SmartCloud Notes. Guidance on Migration Strategies and Tooling from On-Premises Mail Solution to SmartCloud Notes. December 2015

Transcription

1 Migration to IBM SmartCloud Notes Guidance on Migration Strategies and Tooling from On-Premises Mail Solution to SmartCloud Notes December

2 Table of Contents PART 1 - INTRODUCTION 4 INTENDED AUDIENCE 4 PART 2 - HYBRID IMPLEMENTATION & CONFIGURATION 5 SMARTCLOUD NOTES HYBRID REFERENCE ARCHITECTURE 5 KEY VALUE PROPOSITIONS OF HYBRID CONFIGURATION 6 COMMON SMARTCLOUD NOTES HYBRID CONFIGURATION 7 SETTING UP THE HYBRID CONFIGURATION 12 PART 3 - HYBRID ACTIVATION & TESTING 16 SMARTCLOUD NOTES HYBRID ACCOUNT ACTIVATION 16 SMARTCLOUD NOTES HYBRID VALIDATION & TESTING 17 SMARTCLOUD NOTES ADMINISTRATION USER ACCOUNTS AND SYSTEM SETTINGS 18 PART 4 - USER/DATA TRANSITION & PROVISIONING OVERVIEW 22 ASSESSMENT, PLANNING & PREPARATION 22 PREPARING FOR USER/DATA TRANSITION 26 USER/DATA TRANSITION PROCESS 27 PART 5 - STAGING SERVER & FILEZILLA SETUP 34 ABOUT THE STAGING SERVER & TOOLS 34 CREATING & CONFIGURING OPT STEPS 35 PART 6 - CONFIGURING OTT DATABASE/SHELL SCRIPTS 36 CREATING & CONFIGURING OTT STEPS 36 PART 7 - REVIEWING OTT CONFIGURATION DOCUMENTS 37 STEP CONFIGURATION DOCUMENTS 37 TASK CONFIGURATION DOCUMENTS 39 MEMO CONFIGURATION DOCUMENTS 40 PART 8 - SCANNING, USER GROUPING & DATA CAPTURE 41 SCANNING THE EXISTING ENVIRONMENT 41 CREATING GROUPS & BATCHES OF USERS 42 CREATING THE IMPORT REQUEST 44 CAPTURING THE MAIL DATABASE REPLICAS 45 PART 9 - ENCRYPT, UPLOAD, IMPORT & PROVISION USERS 47 ENCRYPTING THE DATA FOR TRANSFER 47 UPLOADING THE ENCRYPTED DATA TO SMARTCLOUD NOTES 48 PREPARING UPLOADED DATA & PROVISIONING ACCOUNTS 49 PROVISIONING NEW USER ACCOUNTS 52 2

3 PART 10 - MAIL ONBOARDING MANAGER (MOM) 53 WHAT IS MOM? 53 MOM ARCHITECTURE 53 MOM CONSIDERATIONS 54 INSTALLATION & SETUP 54 DOWNLOAD MOM 62 LINK TO MOM DEMO 62 PART 11 - SMARTCLOUD UPGRADE FACTORY (SCUF) 63 WHY USE SCUF? 63 PRICING & HOW IT WORKS 64 CUSTOMER ROLES & RESPONSIBILTIES 65 PREREQUISITES 66 PART 12 - COMPARING MIGRATION OPTION & PROCESSES 67 WHEN TO USE SMARTCLOUD NOTES SERVICE-ONLY 67 WHEN TO USE SMARTCLOUD NOTES HYBRID 68 WHY USE OPT/OTT? 68 WHY USE MOM? 69 WHEN TO USE WHAT MIGRATION TOOL 69 MIGRATION PROCESS 71 3

4 Part 1 - Introduction With the emergence of Connections Cloud, companies are having renewed interest in evaluation of their messaging and social platforms. The ability to provide onboarding capabilities for companies to migrate to SmartCloud Notes is critical for technology adoption. This document will explore strategies for migration to SmartCloud Notes from an on premises mail solution exploring several options. It will provide guidance on the type of migration strategies customers should consider, how to assess, plan and prepare to before migrating, and specific capabilities required before and during migration. Topics such as implementing, configuring, activating, testing, transitioning, provisioning, staging, reviewing, scanning, grouping, encrypting, uploading, importing and comparing will be discussed. Intended Audience We understand that information already exists but not in a single source document. It is designed to assist technical practitioners with the migration of mail from an on premises mail solution to SmartCloud Notes. The various methods and options can be evaluated and utilized by practitioners to create the best scenario for a customer. Each section of the document highlights important topics for migration. A solid understanding of the existing Domino cloud migrations and a fundamental Domino administration is key. The following highlights the intended audience: Certified Practitioners - Technical practitioners who are certified to use the OPT/OTT, MOM and migration tooling for SmartCloud Notes should review this document. This can include Business Partners and Technical Services professionals. Technical Sales Technical sales professionals who require a deep understanding of the steps to migrate customers wishing to move to SmartCloud Notes. IBM Business Partners wishing to better understand the opportunity and process for migration of on premises mail to SmartCloud Notes. Customers wishing to gain knowledge about all the available options in order to choose the best method for their situation. 4

5 Part 2 - Hybrid Implementation & Configuration Below is a logical diagram that illustrates the main components of the SmartCloud Notes service and their placement relative to various network zones. Figure 1 - SmartCloud Notes "Hybrid" Reference Architecture The diagram in Figure 1 is called the SmartCloud Notes Hybrid Reference Architecture. It is a logical diagram that illustrates the main components of the SmartCloud Notes service and their placement relative to various network zones. The red zone at the top contains all clients, mobile devices, and servers (including customer networks) that might want to connect to SCN. These are all items that SCN service does not manage and exist outside of our external firewall. The yellow zone is the traditional DMZ, through which only authenticated users and clients can pass, so it includes the authentication services. The green zone contains the servers that make up the SCN service. This includes SMTP and NRPC routing servers, BES and Traveler servers for mobile device support. Users are hosted on 5-node Domino clusters, with each user having a replica on 2 nodes in a cluster. Clusters are horizontally scalable to increase capacity as necessary. 5

6 Directory services are provided by Tivoli Directory Server and a synchronization service is provided to ensure that TDS and customer directory replicas remain consistent. Import servers are used as a temporary storage for existing mail databases being migrated into the service where they can be scanned for virus and prepared for provisioning. Hybrid refers to a specific configuration of the SmartCloud Notes customer account within the service that allows existing IBM Domino customers to integrate the onpremises environment and is a core strength and value proposition. The customer Admin can choose if the mail users mail account exists on-premises or in the SmartCloud Notes service. Customers select the Hybrid Environment option when performing initial setup. Key Value Propositions Customers can keep current environment Supports IBM Notes, browser, IMAP and mobile clients Users don't need to care who is Hosted or On-Premises Maintains the existing certificate hierarchy and domain structure Supports native NRPC mail routing No change required to continue accessing existing applications Existing mail databases can be transitioned in their entirety or with a selected subset of data Version requirements for on-premise Domino servers: Figure 2 - Domino version requirements 6

7 "Hybrid" Basic Architecture Most suitable for implementations where HA is not a requirement (e.g. pilot or smaller customer implementations) Figure 3 - Hybrid Basic Architecture This simplest implementation above has a single on-premises domain, containing at least one existing Domino server and uses a single passthru server for inbound connectivity. The passthru server may even already exist for some customers so it is just a case of validating server versions and doing the configuration. 7

8 "Hybrid" - High Availability Implementation Figure 4 - Hybrid High Availability Implementation The diagram in Figure 4 shows that the SCN configuration supports having up to 2 server for each of the passthru, mail routing and directory replication servers. This provides a more highly available integration. Each pair of servers are designated as a primary and secondary in an active / passive model. If the primary is not available the secondary is used; there is no load balancing of connections or requests across the servers. 8

9 "Hybrid" - Multiple Domain Architecture Figure 5 - Hybrid Multiple Domain Architecture Multiple Domino domains One domain designated as primary through which hybrid connectivity from SmartCloud Notes is achieved Other domains become subordinates in the context of mail routing, free-time lookup and directory replication Directory updates from downstream domains are replicated via the directory replication hubs in primary domain Each domain is responsible to independently route mail directly to the SmartCloud Notes service. Note: Once the account is configured for the primary domain the customer creates group / connection documents for each additional domain in their environment. 9

