High Availability for Exchange 2007 Server Roles
                            Network Load Balance for Client Access Server and Hub Server Role

High availability is one of the important aspects which are needed by each and every business. Let me take you back to Exchange 2003 version high availability. When we are considering the factor for high availability in Exchange 2003 the only things running in my mind is clustered environment and if it is a FE server the network load balancing concept comes into the picture.

In Exchange 2007, if we want to maintain high availability we need to consider for all the server roles i.e.
 Database – Mailbox Server
 OWA, Activesync, IMAP POP3 and name resolution : Client Access Server
 Mailflow within a active directory – Hub Server Role
 Mailflow in and out of the organization to the internet cloud – Edge Server.

Exchange 2007 Mailbox High Availability:
Refer the below link
 LCR
 CCR
 SCC
 SCR

Exchange 2007 Edge Server High Availability:
Edge server is the server which is recommended to be placed in the DMZ network for protecting our active directory domain by stopping irrelevant mail like spam, unknown sender etc. The link from edge server to Active Directory is configured by mode of ADAM and edgesync i.e from edge server to Hub server and replication is always a one-way replication.
 Fine let say if we have only one edge server and crashed down what will happen. As an administrator I can’t imagine it. If we have more then one edge server then what best we can do here is using of multiple DNS MX record for load balancing. For edge server high availability I can’t drive out from my lab server.

Exchange 2007 Hub Transport Server High Availability:

Hub Transport   You can deploy multiple Hub Transport servers for internal transport high availability. Resiliency has been designed into the Hub Transport server role in the following ways:

• Hub Transport server to Hub Transport server (intra-org)   Hub Transport server to Hub Transport server communication inside an organization automatically load balances between available Hub Transport servers in the target Active Directory directory service site.
• Mailbox server to Hub Transport server (intra-Active Directory site)   The Microsoft Exchange Mail Submission service on Mailbox servers automatically load balances between all available Hub Transport servers in the same Active Directory site. U
• Unified Messaging server to Hub Transport server   The Unified Messaging server automatically load balances connections between all available Hub Transport servers in the same Active Directory site.
• Edge Transport server to Hub Transport server   The Edge Transport server automatically load balances inbound Simple Mail Transfer Protocol (SMTP) traffic to all Hub Transport servers in the Active Directory site to which the Edge Transport server is subscribed.

Hub & Client Access Server High Availability:
As like Exchange 2003 FE topology high availability we have the same module drived for exchange 2007 which is called as Network Load Balancing. Network Load Balancing is nothing but one sort of clustering where you will share your common host name between the two nodes so that if one node fails other node will take the ownership.
For client Access Server role and Hub Access Server Role we can avail this feature and can maintain the high availability Today I will take ride of configuring NLB for hub and cas server.

For configuration of Network Load Balancing initially I was aware about the concept but not much had a clear path on configuring it. I would like to thanks to Henrik Walter who is the role module for me to encouraging me to keeps on learning and even for this article his one of  the NLB configuration article was really a supportive information for me.

NLB can be done for each individual server role (i.e Hub & CAS role) or both the server role in one computer. Most of the organization use to go with the option of having two servers role in one computer.

My Lab Scenario:

Having One Active Directory Role Server in which I have installed Microsoft Certificate as well. Reason for having Microsoft Certificate for creating one common certificate for both the nodes i.e, SAN Certificate, which will see in a short while.
 Server name : DC.happy.com
 Role: DC\GC\DNS,IIS & Microsoft CA is installed

One Mailbox Server who is going to hold the mailbox information.
 Server Name : Mailbox.happy.com
 Role: Mailbox Server Role

Two Member Servers in which  I had installed Hub & Client Access Server Role.

Computer name Hub-Cas1.happy.com & Hub-Cas2.happy.com. Both of them will have two nic cards. One will be your public card another will be for NLB communication.
Hub-Cas1.happy.com – Hub and Cas server role installed
Ip address : 192.168.1.2 (public)
Ip address : 192.168.1.10 (N L B )

Hub-Cas2.happy.com – Hub and Cas Server role installed
Ip address : 192.168.1.3
Ip Address : 192.168.1.20 (N L B )

One Vista computer having outlook 2007
Vista.happy.com
Ip address : 192.168.1.5

Recommendation : if you are going to test NLB configuration for cas and hub server role in the VMware machine please do a fresh installation each otherwise it won’t work as expected (personally experienced)

Ok my lab is ready for now… having the above configuration for testing out network load balancing:

Creation of host entry in the DNS server:

First thing we need to have is host record entry for our cluster name. So what I will do here I will create a host entry called as webmail.happy.com and ip address will be 192.168.1.30. Reason for having this host entry is whenever  any one of server fails other should take the ownership by mode of NLB but there is should be one common name who will going to be resolver.
So let’s add a host entry, Log on to dns server and add a host entry
Figure 1
 

Note: in the above figure we have created one virtual host entry for NLB configuration.

