Figure 1: Secure Exchange Reference Architecture

Transcription

1

2 The Problem has become a vital communication tool for most businesses. Whether in the office or on the road, communicating internally or closing business with customers, users depend upon to get their jobs done. Due to the increase in popularity of as the preferred communication tool, the amount of traffic is increasing at a very rapid pace. Storing and managing this exponentially growing traffic can become a daunting task. Along with the growing traffic, the threat of virus and spam is also growing. It is extremely important to design a base messaging infrastructure that is secure, flexible and scalable to meet the availability needs of your organization while safeguarding against any security threats. What is Secure Exchange? Dell s Secure Exchange solution is a reference architecture based on industry standard components that can provide protection to businesses with the ability to scale to support the largest enterprise deployments. A Secure Exchange configuration can be tailored specifically to organizations needs and can give benefits in the following areas: Strengthen front-end security Facilitate regulatory compliance Simplify management of systems Reduce risk and complexity This approach enables organizations to pick the appropriate tools for different data center functions without being locked into proprietary technologies. Using this model, Dell has partnered with and collaborated closely with Symantec and Microsoft to provide secure, highly available, scalable Exchange messaging solutions. All the components of the reference architecture have been validated to ensure their interoperability. Figure 1: Secure Exchange Reference Architecture 1

3 Dell Dell s expertise has been relentlessly proven through millions of successful high-demand deployments. You ll get the industry s highest standard in Exchange services and mailbox management and through close collaboration with Symantec no other Exchange Server vendor can match Dell s proven, seamless integration with Symantec products. Symantec Enterprises need to keep their infrastructures operational 24x7. They need to be able to access information anytime and anywhere and that means that their critical systems must be on-line continuously. It is therefore imperative that they protect the physical systems, the operating environments, and the applications across all tiers of their infrastructure. They must protect a broad range of information types from to business documents to digital photos to audio and video files. They must also ensure that the interactions, the connections, the collaborative environments, and the movement of data while in use, are protected. An integral component of the Secure Exchange solution is the unique response infrastructure provided by Symantec. To keep ahead of the latest security and instant messaging threats, Symantec maintains threat detection and response centers located across the world. These focused and coordinated operations centers, part of Symantec Security Response, operate 24x7 and perform the following vital functions: Automatic real-time threat monitoring with the Probe Network. A key asset for Symantec Security Response is the Probe Network, an extensive array of over 2 million decoy addresses, also known as honey pots. This patented global network of accounts attracts and collects large quantities of spam and related threats tens of millions of spam messages pass through the Probe Network every day. Symantec uses these decoys to stay current with the very latest spamming tactics. Provide up-to-the-minute, round-the-clock, virus protection in the Symantec Mail Security products. Symantec employs the industry s largest team of experts who work to identify and neutralize viruses before they can enter the network and spread across the enterprise. Symantec Security Response provides swift, global response to virus outbreaks and proactive research on future threats. Enterprise Vault Awards (2007) Only leader in Gartners Magic Quadrant for Archiving 4th straight year Leader in Radicati s Archiving Vendors Market Quadrant Market Leader in IDC s Archiving Applications Symantec Mail Security (SMS) Awards and Catch Rates (2007) Leader in Gartners Magic Quadrant for Security 4th straight year InfoWorld s Technology of the Year Award for Best Antispam 3rd straight Year JupiterMedia s SeverWatch.com Product Excellence Award Anti Spam technology rated with a 97% catch rate and a 1 in 1 million critical false positive rate 2

4 Key components of Secure Exchange The key Symantec components of the Secure Exchange reference model are as follows: Symantec Enterprise Vault Symantec Enterprise Vault 2007 provides a software-based intelligent archiving platform that stores, manages, and enables discovery of corporate data from Exchange messaging systems. Enterprise Vault can use intelligent classification engines to manage and identify data, improving a company s ability to retain and protect corporate information while reducing storage costs and simplifying management. Enterprise Vault can also be used to simplify the end users management of their mailbox while eradicating.pst files and the users need to use them. Key Features Automatic Mailbox Management frees users from quota frustrations without compromising Exchange performance and reliability. Eliminates.pst headaches and removes the problems of backup, security, stability, and storage consumption inherent to these types of files. Centralized management of content ensures faster backup of Exchange servers and controlled recovery in the event of a disaster. Archiving enables the retrieval of content and corporate documents to meet legal and regulatory compliance requirements. Key Benefits Eliminate mailbox quotas and message size restrictions. Provide users with a mailbox of virtually unlimited size while controlling message storage growth. Migrate all existing.pst file data into the archive, enabling IT to effectively achieve.pst file eradication. Assist with and reduce the timescales associated with Exchange migrations by significantly reducing the size of the Exchange store by moving older messages into the archive. Speed up backup and restore times of Exchange server environments by reducing the online message store by 50 to 75 percent through archiving. Retain a copy of all messages sent and received, ensuring they are kept for the appropriate period of time to meet regulatory and legal retention requirements. 3

