Hardware Sizing and Bandwidth Usage Guide. McAfee epolicy Orchestrator 4.6.0 Software



Similar documents
McAfee Risk Advisor 2.7

McAfee VirusScan Enterprise for Linux Software

Product Guide Revision A. McAfee Secure Web Mail Client Software

Release Notes McAfee Risk Advisor Software For use with epolicy Orchestrator and Software

epolicy Orchestrator Log Files

Product Guide Revision A. McAfee Secure Web Mail Client Software

McAfee epolicy Orchestrator

McAfee Host Data Loss Prevention 9.1 Cluster Installation Guide

McAfee Agent Handler

McAfee Optimized Virtual Environments - Antivirus for VDI. Installation Guide

McAfee Gateway 7.x Encryption and IronPort Integration Guide

McAfee epolicy Orchestrator 4.5 Cluster Installation Guide

Product Guide. McAfee epolicy Orchestrator Software

Product Guide. McAfee Security-as-a-Service Partner SecurityDashboard 5.2.0

McAfee Optimized Virtual Environments for Servers. Installation Guide

McAfee VirusScan Enterprise for Storage 1.0 Sizing Guide for NetApp Filer on Data ONTAP 7.x

Release Notes for McAfee epolicy Orchestrator 4.5

Installation Guide. McAfee epolicy Orchestrator Software

McAfee SiteAdvisor Enterprise 3.5 Patch 2

Desktop Release Notes. Desktop Release Notes 5.2.1

Installation Guide. McAfee Security for Microsoft Exchange Software

McAfee Public Cloud Server Security Suite

McAfee SiteAdvisor Enterprise 3.5.0

Data Center Connector for vsphere 3.0.0

Data Center Connector for OpenStack

Best Practices Guide Revision B. McAfee epolicy Orchestrator Software

Recommended Recommended for all environments. Apply this update at the earliest convenience.

McAfee GTI Proxy Administration Guide

McAfee Solidcore Change Reconciliation and Ticket-based Enforcement

Best Practices Guide. McAfee Endpoint Protection for Mac 1.1.0

Application Note. Configuring McAfee Firewall Enterprise for McAfee Web Protection Service

Best Practices Guide. McAfee epolicy Orchestrator Software

Installation Guide. McAfee VirusScan Enterprise for Linux Software

McAfee Endpoint Encryption for PC 7.0

Product Guide. McAfee SaaS Endpoint Protection 5.2.0

Implementing McAfee Device Control Security

McAfee Policy Auditor software Installation Guide

Installation Guide. McAfee SaaS Endpoint Protection 5.2.0

McAfee SaaS Archiving

Total Protection Service

McAfee Host Data Loss Prevention Best Practices: Protecting against data loss from external devices

Release Notes for McAfee VirusScan Enterprise for Storage 1.0

McAfee Endpoint Security Software

User Guide. FIPS Mode. For use with epolicy Orchestrator 4.6.x Software

McAfee Asset Manager Console

McAfee Policy Auditor 6.0 software Product Guide for epolicy Orchestrator 4.6

McAfee Content Security Reporter 2.0.0

Installation Guide Revision B. McAfee epolicy Orchestrator Software

Installation Guide. McAfee epolicy Orchestrator Software

McAfee Solidcore Product Guide

McAfee Total Protection Service Installation Guide

Setup Guide Revision B. McAfee SaaS Archiving for Microsoft Exchange Server 2010

System Status Monitoring Guide. McAfee Network Security Platform 6.1

McAfee Content Security Reporter Software

Product Guide. McAfee epolicy Orchestrator Software

McAfee. Firewall Enterprise. Application Note TrustedSource in McAfee. Firewall Enterprise. version and earlier

McAfee MOVE AntiVirus Multi-Platform 3.5.0

McAfee Security for Microsoft SharePoint User Guide

Product Guide. McAfee SaaS Endpoint Protection (October, 2012 release)

McAfee Directory Services Connector extension

Network Threat Behavior Analysis Monitoring Guide. McAfee Network Security Platform 6.1

McAfee VirusScan Enterprise 8.8 software Product Guide

McAfee MOVE AntiVirus 2.6.0

How To Encrypt Files And Folders With A Password Protected By A Password Encrypted By A Safesafe (Mafee) (Eeff) 4

