance Tuning PKI... 7 Sample Configuration for 10k Devices... 9 Alternate Configuration for 10k Devices (Tested)... 9 Alternate Configuration for 20k Devices (Tested) Test Results Scenario 1 Basic Provisioning and Sync Scenario 2 Threat Events and App Reputation Scenario 3 Enterprise Wi-Fi and VPN configuration (PKI)... 15

3 Purpose This document provides the performance and scalability test results for McAfee Enterprise Mobility Management 12.0 (McAfee EMM ). It is intended as a guideline for customers implementing McAfee EMM in networks with more than 3,000 devices. Executive Summary McAfee EMM can support up to 3,000 devices using the minimum system requirements defined in the data sheet and website. McAfee EMM can support up to a maximum of 20,000 concurrent mobile devices, regardless of the number of servers deployed in a single environment. This document describes the test scenarios and results, and explains the McAfee EMM configuration required to support up to 20,000 concurrent devices. For customers who intend to support between 10,000 and 20,000 mobile devices, with failover and redundancy, we recommend: Use McAfee epolicy Orchestrator (McAfee epo) server or later. Follow the recommended configurations in this document based on the projected total number of devices expected. Install only McAfee EMM on servers used to run the software. No other IIS services can co-exist Install McAfee EMM and McAfee epo on separate servers. The McAfee EMM and McAfee epo databases can co-exist on a single database server as long as the server is dedicated to only those products and appropriate redundancy is configured. Testing Process In order to mirror real-world usage, testing included the following common functions: Provisioning and enrollment of devices sync Policy update MDM check-in App compliance App blacklisting Threat events Provisioning with enterprise Wi-Fi and VPN certificate profiles (PKI environments) 1

4 Test Scenarios Simulated devices for each scenario included 70 percent ios and 30 percent Android devices. Scenario 1 Basic Provisioning and Sync Tests Provisioning sync Policy update Description Mobile devices were enrolled (provisioned) at a rate of one device every second. After ramping up to the target load of 20,000 devices, the system remained in sustaining mode for over 24 hours and the systems were monitored for: - Provisioning success - sync availability - System health, including CPU and memory utilization Note: Provisioning devices does not affect overall performance. Our tests involved provisioning devices much more quickly than would be expected in a real-world setting in order to more rapidly increase the number of devices in our test bed. Scenario 2 Threat Events and Application Compliance Tests Blacklisted app Malicious app (App reputation) Malware (as detected by VirusScan Mobile Security) Description Ten percent of Android and ios devices had a blacklisted app installed. The devices became non-compliant and a threat event was generated. Then, the blacklisted app was removed and the devices became compliant. Twenty-five percent of Android devices had a malicious app based on the app protection (reputation) score. The devices became noncompliant and a threat event was generated. Then, the malicious app was removed and the devices became compliant. Twenty-five percent of Android devices had malware based on McAfee VirusScan Mobile detection. The devices became noncompliant and a threat event was generated. Then, the malware was removed and the devices became compliant. 2

5 Scenario 3 Enterpirse Wi-Fi and VPN configuration (PKI) Tests Provisioning sync Description This scenario simulated provisioning one device every two seconds. McAfee epo policy was configured with a PKI-enabled profile, where each device got one enterprise Wi-Fi and one enterprise VPN configuration with a different certificate template for each. After ramping up to the target load of 20,000 devices, the system was maintained in sustaining mode for over 24 hours and the systems monitored for: Provisioning success sync availability System health, including CPU and memory utilization McAfee EMM 12.0 Architecture The diagram below illustrates a typical high-level architecture for a McAfee EMM deployment with Enterprise ActiveSync proxy server or servers in the DMZ and a Hub or Hubs in the internal network. 3

6 Test Environment This section describes how the load test environment was configured to run the three scenarios. All test machines were McAfee epo managed nodes with McAfee VirusScan Enterprise and McAfee Agent installed. Software SimDevice Tool used to simulate ios and Android devices Perfmon Tool used to collect performance metrics SQL Management Scripts to monitor metrics and database health Operating System: Windows 2008 R2 SP1, Windows 2012 Exchange Server: Exchange 2007, 2010, 2014 Hardware All test servers were virtual machines using VMware on ESX server. An F5 Big IP hardware load balancer was placed in front of the Exchange CAS array. - F5 was configured with an SSL pass-through rule. - F5 was configured to load balance with equal load across all servers. - Keep alive connections timeout setting was set to 5 minutes. System configuration McAfee EMM Servers Quad Core CPU 8GB RAM 100GB hard disk space McAfee epo Server Quad Core CPU 16GB RAM 100GB hard disk space SQL Server 16 Core CPU 32GB RAM 300GB dedicated database disk space External Influences on McAfee EMM 12.0 Scalability Limit The scalability limit of 20,000 devices depends on two important factors: McAfee epo Agent Handler connection. IIS concurrent connections limit. 4

