Installing on a cluster

 

Applies to: Forefront Security for Exchange Server

To install Forefront Security for Exchange Server in a cluster environment, you must log on to the local computer as a Domain user with an account that has local administrator rights. FSE must be installed on each node. All program files should be installed to a local drive.

There are some important considerations:

  • Configuration data (such as ScanJobs.fdb and Notifications.fdb) is associated with a Clustered Mailbox Server (CMS) so each node does not need to be configured separately.

  • Scanner signature files are associated with a CMS, so both active and passive nodes will always be up to date.

  • Configuration data kept in the registry is replicated, on a CMS basis, when the CMS moves from one computer to another during a failover event.

  • The Forefront Server Security Administrator should be connected to the Virtual Machine when connecting to FSE on a cluster server. If you try to connect to the physical server, you will be asked to select the Virtual Machine to which you would like to connect.

Installing on an Exchange 2007 CCR cluster

Install FSE first on the active node and the on the passive node, following the instructions for Cluster installs found in the “Forefront Security for Exchange Cluster Installation Guide”, available on TechNet.

Important Considerations for CCR Cluster Installations

  • You must install FSE on the active node before installing it on the passive node. This is true for the first installation of a CCR cluster node. However, if a node fails and a new installation must be performed, you should perform the installation on the passive node, so that the passive node replicates the known-good data from the active node. If you perform the installation on the active node, the known-good data will be overwritten.

  • Do not fail over a CCR cluster node that has FSE installed to another node that does not have FSE installed.

  • You cannot perform a remote installation of a CCR cluster. Use a terminal server session instead.

  • Use the Cluster Administrator to check that the Exchange Cluster Resources are online on the active node before you install FSE. If the Exchange Cluster Resources are not online before you install Forefront Security, the node will be detected as passive.

  • When you install FSE on a CCR cluster, the installation path must be the same for both nodes.

Installing on an Exchange 2007 SCC cluster

Install FSE first on the active node and then on the passive node, following the instructions for Cluster installs found in the “Forefront Security for Exchange Cluster Installation Guide”, available on TechNet.

Important Considerations for SCC Cluster Installations

  • For Single Copy Cluster installs, the cluster group must have the same name as the Network Name resource, otherwise the FSE installation will fail.

SSC cluster installation tips

Installing on clusters is complicated by the configuration and naming of the resources within the cluster administrator. The development and testing of cluster installation assumed the default configurations in Cluster Administrator; this has led to some confusion and installation issues. Problems can arise if there have been name changes within the Cluster Administrator, creating an extra layer of confusion during installation.

The installation process uses the resource name to derive the drive letter for the installation. During the installation, the user is prompted for both a shared drive and a cluster folder. Based on the listed assumptions the results of the various combinations are listed below.

Assume the following configuration in the cluster administrator:

Resource Names Physical Path Type

Disk E:

E:

Shared Drive

Diskf

F:

Shared Drive

Disk G:

G:

Shared Drive

Mtptdr

F:\mpd

Mount point

Gmpd

G:\mpd2

Mount point

For shared drive installs:

Disk Resource Name for Shared Drive Cluster Folder Path Forefront Uses

E:

Forefront Cluster

E:\Forefront Cluster

Diskf

Forefront Cluster

F:\Forefront Cluster

E:

Test\Forefront Cluster

E:\test\Forefront Cluster

F:\mtpdr

Forefront Cluster

X – no match in resource names

F:\mpd

Forefront Cluster

X – no match in resource names

E:\test

Forefront Cluster

X – no match in resource names

F:

Forefront Cluster

X – no match in resource names

For mount point drive installs:

Disk Resource Name for Shared Drive Cluster Folder Path Forefront Uses

G:

mpd2\Forefront Cluster

gmpd\Forefront Cluster

Diskf

mpd\Forefront Cluster

F:\mpd\Forefront Cluster

Mpd

Forefront Cluster

X – no drive associated with mount point resource

E:

mpd\Forefront Cluster

X - Installs, but not to mount point. It is installed to E:\mpd\Forefront Cluster

G:

gmpd\Forefront Cluster

X – Installs, but not to mount point. It is installed to g:\gmpd\Forefront Cluster

Additional Considerations

  • There must be at least one passive node.

  • Forefront supports any number of active nodes and one or more passive nodes.

  • Each node can only run one Clustered Mailbox Server (CMS) at a time.

  • Failovers must be to the passive node.

  • All configuration data is stored on the shared drive, so active and passive nodes will have the same settings.