Product Guide Revision A. McAfee Web Reporter 5.2.1

Installation Guide. McAfee epolicy Orchestrator Software

McAfee Client Proxy 2.0

Unprecedented Malware Growth

Verizon Internet Security Suite Powered by McAfee User Guide

McAfee Data Loss Prevention 9.3.0

Product Guide Revision A. McAfee Data Loss Prevention Endpoint 9.3.0

Server Installation Guide ZENworks Patch Management 6.4 SP2

McAfee Client Proxy Software

Virtualization Guide. McAfee Vulnerability Manager Virtualization

Product Guide. McAfee Endpoint Protection for Mac 2.1.0

McAfee Cloud Identity Manager

Product Guide. McAfee epolicy Orchestrator Software

McAfee VirusScan and epolicy Orchestrator Administration Course

McAfee UTM Firewall Control Center Product Guide. version 2.0

Application Note. Providing Secure Remote Access to Industrial Control Systems Using McAfee Firewall Enterprise (Sidewinder )

McAfee Data Loss Prevention Endpoint

Application Note Configuring Department of Defense Common Access Card Authentication on McAfee. Firewall Enterprise

McAfee Cloud Identity Manager

Symantec Endpoint Protection 11.0 Architecture, Sizing, and Performance Recommendations

Installation Guide Revision B. McAfee Gateway 7.x Virtual Appliances

Release Notes for McAfee(R) GroupShield(TM) version Patch 1 for Microsoft Exchange. Copyright (C) 2011 McAfee, Inc. All Rights Reserved CONTENTS

McAfee Cloud Identity Manager

Best Practices Guide. McAfee Security for Microsoft Exchange Software

Installation Guide. McAfee SaaS Endpoint Protection 6.0

McAfee Application Control / Change Control Administration Intel Security Education Services Administration Course

McAfee Data Loss Prevention Endpoint 9.4.0

McAfee VirusScan Enterprise 8.8 software Installation Guide

Product Guide. McAfee Endpoint Security for Mac Threat Prevention

Product Guide Revision A. McAfee Total Protection for Data Loss Prevention 9.2 Software

How To Set Up A Firewall Enterprise, Multi Firewall Edition And Virtual Firewall

Best Practices Revision A. McAfee Gateway 7.x Appliances

Installation Guide. McAfee SaaS Endpoint Protection

Infor Web UI Sizing and Deployment for a Thin Client Solution

Transcription:

Hardware Sizing and Bandwidth Usage Guide McAfee epolicy Orchestrator 4.6.0 Software

COPYRIGHT Copyright 2011 McAfee, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies. TRADEMARK ATTRIBUTIONS AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN, WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

Contents Preface 5 About this guide.................................. 5 Audience.................................. 5 Conventions................................. 5 Finding product documentation............................ 6 1 Introduction 7 Purpose of this guide................................. 7 2 Calculating Hardware Requirements 9 Types of servers used for testing............................ 9 Considerations for outbreak response...................... 10 Recommendations for events per client per ASCI.................. 10 Managed systems per server............................. 10 Agent Handler scalability............................ 12 3 Bandwidth Usage 13 Bandwidth requirements for initial deployment...................... 13 Agent deployment and bandwidth........................ 13 Bandwidth requirements to deploy managed products................... 14 Methods to minimize impact when deploying products................ 15 Bandwidth recommendations for repository distribution.................. 15 4 Concurrent Users 19 Concurrent users and the effect on dashboard page loading................ 19 5 Database Sizing 21 A Appendix: Dashboard page load times 23 Index 25 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 3

Contents 4 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

Preface This guide provides the information you need to configure, use, and maintain your McAfee product. Contents About this guide Finding product documentation About this guide This information describes the guide's target audience, the typographical conventions and icons used in this guide, and how the guide is organized. Audience McAfee documentation is carefully researched and written for the target audience. The information in this guide is intended primarily for: Administrators People who implement and enforce the company's security program. Conventions This guide uses the following typographical conventions and icons. Book title or Emphasis Title of a book, chapter, or topic; introduction of a new term; emphasis. Bold User input or Path Code Text that is strongly emphasized. Commands and other text that the user types; the path of a folder or program. A code sample. User interface Hypertext blue Words in the user interface including options, menus, buttons, and dialog boxes. A live link to a topic or to a website. Note: Additional information, like an alternate method of accessing an option. Tip: Suggestions and recommendations. Important/Caution: Valuable advice to protect your computer system, software installation, network, business, or data. Warning: Critical advice to prevent bodily harm when using a hardware product. McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 5