10 "Hybrid" - Multiple Data Center Implementation Suitable for large customers who have infrastructure in more than one data center. Figure 6 - Multiple Data Center Implementation Single Domino domain Pair of customer data centers Pair of passthru servers (primary in one data center and secondary in the other data center) Separate mail routing and directory replication hub servers in each data center Provides for both a level of local (within data center) resilience and DR protection in the event of data center failure Should the primary data center or the servers in it be unreachable for any reason, the SCN service will connect via the secondary data center instead. This assumes that in the back end on-premises environment, directories replicate and mail routes appropriately between the data centers. 10

11 "Hybrid" - 'SHIM' Domain between SCN & Existing Domains Figure 7 - SHIM Domain between SmartCloud Notes & Existing Domains Hybrid shim domain inserted between SCN and multiple other existing domains Existing domains are all subordinate (route mail and replicate directory through) the shim domain Single passthru server (a second could be added for failover) Separate mail routing and directory replication hub servers For customers who have many on-premises domains, especially if they are chains of nonadjacent domains, that means directory replication and mail routing has to propagate through those domains. To be able to flatten the directory replication and mail routing topology to make each domain logically closer to SCN, a domain can be inserted to host the directory and mail routing servers. Since it is inserted between SCN and the existing domains we call it a shim domain. It can then be configured to replicate and route mail with each other domain effectively only one hop away. 11

12 "Hybrid" - Leveraging Infrastructure-as-a-Service (IAAS) for Domino Applications Figure 8 - Hybrid Leveraging Infrastructure-as-a-Service (IAAS) for Domino Apps Single Domino domain Single passthru server Single combined Domino mail routing and directory replication server Domino application and hybrid integration servers (like passthru) hosted on IBM SoftLayer or other IaaS providers No Domino servers on customer network Note: Customer DMZ and optional SoftLayer firewalls not shown Setting Up Hybrid Configuration Many customers want to remove all infrastructure from their networks, but hybrid is designed to connect to existing environment where application servers might remain. A customer can make use of services such as IBM SoftLayer IaaS or more traditional partner hosting models to support those non-scn servers. Provided there is connectivity between SCN and where the servers reside, and between the network and the servers for client access, the hybrid solution will function fine. 12

13 Firewall rules are an important part of the correct functioning of the SCN implementation. Follow the rules to ensure firewall configurations allow for proper traffic flow while minimizing risk of network attacks. Create the company account for Connections Cloud. The customer needs to provide the name of their organization and contact information for the initial administrator account. Select Hybrid Environment. The first choice an administrator makes is whether or not they want to set up the SCN account as hybrid. For an existing Domino customer, to set up in hybrid mode, they check the box and confirm their choice. Initially, the account setup page will display a set of 5 steps marked in red with a warning triangle. It simply means that the information required for each of those configuration items has not yet been provided. Run the pre-configuration test tool to see that the existing environment is in good shape to proceed. Enter server details and click Run Test to test configuration. Fill out the relevant information based on what servers are being used in what roles, which directories are to be synchronized, etc. The output of the test can be viewed immediately on the screen. This output is also written to a file called liveserverconfig.log in the Notes client data directory on the workstation where the tool is run. Inspect the output and look for any reported problems. Create Server OU Certifier for Connections Cloud Virtual Server Name Registration. Configure a Directory Sync Server. Provide at least one domino server and directory file name. Do not check the box that says Do not use this Domino Directory for provisioning or you will not be able to select users in the directory for provisioning later. This should only be selected if the directory being configured is an extended directory catalog. After saving the configuration, the sync status will show Error. This is not a problem at this time as we have not yet told Connections Cloud or the on-premises Domino environment how to connect with each other. Configure the Mail Routing Hub. Provide at least one domino server and domain name. Configure virtual mail server common name. Provide a base common name to be used for virtual server name creation. The mail server base name is used to generate all of the common names for the virtual mail servers in Connection Cloud for the account. 13

14 Configure the Passthru server. The Passthru server must use an IP Address that is routable from the internet. Enter at least one domino Passthru sever, hostname and associated domino domain name. *Note - We recommend using a host name rather than IP address in the middle field so that any changes in IP address can be done in DNS rather than having to remember to edit this configuration. Upload Certifier ID that will be used to create virtual server identities. You must not upload a certifier that is already used in the on-premises environment. Confirm all information entered and click "Enable My Account" to prepare for directory synchronization and activation. Prepare for account activation. Click "Download Configuration Tool" to download the tool. The account setup page will indicate 2 new outstanding steps with the red warning triangle. This indicates the steps have not been done yet, not that there are any problems. When downloading the NSF, save it to the workstation file system before opening it in the Notes client. Note: Administrator and remote console access are required to run this tool. If you make any configuration changes, you must download and re-run the tool again. The domain configuration tool has 3 modes of operation. 1. Begin pre-configuration test (reports back on the state of the on-premises) 2. Begin configuration report (perform a dry run...no actual changes are made) 3. Configure servers (update the on-premises server configurations) Domain Configuration Tool Results - Log file Clicking the View log file button in the configuration tool will display contents of the log file. liveserverconfig.log file is stored in the data directory of the client used to run the database. It is useful to keep copies of the log files when the configuration tool is run as historical documentation of what was configured and when. It also a great source of information for troubleshooting purposes. Confirm SCN server are connecting to the Passthru server. Look for sessions containing virtual server names from the service and of type PASSTHRU. Confirm SCN servers are connecting to Mail Routing/Directory server(s). Sessions for SCN virtual servers representing the directory sync service means that SCN is successfully accessing the server via Passthru. Directory Sync Status. If the SCN service is connected to the directory server and can access the directory, the status should be reported as OK. 14

15 If not there will be an error status and clicking on the directory server name will display more details about the problem. After running the Domain Configuration Tool the service should be able to connect to perform the initial directory synchronization process. The SCN account setup page will indicate that step is complete and that the Internet domain verification is still not done. Click on Internet Domain Verification to confirm that your Internet domain is ready to be validated. The service performs domain name verification to prevent abuse of SmartCloud Notes accounts and requires you to create a CNAME record to prove ownership of a domain. 15

16 Part 3 - Hybrid Activation and Testing Account Activation Go to the Account Setup page Click the Activate My Account button to complete initial hybrid setup Looking at your account setup now, you should see both directory sync and domain ownership steps are complete, as signified with the green check. You should also now see that an Activate My Account button has appeared if both of those steps are complete. You can click that button once, and you should then see the Congratulations! response indicating that the account activation is complete. Figure 9 - Account Activation Looking at your account setup now, you should see both directory sync and domain ownership steps are complete, as signified with the green check. You should also now see that an Activate My Account button has appeared if both of those steps are complete. You can click that button once, and you should then see the Congratulations! response indicating that the account activation is complete. ID Vault IBM creates the ID vault when the customer account is created. In order for a user's ID file to be uploaded to the ID vault, you must issue a Vault Trust Certificate from a parent certifier of the user ID file to the ID vault certifier. After the Vault Trust Certificate is issued, only IDs of users with SmartCloud Notes accounts are uploaded to the ID vault. Issue the certificate after the on-premises directory has been synchronized with the SmartCloud Notes directory. 16

17 Note: If you try to manage the vault and see a error not found in view index then the directory indexes might not yet have refreshed and you can use updall -r to do that from the hub server console. 1. Select Add or remove organization... and click Next 2. Click the Add or Remove button 3. Select the organization and click Add 4. Click OK 5. Click Next 6. Click Configure 7. Choose a Certifier ID File dialog 2. Select the certifier ID file and click Open 3. Enter that password and click OK 4. Click Done You are done when you see the message that you have successfully managed the ID vault and that the certifier was successfully added. Confirm SCN Servers are Connecting to the Passthru Server Look for sessions containing virtual server names from the service and of type PASSTHRU The virtual server names contain the OU certifier that was uploaded during hybrid configuration Confirm SCN Servers are Connecting to Mail Routing / Directory Server(s) Similar sessions from the SCN service containing virtual server names should be visible on the console of the mail routing / directory replication servers Additional Outbound Connection Testing / Validation After Directory Synchronization reports it is complete Ensure that a Domino console trace from the customer mail routing hub server to any of the SmartCloud Notes servers that can be seen connecting to Passthru server A group contains allocated servers for the customer, but not all will be running; failing to connect to one of them is to be expected. You will see an error about not being authorized to connect initially; this is expected because the trace command tries an anonymous connection first. Configuration Test Web-based tool to allow you to test what the service can see If you run this before directory synchronization has completed, there will be a lot of errors because synchronization has not yet completed 17

