Building a Bulletproof SharePoint Farm

1. Building a Bulletproof SharePoint Farm Michael Noel Convergent Computing Twitter: @MichaelTNoel

2. Michael Noel Author of SAMS Publishing titles �SharePoint 2007 Unleashed,� the upcoming �SharePoint 2010 Unleashed,� �SharePoint 2003 Unleashed�, �Teach Yourself SharePoint 2003 in 10 Minutes,� �Windows Server 2008 Unleashed,� �Exchange Server 2007 Unleashed�, �ISA Server 2006 Unleashed�, and many other titles . Partner at Convergent Computing (www.cco.com / +1(510)444-5700) � San Francisco, U.S.A. based Infrastructure/Security specialists for SharePoint, AD, Exchange, Security

3. Session Objectives And Agenda SharePoint Structure and which components can be made redundant / highly available Sample Architecture of Redundant/Highly Available Deployments Smallest redundant/highly available farm Large farms Redundancy/Availability across farms SQL Mirroring of Content Databases Synchronous Mirroring in Single Site Model Synchronous Mirroring in Highly Connected DR Site Model Asynchronous Mirroring in DR Site Model Third-party Content Replication for Availability Backup/Restore Tips, including info on DPM 2007 Snapshot-based backup for SharePoint

4. SharePoint Component Redundancy Understand How to Make the Various SharePoint Roles Redundant and Highly Available

5. SharePoint Component Redundancy Each SharePoint Role has different redundancy/availability concerns. Web Role Query Role Application Role Index Role Database Role

6. SharePoint Component RedundancyWeb Role Redundancy/HA can be achieved by adding multiple web role servers to farm Network Load Balancing can then be configured between the servers Software NLB (Windows NLB) is possible, Hardware NLB (F5, CSS, NetScaler) is preferable Be sure to enable �stickiness� or your users will be prompted to authenticate multiple times and may have functionality break!

7. SharePoint Component RedundancyQuery Role Query Role can be placed on multiple front-ends Often paired with Web Server Role SharePoint intelligently sends search referrals to Query Servers Each Query Server requires a large drive set for Index propagation. Be sure to set aside enough space! The index size may be from 10% to 40% of the size of the content being indexed. Don�t forget external content sources! If using multiple Query servers, Query role may NOT be placed on Index role, this is not supported and Index propagation will fail.

8. SharePoint Component RedundancyApplication Role Includes the following components: Excel Services Infopath Forms Services Similar to Query role, web servers issue referrals to servers configured as App servers Common to place this on Web server role. Large deployments may have this role on dedicated servers

9. SharePoint Component RedundancyIndex Role Only role that can�t be made redundant A Shared Service Provider (SSP) can only �live� on a single Index Server Failure of the Index Server role will not immediately affect functionality, but updates to the Index will not be performed The Index files cannot be �transferred� to another Index server, they must be re-built Index server failure can be fixed through a restore, or by re-indexing / re-propagating content from a new Index Server

10. SharePoint Component RedundancyDatabase Role Shared Storage Clustering (MSCS) can be used for local server High Availability Mirroring of Content Databases to remote SQL instance is supported (and recommended) More on this� SQL Server 2005/2008 Standard Edition supports two-node Cluster and synchronous mirroring. Fully Supported (and recommended) in SQL 2008 SharePoint 2007 supports SQL 2000, but not recommended NOTE: SharePoint 2010 will be SQL 2005 or 2008 (x64) only�prepare for this.

11. A SQL Alias will help you if you need to change your DB location. For example, if your SQL server name is �SQL1�, use something like �SPSQL� to connect, and have DNS point to the proper server location. This makes it MUCH more flexible. Either a DNS alias or a SQL Client Alias (preferred option). Often times a combination of both is best. Consider an Alias for Config DB and an alias for Content DBs.

12. Highly Available and Redundant Farm Architecture Examining Several Real World HA and DR Designs for SharePoint Farms

13. All SharePoint roles and SQL Server on the same box For very small environment without a lot of load SQL contention with SharePoint Easy to deploy, but highest potential for contention NOTE: Only the smallest environments use SQL Server Express or SQL Embedded Farm ArchitectureAll-in-One Farm (No Redundancy)

14. Dedicated SQL Server All SharePoint roles on single box Disk IO contention lessened by moving SQL off SP Server Greater performance can be gained by breaking SharePoint roles onto separate servers Farm ArchitectureDedicated SQL Database Server (Better Performance / No DR)

15. 2 Web/Query/Application /Central Admin/Inbound Email Servers 1 Dedicated Index Server (With Web role to allow it to crawl content) 2 SQL Standard Edition Cluster Nodes (Active/Passive) Smallest highly available farm (loss of any one server will not affect functionality) Farm ArchitectureSmallest Highly-Available Farm

16. Farm ArchitectureScalable Farm Multiple Dedicated Web Role Servers Multiple Dedicated Query Servers Multiple Dedicated Application Servers Dedicated SharePoint Central Admin Server(s) Single Index Server (per Shared Services Provider) Multiple node or multiple instance SQL Server Enterprise Edition Cluster(s)

17. Windows Server virtualisation Licensing Standard Edition: One virtual guest (if host is dedicated to virtualisation role) Enterprise Edition: Four virtual guests (if host is dedicated to virtualisation role) / Guests can be Std/Ent DataCenter Edition: Unlimited Number of Virtual Guests / Per processor socket license virtualisation OS licensing applies to Hyper-V or any virtual host software listed in SVVP (KB 897615) System Center virtualisation Licensing System Center Management Suite Standard Edition License: Gives DPM, OpsMgr, ConfigMgr, and VMM Agents for 1 server. System Center Management Suite Enterprise Edition License: Gives unlimited DPM, OpsMgr, ConfigMgr, and VMM Agents for all virtual guests on the host. Check with Microsoft for Specifics� Virtualised Farm ArchitectureMicrosoft Virtualisation Licensing Primer

18. Virtualised Farm ArchitectureCost Effective Farm / No HA

19. Virtualised Farm ArchitectureFully Redundant Farm with only Two Servers

20. Virtualised Farm ArchitectureBest Practise, Highly Available and Scalable Farm

21. Multiple Hosts � Scale Out

22. Content DB / Site Collection ScalabilityDistribute by Default Start with a distributed architecture of content databases from the beginning, within reason (more than 50 per SQL instance is not recommended) Distribute content across Site Collections from the beginning as well, it is very difficult to extract content after the face Allow your environment to scale and your users to �grow into� their SharePoint site collections

23. Sample SP Logical Architecture

24. Redundancy ACROSS FarmsThird party content replication model Farms in multiple locations 2-way synchronisation of content using third party replication tool Syntergy, AvePoint, WinApp Technologies, Casahl, Infonic Entire Web application is replicated

25. Bonus = Global load balancer (F5, NetScaler, CSS) used to direct users to local content. Alternate solution is to change DNS records. Failure of a farm is insignificant, content is replicated elsewhere, user is automatically switched (via global load balancer) to secondary location Other advantage is that users consume content in local location Disadvantage = Cost of third-party software and hardware load balancers, complexity of setup Redundancy ACROSS FarmsThird party content replication model

26. Content Database Mirroring Using SQL 2005/2008 Mirroring for SharePoint Content Databases

27. New in SQL 2005 SP1, available in both Standard and Enterprise editions, improved in SQL 2008 (better compression and speed) Works by keeping a mirror copy of a database or databases on two servers Can be used locally, or the mirror can be remote Can be combined with traditional shared storage clustering to further improve redundancy SQL Database MirroringHA Solutions using Mirrored Copies of SharePoint Databases

28. High Performance (Enterprise Edition only) Asynchronous Mirroring Safety level = OFF Failure of principal server may result in data loss High Availability Synchronous Mirroring Safety level = ON Dual-commit process ensures no data loss Third witness server required High Protection Synchronous Mirroring Safety level = ON Manual failover, no witness server SQL Database MirroringSQL Mirroring Modes

29. Single Site HA Mirrored Farm Single Site Synchronous Replication Uses a SQL Witness Server to Failover Automatically Mirror all SharePoint DBs in the Farm Use a SQL Alias to switch to Mirror Instance

30. Cross-Site Mirrored HA Farm Two Sites 1 ms Latency 1GB Bandwidth Farm Servers in each location Auto Failover

31. Two Farm / Mirrored Content DBs Two Sites Two Farms (one warm farm) Mirror only Content DBs Failover is Manual Must Reattach DBs Must re-index

32. Recovery level of databases must be set to FULL SQL System databases cannot be mirrored Synchronous (safety level is FULL) can result in slowness or performance issues if WAN gets congested For Performance reasons, max of 50 SharePoint Databases mirrored per Principal/Mirror Pair is Recommended. Requires unique instances on both principal server and mirror server Backup and restore database from principal server to mirror server before establishing initial sych. SQL Database MirroringSQL Mirroring Specifics