Preface Finding product documentation Finding product documentation McAfee provides the information you need during each phase of product implementation, from installation to daily use and troubleshooting. After a product is released, information about the product is entered into the McAfee online KnowledgeBase. Task 1 Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com. 2 Under Self Service, access the type of information you need: To access... User documentation Do this... 1 Click Product Documentation. 2 Select a product, then select a version. 3 Select a product document. KnowledgeBase Click Search the KnowledgeBase for answers to your product questions. Click Browse the KnowledgeBase for articles listed by product and version. 6 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

1 Introduction 1 This document helps you determine the level of server hardware, system core, memory, storage, and network bandwidth that McAfee recommends for the server-based components of your epolicy Orchestrator software deployment. This information can help you make hardware purchasing and provisioning decisions. Purpose of this guide McAfee has performed tests on different server-class systems to help you decide the hardware requirements for epolicy Orchestrator deployment. What is the goal? Assess and recommend the hardware required to support and manage environments of varying sizes. What is being measured and determined? Number of agent communication transactions processed over a period of time. Peak transaction rates for each server configuration. Recommendations for the number of client systems a server can manage. Which products were tested? The following McAfee products were tested: Agent 4.6.0 Application Control Change Control 5.1.0 Change Reconciliation 5.1.0 Email Gateway 5.6.1 Endpoint Encryption for Files and Folders 4.0.0 Endpoint Encryption for PC 6.1.0 GroupShield for Microsoft Exchange 7.0.1 Host Data Loss Prevention 9.1.0 Host Intrusion Prevention 8.0.0 Host Intrusion Prevention Content 3816 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 7

1 Introduction Purpose of this guide Integrity Control 5.1.0 MOVE-AV for VDI (MOVE) 2.0.0 Network Access Control 3.2.1 Network Security Platform 6.0.1 Policy Auditor 5.3.0 Rogue System Detection 4.6.0 Security for Microsoft SharePoint 2.5.0 SiteAdvisor Enterprise Plus 3.0.0 VirusScan Enterprise 8.8 VirusScan Enterprise DAT 6334 VirusScan Enterprise Engine 5400 Vulnerability Manager 7.0.0 Web Gateway 7.1.0 What effect does the product have on events and performance? An event from VirusScan Enterprise is essentially the same size as an event from McAfee Host Intrusion Prevention. Performance is determined by how many events a product generates. 8 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

2 Calculating 2 Hardware Requirements McAfee provides hardware recommendations for the server-based components of your epolicy Orchestrator deployment. Use these recommendations when allocating server hardware to host the epo server. Contents Types of servers used for testing Managed systems per server Types of servers used for testing McAfee conducted tests on a four-core epolicy Orchestrator server with an eight-core database. The following are specifications for the epolicy Orchestrator server, the database server, and the network. epolicy Orchestrator server specifications Four-core server system, Intel Xeon X5650 2.67 GHz 1 GB of RAM per core Windows 2008 Server R2, 64-bit RAID 5 array with internal SAS drives Database server specifications Eight-core server system, Intel Xeon E7540 2.00 GHz 1 GB of RAM per core Windows 2008 Server R2, 64-bit SQL Server 2008, Service Pack 2, 64-bit RAID 5 array with internal SAS drives McAfee recommends that in larger environments (>50,000 nodes), you store the Data and Logs databases on separate spindles in a RAID 1+0 configuration. Agent Handler specifications Four-core server system, Intel Xeon X5650 2.67 GHz 1 GB of RAM per core Windows 2008 Server R2, 64-bit RAID 5 array with internal SAS drives McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 9