18 Go to the Configuration Test link in the UI and click the Run Tests button to start the test execution. These tests should be run any time you make changes to the hybrid setup or whenever you are troubleshooting problems between SCN and the on-premises environment. SmartCloud Notes Web Administration (User Accounts & System Settings) If you are not still logged in, log in as the administrator again Navigate to the IBM SmartCloud Notes option Figure 10 - SmartCloud Notes Web Admin With completion of the account activation, a wider set of SCN specific configuration and administrative options become available. From the IBM SmartCloud Notes navigation link on the left, the SCN specific administration section now provides additional access into these other areas. 18

19 System Settings - SmartCloud Notes Account Setup There are many new options listed below the Configuration Test item that were not there before account activation was completed. Figure 11 - SmartCloud Notes Account Setup SmartCloud Notes Account Setup - Instant Messaging The options under Instant Messaging control how the SCN web UI or Notes embedded Sametime client are integrated with community services, not whether chat and awareness are available to the user via general web chat or rich client. When disabled (the default), there is no presence awareness in the SCN web UI, but an end user can still manually configure a Sametime client to independently connect to SmartCloud IM. SmartCloud Notes Account Setup Default Time Zone This time zone option is used only for newly provisioned mail databases where a default set of free-time should be published, even if the user has not yet set their preferred time zone or work schedule. Typically this should just match the location of the majority of the users in the company. 19

20 SmartCloud Notes Account Setup - Notifications This option allows an administrator to specify the addresses to which notifications of problems with the service can be sent. Currently, this is limited to alerts about problems with directory synchronization. SmartCloud Notes Account Setup - & Calendar Options The Calendar Details option enables the collection of summary data for display when using the group calendar function, to show a limited amount of data about appointments. SmartCloud Notes Account Setup - Management There are a number of controls on this page related to management. The absolute maximum message size allowed in SCN is 100MB. Limiting the message size allows a customer to reject messages that are over some size lower than this maximum. Mail retention governs how long the soft delete period should be. By default it is 14 days but can be up to 90 days long. SCN also provides a method to purge mail data over a certain age. When enabled, the customer decides for how long data can live in the mail database. SmartCloud Notes Account Setup - Inbound Mail Routing The Inbound Internet Mail Routing page shows who is responsible for handling incoming SMTP mail for each verified domain owned by the customer. SmartCloud Notes Account Setup - Filters (Spam) filters provide some level of customization for how the Protector SMTP hygiene filters process inbound SMTP mail. The system filter is default for all customers and cannot be removed. It is the fundamental spam filter and applies to all mail. SmartCloud Notes Account Setup - Filters (White/Black Listing) In addition to the spam filter, an administrator can define white and blacklists that contain either individual addresses or domains. For each rule, they choose deliver to Inbox, deliver to Junk or block. SmartCloud Notes Account Setup - Filters (Newsletter) The keyword filter rule currently has one category of content defined and that is Newsletters. Adding this rule will allow Protector to use its newsletter detection algorithms to filter this kind of based on the configured action. SmartCloud Notes Account Setup - IMAP Access SCN supports the use of IMAP clients and administrators can control whether or not users are allowed to use IMAP clients. By default, IMAP support is turned off. 20

21 SmartCloud Notes Account Setup - Password Management The expiry of passwords in Notes IDs can be enabled and set to an expiration duration. SmartCloud Notes Account Setup - Name Finder The Name Finder option controls how type-ahead and searching works for addressing users in SCN web. By default using the basic option, when a user begins typing on the To / CC / BCC fields a simple type-ahead text list of user names is shown from which to choose. SmartCloud Notes Account Setup - Journaling Options Although this option is called journaling it is not the same as Domino message journaling. It relates to the logging of mail delivery and client access events into log files, stored in a default format, that a customer can download and import into a data warehouse and then run reports. System Settings - Security Security Settings for Connections Cloud overall are set outside of the SCN specific administration, using the Security link under Systems Settings. A customer can control password expiry interval, what info to display to a user who clicks the Forgot Password link on the login page and the use of application passwords. Application passwords are for mobile device usage, are system generated but managed by the user, and can bypass IP address range restrictions (since you never know where a mobile device might be connected). The IP address range restriction allows the administrator to specify from which set of networks their users should be allowed to connect. System Settings - Theme An administrator can make some limited cosmetic changes. Changing the theme gives access to 9 preset color combinations, while the 10 th option (the rainbow) allows the administrator to set explicit RGB color combinations for the main UI components. In addition, an administrator can upload a logo image which they can choose to display in the top left-hand corner of the top navigation bar which runs persistently across the entire page, no matter what service is being used. 21

22 Part 4 - User/Data Transition and Provisioning There are 4 main phases associated with user and data transitioning and provisioning. 1) Assessment 2) Planning 3) Preparation and Validation 4) User/Data Provisioning Process Figure 12 - Assessment, Planning and Preparation The first three phases focus efforts towards the ultimate goal of moving users and their historical data. With this method, customer assistance is increased as customer and IBM risk is decreased. The Domino Configuration Tuner (which is shipped for free with Domino) can be used to gather detailed information about servers. The SCN pre-config tool can be used to assess the readiness of the current Domino environment for hybrid configuration. 22

23 Assessment is where a thorough understanding of the current environment and business requirements is done. It is important to understand in detail the current environment, to be able to make good informed decisions about what changes need to occur for a successful move to SCN. Planning (or sometimes Design) is the creation of the desired state, thinking through what will be required and defining the appropriate sequence of events to realize it. The information gathered during assessment is vital to being successful in planning the path to cloud. OPT (Onboarding Planning Tool) is provided to certified practitioners. OPT helps understand user, mail database and client usage and also helps to segment the user population into manageable groups for transition planning. Prep / Validation (or sometimes Build) is the execution of the plans. OTT (Onboarding Transition Tool) is provided to certified practitioners and assists with the execution of the user move. It leads the practitioner through a set of automated or semi-automated steps for each logical group of users being processed. MOM (Mail Onboarding Manager) is available to be downloaded by any administrator of a Connections Cloud organization that has SmartCloud Notes or Connections Cloud S1 subscriptions. OPT, OTT and MOM will be discussed in greater details later in a separate topic. A pre-sale Technical and Delivery Assessment (TDA) is a technical inspection of a completed solution design. Technical Subject Matter Experts (SMEs) who were not involved in the solution design participate to determine: a. Will it work? b. Is the implementation sound? c. Will it meet customer requirements and expectations The TDA also helps to ensure that important areas of prerequisites, capabilities and dependencies are discussed and understood early to reduce the possibility of road blocks or surprises during implementation. Typical Customer Responsibilities: Assessing Domino applications and impact of client upgrades to FP5+ Fixing application problems Assessment and planning of end state directory architecture, mail routing and replication Assessment, planning and changes to existing security policies / procedures Assessment and planning of end state architecture for customization / integration with other systems Network capacity planning and any associated network routing changes 23

24 Fixing existing problems or issues in the on-premises Domino environment Creation and staging of client installation packages Planning and execution of client upgrades or new installations Establishing and testing hybrid environment setup; implementation of passthru server(s), directory replication and mail routing between on-premises and SmartCloud Notes environments Transformation management including end user communication plans, communication content, delivery of enablement, etc. Post-transition decommissioning of mail files and mail servers Assessment Phase: The diagram below indicates phases and a collection of activity areas, but no idea of overall sequence. Figure 13 - Assessment The diagram in Figure 13 indicates phases and a collection of activity areas, but no idea of overall sequence. Design and Planning Phase: Determine the mixture of services required to satisfy collaboration / user needs and what data transition is required Plan for connectivity between on-premises and SmartCloud Notes data center Determine a high level schedule for overall implementation Determine the sequence of deployment for user segments / business units / locations and the associated Connections Cloud services Define the coexistence that will be required to support the transition (hybrid) Determine how the business is going to be prepared for the transition Figure 14 - Design and Planning The network is a critical component in a SaaS and is often overlooked; customers think their existing Internet connection(s) will be enough but that is not always true. The overall sequence / schedule needs to be mapped out. The rate of transition is important i.e. how many users per day or week are moved to SCN. 24