33. Mirroring across farms is only supported on Content Databases (Synchronous of all DBs within a farm is OK) Failover of a Content Database from one instance to another has to be performed through the SharePoint Central Admin tool or with STSADM Prerequisite checklist: SQL Services running with identical service accounts on both instances Backup of content databases must be done in �NORECOVERY� mode A full backup and a logs backup must be performed Encryption on endpoints is enabled by default, can be disabled by typing ALTER ENDPOINT Mirroring DISABLED (Mirroring is the name of the endpoint created, must be performed on both sides. SQL Database MirroringSQL Mirroring Specifics

34. DemoSetting up a SQL DB Mirror

36. Data Redundancy

37. SharePoint Backup and Restore Guide Backup SQL Databases (SQL Maintenance Plan or Third-party agent.) Backup OS, System State, and 12-Hive on Front-ends (not needed to backup often) Run stsadm � o backup �backupmethod FULL as part of a regular scripted batch file to backup all SharePoint content, including indexes Do individual site backups using stsadm � o backup �url individually or using a custom script (downloadable from presenter�s Network World blog Backup IIS metaverse using iisback.vbs Look at third party backup solutions (DocAve, Commvault, Quest) Consider System Center Data Protection Manager (DPM) 2007 for SharePoint aware backup/restore and item-level recovery

38. Microsoft System Center Data Protection Manager (DPM 2007) for SharePoint

39. Features of DPM for SharePoint Item-level recovery of Documents and List Data VSS Snapshot Integration, can snapshot SQL Databases every 15 minutes Backup to Disk (near-term), Backup to Tape (long-term) � Direct integration Not only SharePoint, but File Data, Exchange, SQL, and Bare-metal recovery (Using SRT)

40. Bonus #1: Enable Kerberos Add the SPNs for SPCA and SSP HTTP/spca.companyabc.com, HTTP/spca (Add to Farm Admin account) HTTP/ssp1.companyabc.com, HTTP/ssp1 (Add to SSP App Pool Identity account) Configure Kerberos as defined in this presentation SSP requires extra steps Install Infrastructure Update (KB951695) or SP2 Create Registry Key �HKLM\Software\Microsoft\Office Server\12.0\KerberosSpnFormat� (REG_DWORD) = 1 Create SPNs for each Web Role Server that hosts SSP (example below, SSP1 = name of SSP, sp1 = SharePoint server) MSSP/sp1:56737/SSP1 MSSP/sp1:56738/SSP1 Enable Kerberos from the command prompt (Stsadm.exe -o SetSharedWebServiceAuthn-negotiate) Bonus #2: Configure both for SSL Encrypts traffic and Admin passwords Create and install Web certs for spca.companyabc.com, ssp1.companyabc.com Bonus #3: Load Balance SPCA and SSP Install SPCA on multiple web role servers Enable either Hardware NLB or Software Windows Network Load Balancing Requires DNS A record (spca.companyabc.com), registry key and AAM modification (below) Bonus #4: Setup SPCA on port 443/80 Delete default IIS Web Site Assign dedicated IP (VIP if load balancing) to SPCA Web App Run STSADM to change the port(s) stsadm �o setadminport �port 80 stsadm �o setadminport �ssl �port 443 Change Port to 80 and 443 in IIS, Assign Cert (if using SSL) Modify SPCA URL on SP Servers - �HKLM\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\12.0\WSS\CentralAdministrationURL� (REG_SZ) = https://spca.companyabc.com/ Change your default AAM to https://spca.companyabc.com Bonus SlideHA and Security for SP Central Admin

41. Key Takeaways Highly consider Database Mirroring to improve DR capabilities Look at the Mirrored Farm Models for failover Consider a third-party product for improved DR and HA solutions At a minimum, make the SharePoint front-end roles redundant, especially web and query. Mirroring and clustering don�t require expensive software, can use standard edition of SQL/Windows SharePoint Backup and Restore can be greatly enhanced and simplified with DPM 2007

42. For More Information Speaker Books (http://www.samspublishing.com) SharePoint Database Mirroring Whitepaper (http://tinyurl.com/mirrorsp) Database Mirroring Failover Case Study (http://tinyurl.com/mirrorspcs) Microsoft �Virtualizing SharePoint Infrastructure� Whitepaper (http://tinyurl.com/virtualsp) SharePoint Log Shipping Whitepaper (http://tinyurl.com/logshipsp)

43. Thanks for having me at SharePoint Saturday Copenhagen! Questions? Michael Noel Twitter: @MichaelTNoel www.cco.com