5 Symantec Mail Security for Microsoft Exchange Symantec Mail Security 6.0 for Microsoft Exchange provides high-performance, integrated mail protection against virus threats, spam, and security risks while enforcing internal policies on Microsoft Exchange servers. Symantec Premium Anti Spam add-on is available to provide best-of-breed spam prevention without additional on-going administration after initial setup. Key Features Advanced antivirus allows administrators to update antivirus definitions approximately every 30 minutes. Integrated content filtering with advanced policy rules and flexible user- and groupbased rules. Performance is significantly improved for faster real-time and mailbox scans and reduced load on the Exchange server. Intuitive user interface provides a consistent, high-performance administration experience. Key Benefits Defend against new and known viruses and security risks for superior virus protection that is backed by Symantec Security Response, the world s leading antivirus and Internet security research organization. Filter inappropriate content within most file formats and block files based on true file type (not just file extension) while preventing inappropriate communications. Intuitive user interface provides a consistent, high performance administration experience. Centralized management enables administrators to update settings of individual servers and groups of servers remotely. 4

6 Symantec Mail Security 8300 Appliance Symantec Mail Security 8300 Series appliances, powered by Dell hardware, feature integrated, best-of-breed antispam, antivirus, and content-filtering technologies that stop inbound and outbound -borne threats from negatively impacting productivity and compromising security. Key Features Premium Content Control add-on subscription helps organizations manage risks associated with data leakage, regulatory compliance (HIPAA, GLBA, PCI), and internal governance. Graphical message tracking enables administrators to easily determine the action taken on any processed by the appliance. Day Zero virus prevention reduces the risk of downtime by proactively detecting and quarantining suspicious attachments before official antivirus definitions become available. SMTP traffic shaping Over time, this feature evaluates sources and develops a record of their reputation for sending spam to your site. As the reputation record grows, Symantec Mail Security accepts fewer connections from those sources identified to be illegitimate, reducing the volume of spam received at your site and saving computing resources needed to filter spam messages. Firewall This early response feature improves message throughput by analyzing incoming SMTP connections, comparing them to Symantec s Reputation service data and industry-generated lists of known hostile senders and enabling you to refuse or defer connections from those hosts. Instant Messaging (IM) Protects your corporate network against external threats delivered via public IM networks, such as AIM, Yahoo and Google, from viruses, worms, and malicious URLs. Note: To protect enterprise Instant Messaging systems such as Microsoft Live Communication Server, or to archive IM conversations to Enterprise Vault, IM Manager, Symantec s market leading IM security solution should be considered. Key Benefits Provides content filtering capabilities, incident management and reporting which enable business users to easily and accurately define and implement compliance policies as well as analyze and manage violations. Allows messaging traffic to be scanned for regulatory compliance and content policy restrictions. Secures the infrastructure more effectively with zero day antivirus protection. Keeps the messaging infrastructure reliable and trouble-free by removing spam, spim, and malware before it reaches business critical servers. 5

7 Symantec Backup Exec for Windows Servers Backup Exec has supported Exchange since its introduction by Microsoft in 1996 and Windows Server operating systems since their introduction in Backup Exec delivers established experience and proven reliability in the Exchange Server market. With Backup Exec 11d and the Backup Exec Agent for Microsoft Exchange Server, Symantec is introducing two key new technologies for Exchange to address the problems with traditional Exchange backups: Granular Recovery Technology (GRT) Continuous Data Protection for Exchange Together, these technologies eliminate not only separate individual mailbox backups but also daily backups, along with Exchange protection management headaches. Symantec believes these technologies provide the fastest and most flexible way to protect and recover Exchange 2007 data. Key Benefits of Continuous Protection (Exchange) Eliminate daily backups Exchange is protected continuously Recover s, folders, and mailboxes in seconds using GRT Automatically truncate Exchange transaction logs for automated log growth control Provide complete disaster recovery of Exchange databases up to the latest transaction log Key Benefits of Granular Recovery Technology Features Recover s, folders, and mailboxes in seconds using GRT Eliminate separate, slow individual mailbox backups completely Perform fast single-pass backups of Exchange databases and still recover individual mailboxes, individual messages, and private and public folders Works with or without the need for recovery storage groups (RSGs) Cut backup time and storage in half by performing fast, single-pass Exchange database backups Reduce storage/media costs Enable granular recovery or complete database recovery of all Exchange data 6

8 Enterprise Vault Architecture The Enterprise Vault for Exchange archiving solution comprises of the following key components: Enterprise Vault Server The Enterprise Vault server provides the platform to archive data from Exchange, Store on suitable low cost media and index and respond to user action requests including search. The modular approach to Enterprise Vaults architecture means that a single EV server should be considered as a flexible building block of functionality that is easy to scale and modify at a later date should archiving requirements change Storage Array Enterprise Vault implements an open storage layer approach to virtualizing the storage medium with which it interacts meaning complete flexibility in choosing and changing the archive storage platform(s). EV can take advantage of DAS, NAS and SAN NTFS based storage as well as several native integrations with storage vendors like Dell and EMC. MS SQL Server Every item archived by Enterprise Vault is logged in a database hosted on one or more MS SQL servers. Additional metadata about the item is also stored to enable fast, efficient lookups on item location and properties. Figure 2: Enterprise Vault Architecture 7

9 Archiving Enterprise Vault uses an archiving agent (no installation required on the Exchange server) to access user mailboxes and based on an Age or Quota archiving strategy move older, less frequently accessed messages from the mailbox to the archive. Shortcuts to these messages are then left in the mailbox. The user can manipulate these shortcuts as if they were the original messages i.e. double click and the user will see the original message, reply and the original item is re-called before replying. Storage/Indexing All data archived from Exchange to Enterprise Vault is subject to compression and single instance storage to reduce the data s footprint on disk. This can often lead to greatly improved storage requirements as Enterprise Vault can maintain single instance across multiple Exchange stores and even servers. An HTML/Text conversion of the archive data is also created and stored and is used to build and maintain an AltaVista index from which the user can search and view their archive. Metadata regarding every archived item is also recorded in a SQL database to enable Enterprise Vault to locate the item at a later date. Clients User functionality is provided via a single, simple to install EV client installer (MSI). This installer extends the native Outlook functionality to provide full integration with Enterprise Vault. Opening, forwarding and replying to an archived message shortcut all result in the original message being recalled. Crucially this action of recall does not cause the original message to be restored into the users mailbox, rather the item is temporarily cached locally. Offline Vault For users accustomed to Outlook offline folders (or cached mode) Enterprise Vault provides a similar experience with its Offline Vault client module. Offline Vault gives users access to their archived content while disconnected from the network. Once connected to the network Offline Vault will initiate an intelligent synchronization with the Enterprise Vault server, keeping the offline cache up to date. Windows Desktop Search Offline Vault can be integrated to and allow Windows Desktop Search to search within its offline cache. The benefits to doing this are obvious as users can initiate a single universal search of their workstation files, Outlook messages and archived data. Archive Explorer For users who are used to browsing through messages rather than having to use a search page, Archive Explorer provides a rich explorer type view of the users archive. This structured view of the archive (similar to way Outlook presents items) allows users to browse, open, reply and forward archived messages directly from the archive. 8

10 Symantec Mail Security for Microsoft Exchange Architecture The Symantec Mail Security for Exchange solution comprises of the following key components: Symantec Mail Security Console The Mail Security console is a Windows application. The console lets you manage local and remote installations of Mail Security from a single computer. You can install and use the console on a computer on which Mail Security is not installed, this lets you manage Mail Security from a convenient location. The Symantec Mail Security for Exchange console can be configured to manage one or more Exchange servers. System administrators should use the multi-server console to manage multiple servers in the same Domain. Symantec Mail Security for Exchange Server In a typical configuration, Symantec Mail Security for Microsoft Exchange is installed on each Exchange server to scan all inbound, outbound, and internal sent to both public folders and private mailboxes. The product delivers the ability to inspect content while in transit, and while it is being accessed from the information store. Administrators can also conduct sweeps of information-store content on a scheduled or on-demand basis, using updated virus definitions. A constant background scan can also be employed to monitor the store, and proactively scan new messages and older messages that have not been scanned with the latest definitions. Figure 3: Symantec Mail Security Mail Flow 9

11 Symantec Mail Security 8300 Appliance Architecture The Symantec Mail Security 8300 appliance architecture comprises of the following key components: Symantec Mail Security Control Center The Symantec Mail Security architecture is managed by one Web-based Control Center interface. The Control Center provides information on the status of all Symantec Mail Security Scanners in your deployment, including system logs, message tracking events, and extensive customizable reports. Use the Control Center to configure both systemwide and host-specific details. The Control Center also hosts the Spam and Suspect Virus Quarantines to isolate and store spam and virus messages, respectively. End users can view their quarantined spam messages and set their preferences for language filtering and blocked and allowed senders. Alternatively, you can configure Spam Quarantine for administrator-only access. Messages which trigger content-based compliance policies are also held on the Control Center, in compliance folders. Symantec Mail Security Scanner The Symantec Mail Security Scanner operates at the outermost gateway layer and is responsible for processing incoming and outgoing and Instant Messaging traffic. To perform this function, the 8300 Series includes a powerful integrated Postfix-based Mail Transfer Agent and Instant Messaging proxy that provides the performance, security, and flexibility you need. Mail flowing through the appliance undergoes a number of processing layers. These layers include firewall checks based on the source or IP connection and reputation, antispam filtering using Symantec Brightmail technology, award-winning Symantec Antivirus protection, content compliance checks, and more. To protect against the latest and instant messaging threats, the scanner component is receiving real time automatic updates from Symantec Security Response. Figure 4: Symantec Mail Security (SMS) 8300 Architecture 10

12 Symantec Backup Exec 11d for Windows Servers Architecture Backup Exec 11d for Windows Servers comprises of the following key components: Backup Exec Media Server and Administration Console In Backup Exec, backup, restore, and utility operations, called jobs, are submitted using the Administration Console. Administrators can run the Administration Console from the media server (a Windows server with storage hardware attached) or from a remote system. After jobs are created, they are processed by the Backup Exec server components running on the media server. All interaction to the Backup Exec system, such as submitting jobs, viewing results, and performing device and media operations, can be done through the Administration Console. The media server contains media and device databases designed to simplify the process of organizing and allocating storage devices attached to your media server and to aid in preventing media from being accidentally overwritten. Through Backup Exec s device management functions, you can logically group storage devices together in device pools. Through the media management function, you can organize, track, and troubleshoot all of the media in your library. Continuous Protection Server Symantec Backup Exec Continuous Protection Server (CPS) software ensures that businesscritical data is always protected and always available. It combines proven Backup Exec data protection with replication technology and disk-based data protection to provide fast and reliable backups and restores. As a disk-based solution, data is protected in a continuous mode that provides granular restore from points in time throughout the day. It also enables simultaneous backups of multiple servers. CPS integrates with Symantec Backup Exec 11d for Windows Servers for traditional tape-based data protection, and delivers integrated management by Backup Exec SmartLink technology. Agent for Microsoft Exchange The Agent for Microsoft Exchange lets you integrate backups of Microsoft Exchange Server databases with network backups without separate administration or dedicated hardware. The Exchange Agent for Exchange 2007 installations provides the following features: Increased performance of mailbox backup and restore Continuous backup of the Exchange Server when Backup Exec Continuous Protection Server (CPS) is installed. The ability to select storage groups for backup and restore jobs The ability to recover individual databases or storage groups by using the Recovery Storage Group feature. Snapshot backup and off host backup on Exchange Server 2007 Figure 5: Exchange database backups using Symantec Backup Exec. 11

13 Using the Symantec Mail Security 8300 Appliance and Enterprise Vault to perform Intelligent Archiving This section of the document will describe how the Symantec Mail Security 8300 appliance can be used together with Enterprise Vault to help intelligently archive inbound and outbound messages and index and assign suitable retention categories based on message content or characteristics. Example Inbound messages As a sample inbound scenario, we ll assume our company, Beta, is doing some work with a third party company called Acme. There is an agreement between both companies that messages containing legal information transferred between the companies via will contain the string Legal: at the start of the subject line of the message. Our company also has a policy that any legal information sent from company Acme must be retained in the archive for a five year period rather than the default two year period. To assure these messages are retained for the correct period of time (without manual intervention) the following steps are followed: 1. A compliance policy is configured on the Symantec Mail Security (SMS) appliance to inspect incoming SMTP messages originating from users at the acme domain and containing the string Legal: in the Subject field. Any messages satisfying these requirements will have an x-header added called x-archive, with a value of Legal 2. The message gets delivered to a journaled recipient in MS Exchange. Exchange saves a copy of the message to the configured journal mailbox. 3. EV archives the message from the journal mailbox, and indexes the x-header information as part of the archiving process. An archive task filter inspects the x-header property tag called x-archive and assigns a different retention category based on the value. In this case an x-archive value of Legal means to use a legal retention category called Legal Messages (set to 5 years). 4. Administrators and Legal team members can now search Enterprise Vault for this item based on either its retention category or the value of the x-archive property as one or more of their search terms. 5. Enterprise Vault will retain and then expire the message from the archive based on the Legal Messages retention category (5 years from the date of archive). 12 Figure 6: Inbound Message Flow and Tagging