2 Calculating Hardware Requirements Managed systems per server Network specification 1000Base-T Ethernet Considerations for outbreak response When applying this data to your own environment, you must consider your outbreak response requirements, including the response time and the number of systems. Response time The time period during which all systems must check in to the epo server. The three factors that define the response time in epolicy Orchestrator are: Agent-to-server communication interval You can configure the response time when setting the agent-to-server communication interval (ASCI). Agent wake-up call The agent wake-up call is initiated manually, but you can determine the response time by setting this period as the Agent randomization interval. Global updating Once configured, global updating initiates updating automatically when packages are checked in. You can configure the response time by setting the randomization interval. Although this information includes data for one to eight-hour response times, McAfee recommends a response time of no greater than six hours. Number of systems The number of managed systems that are required to check in within the response time. Recommendations for events per client per ASCI McAfee recommends < 25 events per client per ASCI. Use this formula to calculate the number of client events per ASCI in your environment. Total number of events / number of client systems / ASCI per day (24/ASCI) With your environment set up according to this recommendation, you can use the chart and table under Managed systems per server to calculate the number of client systems your server can manage with a given response time. Managed systems per server The data in the following chart and tables shows the response times for managed systems. These recommendations are conservative, based on test results that were significantly higher, in order to accommodate instances of increased load. The calculations here are for an environment with <99 events per client per ASCI. For the best performance, McAfee recommends an environment with <25 events per client per ASCI. 10 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

Calculating Hardware Requirements Managed systems per server 2 Although the data is provided for one- to eight-hour response times, McAfee recommends a response time no greater than six hours. Figure 2-1 Managed systems' response time Table 2-1 Client systems managed by epolicy Orchestrator 4.6.0 Required response time (hours) Four-core epolicy Orchestrator server Eight-core SQL server 1 66,000 2 133,200 3 199,800 4 266,400 5 333,000 6 399,600 7 466,200 8 532,800 Table 2-2 CPU usage of epolicy Orchestrator 4.6.0 and database server Required response time (hours) Four-core epolicy Orchestrator server Eight-core SQL server 1 ~100% 2 ~20% McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 11

2 Calculating Hardware Requirements Managed systems per server Agent Handler scalability Adding distributed Agent Handlers to your managed environment can help you scale your network. However, as the following figure shows, adding numerous Agent Handlers might result in diminishing returns. This is the result of the fact that Agent Handlers must be in constant contact with the epolicy Orchestrator database, and this connection can consume a significant amount of bandwidth. Figure 2-2 Number of managed systems by number of Agent Handlers Table 2-3 Client systems managed by epolicy Orchestrator 4.6.0 with 1 hour ASCI Number of distributed Agent Handlers Four-core Agent Handler Eight-core SQL server 1 64,800 2 137,400 3 73,800 4 59,400 5 61,200 Due to the bottleneck on the database server, McAfee recommends distributing up to three Agent Handlers to epolicy Orchestrator for a network site if the database server has eight cores or fewer. If the ASCI value is more than one hour, multiply the number of client systems by your ASCI value. 12 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

3 Bandwidth 3 Usage This section identifies and describes the network traffic generated by epolicy Orchestrator and its components in a managed environment. It also covers product tuning information to help you balance bandwidth resources with the needs of the product. Use this information when customizing your deployment strategies and policy settings, to maximize network efficiency and ensure that you do not exceed the bandwidth limitations of your environment. Contents Bandwidth requirements for initial deployment Bandwidth requirements to deploy managed products Bandwidth recommendations for repository distribution Bandwidth requirements for initial deployment When implementing epolicy Orchestrator in your environment, you must distribute agents, components, and security products to manage and protect the systems on the network. Agent deployment and bandwidth During the initial setup of the managed environment, deploying the agent generates enough network traffic that we recommend planning the deployment. Although the installation package for the agent is smaller than those of other products (such as VirusScan Enterprise), the agent must be deployed to each client system you want to manage. This table shows the total bandwidth used on an epo server, client system, and database server for agent 4.6.0 deployment. Table 3-1 Agent 4.6.0 deployment Agent deployment Total Tx Rx epolicy Orchestrator server 5.04 4.83 0.21 Client system 4.64 0.04 4.60 Database server 0.42 0.18 0.24 Actual deployment The first and most extensive use of bandwidth occurs when the agent installation package is deployed to client systems. You can deploy the agent installation package from the epolicy Orchestrator console to sites, groups, or systems in the System Tree. Regardless of the method you use, deploying the agent installation package over the network generates traffic to each system. Base the agent deployment on the number of client systems you plan to manage, their location in the network topology, and the amount of bandwidth you have available between the epo server and these systems. McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 13

3 Bandwidth Usage Bandwidth requirements to deploy managed products McAfee recommends deploying agents: In stages Do not push network utilization over 80% at any time for a given segment of resources. To individual sites or groups This is especially important if you have more bandwidth-limiting factors such as slower connections between geographic locations. Location of network impact Agent-deployment traffic occurs directly between the epolicy Orchestrator server and the systems to which the agent is deployed. Bandwidth requirements to deploy managed products Deploying security products such as VirusScan Enterprise to client systems can be the most bandwidth-intensive part of setting up a managed environment. Like the agent, security software must be installed on each system you plan to manage. This table shows the total bandwidth (in megabytes) used to deploy specific managed products, as well as the data transmitted and received by the epolicy Orchestrator server, a client system, and the database server. Table 3-2 McAfee product deployment Product Deployment epo server SQL server Client system Total Tx Rx Total Tx Rx Total Tx Rx Disk space Agent 4.6.0 5.04 4.83 0.21 0.42 0.18 0.24 4.64 0.04 4.60 33.90 Endpoint Encryption for Files and Folders 4.0.0 Endpoint Encryption for PC 6.1.0 GroupShield Enterprise 7.0.0 Host Data Loss Prevention 9.1.0 Host Intrusion Prevention 8.0.0 McAfee Network Access Control 3.2.0 9.91 5.21 4.70 6.14 4.61 1.53 3.77 0.09 3.67 22.92 174.79 17.04 0.44 0.50 0.29 0.22 16.98 0.15 16.83 11.29 129.81 114.02 15.79 19.15 14.49 4.66 110.66 1.30 109.36 531.41 31.47 16.85 14.62 18.75 14.38 4.38 12.71 0.24 12.47 126.78 13.67 13.29 0.38 0.57 0.25 0.32 13.10 0.13 12.97 43.02 14.86 14.47 0.39 0.85 0.25 0.60 14.30 0.14 14.16 16.51 MOVE-AV 2.0 8.88 8.54 0.34 0.63 0.27 0.36 8.25 0.07 8.18 6.00 Security for Microsoft SharePoint 2.5.0 191.04 155.07 35.98 45.58 34.39 11.19 145.47 1.59 143.88 610.94 14 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

Bandwidth Usage Bandwidth recommendations for repository distribution 3 Table 3-2 McAfee product deployment (continued) Product Deployment epo server SQL server Client system Total Tx Rx Total Tx Rx Total Tx Rx Disk space Policy Auditor 5.3.0 Rogue System Detection 4.6.0 Site Advisor Enterprise 3.0.0 24.41 23.82 0.60 0.94 0.39 0.55 23.47 0.21 23.26 46.31 5.74 5.53 0.21 0.31 0.15 0.16 5.44 0.06 5.37 5.46 5.25 5.01 0.23 0.75 0.47 0.06 4.78 0.05 4.73 15.43 Solidcore 5.1.0 12.62 11.88 0.73 1.34 0.63 0.71 11.28 0.10 11.18 35.70 VirusScan Enterprise 8.8.0 97.19 95.48 1.72 2.52 1.01 1.51 94.67 0.71 93.96 320.55 Methods to minimize impact when deploying products Consider these suggestions to minimize traffic generated by deploying products. Deploy the product to segments of the System Tree, rather than all systems at once. For example, schedule the deployment task to run for one group at a time. Use randomization intervals to distribute the deployment to a group over a period of time. Schedule the deployment task to run at local time, which is the default setting. This is helpful if your enterprise has offices in different time zones. Create and configure distributed repositories to localize network traffic during product deployment. Before running the deployment task, replicate the deployment package from the master repository to the distributed repositories. The deployment task generates traffic between the agent and the nearest repository only. However, after an installation, the agent sends properties to the server. Updating from the closest distributed repository localizes the traffic for product deployment. Bandwidth recommendations for repository distribution If the epo server is managing systems across the Wide Area Network (WAN), McAfee recommends that you create distributed repositories on each Local Area Network (LAN) for client updates. McAfee recommends that you create at least one distributed repository per LAN. Number of distributed repositories Systems in LAN Network Bandwidth (LAN) 100 Mbps 1 Gbps 1,000 1 1 2,000 2 1 3,000 3 1 4,000 4 1 5,000 5 1 10,000 10 2 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 15

