Dell - Secure Exchange Reference Architecture Dell White Paper By Sumankumar Singh & Bharath Vasudevan 1
Summary Email has become a vital communication tool for most businesses. Whether in the office or on the road, communicating internally or closing business with customers, users depend upon email to get their jobs done. Due to the increase in popularity of email as the preferred communication tool, the amount of email traffic is increasing at a very rapid pace. Managing this exponentially growing traffic can sometimes become a daunting task. Along with the growing traffic, the threat of virus and spam is also growing. It is extremely important to design a base messaging infrastructure that is secure, flexible and scalable to meet the availability needs of your organization while safeguarding against any security threats. This paper presents a Dell Messaging Reference Architecture that is built on industrystandard components providing both security and availability and is scalable to accommodate future growth needs. All the components of the reference architecture have been validated to ensure their interoperability. Partnering with industry leaders Microsoft and Symantec allows Dell to provide a holistic solution for messaging environments incorporating security and archiving to complement the basic email solution. 2
Introduction The Dell Secure Exchange reference architecture is based on industry standard components that can provide email protection to businesses with the ability to scale to support the largest enterprise deployments. This approach enables organizations to pick the appropriate tools for different data center functions without being locked into proprietary technologies. Using this model, Dell has partnered with Symantec and Microsoft to provide secure, highly available and scalable Exchange messaging solutions. All the components of the reference architecture have been validated to ensure their interoperability. Figure 1 provides a pictorial representation of the Dell Secure Exchange Reference Architecture. Perimeter Firewall Internal Firewall Exchange Front End Servers Fibre Channel Switches Symantec Mail Security Appliance ISA Perimeter Network Active Exchange Directory and Back End Global Catalog Servers Server Tape Back Up Storage Systems Outside Clients Internal Clients Fig1. Dell Secure Exchange Reference Architecture The following components of reference architecture are discussed in more detail: Perimeter Network Exchange Front-end servers Exchange Back-end servers Storage Systems Tape backup Archiving 3
Reference Architecture Components 1. Perimeter Network: A perimeter network is typically the network segment that is closest to your internet gateway. It is the first network encountered by any incoming traffic from the internet into your internal network. Typically, if your network design includes a firewall, your perimeter network will be a part of it. In the absence of a perimeter network, the front-end messaging servers will need to handle the balance of all incoming email traffic which can expose them to email-based threats and viruses. Implementing a perimeter network helps you better control security by controlling the access of internal resources by external traffic and prevent attack from intruders. According to some estimates, by the end of 2006, 71% of email messages sent worldwide per day will be spam, and this percentage will grow to 79% by 2010.* It is important to prevent this spam from entering into the internal network. For customer deployments larger than 2000 users, the amount of email traffic can warrant a two tier approach to reduce the amount of unwanted email traffic: a traffic shaper and a content filtering mechanism. For smaller deployments, both can still be implemented, but a content filtering solution may be enough to reach the desired performance goals. Traffic Shaping In the messaging context, traffic shaping involves intercepting and scanning incoming emails to determine authenticity and relevancy of the email traffic. In the perimeter network, organizations must consider significantly reducing, and hopefully eliminating all spam traffic prior to it entering the internal network. Traffic shaping helps to reduce the amount of unnecessary traffic and improves the performance and security of the internal network. Traffic shaping can be achieved by deploying antispam devices in the perimeter network. The Symantec Mail Security 8160 is a traffic shaper which is built as an appliance on top of the Dell PowerEdge 1850 server. This appliance acts as a router, inspecting incoming Simple Mail Transfer Protocol (SMTP) traffic in real time and providing a mechanism to reduce the amount of spam entering the internal network. By shaping email traffic at the TCP protocol level, this security appliance prevents spammers from forcing unwanted email into your network. Over time, the appliance determines a sender s reputation based on a cumulative history and can automatically shape traffic based on that reputation. Content Filtering In addition to traffic shaping, additional security may be required to prevent spam and other unwanted email from reaching the mail servers. Controlling outbound content may also be necessary to ensure that an organization is not perceived as a source of inappropriate or malicious content. *Radicati Group, Quick Facts, Vol. 3 Issue 4, June 2006, http://www.radicati.com/news/facts.asp. 4