25 Preparation Phase: A large part of the preparation activity is the set up of the SCN hybrid configuration and associated infrastructure such as network connectivity or SAML identity provider. There is also the corresponding testing of the various components that are configured to ensure that the SCN hybrid, etc. are working properly. Provisioning of new user accounts should be tested end to end. If Notes client installation or upgrades are needed, then the deployment tools and install kits need to be set up and tested. Figure 15 - Preparation Pilot Transition: It is important to run a pilot of the transition process early in the deployment phase. The process as implemented by the OPT and OTT tools is fairly strict. It has been proven to work and deliver a known outcome that is a very transparent transition for the end user. The pilot is used to test the process / solution on real users: A set of users should be invited to participate Communication and enablement material is validated with the pilot user set For existing IBM Notes users, the following occurs for pilot users: IBM Notes clients may be upgraded The mail files are replicated to an on-premises staging server and encrypted The encrypted replicas are uploaded to the SCN data center via FTP The databases are prepared and once ready, the associated users are provisioned in the SmartCloud Notes service The Domino Directory entries are updated to point mail server entries to new SmartCloud Notes mail server(s) IBM Notes client configurations are updated to reflect new SmartCloud Notes mail server(s) and final replication occurs with on-premises replica Production Transition: Production deployment is similar to the pilot process flow, except that it is repeated as many times as necessary to process the user population in logical batches (or groups). The remaining users are scheduled in batches Depends on user demographics, volumes of data, organizational change requirements, etc. Processes are repeated iteratively until all users moved For existing IBM Notes users, the following occurs for each batch of users: IBM Notes clients may be upgraded The mail files are replicated to an on-premises staging server and encrypted 25

26 The encrypted replicas are uploaded to the SCN data center via FTP The databases are prepared and once ready the associated users are provisioned in the SmartCloud Notes service The Domino Directory entries are updated to point mail server entries to new SmartCloud Notes mail server(s) IBM Notes client configurations are updated to reflect new SmartCloud Notes mail server(s) and final replication occurs with on-premises replica Preparing for Transition: In order to be able to execute the user transition process, a number of prerequisites need to be in place before you start. SmartCloud Notes hybrid integration is already implemented, tested and functioning properly Staging server and tools are implemented and connected to customer network Staging server has access to all mail servers and mail databases in scope Partner has appropriate accounts/roles within customer company account Secure FTP (over SSL/TLS) access to SmartCloud Notes data center is available End user IBM Notes clients meet minimum software version requirements End user mail databases are configured appropriately Staging Server Setup: Figure 16 - Staging Server The staging server is a temporary Domino server on which to run IBM tools that help to manage the transition process. Once users are transitioned it can be removed. 26

27 It must be a Windows server running Domino (or higher) 32-bit application. It does not require a lot of hardware resources, its primary role is to run a single Domino server that the admin might access, so the workload is very light. 1. On-premises data preparation (FTP) Figure 17 - On-premise Data Preparation (FTP) To capture the data, the staging server pulls full or selective replicas of the existing mail databases from the existing mail servers across the customer network, to its local storage. To reduce the time taken to replicate, it is desirable to place the staging server as close to the source mail servers as possible from a network point of view. The staging server generates a file of metadata about each user and database within a dataset. We call this the manifest, and it is an XML file that is used to describe the dataset to SCN once it has been uploaded. No data ever leaves the customer network without being encrypted. Note: An alternative to FTP is to put the data onto USB-connected removable storage. This provides a way to move a very much larger volume of data in a relatively short (few days) amount of time by shipping the device to the SoftLayer data center. 27

28 1. On-premise Data Preparations (Removable Storage) Figure 18 - On-premise Data Preparation (Removable Storage) An alternative to FTP is to put the data onto USB-connected removable storage. This provides a way to move a very much larger volume of data in a relatively short (few days) amount of time by shipping the device to the SoftLayer data center. 28

29 2. Upload Mail Content to SCN Data Center Figure 19 - Upload The encrypted data is uploaded to the SCN FTP service across the Internet. Using secure FTP protects the communication during upload, and because the data is already encrypted, it is protected at rest when it lands on the FTP service. 29

30 3. SCN Data Ingestion (FTP) Figure 20 - Data Ingestion Once the data upload is complete, the SCN database import service can read the encrypted files from the FTP service, decrypt them, read the manifest and prepare the databases it describes for provisioning. The same applies for removable storage. 3. SCN Data Ingestion (Removable Storage) Figure 21 - Data Ingestion (Removable Storage) 30

31 4. SCN Provisioning Figure 22 - Provisioning At provisioning time, for each user being provisioned, the SCN service will decide on which pair of servers in a cluster a user will be hosted; a primary (home) server and its cluster partner. Each of those servers know on which database import server to find the replica of the mail database for that user. Instead of creating a new empty mail database, each server streams a replica copy from the import server to its own storage. The server decision also determines the corresponding cluster and pair of servers in the DR data center to which the user should belong, and a second set of replicas are created on the DR cluster server pair in the background. 31

32 5. Directory Synchronization Figure 23 - Directory Synchronization Once the database replicas are in place on the primary server and cluster partner in the primary data center, it is safe to update the directory entry for the user. This change updates the references to the mail server and mail file path entry to point at the databases now running on the SCN servers, instead of the on-premises servers. Through the directory sync process, this change propagates back to the on-premises Domino environment as well. Once the change reaches those servers, all new mail for the users who were provisioned, will be routed to the SCN servers instead. The transition tools create a message in each user's Inbox, effectively a welcome to SCN message, with instructions about what they should do next to access the SCN service. 32

33 6. Desktop Update Process Figure 24 - Download, Setup and Catch-up Process Users can log in with a web browser right away and be productive. Users who use a Notes client must download a small NSF database which contains code to reconfigure their Notes client to point at SCN instead of their on-premises mail server. This database cannot be shared between users and will not work for any other user. This tool also causes the client to perform a catch-up replication cycle between the onpremises and SCN replicas to ensure any changes since the database upload are captured. Lastly the tool shuts down the Notes client so that the location switch can take effect. 7. On-Premises Clean Up Once the user have switched over, the on-premises mail file replicas can be decommissioned and finally so can the on-premises mail servers. 33

34 Part 5 - Staging Server & FileZilla Setup Staging server basics Designed to run stand-alone (separate domain) but connected into existing environment to be minimally invasive Domino (or later, including Domino 9) server with some additional tools: Runs in isolated domain but using a server ID that belongs to the customer certificate hierarchy to remove need for cross-certification Requires access to mail servers which users to be transitioned are homed Requires mail servers trust the staging server ID for remote agent access Requires ACL access to all mail files belonging to users being transitioned preferably manager Requires access to the server through which the Domino directory replicates with SmartCloud Notes Remote access if managing from outside of customer network Staging server requirements Hardware Requirements Dual Core Intel / AMD CPU 2 GB RAM Gigabit Ethernet network port Sufficient disk to support 2x in flight data volume Software Requirements Microsoft Windows Server IBM Domino Server (32-bit) or later Remote access Additional Domino Server utilities deployed as part of the OTT database implementation: encryptdb.exe unrdsync.exe Additional scripts deployed as part of the OTT database implementation: setenv.bat unread-sync.bat Additional tool to be downloaded from SourceForge: tee.exe FileZilla is not required, but is a good implementation that supports the following required capabilities: Implicit FTP over SSL/TLS SSL session reuse Resumable transfers Install the latest FileZilla client for Windows 32-bit on the BP#HUB Domino server Download from: 34

35 Onboarding Planning Tool (OPT) This tool assists in planning and preparing for the transition of users and their data Assists the user to analyze the current user, client and mail database environment Can be run from Administrator workstation with zero server impact or Can be run in a scheduled fashion from an existing Domino server Assists in defining the sequence and grouping of the user population into manageable chunks for further processing User Batch Planning Sequencing and grouping of users / databases into logical deployment groups Filters the overall user population into those who are ready to move and those who are not Assists with identifying important relationships between users that must be considered during scheduling Note: Running OPT as early as possible can be preventive maintenance because it can uncover activities that the customer needs to perform. Creating and Configuring OPT Steps 1. Server-Based Install 2. Signing the Database 3. Setting the ACL 4. External Agent Log 5. Log Database: Show in "Open Application" Dialog 6. Agent Log - Setting the ACL 7. Setup Wizard - Welcome 8. Setup Wizard Current and Future Client Types 9. Setup Wizard Minimum Client Version 10. Setup Wizard Initial Scan Document 11. Setup Wizard Directory Server 12. Other Scan Types 13. Setup Wizard Additional Server Selection 14. Setup Wizard Scan Summary 15. Setup Wizard Execution Option 16. Setup Wizard Running Scan 17. Basic Setup Complete 18. Initial Scan Results 19. User Profile Warnings and Errors 20. Domino Directory (names.nsf) Usage 35