14 Example Outbound messages Our second scenario will demonstrate an outbound policy. We are going to assume that our accounting department in Acme, sends out weekly information to the bank in a file called weekly results.xls. The company wants to send a copy of these messages into a specific internal archive mailbox. When these messages are eventually archived by EV from this dedicated mailbox, we need to make sure these messages remain in the archive for a five year period rather than the default two year period. To ensure these messages are retained for the correct period of time (without manual intervention) the following steps are followed: 1. Define the Symantec Mail Security archive mailbox and host to be used when the archive action is defined in a compliance policy. 2. Populate the Classified or Restricted Premium Content Control dictionary with filenames that you may want to create content compliance policies against. In this case we will add the weekly results.xls filename to the list. 3. A compliance policy is configured on the Symantec Mail Security appliance to inspect outbound SMTP messages containing attachments listed in the Classified or Restricted Premium Content Control dictionary. The action to deliver the message normally, and archive (copy) the message adding an optional X-header with a value of bank is selected. 4. EV archives the message from the Symantec Mail Security archive mailbox, and indexes the x-header information as part of the archiving process. An archive task filter inspects the x-header property tag called x-archive and assigns a different retention category based on the value. In this case an x-archive value of bank means to use a financial legal retention category called Financial Messages (set to 5 years). 5. Administrators and Legal team members can now search Enterprise Vault for this item based on either its retention category or the value of the x-archive property as one or more of their search terms. Enterprise Vault will retain and then expire the message from the archive based on the Financial Messages retention category (5 years from the date of archive). Figure 7: Outbound Message Flow and Tagging 13

15 Hardware Sizing Enterprise Vault Sizing Sizing systems appropriately for deployment for Enterprise Vault requires careful examination of specific mailbox and journal archiving requirements and variables such as the number of messages per day per user to be archived. This is the most important variable from a sizing perspective. Other important variables include the average size of the messages and when and how often messages are archived. Often it is recommended to run Enterprise Vault archiving outside of core business (9am 5pm) to ensure impact on both the Exchange server(s) and end users is kept to a minimum. This is due to the archiving process moving data between the Exchange server(s) and Enterprise Vault requiring CPU cycles, Storage IOPS and network resources to achieve. By doing this work in the evening Symantec has found that often (due to the reduced user load outside of core hours) the Exchange server is actually less utilized than it would be during the day with no archiving occurring i.e. just user load. Evening archiving schedules hinge on there being enough of a window available for EV to do its work while not impinging on other Exchange related activities such as backup and maintenance periods. In summary the main contributing factors to understanding and sizing an Enterprise Vault solution are as follows: The amount of data that needs archiving: How much data represents the backlog? How much data will be archived from mailboxes each day? * The EV solution should provide sufficient capacity to archive these quantities of messages in a timely manner (see below). The times available to do the archiving: When is Exchange backed up? When is the maintenance period for Exchange? Does the backlog need clearing in a specific time scale? How much time would be available for archiving daily / weekly? * The EV solution should be sufficiently powerful enough to ensure the quantity of messages defined above can be archived in the defined time windows. The distribution of mailboxes across multiple Exchange servers: What version of Exchange are they running? How many mailboxes will be enabled for archiving? What is the split of mailboxes across the Exchange servers? How many of these Exchange servers are not on the LAN i.e. remote from EV? * The EV solution should cater for archiving from remote Exchange servers if necessary (hourly archiving rates may well be reduced for these remote servers due to network latency and bandwidth). 14

16 How these factors change over time: Annual increase in message volumes Annual increase in number of mailboxes * Providing an archiving solution that will scale with the needs of the customer is crucial. The solution should have sufficient capacity to allow for increases in both archiving and user load. What other EV components are on the EV servers: Mailbox, Public Folder, Journal and PST archiving? Discovery / Compliance Accelerator? * The EV solution should cater for the fact that perhaps more than one archiving module may be running concurrently. This effect can be minimized by choosing different archiving periods for the various types of archiving. Consider though, as an example, journal archiving where load is constant (and not scheduled) throughout the business day. What other 3rd party components are on the EV servers? Will EV share a server with SQL server? Anti-Virus / Backup Agents? * Any 3rd party components may place additional loads and requirements upon the EV servers. Particularly SQL server which in small implementations is fairly common to see it sharing the same server hardware as EV It should be noted that in most Enterprise Vault deployments catering for archiving for up to 2,000 users it would be unusual to require more than a single Enterprise Vault and SQL server from a hardware perspective. Additional requirements such as disaster recovery, high availability and multi sites network topologies can however change this. Recommended server specification for Enterprise Vault Dell PowerEdge x CPU 4GB RAM Local mirrored HDD (min. 70GB) Additional local or network Dell/EMC storage for storing archived data and indexes. 15

17 SMS 8300 Appliance Sizing When considering which SMS 8300 hardware to purchase some of the main factors that need to be considered are the number of messages that will be passing through the appliance daily, the percentage of the total mail volume that is spam, the number of peak messages per hour and the average message size. As a guideline, in a typical 2,000 user single site environment where 65% of the total mail volume is spam, the average message is 30 kilobytes, with an average of 9 messages per second during working hours, a peak of 14 per second, and where the average user is sending 40 messages per day and receiving 115 messages (before removal of spam) one SMS 8360 appliance acting as a Control Center and Scanner can be used to protect the environment. In a similar 1,000 user single site environment where 65% of the total mail volume is spam, the average message is 30 kilobytes, average messages per second is between 4 and 5 messages during working hours, peak messages per second is 7 messages, and where the average user is sending 40 messages per day and receiving 130 messages (before removal of spam) one SMS 8340 appliance acting as a Control Center and Scanner can be used to protect the environment. Multiple scanners are recommended for forecasting future mail usage, for instant messaging scanning, and for resiliency and load balancing purposes. A dedicated Control Centre may be required if reporting data and spam quarantine will hold information for periods longer than the defaults. 16

18 The Effect of enabling Journaling on MS Exchange Exchange journaling can be configured and enabled in such a way that it has a very minimal impact on the messaging environment. 5,500 Enterprise Vault customers can not all be wrong. Symantec can confirm that after many years of supporting Enterprise Vault they do not have a single recorded case of a customer enabling journaling and journal archiving that causes a significant or unreasonable performance degradation in their Exchange servers. Claims that enabling Exchange journaling causes between 25% and 35% additional overhead on an Exchange server are in fact a gross misrepresentation of the truth. The performance overheads are all in fact felt in disk I/O: Disk I/O The overhead journaling causes can for the most part be contributed to a potential increase in Disk I/O and not memory or CPU usage. This additional overhead in IOPS of enabling message journaling is between 4 and 8 percent when SAN storage is used for the Exchange databases and log files AND the journaling mailboxes are hosted on the same databases that are used for user mailboxes. SAN is the preferred storage platform for the majority of customers that have implemented Exchange. Load simulation tests that used storage area network (SAN) storage devices showed the following average disk I/O increases: Approximately 4 percent for database operations Approximately 8.25 percent for log file operations * These tests were performed by using the Loadsim program to simulate loads of between 1,000 users and 2,000 users. It should also be made very clear that I/O impact is only felt if the journal mailbox(es) are located on the same databases that host the user mailboxes. This is a very uncommon scenario as Microsoft best practice dictates that customers should have a dedicated database(s) or server(s) that host the journal mailboxes. This configuration means that the effect of journaling on the mailbox stores is virtually zero. The increased I/O will only be felt in the Journal store. 17

19 Enterprise Vault Best Practices Backup During an Enterprise Vault backup, a user or process must not add new data to Enterprise Vault because integrity would be lost between the databases, indexes, and vault stores. A backup (and thus restore) should represent one snapshot in the past to which you can revert or recover Enterprise Vault. To prevent any changes occurring during this backup period the user of Enterprise Vault read-only mode enables users to access archived messages from both Outlook and the search application but prevents any new data from being added. A backup of Enterprise Vault consists of a backup of the Vault Store partitions, the index partitions and all EV SQL databases (of which there will be multiple). Safety Copies The use of safety copies is highly recommended to help ensure the integrity of data being archived from users mailboxes before being removed from the Exchange information store. This feature works by marking any newly archived items in users mailboxes as Archive Pending. In this state the marked messages have been archived and can now be found in the archive but an Enterprise Vault backup has yet to occur. Once a backup run has completed, Enterprise Vault will convert each Pending message to a shortcut as defined in the mailbox archiving policy. By using the backup process as a flag to ensure data integrity Enterprise Vault can ensure that before any item is removed from the Exchange store it is safely stored and backed up within its data stores. More information on read-only mode, backing up Enterprise Vault and the use of safety copies can be found in the Enterprise Vault Administrators reference guide. Archive Timing Defining a suitable archiving schedule for Exchange user mailboxes can be a tricky business. There are many ways to approach this subject, however, listed below are 3 of the most common configurations: 1. Archive user mailboxes immediately after the Exchange backup has completed. This will most likely be out of hours and should complete before users arrive for work the following morning: Advantages Occurs out of hours and has minimal impact on users, Archiving will work at optimal speed as Exchange is in low utilization period. Disadvantages The Exchange backup and maintenance windows can often take all night leaving no room for an archiving window, A daily Enterprise Vault backup period would be required. 18

20 2. Archive mailboxes during the weekend only. The window allocated for archiving would need to be much larger however it will have very little impact on users during the business week. Advantages Occurs out of hours and has minimal impact on users, Archiving will occur at optimal speed as Exchange is in a low utilization period, Does not affect nightly Exchange backups during the week, Less Enterprise Vault backup windows required. Disadvantages Requires a much larger archive window at the weekend, User mailboxes can reach their quota limits and require archiving before the weekend. 3. Archive mailboxes during the business day but reduce the number of active archiving threads to reduce the impact of archiving on Exchange. This allows for day time archiving which can be the only option if Exchange maintenance windows take all night: Advantages Users will have their mailboxes actively maintained and archived during the day, Only option if Exchange maintenance windows take all night to complete, Leaves the overnight maintenance window for archiving other data sources such as User PST files. Disadvantages Can have an impact on Exchange particularly if the server(s) are already stretched for resource. Certification Symantec is constantly evolving the list of supported platforms, applications and service packs that work with Enterprise Vault. To ensure that the platforms and applications you wish to integrate with Enterprise Vault are supported and can be expected to function correctly, please download and view the Enterprise Vault Certification and Compatibility guide from the Symantec website. This guide is updated monthly with the latest certification and recommendations. Symantec Mail Security for Microsoft Exchange Best Practices Updating Definitions If you have Symantec AntiVirus Corporate Edition or Symantec Endpoint Protection installed on the same computer as Mail Security, as the two products can share definitions, configure the file system software to perform definition updates, and disable liveupdate from within the Mail Security for Exchange product. Also note that certain files and folders will need to be excluded from any file system antivirus scanning software. See the Microsoft for Exchange Implementation Guide for further details. Performance To enhance performance, enable background scanning of the message store during off-peak periods. 19

21 Symantec Mail Security 8300 Appliance Best Practices Deployment To get the best results from your Symantec Mail Security 8300 appliance it should be deployed directly at the gateway. This allows the appliance to obtain the physical or peer IP connection for an incoming message which is required to take advantage of the Traffic Shaping, Directory Harvest Attack, and Virus Attack Firewall technologies. Backup Regular backups of the Control Center should be taken in case of disaster. Ideally the option to back up to a remote FTP server should be used. If disaster occurs and a restore needs to be run, the Control Center needs to be running the same version of the software that was running when the backup being restored was taken. Also if a Control Center needs to be rebuilt or backed up to a different appliance, the new Control Center must be set up identically to the backed up Control Center in terms of IP address, hostname etc. Performance Retaining large amounts of quarantine, logging, and reporting data for long periods of time can affect Control Center performance: If Logging data is required for long periods of time, the option to enable remote logging to Syslog should be used. The Spam Quarantine is not designed to keep large amounts of spam for long periods of time. When planning to use the spam the quarantine an LDAP Authentication source should be setup and configured if possible so the Delete messages sent to unresolved addresses quarantine setting can be enabled. This setting will make sure spam addressed to non existent recipients is deleted before being inserted into the spam quarantine which saves valuable quarantine space. In terms of Reports, only enable extended Reporting that is required within your organization, in particular, the sender statistics usually consume a large amount of disk space. Also schedule reports regularly so report data doesn t need to be stored for long periods of time. 20

22 Enterprise Vault and Symantec Mail Security for Exchange Testing The primary focus of the yellow book testing was to determine the overall impact to Exchange server performance when either or both Symantec Enterprise Vault mailbox and journal archiving and SMS for Exchange security were deployed. The testing is aimed at showing what (if any) additional hardware requirements result from deploying the Symantec solutions. Performance testing with Microsoft LoadSim was used to simulate Exchange load similar to customer environments with between 1,000 and 2,000 mailboxes. EV and SMS were then additionally loaded and allowed to run on or against the Exchange server. The Server and Storage hardware used to conduct all of the Yellow Book tests were as follows: * All servers were running Windows 2003 server. Server Specifications Model Name: Dell PowerEdge Server PE1950 Processor: 3GHz Xeon (Dual Core) No. Processors: 2 Memory Size 8GB RAM Network Interface: Dual Embedded Gigabit NICs Internal Storage: 2 x 72GB HDD, 10K RPM Storage HBA: QLogic 2342 Dual Port 2Gb FC Model Name: Dell PowerEdge Server PE2950 Processor: 3GHz Xeon (Dual Core) No. Processors: 2 Memory Size 16GB RAM Network Interface: Dual Embedded Gigabit NICs Internal Storage: 2 x 146GB HDD, 10K RPM Storage HBA: QLogic 2342 Dual Port 2Gb FC Storage Specification Model Name: Dell/EMC CX300 SAN Disk Array No. Disks: 15 HDD: 146GB FC HDD, 10K RPM Front End Hosts 4 x 2Gb FC Ports 21

23 Network Topology The server hardware was deployed on a single Ethernet network segment each using a Gigabit NIC for network communication. The storage was provisioned over fibre to each of the servers using a dedicated fibre channel switch connected to the CX300 SAN. See Figure 8 for a high level network topology: Test Results Figure 8: Exchange, Enterprise Vault and Symantec Mail Security testing - Network Topology The results are split into 3 different testing categories: 1. Exchange baseline 2. Exchange + SMS 3. Exchange + SMS + EV Mailbox Archiving The testing for all three categories were conducted three times: once for 1,000 users, once for 1,500 users and once for 2,000 users. During each of the phases of testing the following metrics were captured from the Exchange server: Number of users CPU Utilization (Total %) Network Connection Utilization (Total MB) Disk IOPS (Store and logs combined) Disk MB/sec Disk Average Response Time (sec) Disk Maximum Response Time (sec) Disk % Reads Disk % Writes Memory Utilization (Total MB) 22

24 The following legend applies to all yellow book results: Table 1: 1,000 Exchange Mailboxes Table 2: 1,500 Exchange Mailboxes Table 3: 2,000 Exchange Mailboxes 23

25 By consolidating the results above it is possible to generate charts showing performance trends across three of the key measurements; CPU Utilization, Response Time and Disk IOPS. Chart 1: CPU Utilization during Testing Chart 2: Response Time (ms) during Testing 24 Chart 3: Disk IOPS during Testing

26 From these charts it is possible to deduce several observations: Introducing EV mailbox archiving to an Exchange server using a sensible and suitable archiving schedule e.g. archiving out side of core business hours, can have virtually no impact on Exchange performance during the day. The tests above were conducted using a full user load to simulate core hours for the Exchange baseline and Exchange + SMS tests and then during the Exchange + SMS + EV mailbox archiving a reduced user load was used to simulate a lower level of user activity i.e. typical evening (pm) server load. It is clear to see from the CPU utilization chart that with this reduced user load and SMS and Enterprise Vault mailbox archiving running on the Exchange server, for user amounts over 1,500 users, it is still not as busy as during the day (core business hours) running just user load. Enterprise Vault tends to impose a consistent load on the Exchange server regardless of the number of users. This is due to the archiving architecture it uses whereby it has a standard number of archiving threads on which to use. SMS for Exchange is slightly different in that it is designed to scan messages on demand and therefore has to be active during the day in order to maximize its value and effectively protect users. It can be seen from the charts above that even with SMS for Exchange running on the Exchange server during core hours the increase in load on the server is capped at approximately 10% (in the worst case), and is often much less (in the low single percentages). Both SMS and Enterprise Vault place an increased disk IOPS load on the Exchange server. This is to be expected as SMS must carry out extra checks on messages, quarantining items if necessary and EV will be moving hundreds of items between Exchange and the archive (depending on the archive policy) and only during its scheduled archive period. EV places the largest load on Exchange in terms of IOPS and this is mitigated by the fact it will be running out of hours and only during its scheduled archive period. SMS places much less of a load (approx. + 25%) and can therefore quite easily wok side by side with Exchange during the business day. Even with the extra load that either EV or SMS place on the number of disk IOPS the total requirement (as shown by the tables and charts) are miniscule when compared with the maximum IOPS throughput of most modern storage devices and certainly do not come close to the throughput possible from a CX300 SAN. For additional information regarding Secure Exchange or other Symantec products sold through Dell, please go to HYPERLINK \o exchange or contact your Dell Sales Representative 25

27