Symantec Mail Security 8200 series appliances and Symantec Brightmail Antispam can help address these challenges. They both include an integrated virus and spam signatures update mechanism. This tool is frequently and automatically updated to ensure that the latest antivirus policies and rules are included. This update functionality is similar to that of an Anti-Virus client running on a desktop machine. Symantec Mail Security 8260 appliance, which is also built on a Dell PowerEdge 1850 server, is designed for environments with more than 1,000 users. It delivers capabilities like antispam, antivirus, content filtering, e-mail firewall, and a quarantine function to help ensure that unwanted traffic does not enter your internal corporate network. ISA Server To complete a secure perimeter network deployment, it is equally important to restrict the access of email servers by unauthorized external clients or intruders. This may be achieved by deploying a Microsoft Internet Security and Acceleration (ISA) server that can control traffic entering your internal network and outbound traffic from your messaging environment. The ISA server can be used to configure rules to securely publish internal mail services to external users by allowing access using specified protocols such as Messaging Application Programming Interface (MAPI), Post Office Protocol 3 (POP3), Internet Messaging Access Protocol 4 (IMAP4) etc. All inbound requests from client applications such as Microsoft Outlook, Outlook Web Access (OWA) or other POP3 email clients can be handled by the ISA server and routed to the appropriate Exchange server on your internal network thereby protecting the internal mail servers from communication directly to external clients. The ISA server protects the Exchange server by acting as a proxy to receive all requests for the Exchange Server. When you use ISA Server to handle all inbound requests from client applications your Exchange front-end servers no longer need to be located in the perimeter network. The Exchange front-end server can be moved from the perimeter network to the internal network. This provides an additional layer of security to the Exchange Server. Due to these security benefits that it provides, it is a best practice to deploy an ISA server into your perimeter network even if you have deployed the traffic shaping and content filtering appliances. 5
2. Exchange Front End Servers: Microsoft Exchange Server 2003 supports a two-tier Exchange architecture consisting of front-end and back-end servers. The front-end server accepts requests from clients and proxies them to the appropriate back-end server for processing. This architecture is recommended if several access protocols are used by the clients to access the Exchange server or there are multiple back-end servers in the Exchange environment. However it may also be used in a single back-end server environment. It is a good practice to deploy the Exchange Front End server behind the Internal Firewall. The Exchange Front End server provides benefits such as: Single Namespace: This enables all users to access their mailbox using a single consistent name even if their mailbox is moved from one server to another or if new servers are added to the back-end infrastructure. It also enables OWA, POP3 or IMAP4 clients to access their mailbox using the same URL. Offload Processing: The front-end server can improve performance of the messaging system by offloading some of the processing tasks that otherwise are typically performed by the back-end server in the absence of a front-end server. This includes tasks such as managing all encryption and decryption processing of outgoing and incoming email traffic. Strengthen Security: The front-end server provides a single point of access for all incoming requests and traffic. As it does not store user information, it provides an additional layer of security for mailboxes. It can also authenticate requests before proxying them to the back-end server thereby protecting against any security breaches. It also eliminates the need to open RPC ports from the perimeter network into the internal network. Scalability: As Front-End servers provide a single name space for all users, they enable the ability to increase or decrease the number of front-end or back-end servers without disrupting users. This simplifies scalability by facilitating the increase or decrease of the size of the Exchange organization. Selecting the right front-end server is critical to ensure the overall performance of the messaging system. The selection depends on many factors including number of users, number of back-end servers and the protocols used. It also depends on what functions the front-end server is performing. Front-end servers typically do not require large or fast disk storage due to the lack of mailboxes resident on the frontend server, but they do have higher CPU and memory requirements to perform the more processor and memory intensive back-end offload processing tasks. An ideal server candidate needs to support 4GB of memory and have scalable processor options while providing the network bandwidth required for hosting Microsoft Exchange 2003. Dell answers all of these requirements with dual-socket PowerEdge Servers. An all-purpose server which meets all of the performance characteristics is the Dell PowerEdge 2950. The Dell PowerEdge 2950 with up to 2 dual-core Intel Xeon processors and up to 32 GB of fully buffered memory provides 6
enough processing power required for the Exchange front-end server functionality. For larger Exchange deployments depending on the number and nature of users, multiple front-end servers may be required. 7
3. Exchange Back End Servers Exchange back-end servers host mailboxes and/or public folders. It is safe to say that the end-user performance and availability of the messaging infrastructure depends heavily on the selection and design of the Exchange back-end infrastructure. It is critical to consider hardware sizing and mailbox design prior to deploying a messaging solution. Ensuring that enough processor, disk, memory and network resources are available to the back-end Exchange infrastructure ensures that this component does not become the bottle-neck for the entire messaging system. In-depth sizing discussions are outside the scope of this paper, but parties interested in sizing Exchange can run Dell s Exchange advisor, available at http://www.dell.com/exchange. This automated tool simplifies the sizing of new Exchange deployments by asking simple questions and converting the answers into Dell-specific Servers, Storage and Software recommendations. In lieu of running the tool, here are some generic sizing guidelines: Processor Resources: A back-end Exchange server is not very processor intensive. However if you have other applications such as anti-virus or anti-spam running on the server, make sure that there is enough processing power available to support those applications. If the processor utilization of the back end server is consistently greater than 60 70%, closely monitor the back end server performance as additional processing power may be required. Disk Resources: Exchange 2003 is an I/O intensive application and all client activity causes updates to the Exchange database, which produces I/O operations to disk. Your disk subsystem should be capable of meeting these demands. It is therefore important to size your disks for the required I/O performance and not just for capacity of the mailboxes. For a more scalable disk I/O sub-system, it is recommended to use external storage options such as Direct-Attached Storage (DAS) or Storage Area Networks (SAN). Memory Resources: Exchange Server 2003 is a 32-bit application. Therefore, the maximum amount of memory that it can use efficiently is limited to 4GB. Deployments using greater than 4-GB of RAM have shown negative performance impacts. Installing 4 GB of physical RAM takes full advantage of Exchange 2003 s capabilities. Network Resources: Exchange servers and messaging clients access Active Directory when logging on to the network, connecting to a mailbox, or accessing server-based address lists. These activities create a large amount of network traffic between the servers. It is important to have enough network bandwidth available between the servers and client computers. For a medium sized environment of about 2000 users, the Dell PowerEdge 2950 server is an ideal candidate. It provides ample computing power to host 2000 mailboxes while providing ample network and disk expandability options. For larger environments you may add additional mailbox servers to your back-end Exchange infrastructure. For more in-depth sizing recommendations refer to Dell Exchange Advisor Tool available at http://www.dell.com/exchange. 8
Mailbox Server Security Security of the back-end Exchange server is a big concern as these servers host critical data such as user mailboxes and/or public folders. Even with strong perimeter network security in place, the mailbox servers require protection against spam and virus as viruses can enter through other vectors such as web mail, USB drives or other removable storage media. Symantec Mail Security (SMS) for Exchange can provide this required integrated mail protection against virus threats, spam, and other unwanted content. It enables administrators to inspect content in real time as e-mail is being committed and accessed from the Exchange database. Attachment and subject line blocking capabilities provide responses against known threats, and support for hourly definition updates enables organizations to respond quickly to emerging threats. Administrators can also conduct scans on a regular scheduled or on-demand basis to identify, detect and quarantine inappropriate content or potential viruses. High Availability Clustering Since the back-end Exchange servers host mission critical data, it is recommended that you cluster these servers to provide high availability. The basic goal of high availability (HA) clustering is to ensure that the physical server hosting the Exchange mailboxes is not a single point-of-failure, by providing the ability for that Exchange application to be restarted on one of multiple servers in the cluster. If the server running the application fails, another designated server takes over the responsibility of running that application. Dell s high availability (HA) cluster solutions built upon the Microsoft Cluster Server (MSCS) are part of the Secure Exchange Reference architecture. They are designed and tested to make sure that no single point of failure (SPOF) exists. High availability clustering using MSCS requires shared storage, as every node in the cluster needs access to the Exchange data. For more information about Dell HA Clusters refer to http://www.dell.com/ha. 9
4. Storage System: In Dell s Secure Exchange reference architecture storage is sharable via Storage Area Networks (SAN). The fabric utilized is fibre channel as it provides high bandwidth and low latency. With the new emerging 4Gb architecture, there is generally enough bandwidth to support the most I/O intensive applications. Redundant fabrics may be used to provide multiple paths to the data and thereby improve availability. Utilizing LUNs, the storage systems can be abstracted more effectively, eliminating physical dependencies between application and data. This also makes the storage system more scalable as storage can be added or removed easily without disrupting applications. Since Exchange is an I/O intensive application the disk system can potentially become a bottleneck. It is recommended to use a large number of drives with smaller capacity instead of fewer numbers of drives with large capacities. This will help improve the performance of the disk subsystem. For environments of about 2000 users, Dell recommends using external storage. There are several external storage solutions available including Direct-Attached Storage (DAS) or Storage Area Networks (SAN). Dell/EMC Fibre Channel storage arrays provide a great platform to host the Exchange Mailbox Stores. They offer a highly scalable enterprise networked storage with superior performance and advanced management. For more in-depth sizing recommendations, refer to Dell Exchange Advisor Tool available at http://www.dell.com/exchange. 10