36 Part 6 - Configuring OTT Database/Shell Scripts Onboarding Transition Tool (OTT) This tool assists in executing the transition of users and their data Provides automation for most tasks within the transition process Must be run from a Domino server Is responsible for the following key activities during the transition: Tracking the status of users as they move through the transition stages of the overall process Pulling user batch definitions from the OPT tool Creating replica stubs of the databases associated with the users in a batch Checking the status of replicas and measuring their completeness for transfer e.g. document count, unread count, replication history entries Generating the manifest XML metadata that describes the user and database replicas, and starting encryption Checking that encryption completed successfully Monitoring the directory for indications that users have been provisioned and activated Depositing end user communications in the on-premises Inbox of users once activated Creating and Configuring OTT Steps 1. Onboarding Transition Tool (OTT) - Install 2. Signing the Database 3. Setting the ACL 4. Agent Log 5. Agent Log Setting the ACL 6. Initial Configuration 7. Configuration Updates from OPT 8. Configuration Profile Basic Configuration 9. Configuration Profile Full Transfer Configuration 10, Initializing the Database 11. Initializing the Database Enable Process New Mail Agent 12. Initializing the Database Sign the OTT / OPT Database 13. Initializing the Database Deploy Shell Scripts / Executables 14. Initializing the Database Initialization Complete 15. Configuring the SETENV.BAT Script Customer ID 16. Configuring the SETENV.BAT Script Paths 17. Mail-In Database Definition 18. Mail Server to Staging Server Replication 19. Trusted Servers 20. Restart the mail server 21. Data Transfer Manager Account Setup 22. Data Transfer Manager Account Capabilities 36

37 Part 7 - Reviewing OTT Configuration Documents OTT Step Configuration Overview Step documents describe and control the sequence in which the processes are executed on the users The process selects users according to current and next steps and current status OTT Step pulldirectory pulldirectory pulls user information from OPT into the OTT user profiles and populates information about the mail files into each OTT user profile e.g. Mail server Mail path Template Replica ID Size Document Count OTT Step replicastub replicastub creates a replica stub on the Staging Server for each source mail database OTT Step checkreplica checkreplica periodically checks the status of the Staging Server replicas against source replicas It rechecks the user status in OPT OTT Step writemanifest writemanifest generates an XML file called the manifest for the batch of users Contains metadata about each user and mail file to be uploaded: SMTP address First name Last name Home server Mail file path Staging replica path Replica ID Client access method Description Special device indicates Selective Transfer Also starts encryption This also does a check of OPT status (it s the final check before sending users to SmartCloud Notes). 37

38 OTT Step Validate Encryption Validate Encryption makes sure encryption finished, and was successful If all.end files exist and are correct size, Validate Manifest runs validation process on server That process ensures manifest is correctly formed, and checks for 1:1 match between manifest and.end files If batch is good, Validate Manifest encrypts the manifest OTT Step checkmailserver checkmailserver periodically checks for the change of the mail server to a SmartCloud Notes server: Checks the directory replica on the synchronization hub Checks the directory replica on the home mail servers For each Full Transfer user where the change has occurred in both places, creates the Welcome Message In the migration process this is where the practitioner sends the mail files to the service and provisions the users. OTT can t see any of that all it can do is wait for the Person document to change. OTT Step Selective Transfer Replication Selective Transfer Replication does catch up replication for Selective users Sends new mail to Staging Server Changes replica ID of Staging Server replica to match cloud server Sends new mail to cloud When complete, it sends the Welcome Message Automatically restarts process to deal with errors within the sequence (e.g. network errors) OTT Welcome Messages OTT generates a Welcome message for each user who has been activated i.e. mail servers have been updated The message is written directly into their on-premises Inbox It s not delivered mail but it looks like it Messages are generated from a pre-defined template document that can be tokenized for personalization OTT Welcome Message Defining the Memo to Use Supplied Step document for Full Transfer computes memo based on DetectedClientType user profile item Can be replaced with any formula Select by Country (e.g. from OU in Notes Name or mail template version) Ensure there is a Memo document matching all possible formula results Can manually select and assign a single memo from a list of those available Corresponding document supplied for Selective just uses a simple selection, but you can use a formula if required 38

39 OTT Step processnewmail (Full Transfer only) processnewmail processes incoming messages received from users to indicate either: Notes client reconfiguration has been successful or failed. Browser users have responded to a request to reply to their welcome . Moves user onto next step of process and updates their status Ignores s which don t match what it expects OTT Step disablereplication (Full Transfer only) disablereplication disables replication in on-premises mail files Home server Any cluster replicas Note: This requires that the staging server have manager access to mail files OTT Step delreplica (Full Transfer only) delreplica will create an Administration Process request to delete the on-premises replica for each user who reaches the Create Replica Delete Request Step: Creates an individual request per home server and cluster partner Does not submit a delete all replicas request Customer administrator must approve the deletions like any other database delete request OTT Step detectdeletion (Full Transfer Only) detectdeletion monitors the administration process requests to verify when deletions have been executed. At this point the user has been transitioned and cleanup has completed. OTT Task Configuration Overview Task documents describe and control the processes which happen in parallel to the Step agents OTT Task Monitor In-Flight Users Currently implements Folder Monitoring Users who modify folder names during transition might get unexpected results e.g. folder names revert to previous name after replication Folder Monitoring: What To Do? There is no good way to prevent folder issues without making the end user s experience worse If you try to prevent them from creating folders, they end up with private desktop folders, which don t appear at all after transition to service Notes users Client Configuration Tool 39

40 As part of Catch-up replication, this tool detects problem folders and fixes them Spots renames and re-renames them, and copies folder design from Inbox Doesn t help web-only users Client Configuration Tool is a Notes database run on the client OTT Folder Monitoring Communication (outside OPT/OTT) to tell user about the problem Scheduled agent to monitor mail files in flight Starts after encryption of the databases (status Encryption Complete ); finishes after provisioning (status User Provisioned ) Folder Monitoring - Initial Notification User receives telling them they should stop modifying folders until they are provisioned OTT Task Direct Replication (Full Transfer only) Direct Replication is the process to replicate the home server s mail file to the SmartCloud Notes server Does not use the replica on the Staging Server This will replicate any content which has changed in the on-premises replica to the SmartCloud Notes replica Intended for web-only users (Notes client users will run the Client Config tool) OTT Memo Configurations Memo Configurations are used to generate messages sent to users Listed under Memo Configuration part of Administration outline Used for Welcome message and Folder Monitoring message contents OTT Memo Configuration Structure Message template allows you to customize the appearance of the messages OTT Full Transfer Both User Notification Complete from / to addressing and subject as appropriate OTT Memo Configuration Notes User Notification Very similar information is typically presented in each memo Slight variations in the links and instructions depending on whether the user will use only Notes, browser or both clients 40

41 Part 8 - Scanning, User Grouping and Data Capture OPT Navigation Navigation pane gives a rough suggestion of a sequence of work, starting with Setup, then Collecting Information, and so on OPT Scan Control Document Open the Collect Information Scan Mail view and open the scan control document OPT Scheduled Scans OPT will warn you if the scheduled agent is not enabled If you enable it here, you should re-sign the database OPT Server Documents Servers view shows the types of servers being scanned OPT Global Settings When you open OPT for the first time, the Startup Wizard collects enough information to get you started Configuration information is stored in a profile document within OPT OPT Global Settings Agent Logging If you created an Agent Log database for OPT, make sure this configuration is pointing to it. Select the Agent Log Database option, click the Choose Agent Log Database button and pick the OPT agent log database from the picker. OPT Global Settings Configuration Options You can override the default maximum number of days for Selective Transfer But do so with care, as the default has been chosen to give good performance OPT Running Scans Select the Scan Mail view Click the Run Selected Scan(s) action to initiate the scan OPT Scan Summary Scan results summary indicates number of users processed OPT Scan Logs Scan results summary indicates numbers of users processed, errors, warnings, etc. OPT User Profile Warnings and Errors Warnings can be acknowledged to indicate they have been read and understood. 41

42 Select the check box next to warning(s) and click the Acknowledge Selected Warnings button to proceed. OPT User Profile Acknowledged Warning Click the Restore Selected Warnings button to undo an incorrect acknowledgment OPT Scan Acknowledgment At the view level, column icon also changed to show acknowledged warning for this user. OPT Rescanning Users After resolving issues: Select those users and click the Rescan Mail Statistics action button to refresh user status for just the selected users A full rescan can be done by going back to Scan Mail view OPT Client Usage View Switch to the Resolve Issues Client Usage view Select some users to update and click Set Client Types: Set all users to have future browser. Set some users to both Notes and browser. OPT Client Usage Set from Mail Statistics Document A single user entry can be updated from the Messaging Info tab: Edit Settings button changes types being used Set button allows specific version information to be selected OPT Users By Errors/Warnings Switch to the Resolve Issues Users By Errors/Warnings view OPT Defining Custom Grouping Criteria You can define up to 5 custom grouping views / criteria OPT Assigning Users to Groups To assign users to a location, go to the Assign Users to Batches Locations view OPT Setting up Provisioning Profiles Navigate to the Provisioning Profiles view OPT comes with a selection of profiles OPT Creating User Batch Navigate to the Batch Definitions view Click the Create Batch action button 42

43 OPT Assigning Full Transfer Users to Batch To assign users to a batch, select the user entries and click the Assign to Batch action. OPT Assigning Selective Transfer Users to Batch Assign a different set of users to a second batch using a Selective provisioning profile Switch to the Manage Batches Batches by Transition State to see your two batches OPT Assigning Recommended Users to Batch To assign users who fail keep together rules to the batch: Select the user entries in the right hand view and click the Assign To This Batch action OPT Acknowledging Keep Together Warnings Instead To acknowledge the warning for users who fail keep together rules: Select the user entries and click the Acknowledge action Red exclamation changes to yellow circle column icons OPT Finalizing the Batch Membership You can either resolve issues and rescan users or remove them from the batch OPT and OTT Dealing with Errors Although fixing errors in OPT before transferring to OTT is desirable, it is not required OTT is the final gatekeeper : it will prevent you from encrypting a batch if there are errors in OPT OPT will prompt you to confirm that you want to proceed Data Transfer Manager Account Setup To access the SmartCloud Notes administration interface to manage the data import and provisioning requires an account with Data Transfer Manager role: Step 1: Customer admin can create an account without any subscriptions Step 2: Connections Cloud Client Services Group (CSG) must assign the DTM role to that account SCN Admin UI Log in with Data Transfer Manager Account From a web browser log into Connections Cloud with the account that has the Data Transfer Manager role. Data Transfer Manager Account Capabilities Accounts with Data Transfer Manager role have a limited set of capabilities Read-only access to most of the SmartCloud Notes administration settings Access to User Provisioning with Mail File Transfer controls to manage 43

44 SCN Admin UI Create First Migration Control Document Click the New Control Document button. Insert your name and address. Insert company name in the description - full or selective batch description. After completing the form click the Submit button SCN Admin UI FTP Space Usage The SCN FTP service allows a certain amount of reusable space per customer Available + Used on control document = customer maximum Tip: Allocate more space than you think you ll need; if it's not needed it is returned for other use immediately after the upload is validated. SCN Admin UI Open Migration Control Document At the control document list, click on the request number link to open it Cancel Request button stops any further processing of this batch and deletes all associated data Reset FTP Password button used to enter a new password for this request SCN Admin UI Download the Encryption Key File Click the Download Key button to save a copy of the key to the staging server Domino data directory Key file name generated from customer ID_control number.mky Repeat These Steps to Create a Second Control Document Need one control document for each of the Full and Selective transfer batches Use the Description field to distinguish the two control documents OTT Import User Batch from OPT Click Import Batch button to import a user batch from OPT: Select the correct OPT batch name from the list Set the date of transfer to match your control document estimated date Click OK to import the user information from OPT Repeat for both of the batches you marked ready for transfer in OPT OTT Imported User Profile Information Open an individual user profile document to see the information inside This ensures that OTT is able to access both sources for future tasks OTT Completing the Batch Documents You should provide OTT the same batch information: Go to the Batches by Name view Edit the batch document corresponding to the OPT batch Batch Document Optional Features Replication Hub Defaults to values in the Configuration Profile 44

45 Can be set differently for each batch Initial User password Allows you to record the password you plan to use for users in the batch Assumes you want to use the same password for all users in the batch OTT Batch Document Saving the Document Saving the batch document updates all user profiles belonging to that batch with the new Control Number, and password if present. OTT Manually Executing Agents From the dashboard: Click link next to the current step of the process to move users to next step Only processes the batch being displayed in the dashboard From the Actions menu: Click Actions Run Agent on Server and then either As Console Command or With Summary, then choose agent from list OTT Create Replica Stubs Go to the User by Status view: Click Actions Run Agent on Server With Summary Choose the Create Replica Stubs agent OTT Checking Replica Stub Creation Go to the Domino Administration client and select the staging (hub) server: Switch to the Files tab Navigate to the customer ID / control number and lower directories to see the replica stubs OTT Initializing and Replicating the Databases Go to the server console of the staging (hub) server: Enter a pull replication command to initialize and replicate the source mail databases to the staging server Do not use 2-way replication OTT Checking the Replicas Go to the Domino Administration client and select the staging (hub) server: Switch to the Files tab Navigate to the customer ID / control number and lower directories to see the replicated databases OTT Checking Replication A replication history entry is written into a replica when a successful replication cycle is completed We use the date and time stamp information later in the process Click Actions Run Scheduled Agent With Summary Choose Check Replication 45

46 Inspecting the Replication History Entries Source Mail Server For a pull only replication, initiated by the staging server to the source mail server Inspecting the Replication History Entries Staging Server For a pull only replication, initiated by the staging server to the source mail server OTT Users On Hold If a problem is detected or you want to halt processing for a user, they can be put into a Hold status: Open the user document to see the reason(s) on the Quality Check tab At view level, select users and choose Tools Remove Error Hold(s) to progress user once problem(s) are resolved OTT Running / Overriding Data Quality Checks Quality Checks can be re-run independently of checking replication history with two selection models: On the individually selected users / staging server replica All users / staging server replicas belonging to a batch Override Quality Checks action runs on selected users: Used when there is a known legitimate reason for a quality check failure Unread Marks Synchronizing Source and Staged Replicas If quality checks are failing because of unread mark differences, you can run this unread mark synchronization tool On the staging server, start a command prompt as administrator: Change to the c:\migrate directory Run the unread-sync.bat script with control number and source mail server as parameters; repeat for both batches 46

47 Part 9 - Encrypt, Upload, Import and Provision Users Encrypting Data Process Readiness Checkpoint At this point the following should be true for each batch: The OTT Batch document must be complete (a document created automatically on import will not be complete until it s been saved) There is an encryption key on the staging server or attached to the OTT Batch document (if attached, it is detached to file system when the manifest XML file is created) There is a set of fully replicated mail databases on the staging server assigned to the batch The mail databases have all passed quality checks (or have been overridden for legitimate reasons) Unread marks have been synchronized between source and staged replicas (if necessary) OTT Creating the Manifest File and Starting Encryption On the dashboard, click the Start Encryption link Confirm execution and review results dialog Note the path for the manifest file (ending.man) Repeat for both batches of users Check log file for each batch in c:\migrate\logs to see encryption output Can also use the Write Manifest XML action button in a batch view What is the Manifest XML (.man) File? The manifest XML contains meta-data to describe the data set being sent to SmartCloud Notes for processing: Contains a schema description against which content can be validated Contains information about the customer, batch and staging server Contains one row per user / database that is included in the batch: User name, address, mail server, mail path, replica ID, staging path and client access type, description OTT Encryption Process During encryption, each database is: Taken offline Used to generate the encrypted version of the database with a.end (Encrypted Notes Database) extension Encryption tool writes actions to log file in c:\migrate\logs directory with a file name structure of customerid_controlnumber.log You can also see the encryption tool screen output in the Staging Server console OTT Encryption Result Output Batch log file in c:\migrate\logs lists all the databases processed by encryption tool 47

