Installing on a cluster
Applies to: Forefront Security for Exchange Server
To install Forefront Security for Exchange Server in a cluster environment, you must log on to the local computer as a Domain user with an account that has local administrator rights. FSE must be installed on each node. All program files should be installed to a local drive.
There are some important considerations:
Configuration data (such as ScanJobs.fdb and Notifications.fdb) is associated with a Clustered Mailbox Server (CMS) so each node does not need to be configured separately.
Scanner signature files are associated with a CMS, so both active and passive nodes will always be up to date.
Configuration data kept in the registry is replicated, on a CMS basis, when the CMS moves from one computer to another during a failover event.
The Forefront Server Security Administrator should be connected to the Virtual Machine when connecting to FSE on a cluster server. If you try to connect to the physical server, you will be asked to select the Virtual Machine to which you would like to connect.
Installing on an Exchange 2007 CCR cluster
Install FSE first on the active node and the on the passive node, following the instructions for Cluster installs found in the “Forefront Security for Exchange Cluster Installation Guide”, available on TechNet.
Important Considerations for CCR Cluster Installations
You must install FSE on the active node before installing it on the passive node. This is true for the first installation of a CCR cluster node. However, if a node fails and a new installation must be performed, you should perform the installation on the passive node, so that the passive node replicates the known-good data from the active node. If you perform the installation on the active node, the known-good data will be overwritten.
Do not fail over a CCR cluster node that has FSE installed to another node that does not have FSE installed.
You cannot perform a remote installation of a CCR cluster. Use a terminal server session instead.
Use the Cluster Administrator to check that the Exchange Cluster Resources are online on the active node before you install FSE. If the Exchange Cluster Resources are not online before you install Forefront Security, the node will be detected as passive.
When you install FSE on a CCR cluster, the installation path must be the same for both nodes.
Installing on an Exchange 2007 SCC cluster
Install FSE first on the active node and then on the passive node, following the instructions for Cluster installs found in the “Forefront Security for Exchange Cluster Installation Guide”, available on TechNet.
Important Considerations for SCC Cluster Installations
- For Single Copy Cluster installs, the cluster group must have the same name as the Network Name resource, otherwise the FSE installation will fail.
SSC cluster installation tips
Installing on clusters is complicated by the configuration and naming of the resources within the cluster administrator. The development and testing of cluster installation assumed the default configurations in Cluster Administrator; this has led to some confusion and installation issues. Problems can arise if there have been name changes within the Cluster Administrator, creating an extra layer of confusion during installation.
The installation process uses the resource name to derive the drive letter for the installation. During the installation, the user is prompted for both a shared drive and a cluster folder. Based on the listed assumptions the results of the various combinations are listed below.
Assume the following configuration in the cluster administrator:
Resource Names | Physical Path | Type |
---|---|---|
Disk E: |
E: |
Shared Drive |
Diskf |
F: |
Shared Drive |
Disk G: |
G: |
Shared Drive |
Mtptdr |
F:\mpd |
Mount point |
Gmpd |
G:\mpd2 |
Mount point |
For shared drive installs:
Disk Resource Name for Shared Drive | Cluster Folder | Path Forefront Uses |
---|---|---|
E: |
Forefront Cluster |
E:\Forefront Cluster |
Diskf |
Forefront Cluster |
F:\Forefront Cluster |
E: |
Test\Forefront Cluster |
E:\test\Forefront Cluster |
F:\mtpdr |
Forefront Cluster |
X – no match in resource names |
F:\mpd |
Forefront Cluster |
X – no match in resource names |
E:\test |
Forefront Cluster |
X – no match in resource names |
F: |
Forefront Cluster |
X – no match in resource names |
For mount point drive installs:
Disk Resource Name for Shared Drive | Cluster Folder | Path Forefront Uses |
---|---|---|
G: |
mpd2\Forefront Cluster |
gmpd\Forefront Cluster |
Diskf |
mpd\Forefront Cluster |
F:\mpd\Forefront Cluster |
Mpd |
Forefront Cluster |
X – no drive associated with mount point resource |
E: |
mpd\Forefront Cluster |
X - Installs, but not to mount point. It is installed to E:\mpd\Forefront Cluster |
G: |
gmpd\Forefront Cluster |
X – Installs, but not to mount point. It is installed to g:\gmpd\Forefront Cluster |
Additional Considerations
There must be at least one passive node.
Forefront supports any number of active nodes and one or more passive nodes.
Each node can only run one Clustered Mailbox Server (CMS) at a time.
Failovers must be to the passive node.
All configuration data is stored on the shared drive, so active and passive nodes will have the same settings.