3 Bandwidth Usage Bandwidth recommendations for repository distribution Systems in LAN Network Bandwidth (LAN) 100 Mbps 1 Gbps 20,000 20 2 30,000 30 3 Recommendations for the server If WAN bandwidth is 6 Mbps, approximately two distributed repositories are updated per minute. McAfee recommends following these steps to avoid network bandwidth saturation. 1 Create an incremental replication task for each distributed repository in each LAN. 2 According to bandwidth (WAN) in Mbps, set each task to run sequentially at the minimum of the minutes of the corresponding randomization interval, to avoid overlap. Bandwidth (WAN) 6 Mbps 1 5 Mbps 2 4 Mbps 3 3 Mbps 4 2 Mbps 5 1 Mbps 6 Randomization interval (minutes) Recommendations for each client 1 Add the local distributed repository to the repository list in the agent policy. 2 Select the repository by Ping Time. 3 Create an agent update task with a randomization interval according to this table. Table 3-3 Recommended interval (minutes) for 1 Gbps network bandwidth Systems in LAN Distributed repositories in LAN 1 2 3 1,000 5 0 0 2,000 10 5 0 3,000 15 10 0 4,000 20 15 5 5,000 30 20 10 10,000 60 40 20 20,000 120 80 40 30,000 180 120 60 Table 3-4 Recommended interval (minutes) for 100 Mbps network bandwidth Systems in LAN Distributed repositories in LAN 1 2 3 4 5 1,000 60 30 20 15 10 2,000 120 60 40 30 20 16 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

Bandwidth Usage Bandwidth recommendations for repository distribution 3 Table 3-4 Recommended interval (minutes) for 100 Mbps network bandwidth (continued) Systems in LAN Distributed repositories in LAN 1 2 3 4 5 3,000 180 90 60 45 30 4,000 240 120 80 60 40 5,000 300 150 100 75 50 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 17

3 Bandwidth Usage Bandwidth recommendations for repository distribution 18 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

4 4 Concurrent Users The epolicy Orchestrator server is able to handle multiple user (http) requests. McAfee has calculated the results of the average page load time versus the number of concurrent user requests with data of 100,000 managed nodes plus 13,000,000 events and 100,000 RSD Detected System Properties. Concurrent users and the effect on dashboard page loading Page load time is the time it takes the epolicy Orchestrator server to respond to a user request to fully load a dashboard page in the web browser. Test scenario A number of users concurrently launched a specific dashboard. When the dashboard was fully loaded, each user refreshed the dashboard immediately and repeated this 20 times. The following chart shows the average dashboard page load time across all dashboards for all tested products (those listed in the "Which products were tested" section in the Purpose of this guide. A detailed listing of load times by user for each product is included in Appendix A: Complete dashboard page load time by number of users. Average dashboard load time by number of users McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 19

4 Concurrent Users Concurrent users and the effect on dashboard page loading 20 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

5 Database Sizing When planning for hardware purchase, an important factor to consider is the amount of storage space you will need. Beyond the initial installation of epolicy Orchestrator to a server, the portion of your environment that experiences the most growth is the database. Consider the data in these tables to plan appropriately for your database storage needs. Table 5-1 epolicy Orchestrator installation size Requirement Size Database 826.25 Database transaction log 235.56 Total 1061.81 Table 5-2 Database size requirements Requirement Size (KB) For a client system 30.72 For an event 1.74 Calculating database size requirements To calculate the size of the database, use this formula: Installed database size + (number of clients x client system size) + (number of events generated x event size). For example, in an environment with 1,000 clients and 10,000 events, the calculation is 1061.81MB + (1,000 x 30.72KB) + (10,000 x 1.74KB) = 1108.80MB. The following table lists the size of the database, based on the number of events generated and the number of client systems being managed. Use this data to plan appropriately for your storage needs. Table 5-3 Database size by number of events and client systems Events System nodes 500 1,000 5,000 10,000 50,000 100,000 150,00 200,000 250,000 300,000 0 1,077 1,092 1,212 1,362 2,562 4,062 5,562 7,062 8,562 10,062 10,000 1,094 1,109 1,229 1,379 2,579 4,079 5,579 7,079 8,579 10,079 20,000 1,111 1,126 1,246 1,396 2,596 4,096 5,596 7,096 8,596 10,096 30,000 1,128 1,143 1,263 1,413 2,613 4,113 5,613 7,113 8,613 10,113 40,000 1,145 1,160 1,280 1,430 2,630 4,130 5,630 7,130 8,630 10,130 50,000 1,162 1,177 1,297 1,447 2,647 4,147 5,647 7,147 8,647 10,147 60,000 1,179 1,194 1,314 1,464 2,664 4,164 5,664 7,164 8,664 10,164 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 21