5. Tape Backup: To protect e-mail data from potential disaster, the first line of defense is usually to back up critical information using tape or disk. Dell s Secure Exchange Reference Architecture recommends using a SAN-based backup model; however other back up methods may be used depending on your environment and needs. In the SAN-based back up method, all of the components of the messaging subsystem are interconnected on the Fibre-Channel SAN fabric: the Exchange servers, a master backup server, the storage systems, and the tape library. Data traffic can be routed from the Exchange servers through a high-speed Fibre Channel switch and written directly to the tape library. Symantec Backup Exec Dell PowerVault Tape Libraries and Symantec Backup Exec together provide a reliable hardware and software platform to ensure your business-critical email data is protected against application or hardware-based failures. The Dell PowerVault Tape libraries are completely scalable to secure the storage capacity required today while helping ensure that they will meet future requirements. Symantec Backup Exec Agent for Microsoft Exchange Server provides administrators with the means and tools necessary for the complete protection of the Exchange Server. It provides a fast and flexible option to protect Exchange while the application is online. Its customizable options allow users to perform individual mailbox or even an individual mail message backup or restore. The support for SAN based backups further increases the backup and recovery process. After hardware and software components are configured properly in the backup infrastructure and critical backup data is identified, administrators must implement a backup strategy. Exchange works with one or a combination of the following methods: full backup, differential backup, incremental backup, and mirror backup. 11
Exchange Severs Backup Server FC Switches Tape Library Storage System Fig2. SAN Based Back Up Model Full Backup A full backup is designed to store all data, including Exchange database files and transaction logs. This approach helps simplify the recovery process because it saves all the data files and transaction log files in a single backup session. However, a full backup operation consumes the most bandwidth and requires the most storage space compared to differential, incremental, and mirror backups. For that reason, best practices recommend a full backup operation be performed at regular intervals, in rotation with other backup strategies. Differential Backup A differential backup contains only the Exchange transaction log files that have changed since the last full backup; the database files are not copied. Because all the transaction logs since the last full backup are required for a restore operation, circular logging cannot be enabled during a differential backup. Recovery requires both the last full backup and the last differential backup. Best practices recommend 12
that a full backup be performed at regular intervals and supplemented with daily differential backups. Incremental Backup An incremental backup contains the Exchange transaction log files that have changed since the last full, differential, or incremental backup. Of these three types, incremental is the fastest backup method and may be suitable for large Exchange databases with a high volume of daily activity. The drawback to the incremental approach is that recovery requires the last full backup and all subsequent incremental backups. Best practices recommend that a full backup be performed at regular intervals and supplemented with daily incremental backups. Mirror Backup A mirror backup is similar to a full backup except that no file marking is performed. Mirror backup is not ordinarily used for recovery purposes. This method can be used to make a full copy of the Exchange database without disrupting any incremental or differential backup procedures. 13
6. Archiving: With the ever-growing volume of emails there may be several reasons for an organization to consider Archiving solutions including business needs, technical requirements or both. The business needs may include compliance or legal requirements. The technical reasons may include better mailbox management, PST migration, faster retrieval etc. Symantec Enterprise Vault software provides a flexible archiving framework to enable the discovery of content held within email, file system, and collaborative environments -- while helping to reduce storage costs and simplifying management. Enterprise Vault manages content via policy-controlled archiving to online stores for active retention and seamless retrieval of information. It provides powerful search and discovery capabilities to enable end users to access all email content. Enterprise Vault is a powerful product with features that enable email management, archiving and compliance. The detailed description of its architecture and components is outside the scope of this paper. Before it can be deployed, the IT administrators should become familiar with its capabilities. To learn more about Symantec Enterprise Vault refer to Symantec Yellow book titled Introducing Symantec Enterprise Message Management for Microsoft Exchange. Dell and Symantec have worked together to validate and test Symantec Enterprise Vault on Dell servers and storage to ensure interoperability and performance and provide an end-to-end Exchange Solution. 14
Conclusion It is Dell s belief that standardization is the key to the continued evolution of the datacenter. All the components of Dell s Secure Exchange Reference architecture are built using industry standards. They are scalable to accommodate changes in your organization. You have the ability to add or remove capacity on the fly without having to change the base architecture of the messaging system. The reference architecture presented will help you design a secure and highly available Exchange messaging environment. Partnering with industry leaders Microsoft and Symantec has allowed Dell to provide a holistic solution for messaging environments incorporating security and archiving to complement the basic email solution. THIS WHITE PAPER IS FOR INFORMATIONAL PURPOSES ONLY, AND MAY CONTAIN TYPOGRAPHICAL ERRORS AND TECHNICAL INACCURACIES. THE CONTENT IS PROVIDED AS IS, WITHOUT EXPRESS OR IMPLIED WARRANTIES OF ANY KIND. Dell, PowerEdge and the Dell logo are trademarks of Dell Inc. Windows is a trademark of Microsoft Corp. EMC is a trademark of EMC Corporation. 2006 Dell Inc. U.S. only. 15
Resources and References For More information please refer to: http://www.dell.com/exchange http://www.dell.com/powersolutions/ http://www.dell.com/setc http://www.symantec.com/enterprise/ 16