48 OTT Validating the Manifest File From the dashboard, click the Check Encryption link Can also be run using the Validate Encryption agent Users moved to Encryption Complete state and manifest is encrypted Validation Process The validation process Checks that the expected.end files exist Checks that the.end file matches the size of the corresponding NSF to within the configured tolerance If both the above are true, it runs encryptdb.exe s validation process Checks the manifest is syntactically correct Check that all database files listed in the manifest are present as.end files If all of the above are correct, it encrypts the manifest OTT Re-running Encryption or Validation The encryption and validation processes are carried out by the encryptdb tool, and could fail for any number of reasons If they fail, reset the users back to the relevant stage and re-process them FTP Updating the SmartCloud FTP Site Definition Click the Site Manager icon to bring up list of site connections: Insert the user ID for the batch into the User field Click Connect to make connection to SmartCloud Notes FTP service FTP Validating the Connection Enter the password when prompted Details about the processing and status are shown in the messages window pane FTP Testing Throughput After establishing a connection to the FTP service, research expected throughput Set FileZilla to use the maximum number of parallel connections to ensure it is pushing as much data over the connection as it can Click Edit Settings... Transfers and then set Maximum simultaneous transfers = 10 FTP Uploading the Encrypted Data to SmartCloud Notes Once connected to the FTP service: Navigate to the output directory c:\end-files\<controlnumber> where the encrypted data for the batch is stored Select both the manifest file and the directory of mail databases Drag to the landing zone root directory / Validate that all data is transferred successfully Files can be deleted and replaced if necessary 48

49 SCN Validating the Uploaded Data From a web browser log into Connections Cloud with the account that has the Data Transfer Manager role: Open the control document for the batch being processed Click the FTP Upload Complete button The manifest and database set will be validated SCN Failed Validation of Upload Figure 25 - Failed Validation Figure 25 shows the output when the FTP validation fails. The page provides details of the failure but also specifically states what caused the failure. You can now correct the problem and click the FTP Upload Complete button again to perform another validation. SCN Post Upload Validation Once the SmartCloud Notes service has validated the uploaded data set: The FTP login account for that request becomes read only The data for that batch can no longer be changed on the FTP server via the FTP client The import server will generate a list of users belonging to that request from the content of the manifest XML file Those users can then be selected in the UI for further processing SCN Admin UI Log in with Data Transfer Manager Account If not still logged in, from a web browser log into Connections Cloud with the account that has the Data Transfer Manager role. SCN Admin UI List of Control Numbers Control Documents page lists all available control documents / batches of users SCN Admin UI Open Migration Control Document At the control document list, click on the request number link to open it 49

50 SCN Admin UI Select Users to Import At the user list, check / uncheck the boxes to choose user databases to be imported SCN Admin UI Checking User Status by Level The submitted users no longer appear in the list because their status changed Change the status filter to Ready to Import Only the users that were selected should now be shown in the list The Ready to Import status tells the import server to prepare these databases Clicking the Import Selected Users button changes the status of the user from Created to Ready to Import and they disappear from the original list. SCN Admin UI Checking All User Status Across Request Click the Status tab to see summary counts of users in each status The import server will then see that it has work to do and will import, decrypt, virus scan, etc. for selected users SCN Admin UI Users Ready for Provisioning After importing the rest and filtering on status Ready to Provision, you can see all users ready for provisioning SCN Admin UI Import Errors Filter the user list by the Error status Look at error text in view and click user name to open user document to read processing history details: If the error condition is transient, correct it and click the Restart Selected Users button If the error is terminal, cancel the user and re-process them in another request if necessary SCN Admin UI Log in with Administrator Account From a web browser log into Connections Cloud with the account that has the Administrator role. SCN Admin UI Provisioning Estimates At the control document list, click on the request number link to open it Click on the Users tab: Change the status filter to Ready to Provision Select one or two users in the list Click the Provisioning Estimate button SCN Admin UI Selecting Users for Provisioning On the Users tab: The same users should have remained selected in the list If not, select one or two users again Click the Provision Selected button 50

51 SCN Admin UI Selecting Messaging Subscription(s) On the resulting Provisioning Options page choose the subscription(s) to apply to all selected users: Click the Next > button SCN Admin UI Selecting Subscription and Mail Template On the resulting Provisioning Options page, choose the template to apply to all selected users: Page through list to locate the desired template and click Select next to it Click the Next > button SCN Admin UI Setting Initial Temporary Password On the resulting Provisioning Options page, choose the temporary password to apply to all selected users: Enter a one time use temporary password Click the Next > button SCN Admin UI Confirming Provisioning Options On the next Provisioning Options page, review the selections and user list: If changes are required, click the < Back button To submit provisioning requests, click the Confirm > button Return to the request Status tab to check progress SCN Admin UI Provisioning Progress Click the Request Provisioning button: The status will show progress of submission of provisioning requests to the provisioning queue Once all are submitted click the Return to Control Document button Check the Status tab for completion of requests SCN Admin UI Successful Provisioning Look at user document to read full processing history details Top entries relate to Import part of process starting with Created... Lower entries relate to Provisioning part of process starting with User selected for provisioning... SCN Admin UI Provisioning Complete What does the provisioning complete status mean: The SCN messaging subscription was associated with the user's Connections Cloud account The service decided on which primary and DR cluster nodes to place the user mail file replicas The directory entry for the user was updated with the new server and mail file name information The directory information will be synchronized and replicated with the on-premises directory replica 51

52 The user can now log in via a browser and can set up their Notes client New mail will flow to the SmartCloud Notes mail server for the user and will stop being delivered to the on-premises mail server SmartCloud Notes Provisioning New Users In hybrid implementations, new users must be registered in the on-premises Domino directory SCN has no access to the other certifier ID files used for user registration Once the new directory entry has synchronized into SCN, the user can be selected and provisioned SCN Admin UI Log in with Administrator Account From a web browser log into Connections Cloud with the account that has the Administrator role. SCN Admin UI Search For User(s) To Be Provisioned Enter part of the user name or address in the search box and click magnifying glass button Select the desired user(s) from the list and click Provision Selected SCN Admin UI Selecting Messaging Subscription(s) On the resulting Provisioning Options page choose the subscription(s) to apply to all selected users SCN Admin UI Selecting Subscription and Mail Template On the resulting Provisioning Options page, choose the template to apply to all selected users SCN Admin UI Setting Initial Temporary Password On the resulting Provisioning Options page, choose the temporary password to apply to all selected users SCN Admin UI Confirming Provisioning Options On the next Provisioning Options page, review the selections and user list and then confirm SCN Admin UI Provisioning Progress Click the Request Provisioning button: The status will show progress of submission of provisioning requests to the provisioning queue Once all are submitted you click Return to Provisioning button You will see a summary display with a status bar showing progress of the submission of provisioning requests into the provisioning queue. 52

53 Part 10 - MOM (Mail Onboarding Manager) What is MOM? Enables customer's SmartCloud Notes Administrator to migrate Notes mail files themselves It is a single executable that can be installed on a Window server, and communicates with the SCN service via https using REST APIs. The administrators configures the tool to access on-premises Domino directory and mail servers / mail databases using a server ID that has relevant access. Other methods are too complex for customers to do themselves OPT/OTT tools were developed as an IBM service asset and not end users tooling Migrators can select users, configure settings and provision users form within the Onboarding tool Migrating is "point and click" experience Minimal client configuration Tool is downloaded from the web and has automatic updates so that services updates are automatically supported Mom Architecture Figure 26 - Mail Onboarding Architecture (MOM) 53

54 MOM Considerations How well prepared is my company for migrations? How complex is my on-premises environment? What type of migration is best for my network topology? Does my Domino Admin have the time to manage the transfer? What kinds of command and control do I need to manage migration? Login Browse to the URL of the MOM server Login the same way you login to the cloud using an account that has the Administrator role Installation and Setup Enter login credentials (usually /password) Enter Domino Directory Enter Domino credentials Summary of information submitted Figure 27 - Install and Setup Create Groups List is created from on-premises users who are eligible for migration to the Cloud. Select 'Create New Transfer Group' Add Name of Group Select users you want in group and drag over to group 54

55 Figure 28 - Create Group Create Settings For every group of users, you need settings for each. Select from a variety of settings and give it a name Figure 29 - Create Settings 55

56 Create Settings Select Subscriptions Figure 30 - Select Subscriptions 56

57 Create Settings Transfer Options Figure 31 - Transfer Options 57

58 Create Settings Mail template/extension Form Figure 32 - Mail Template/Extension Form 58

59 Create Settings Use pre-transfer instructions (optional) Figure 33 - Pre-transfer Instructions 59

60 Create Settings Post-provision instructions (mandatory) Last message user will receive in old inbox Give instructions on how to connect to new mail file Figure 34 - Post-Provision Instructions 60

61 Create Settings Review button for summary of settings Click Continue to name settings group Staging - Upload and Provision (The View) Set of users along with settings that are ready to migrate Option to start immediately or schedule transfer Figure 35 - The View Staging - Upload and Provision (List View) More detailed status of each file Figure 36 - The List View 61