5 Database Sizing Table 5-3 Database size by number of events and client systems (continued) Events System nodes 500 1,000 5,000 10,000 50,000 100,000 150,00 200,000 250,000 300,000 70,000 1,196 1,211 1,331 1,481 2,681 4,181 5,681 7,181 8,681 10,181 80,000 1,213 1,228 1,348 1,498 2,698 4,198 5,698 7,198 8,698 10,198 90,000 1,230 1,245 1,365 1,515 2,715 4,215 5,715 7,215 8,715 10,215 100,000 1,247 1,262 1,382 1,532 2,732 4,232 5,732 7,232 8,732 10,232 110,000 1,264 1,279 1,399 1,549 2,749 4,249 5,749 7,249 8,749 10,249 120,000 1,281 1,296 1,416 1,566 2,766 4,266 5,766 7,266 8,766 10,266 130,000 1,298 1,313 1,433 1,583 2,783 4,283 5,783 7,283 8,783 10,283 140,000 1,315 1,330 1,450 1,600 2,800 4,300 5,800 7,300 8,800 10,300 150,000 1,332 1,347 1,467 1,617 2,817 4,317 5,817 7,317 8,817 10,317 160,000 1,349 1,364 1,484 1,634 2,834 4,334 5,834 7,334 8,834 10,334 170,000 1,366 1,381 1,501 1,651 2,851 4,351 5,851 7,351 8,851 10,351 180,000 1,383 1,398 1,518 1,668 2,868 4,368 5,868 7,368 8,868 10,368 190,000 1,400 1,415 1,535 1,685 2,885 4,385 5,885 7,385 8,885 10,385 200,000 1,417 1,432 1,552 1,702 2,902 4,402 5,902 7,402 8,902 10,402 22 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

A Appendix: Dashboard page load times The following table provides a detailed list of dashboard page load times by product and number of users. Page load time is the time it takes the epolicy Orchestrator server to respond to a user request to fully load a dashboard page in the web browser. For more information on the test scenario in which this data was generated, see Concurrent users and the effect on dashboard page loading. Table A-1 Dashboard page load times by number of users Dashboard Load time (seconds) by number of users 1 5 10 20 30 40 50 60 70 80 90 100 Audit 1.27 2.82 5.07 10.64 15.48 23.78 30.10 33.05 40.42 50.16 52.69 55.68 DLP: Status Summary 1.72 2.85 6.44 11.99 17.77 23.91 32.35 34.07 39.13 45.77 52.54 63.74 EWS Dashboard 1.33 4.48 5.43 10.02 15.80 21.57 23.60 31.33 38.30 45.38 57.19 53.22 Endpoint Encryption Executive Dashboard GroupShield for Exchange 7.0 Host IPS: Dashboard Host IPS: Triggered Signature MEG Activity Dashboard 1.11 2.90 4.93 10.92 15.34 23.03 28.74 35.54 41.01 43.29 45.02 58.66 1.23 3.13 5.04 9.62 15.11 19.52 24.58 31.09 41.15 46.16 55.16 57.25 1.48 2.67 5.56 10.33 16.78 20.16 28.90 30.76 38.36 52.23 47.54 56.67 1.35 4.47 6.73 10.48 15.87 22.73 30.55 35.72 42.15 50.10 54.17 58.44 1.50 2.64 5.56 11.12 15.98 21.82 32.78 36.08 43.34 52.90 53.57 64.73 1.16 4.52 6.37 10.02 16.42 23.34 30.57 34.86 42.82 48.45 52.84 60.20 MEG Server Status 1.07 2.51 4.36 10.09 15.78 21.84 27.77 27.60 39.35 47.19 57.31 60.14 MRA Rollup: Risk Advisory MRA: Threat Action Advisory MRA: Threat Dashboard 1.49 2.75 4.77 11.34 16.18 20.16 29.11 30.66 39.04 44.53 52.52 52.44 1.31 2.58 4.62 9.87 15.40 20.46 28.80 29.31 42.19 42.91 56.42 58.38 1.43 2.83 4.81 10.82 15.75 20.88 29.68 32.15 39.71 36.50 54.20 58.71 MVM Summary 1.33 2.55 4.51 10.61 16.24 20.22 29.28 31.07 41.13 42.01 48.87 56.68 MVM Web Assessment Summary MWG 6.x Dashboard 1.58 2.70 5.19 10.99 16.36 23.42 26.23 32.18 40.03 44.66 52.19 59.94 1.33 2.70 4.15 10.62 16.89 23.44 32.15 31.63 39.39 40.53 55.32 54.66 MWG 7 Dashboard 1.39 2.61 5.06 10.47 16.71 23.32 30.87 31.28 38.03 41.33 47.24 57.94 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 23

