Technical White Paper HP Access Control Upgrade Guide. August 2017

Transcription

1 Technical White Paper HP Access Control Upgrade Guide

2

3 Table of contents 1 Introduction Preparation Where to obtain the current HP AC software Where to obtain HP AC documentation Can this HP AC version be updated in-place? Supported devices / firmware revisions Certificates Time required Backup prior to upgrading Determine order of the upgrade Licensing AlertX Testing prior to upgrade Upgrading HP Access Control Upgrade device firmware if necessary Upgrade HP AC client software on end user PCs Upgrade HP AC server Single-server environments Multi-server environments, within each given data center: Upgrade the device HP AC IRM Agent HP AC client HPAC card readers and masking HP AC IPM HP AC Job accounting Table of contents 3

4 8 HP AC IRM Authentication database NLB considerations for order of upgrade Multi-domain Known issues Post upgrade tasks Table of contents 4

5 1 Introduction This guide covers the process of upgrading to a new version of HP Access Control (HP AC). Some legacy versions of HP Access Control (versions 6.x, 12.x, 13.x and 14.x) were based on entirely different architectures. Upgrading from those versions is considered a migration and is out of scope for this document. Upgrades beginning with HP AC 15.0 take advantage of architecture consistency and are much simpler. This guide addresses how to implement upgrades as effectively as possible. For simplicity, we assume HP AC Enterprise 15.x has been installed and configured correctly for the customer environment and that no architecture changes will be implemented as part of the upgrade. If there will be significant changes to the infrastructure or the addition of new features, it is recommended to consult with HP prior to upgrading. 2 Preparation 2.1 Where to obtain the current HP AC software HP recommends always using the latest upgrade software available. Using older versions may unnecessarily expose the customer environment to issues that have been resolved in newer revisions. HP Access Control software can be downloaded via this URL: Where to obtain HP AC documentation The HP AC Admin Guide and other documentation can be obtained via this URL: Release Notes for each HP AC version are included with the software bundle. 2.3 Can this HP AC version be updated in-place? It may be possible to upgrade the HP AC server in-place. However, before initiating an upgrade please contact HP to ensure your version can be upgraded. It is highly recommended to receive technical consultation prior to upgrade. Recognize whether a given project represents an upgrade or a migration. If a significant infrastructure, architecture or server hardware change is included, it should be handled as a migration and is out of scope for this document. 1 Introduction 5

6 2.4 Supported devices / firmware revisions Review the Release Notes for the new HP AC version for the list of supported devices. Firmware should generally be kept up-to-date. Please contact HP for recommendations on any specific device or firmware revision. Firmware updates can be completed any time before the HPAC upgrade. 2.5 Certificates If using self-signed certificates, be aware that the default self-signed certificates type changed in HP AC If upgrading from a version prior to 15.2, you will need to generate and apply new self-signed certificates. 2.6 Time required For in-place upgrades, when you run the HP AC Setup utility, the installer should recognize the existing installation and run through that automatically with no user intervention required. Total time will vary, but this typically takes less than 15 minutes per server to complete. HP AC Job Accounting server upgrades may take longer because SQL database will typically need to be updated. 2.7 Backup prior to upgrading NOTE: Any file that has been customized or patched for the specific deployment should be backed up unless HP has confirmed those patches are included in the solution update. Consult with HP on whether these files should be put back into place following the update. We recommend performing a server backup or snapshot for virtual machines for disaster recovery purposes prior to commencing the upgrade. For servers with Card ID Masking enabled, it is highly recommended to back up the DataDecodeDefaults.xml files prior to upgrading. The AD-Authenticator DataDecodeDefaults.xml file is located in the \HP Access Control\AD-Authenticator\ folder. The XT device DataDecodeDefaults.xml file is located in the \HP Access Control\DPR\ folder. If using HP AC IPM, we recommend backing up rules. If needed, please contact HP for instructions on backing up IPM rules. HP AC Authentication and Job Accounting databases should be backed up prior to the upgrade. HPAC will upgrade database tables as required if the newer HPAC version requires it but the upgrade does not back up databases. The C:\Program Files\HP\HP Access Control\bin\Config4.sdf file can be backed up to enable disaster recovery of the HP AC Configuration Utility settings. 2.8 Determine order of the upgrade 1. Upgrade device firmware if necessary. 2. Upgrade HP AC client software on end user PCs. 3. For single-server environments, upgrade the HP AC server. 4. For multi-server environments, within each given data center: a. Job Accounting / License management server first b. Standalone HP AC Enterprise print servers next c. Clustered or paired NLB servers must be upgraded together 2 Preparation 6

7 WARNING: Do NOT push an updated device agent and configuration from a version or newer Admin Console to devices configured to pull jobs from a version or older pull print server. This will result in an error condition as the devices try to connect with a newer pull print service which does not exist on the older server version. Upgrade the pull print servers prior to pushing an updated device configuration. 5. Hold on upgrading from original 15.2.x device agents until all server upgrades are complete. NOTE: if using the X3D03A /HIP II reader, is going to be used for more than 2 card types, then the HPAC devices agents for the devices using that reader will need to be upgraded. 6. If the HP AC pull print queue is named pullprint," HP recommends disabling internet printing. a. Under Print and Document Services in the Windows Server Manager, clear the Internet Printing checkbox. b. Click Next. NOTE: This will prevent a conflict with the HP AC pull printing web service for FutureSmart 4 devices. Figure 1 3 Upgrading HP Access Control 7

8 5. Hold on upgrading from original 15.2.x device agents until all server upgrades are complete. NOTE: if using the X3D03A /HIP II reader, is going to be used for more than 2 card types, then the HPAC devices agents for the devices using that reader will need to be upgraded. 2.9 Licensing Licenses are retained across an upgrade. However, for disaster recovery purposes, a best practice is to keep a record of the software licenses. HP can also provide replacement licenses if needed. If new servers will be introduced, new licenses may be required. Consult with HP if this is a requirement for the upgrade/migration AlertX If AlertX is being used to monitor service failures, it should be stopped prior to the upgrade. If allowed to continue running, AlertX will be triggered during the upgrade which could have negative consequences depending on how it is being used. Refer to the AlertX documentation or contact HP Support if you need instructions on disabling AlertX Testing prior to upgrade RECOMMENDED: HP strongly recommends qualification of the new HP AC version and the upgrade process in a non-production part of the customer s environment before deployment to the production environment. 3 Upgrading HP Access Control Perform the following steps to upgrade HP Access Control: 3.1 Upgrade device firmware if necessary 3.2 Upgrade HP AC client software on end user PCs 3.3 Upgrade HP AC server

9 3.3.1 Single-server environments An upgrade of HP AC upgrades all HP Access Control (HP AC) components currently installed on the server. During an upgrade, all HP AC processes are stopped. Move the latest HP AC installation file to the server where the older version of HP AC is installed. Complete the following steps: 1. Right-click the HP AC installation file and select Run as administrator. 2. Click Next to begin the upgrade. 3. If prompted, type the correct SQL login and password, and then click Next. NOTE: If the HP AC server is connected to a SQL database on a different server using SQL credentials, you might be prompted to enter your SQL credentials to restore the connection. 3 Upgrading HP Access Control 8

10 4. Click Finish. After upgrading the HP AC configuration tool, make sure to upgrade the agent files on devices. Upgrading of a new agent version can be installed over an older agent version. 5. For both HP AC Secure Pull Print Enterprise and HP AC Secure Pull Print Express, it is highly recommended that the following settings be re-applied in the HP AC admin console: a. In the HP AC configuration utility, go to the Settings tile. Click the Device tab, and enter the Administrator password (in the Device section). Click Apply. b. On the Settings tile, go to the IIS tab. Under each section, click Test to test the connection and click Apply. 3 Upgrading HP Access Control 9

11 6. If Job Accounting and IPM were previously installed, go to Settings tab > Database tab. In the Database configuration section, click Test to test the connection to the Job Accounting database and click Apply. NOTE: When using Windows authentication to connect to the Job Accounting database, ensure that for the Agent Configuration section the LocalSystem account is unchecked, and the correct Windows Domain\User and Password credentials are entered. This is required for access to the database. Select to Restart services after update and click Test and Apply. 7. If Job Accounting was installed, go to the Settings tile. Go to IIS tab. In the Push mode section, click Test and Apply Multi-server environments, within each given data center: a. Job Accounting / License management server first b. Standalone HP AC Enterprise print servers next c. Clustered or paired NLB servers must be upgraded together 3 Upgrading HP Access Control 10

12 3.4 Upgrade the device HP AC IRM Agent WARNING: Do NOT push an updated device agent and configuration from a version or newer Admin Console to devices configured to pull jobs from a version or older pull print server. This will result in an error condition as the devices try to connect with a newer pull print service which does not exist on the older server version. Upgrade the pull print servers prior to pushing an updated device configuration. HPAC server upgrades are normally backwards compatible with older device agents however, it is recommended that device agents are not older than one version behind the server. To take advantage of any feature additions or enhancements, the best practice is to upgrade agents as soon as business requirements allow. Partial cleaning of devices is normally not a requirement. Agents will install over the top over the older ones and then reboot the device upon completion. 1. In the HP AC configuration utility click Devices. 2. Select the devices you want to update. 3. Click Install to push the HP AC agent to the device. Choose Yes when prompted. NOTE: FutureSmart devices will display Receiving Upgrade. Non FutureSmart devices will display Disk Operation Failed. This is expected behavior. Installation will fail if device EWS password is not set. After upgrading a FutureSmart device, make sure to re-apply the Sign-In Method on the EWS > Access Control page. After upgrading a non-futuresmart device, right-click the device and click Update selected to reapply authentication. 3 Upgrading HP Access Control 11

13 4. For non-futuresmart devices, right-click the device and choose Enable OXPd 1.6. NOTE: In order to use pull printing, OXPd 1.6 must be enabled on non-futuresmart devices so that the HP AC button will display on the front panel. 5. Wait for the device to reboot. 6. For HP AC Enterprise, go to the HP AC admin console > Settings > SPP Enterprise and click Update printer definition. 3 Upgrading HP Access Control 12

14 4 HP AC client As of HP AC version , HP AC Client software cannot be automatically updated in-place. To upgrade to a newer version, the older version must first be uninstalled. Be advised that HP AC Client software in version and newer requires.net 4.6 installed on the client PCs. HP AC Client software should be updated prior to updating HP AC server or device agent components. 5 HPAC card readers and masking If Card Masking is enabled, backing up the datadecodedefault.xml folder is a required step. The backed-up datadecodedefault.xml file should be restored immediately following the HP AC upgrade. In a mixed environment where there are both the HIP1 (CZ208A) and HIP2 (X3D03A) readers and HP AC 15.3.x is installed and capable of managing 4 different card types, the CZ208 reader will always read from the first two card types configured in IRM. (See the screen shot in Figure 1). NOTE: For a device using the HIP2 reader to read all four card types set in IRM, the agent will need to be upgraded to version 15.3 or newer. NOTE: The Proximity reader configuration settings of IRM must not change if this server is doing the authentication. 4 HP AC client 13

15 Example: If you are configuring your devices from a central management server (Server A) it is possible to make changes to this setting for each Pull Print/Authentication server (Server B) you configure. Server B s card reader configuration would always remain static but server A would change according to which devices are being configured and for which server. However, if you are doing centralized management AND centralized Authentication (Where all devices authenticate against one server) then you must not change the card types in IRM once set. 6 HP AC IPM IPM is used for rules-based printing. Our best practice recommendation is to back up the rules for disaster recovery purposes. Please contact HP if you need instructions on how to back up IPM rules. 7 HP AC Job accounting NOTE: Upgrades of HP AC Job Accounting can generally be separated from upgrades to HP AC s Authentication/Authorization and Pull Printing components for project simplification. JA upgrades may involve extending the SQL database schema. DB Owner or equivalent SQL account permissions are required to perform this action. If upgrading HP Access Control Job Accounting, we recommend first performing the following steps: 1. Stop the Agent service. 2. Backup the HPACJA database on the SQL Server. 3. Backup the C:\Program Files\HP\HP Access Control\Temporary folder which contains tracking XML files that have not yet been processed into the JA database. 8 HP AC IRM Authentication database HP recommends that the IRM Authentication database should be backed up prior to the upgrade for disaster recovery purposes. The database schema may be extended as part of the upgrade process, but the enrollment data should be retained across an update. 6 HP AC IPM 14

16 9 NLB considerations for order of upgrade When upgrading HP AC running on a Network Load Balancer (NLB) node, that node needs to first be brought off-line in the NLB manager so it will not be used. When the first node has been updated and brought back online in the NLB manager, the remaining nodes should be brought off-line until they are also updated. Using this process will avoid having mixed HP AC versions within a single NLB cluster. With more than 2 nodes you may consider the following strategy: For three nodes: o o o o Take node 1 offline and upgrade HP AC on it Bring node 1 back online Take nodes 2 and 3 offline upgrade HP AC on them Bring nodes 2 and 3 online again For four or more nodes: o o o o Take half of all nodes offline and upgrade HP AC on them Bring the upgraded nodes online Take the remaining nodes offline and upgrade HP AC on them Bring all the nodes online again Non-clustered HP AC 15.2.x servers and 15.3.x servers can operate in the same environment while upgrades are completed although it is recommended that the migration strategy be discussed and planned to validate proper functionality. 10 Multi-domain If upgrading HP AC to take advantage of Multi-Domain support in version in 15.3 the Domain field in the IRM Authentication database will need to be updated via SQL script. Consult with HP for recommendations on this environment architecture change. 9 NLB considerations for order of upgrade 15

17 11 Known issues HP AC Express, Intermittent pull print jobs do not print When upgrading from HP AC Express 15.2.x or older to HP AC Express 15.3 or , intermittently users may report that retrieved jobs do not print. This may be caused by a missing snmpdevicetimeout registry entry. This is resolved in HP AC Express Message during upgrade about SQL Compact Edition Some previous versions of HP AC enabled the use of SQL CE for the authentication database. SQL CE should no longer used. Contact HP if you need assistance exporting authentication/enrollment data from SQL CE to a new database. 12 Post upgrade tasks Following the HP AC upgrade we recommend exporting the configuration settings so they can be used for future disaster recovery if needed. 11 Known issues 16