Configuring the NLB adapters:

Now its time to configure the second adapter of both hub-cas servers. I have given the name as Pubic and NLB just for our reference in both the computer (hub-cas1 & hub-cas2)
Figure 2:
 

I have assigned a ip address for public & private network on both the servers
Hub-cas1.happy.com
Ip address : 192.168.1.2
Subnet mask : 255.255.255.0
DNS Ip Address : 192.168.1.1

And for NLB network card
Ip address : 192.168.1.10
Subnet mask : 255.255.255.0

Figure 3:
 

Hub-cas2.happy.com
Ip address : 192.168.1.3
Subnet mask : 255.255.255.0
DNS Ip Address : 192.168.1.1

And for NLB network card
Ip address : 192.168.1.20
Subnet mask : 255.255.255.0

Figure 4:
 

For configuring the NLB there are totally 3 ways:

1) Click on Start => Programs => Administrative Tools => Network Load Balancing
Figure 5:
 

2) Click on Start => Run => Nlbmgr.exe
Figure 6:
 

3) Right click my network places => right NLB network card => Properties and select network load balancing and then properties
Figure 7:
 

Note: In the above figure I selected Network Load Balancing then I clicked on properties.

Under properties we will see 3 tabs: Cluster parameters, Host Parameters and Port Rules.

In the cluster Parameters:
Inside cluster parameter, we have 3 options – cluster ip configuration, cluster operation mode and Allow remote control.
Normally we will select first two options only i.e cluster ip configuration and cluster operation mode.

In cluster ip configuration :
 Ip address : we need to give the ip address of virtual host name which we have created in the DNS zone as per figure 1. So my ip address is 192.168.1.30 and full internet name : our virtual host name for 192.168.1.30 ip address i.e webmail.happy.com

Note : we are able to see one option network address inside the ip configuration, I told you earlier that we need to have clean installation of OS if we are implementing this in a Vmware because if we go with copy images of this OS for the another node then network address will have the same value and because of this we will face some issue while configuring.

In Cluster Operation Mode: Select Multicast (because I faced an issue of request time out from the second node of the cluster to all servers and once I disabled my NLB nic card it was responding properly, latterly I changed the Unicast to Multicast.

One more mistake I would like point out here, which I did at the time of experiment, first I had configured the hub-cas1 and then I logged to hub-cas2 server tried to configure the NLB and both the server was not able to work in the cluster node and the reason for this under cluster ip configuration we have full internet name, in hub-cas1 I had typed webmail.happy.com and in hub-cas2 I had typed Webmail.Happy.com. So here I would like say that it is case sensitive. Once I rectified it, it was working but my recommendation would configure it from the one server itself which I am doing right now.

Host Parameters Tab:

Now lets go to Host Parameters Tab:
Figure 8:
 

Under host parameter:
Priority : In Windows 2003, NLB can be supported upto 32. As this is the first server for the NLB the priority will be 1 by default, if we want we can change it. So as it is priority 1, this server will take responsibility for processing the request and if it fails another node will take who is standing next to this priority.

Dedicated Ip Configuration : we have configured virtual host name and ip address but we need to have the actual ip address who is going to run this virtual host name and ip address. In my case I have given 192.168.1.10 as per the figure 3.

Default State: Keep it started.

Port Rules Tab:
 Port rules tab is nothing but the port which we want to enable for NLB, simply remove the existing one and click on add and add the following ports.
Figure 9:
 

For more information about this port number infromation you can refer this link.

Now click on Ok, it will inform you to add the clustered ip address i.e 192.168.1.30 in the TCP/IP properties of NLB network card
Figure 10:
 

I have added the ip address as per the above figure information
Figure 11:
 

NLB configuration status verification:
Now let see our Network load balancing information i.e click on start => Run => NLBmgr.exe
Figure 12:
 

If you see the above figure, there is nothing in the nlb information it is just because we have not opened our configured NLB. So inorder to do that, right click on Network Load Balancing Cluster and click on Connect to Existing, once you click on “Connect to Existing” it will open a small window called as Connect and under Connect, we have the option called as host, type the computer name of the NLB configured server and click on  connect  and below you will see the virtual FQDN host name under cluster window, for my lab it will be hub-cas1.
Note : don’t type the virtual FQDN under host it won’t recognize and it will ask you credential information again and again
Figure 13:

Now click on Finish, once click on finish, you will get below information
Figure 14:
 

In the above figure : my NLB server is Hub-cas1 for FQDN name : webmail.happy.com on the right end side you will see host name who is owning this virtual FQDN, status : converged means it is working fine, actual ip address of private network card, host priority set to 1 and host state : started.

Now lets click on Hub-Cas1(N L B )
Figure 14-1
 

Now in the above figure you can the port number which is listened by hub-cas1 and below there is log entry which will show the current activities information.

When we right click server name : hub-cas1(N L B )
Figure 14-2
 
Delete host : To delete the host entry
Host properties : Figure 7, 8 & 9
Host Status : current status of that server
Control host : you can start the service, suspend, resume etc
Control Ports : figure 9

Even you can enable the logging: inorder to do that you need to click on Options from figure 14-2 (you can see the options) then click on “log settings”
Figure 14-3
 

Ok these are the few setting I know as of now.