62 Mail Onboarding Manager Facts REST API interface to onboarding User Interface designed by IBM Design Team Major UX initiative for IBM Connections Cloud Continuous Delivery Model User and customer feedback, issues are treated as priorities Download the Mail Onboarding Manager Accessible by administrators of any organization with SmartCloud Notes or Connections Cloud S1 subscriptions Figure 37 - Download MOM YouTube Link to MOM demonstration: 62

63 Part 11 - SmartCloud Upgrade Factory (SCUF) Why Use SCUF? SCUF compliments existing services offerings for Messaging Data Migration. Best method when customer wants to move fast at minimum cost. Figure 38 - Migration Options Why SmartCloud Upgrade Factory * Allows customers to move to SmartCloud Notes from Exchange or Domino rapidly at a low cost. Pricing is based on per user basis. * Available to ALL customer who have purchased IBM Verse. * Automated review of your current mail boxes with recommended remediation * Full Fidelity Mail migration, including , calendar and to-dos. * Provides an easy to use pricing tool available to the field for pricing and estimates upgrade duration. * Includes Level 2 Help Desk during the migration. * Personalized assistance with onboarding and provisioning * Integration with existing on-premise Exchange or Domino environment to ensure users can communicate. 63

64 Sample Pricing Scenarios Figure 39 - Pricing Scenarios SCUF simple Migration Path (How It Works) Figure 40 - How SCUF Works 64

65 What does a customer need to do? Make available the current mail administration team Provide IBM access to the Exchange or Domino environment Ensure environment meets the minimum requirements for SmartCloud mail Provision and configure the SmartCloud account Continue to manage and administer current environment until upgrade is complete Put into place a temporary coexistence solution Schedule and prepare 1,500 (MS) or 2500 (Domino) mailboxes per week Provide first level support to users during the transition Own communications, training and enablement for users during the project Project Roles and Responsibilities Figure 41 - IBM/Customer Roles & Responsibilities To meet SCUF Requirements Assumes the customer meets the technical requirements of Connections Cloud If they do not, contact a Solution Architect or other local ISSC representative for a customer estimate Customer must be compliant with the SCUF readiness checklist 65

66 Customer Prerequisites Customer is responsible for remediation of non-compliant mailboxes or environmental components prior to and during the project Customer provides the required hardware/systems needed to create a hybrid environment and upgrade users. Customer may elect to procure a SoftLayer environment to house the hybrid environment. For Exchange: IBM will move 300 mail files per day, 5 days per week For Domino: IBM will move 500 mail files per day, 5 days per week Average mailbox size is 500Mb IBM will require remote access to the customer environment to manage the transition Customers need to ensure adequate help desk support to accommodate 1500/2500 users provisioned per week Only one Active Directory Domain is supported Public Folders and PSTs will not be migrated Resource Reservations is out of scope Migration Flow (Who Does What Activities?) Figure 42 - Activity Chart 66

67 Part 12 - Comparing Migration Options & Processes Media Transfer Best used when moving high data volumes in short period of time Requires Industry Cloud Solutions (ICS) Engagement FTP Upload Same tool and onboarding preparation as media transfer Transfer method is difference (Electronic vs Physical) Requires Certified Business Partner or ICS Engagement When to use SmartCloud Notes Service-Only Figure 43 - SmartCloud Notes Service-Only The diagram in Figure 42 displays the criteria and requirements for choosing SmartCloud Notes Service-Only option. 67

68 When to use SmartCloud Notes Hybrid Figure 44 - SmartCloud Notes Hybrid The diagram in Figure 43 displays the criteria and requirements for choosing SmartCloud Notes Hybrid option. Why Use OPT/OTT Best suited for large scale migrations Supports the ability to migrate users on USB which can be much more efficient than using FTP or MOM for a large number of big mail files A single 8TB drive can possibly hold all of your mail files for migration OPT has more configuration options than MOM, therefore, can be adapted to nonstandard environment/requirement OPT has the ability to work with multiple Domino domains, MOM can only migrate users from a single domain Business Partners/ICS have created tooling in conjunction with OPT/OTT to create composite dashboards for multi-site migrations Certified Business Partners and ICS specialists are very knowledgeable and can assist with the migration OPT/OTT but it works extremely well for its designated purpose and MOM tool is not as flexible with fewer points of control in the process Note: It is certainly possible that a project might combine the use of OPT / OTT and MOM tools depending on specific requirements Running OPT as early as possible can be preventive maintenance because it usually uncover activities that the customer need to perform 68

69 Why Use MOM OPT/OTT requires a Certified Business Partner or ICS which can be expensive OPT/OTT requires the coordination of several different tools/technology stack FTP or USB, SmartCloud Notes Administration Web UI, SmartCloud Integration Services (SCIS) to do bulk provisioning. This complexity is hidden by the Business Partner/ICS professional but this method has many moving parts Other migration processes can be too complex for customers to do themselves 'Jump Start' participants have found process overwhelming Multiple tools, OPT/OTT, SmartCloud Notes web admin 3rd party tools FTP requires firewall changes OPT/OTT were developed as an IBM services asset and not end user tools Not internationalized When to Use What Migration Tool Figure 45 - MOM versus OTT MOM - SCUF - OPT/OTT - White Glove Figure 46 - Migration Options 69

70 Bulk User Provisioning Bulk User Provisioning is a service that is available through the integration and migration site to create new accounts in the cloud environment. This function does not migrate data and accounts. For data migration, check the migration options section of this document. Bulk User Provisioning saves you time and automate the administration of your cloud subscriptions and subscribers (users). It is achieved by setting up an on-premises integration client and uploading a comma separated values(csv) file to the Enterprise Integration Site as shown in the figure x below. Figure 47 - Bulk User Provisioning The integration client is a computer system (can be a virtual machine) that connects to your IBM Domino Directory, Microsoft Active Directory, Tivoli Directory Server, or any other LDAP source. The integration client can be an administrative workstation that just creates the csv file or it can be a full function server that hosts IBM Security Directory Integrator to read changes from the corporate directory automatically. The IBM Softlayer cloud can host the integration client with both setup types, removing the need for additional hardware costs, and risks of hardware failure. The integration and migration site (FTP Server) allows customers upload provisioning files over an authenticated SSL encrypted channel. 70

71 Migration Process On-Premises - this is where the source mail files are located Staging - ICS/BP will add this to customer environment. (OPT/OTT is installed here) FTP Upload - this is where files are transferred (yellow zone) SmartCloud Notes Admin - Users are managed via Admin SmartCloud Notes Service - final destination for user mail files Figure 48 - Mail Migration Diagram 1 1. Create Hybrid connection to the Cloud 2. Establish Staging server 3. Identify group of users to migrate 4. Pre-check selected users for obvious issues 5. Go to SmartCloud Notes Administration to create migration request which will create 6. encryption key to encrypt data that will be send to service 7. Go back to Staging and create replicas of selected users 71

72 Figure 49 - Mail Migration Diagram 2 8. OTT will run additional quality checks 9. OTT will do a sync to make sure new replicas unread marks are up to date 10. Encrypt the files before the transfer to SmartCloud Notes 11.Optional: Pre-notify end users 12. FileZilla requires Port 990 and has its own firewall requirements 13. Go to SmartCloud Notes Admin, click button to indicate upload is complete and ready to proceed 14. Files will be decrypted from FTP landing zone, virus scans will run and wait for further instructions 15. Migrator must monitor to ensure processes are completed 72

73 Figure 50 - Mail Migration Diagram Migrator can select which users that want to provision 17. Choose Subscriptions and entitlements 18. Choose mail templates, language preferences, initial password 19. SmartCloud Notes Service will take that request and move and create the users 20. SmartCloud Notes Service will update the home server in the Domino Directory indicating the user is no longer located on-premises but in the Cloud 21. Catchup Replication will initiate to get any mail which was delivered while the transfer was in process 22. Notify end users which is the last stating the users have been move to the Cloud 73

74 Please Note IBM s statements regarding its plans, directions, and intent are subject to change or withdrawal without notice at IBM s sole discretion. Information regarding potential future products is intended to outline our general product direction and it should not be relied on in making a purchasing decision. The information mentioned regarding potential future products is not a commitment, promise, or legal obligation to deliver any material, code or functionality. Information about potential future products may not be incorporated into any contract. The development, release, and timing of any future features or functionality described for our products remains at our sole discretion. Performance is based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput or performance that any user will experience will vary depending upon many factors, including considerations such as the amount of multiprogramming in the user s job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can be given that an individual user will achieve results similar to those stated here. 74