A Appendix: Dashboard page load times Table A-1 Dashboard page load times by number of users (continued) Dashboard Load time (seconds) by number of users 1 5 10 20 30 40 50 60 70 80 90 100 NAC Summary 1.34 2.66 5.24 11.74 16.92 23.45 30.49 34.81 36.48 46.53 51.24 57.20 NSP Network Security Platform Summary PA: Compliance Summary PA: MS Patch Status Summary 1.45 2.88 5.38 11.44 16.45 24.28 26.96 36.38 41.98 54.11 53.39 58.24 1.69 2.61 5.77 10.93 18.20 23.89 29.31 31.59 44.11 45.68 55.62 61.82 1.56 2.56 5.53 10.40 17.62 23.02 30.08 34.13 43.67 39.64 50.99 55.23 PA: PCI Summary 1.87 2.92 6.00 11.28 16.70 23.47 29.09 35.71 39.93 44.42 52.08 53.57 PortalShield for SharePoint Product Deployment 1.34 2.88 5.33 10.12 15.74 23.20 28.99 33.69 41.68 36.61 53.86 62.71 1.55 2.90 5.77 9.75 16.96 23.79 31.69 32.38 39.96 50.54 49.02 60.47 RSD Summary 1.45 2.89 5.72 10.76 16.12 22.55 28.43 32.06 39.05 38.05 47.32 62.90 SAE+: Activity 1.44 2.58 5.42 10.76 16.44 22.04 26.54 31.67 40.33 46.12 53.73 60.44 SAE+: Authorize/ Prohibit Lists SAE+: Content Summary SAE+: Security Summary SAE+: Single Rating Factor Block/ Warn SAE+: Warned/ Blocked Solidcore: Application Control Solidcore: Change Control Solidcore: Integrity Monitor 1.37 2.52 5.19 10.70 16.17 22.25 30.47 37.71 34.83 47.44 53.83 55.34 1.49 2.55 5.31 10.24 16.75 21.10 28.26 31.40 37.57 47.48 53.18 59.97 1.38 2.65 5.41 10.81 17.18 21.61 30.90 31.12 41.92 45.52 47.01 51.74 1.63 2.50 5.69 10.51 16.16 22.32 29.00 34.29 43.04 50.68 53.70 51.12 1.32 4.01 5.21 10.79 15.25 22.67 27.87 36.54 44.78 40.95 55.07 63.10 1.43 4.38 5.20 11.05 16.08 23.55 62.26 35.70 42.62 46.55 55.46 63.40 1.44 2.49 5.44 10.47 16.99 22.46 29.10 32.41 41.28 41.56 56.56 57.98 1.64 2.64 6.19 12.33 17.35 23.99 28.73 33.48 37.31 48.43 50.51 55.16 Threat Events 1.57 2.56 5.09 9.59 15.79 23.02 30.55 32.17 44.82 49.60 51.74 54.60 Trends 1.50 2.45 5.60 10.15 17.21 23.41 30.28 37.30 41.51 45.70 59.87 59.57 VSE: Current Detections 1.64 2.52 5.65 10.22 17.48 23.67 28.56 35.29 40.44 43.86 56.44 61.06 VSE: Trending Data 1.47 2.47 5.64 10.22 17.54 21.79 28.13 31.96 42.04 50.69 51.52 63.93 epo Summary 1.43 2.80 5.96 10.81 15.05 22.94 29.52 37.47 41.17 51.32 51.34 61.81 Average Page Load Time (seconds) 1.44 2.90 5.39 10.64 16.41 22.51 30.03 33.27 40.67 45.78 52.78 58.43 24 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

Index A about this guide 5 C conventions and icons used in this guide 5 D documentation audience for this guide 5 product-specific, finding 6 documentation (continued) typographical conventions and icons 5 M McAfee ServicePortal, accessing 6 S ServicePortal, finding product documentation 6 T Technical Support, finding product information 6 McAfee epolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 25

00