7 McAfee epo Agent Handler Connection Limit All requests from a device, including initial provisioning and any ad-hoc or periodic updates, are pushed from McAfee EMM to McAfee epo as properties updates via McAfee epo Agent communications. Special threads on the McAfee EMM Hub queue requests and push them to McAfee epo at configured intervals. Various tests revealed that the McAfee epo Agent connection could withstand up to a maximum of four McAfee EMM threads pushing properties. McAfee EMM requires constant communication to keep devices connected. This results in McAfee EMM communicating with the McAfee epo Agent more than other integrated products and is the reason for limiting the number of McAfee EMM Hub threads to four. Each McAfee EMM Hub server is configured by default to run on one IIS worker process and each process runs one property update thread. Therefore, there can be no more than four McAfee EMM Hub servers with the default configuration or two McAfee EMM Hub servers running two IIS worker processes each. Microsoft IIS concurrent Connections Limit Microsoft IIS has a known limitation in application pools whereby no more than 5,000 concurrent connections can be handled per worker process. The McAfee EMM Hub server, during the course of normal operation with 20k devices, sees a maximum of 1,500 concurrent connections, and an average of 15. Therefore, the chances of the McAfee EMM Hub reaching the limit of concurrent connections are less than 50 percent. The McAfee EMM DMZ server, during the course of normal operation with 20k devices, has higher chances of reaching the concurrent connections limit due to the McAfee EMM Proxy component, which services Exchange ActiveSync requests ( sync). Exchange ActiveSync traffic supports keep-alive connections, called push (ping), that are used to automatically push new s to devices without user intervention. These keep-alive connections can stay open for up to 60 minutes. Since the McAfee EMM Proxy acts as a proxy between a device and the Exchange server, this component has to maintain keepalive connections, which makes it 80 percent likely to hit the concurrent limit. In order to support more than 5,000 devices per McAfee EMM Proxy, additional McAfee EMM servers or additional IIS worker processes must be added. Refer to Performance Tuning for more details. McAfee EMM Deployment and Configuration Options To support between 3,000 and 20,000 mobile devices, McAfee EMM and McAfee epo servers require specific hardware and software configuration with additional performance tuning. 5

8 Minimum Hardware Configuration McAfee EMM Servers Quad Core CPU 8GB RAM 100GB hard disk space McAfee epo Server Quad Core CPU 16GB RAM 100GB hard disk space SQL Server 16 Core CPU 32GB RAM 300GB dedicated database disk space Minimum McAfee EMM Server Deployment McAfee EMM in dual server configuration Two McAfee EMM DMZ servers and two McAfee EMM Hub servers Hardware Load Balancer (such as F5) configured in front of both the DMZ and the Hub servers Software Configuration McAfee epo or later Maximum SQL Server memory configured at 75 percent of actual physical memory (based on Microsoft SQL recommendation) Performance Tuning McAfee EMM servers can be configured in two ways to achieve scalability needs. The most common method is adding more servers. Apart from this option, each McAfee EMM server can be fine-tuned to increase the number of devices it can support at an application level. This can be achieved by increasing the number of worker process in the IIS application pool. The following formula can be used to determine the number of worker processes needed based on the maximum number of devices. On DMZ Servers Calculate minimum number of worker process per 1 DMZ server as rounding of: ((# of Device/5000) * 80%) - Example for 10k devices: (10000/5000)*80% = 1.6 = 2 worker processes - Example for 20k devices: (20000/5000)*80% = 3.2 = 3 worker processes The 80 percent factor is due to the IIS concurrent connections limit explained in External Influence on McAfee EMM 12.0 Scalability Limit. Configure the following properties on MSExchnageSyncAppPool IIS Application pool: - Process Model: Maximum Worker Process: <as calculated above> - Process Model: Queue Length:

9 - Process Model: Ping Enabled: False - Recycling: Regular Time Interval (Minutes): 0 Additionally, based on Microsoft best practices, there should be no more than five worker processes on each DMZ server. On Internal Servers Calculate minimum number of worker process per 1 Hub server as rounding of: ((# of Device/5000) * 50%) - Example for 10k devices: (10000/5000)*50% = 1 = 1 worker process - Example for 20k devices: (20000/5000)*50% = 2 = 2 worker processes The 50 percent factor is due to IIS concurrent connections limit explained under External Influence on McAfee EMM 12.0 Scalability Limit. Configure the following properties on EMMHubPool IIS Application pool: - Process Model: Maximum Worker Process: <as calculated above> Process Model: Queue Length: Process Model: Ping Enabled: False - Recycling: Regular Time Interval (Minutes): 0 Additionally, based on Microsoft best practices, there should be no more than four worker processes in total on all McAfee EMM Hub servers. For example, if there are two Hubs, you cannot have more than two worker processes on each Hub. This is due to the McAfee epo data channel limit explained under External Influence on McAfee EMM 12.0 Scalability Limit. The following change has to be made on each McAfee EMM Internal server configured to use more than one IIS worker process 1 Navigate to the McAfee EMM Hub Installation folder (c:\program Files (x86)\mcafee\emm Platform\EMM Hub). 2 Save a copy of the web.config file and open it for editing. 3 Search for the string WorkerProcessThreads_UseMutex and set the value to true. 4 Save the config file and reset IIS. Note: This approach helps increase scalability on an individual set of McAfee EMM servers. However, it does not address load balancing and high availability. To address high availability and load balancing needs, additional McAfee EMM servers should be added behind existing hardware load balancers Refer to the Knowledge Base article, Guideline for configuring load balancing in a McAfee EMM HA environment. Refer to the Knowledge base article, How to install McAfee EMM in High Availability Mode. Additional Performance Tuning PKI In a PKI environment, each device provisioning request results in an additional call to McAfee epo to request a client certificate. Therefore, the McAfee EMM server initiates connection to the McAfee epo Agent more often than the basic provisioning and threat event scenarios. To allow McAfee EMM and McAfee epo to scale up to 20,000 devices in PKI enabled environments, we must reduce the interval at which device properties are pushed to McAfee 7

10 epo via the Agent Handler connection. This interval can be set from the McAfee epo Console (Server Settings Enterprise Mobility Manager General Settings EMM Hub-toePO communication interval). Change this interval from 60 minutes to 1440 minutes (24 hours). 8

11 Sample Configuration for 10k Devices 3 DMZ servers 1 worker process each 2 Internal servers 1 worker process each Alternate Configuration for 10k Devices (Tested) 2 DMZ servers 2 worker processes each 2 Internal servers 1 worker process each 9

12 Sample Configuration for 20k Devices 5 DMZ servers 1 worker process each 4 Internal servers 1 worker process each Alternate Configuration for 20k Devices (Tested) 2 DMZ servers 3 worker process each 2 Internal servers 2 worker process each Note: A maximum of five worker processes is supported per DMZ server (Proxy) and a total of four worker processes is supported across all internal servers (Hubs). 10

13 Test Results Test results were recorded for the target load of 20,000 devices. Initial ramp-up of devices to the target load took approximately 14 hours. At the target load of 20,000 devices, the test was maintained in sustaining mode for more than three days. Scenario 1 Basic Provisioning and Sync McAfee EMM DMZ Server Average memory utilization: 40% Average CPU utilization: 11% McAfee EMM Hub Server Average memory utilization: 14% Average CPU utilization: 23% Legend: # of concurrent connections; Scale Memory consumption: % committed bytes in use; Scale 1 % CPU utilization; Scale

14 SQL Server Average memory utilization: 71% Average CPU utilization: 16% Average User Connections: 52 Legend: User connections; Scale 1.0 Memory consumption: % committed bytes in use; Scale 1 % CPU utilization; Scale

15 Scenario 2 Threat Events and App Reputation McAfee EMM DMZ Server Average memory utilization 28% Average CPU utilization - 48% McAfee EMM Hub Server Average memory utilization 12% Average CPU utilization - 18% Legend: # of concurrent connections; Scale Memory consumption: % committed bytes in use; Scale 1 % CPU utilization; Scale

16 McAfee epo Server Average memory utilization: 10% Average CPU utilization: 1.2% Legend: Memory consumption: % committed bytes in use; Scale 1 % CPU utilization; Scale 1.0 SQL Server Average memory utilization: 52% Average CPU utilization: 10% Average user connections: 52 Legend: User connections; Scale 1.0 Memory consumption: % committed bytes in use; Scale 1 % CPU utilization; Scale

17 Scenario 3 Enterprise Wi-Fi and VPN configuration (PKI) McAfee EMM DMZ Server Average memory utilization 52% Average CPU utilization - 9% McAfee EMM Hub Server Average memory utilization 21% Average CPU utilization - 19% Legend: # of concurrent connections; Scale Memory consumption: % committed bytes in use; Scale 1 % CPU utilization; Scale

18 McAfee epo Server Average memory utilization: 11% Average CPU utilization: 21% Legend: Memory consumption: % committed bytes in use; Scale 1 % CPU utilization; Scale 1.0 SQL Server Average memory utilization: 27% Average CPU utilization: 10% Average user connections: 50 Legend: User connection; Scale 1.0 Memory consumption: % committed bytes in use; Scale 1 % CPU utilization; Scale