Now we need to test whether webmail.happy.com able to resolve the name of FQDN of cas server for my owa access i.e if I type webmail.happy.com it should redirect to hub-cas1.happy.com/owa.
I will show you the testing of the above information from my CAS server and my vista machine.

Logged into the hub-cas1 server => Open the internet explorer and typed: https://webmail.happy.com/owa
Figure 15:
 

In the above figure you can see that https://webmail.happy.com/owa resolved to my cas server hub-cas1 and you can see that as this certificate is not a part of my trusted certificate it is informing me to install the certificate.

Now lets take a look into my vista machine
Figure 15-1
 

The above screen I took from my vista machine which is having IE7.

Adding Second Node for NLB

So my NLB is working fine, now it’s a time to add the second node for this cluster hostname so inorder to do this..
Logging to hub-cas1.happy.com

• Click on Start => Run => NLBmgr.exe
• Click on Cluster Tab => click on Connect to Existing cluster and give FQDN of cluster virtual host name (webmail.happy.com)

        Now it will display the webmai.happy.com under this we have hub-cas1 as per Figure 14.
        Right click on webmail.happy.com and click on “Add Host to Cluster”
Figure 16:

Once we click on Add host to Cluster we will see the information as like Figure 13. Here under Host name : need to type the second node server and then click on Connect and after that we need to select the private ip address which is going to host the virtual host name and click on next
Figure 16-1
 

Once we click on next we will see the next screen “Host Parameter”
Figure 16-2
 

In the above figure see the priority which is select by default for the second node server i.e priority : 2 and the ip address is 192.168.1.20, this is nothing but my second node server (hub-cas2.happy.com) private card ip address.

Once we click on finish we have configured our NLB configuration:
Figure 17:
 

In the above figure:
Under webmail.happy.com (192.168.1.30)
 We have two servers listed and on the right end side the current status of both the servers and if you see the log entry it will display the progress happen so far.

Now we are done with NLB configuration but how we will confirm that Network Load Balancing is working.
So lets try this method:
Log on to vista server
 Ping 192.168.1.10
 Ping webmail ip address or FQDN
As expected it will display the reply response because my webmail is nothing but hub-cas1 server.
Now what I am going to do here is , I will shut down my hub-cas1 server and then I will ping the above ip address and as per expectation the output should be
 ping 192.168.10 (Request Timed Out)
 Ping 192.168.30 or webmail (here I should get reply because I have configured NLB so here 192.168.1.30 should redirect to hub-cas2.happy.com
Figure 18:
 

In the above figure 192.168.1.10 (hub-cas1) [Currently it is shutdown]
192.168.1.30 (currently my hub-cas2 took the ownership)

Now lets try to browse the https://webmail.happy.com/owa
Figure 19:
 

Ok I hope that you are able to understand the basic configuration about NLB. Now let me revert back my cluster active node as hub-cas1

Configuring Common Certificate for both the nodes and it should be trusted:

If you see the figure 15 and Figure 15-1, it is giving an error message, which is nothing but it is telling me to that these certificates need to be part of the trusted root.
Now I have certificate for hub-cas1 & hub-cas2 and we have webmail.happy.com/owa which is a resolver for both the server. Here we can add them into trusted certificate but it won’t help us to access the owa through https://webmail.happy.com/owa. So what I need here? A common Certificate for both the node which should be stored in their own IIS. this common name is nothing but a subject alternative name (SAN) certificate.

How to Create SAN Certificate:

• Log on to first node server (hub-cas1.happy.com)
• Open the Powershell and type the following command:New-ExchangeCertificate -GenerateRequest -SubjectName "DC=happy, DC=com, CN=webmail.happy.com" -DomainName webmail.happy.com, autodiscover.happy.com, hub-cas1.happy.com, hub-cas2.happy.com -FriendlyName "SAN Certificate" -KeySize 1024 -Path c:\SanCert.req -PrivateKeyExportable:$true

Note: Above command is for creating a exchange certificate subject name would be webmail.happy.com and it will be saved as SanCert.req under C\Root Drive

Figure 20:
 

In the above figure I ran two commands, first one for the creation and second one to know the number of certificate which I created so far.

Figure 20-1 (Location of SanCert.req)
 

San Certificate support is not enabled by default, inorder to support this request we need run this following command from the command prompt:
“Certutil –setreg policy\EditFlags –EDITF_ATTRIBUTESUBJECTALTNAME2”  without quotation mark

Steps:

•  Logon to that server where you have installed Microsoft Certificate Authority Server (Dc.happy.com)
• Open the command Prompt Type the following command : Certutil –setreg policy\EditFlags –EDITF_ATTRIBUTESUBJECTALTNAME2
  And then Restart Certificate Service (Services.msc => Certificate Service)
  

How to create a certificate:

Select the option: Request a Certificate
Figure 21: