SmartCloud · 2015-02-12 · SmartCloud Notes users IBM Domino 8.5.1 Fix Pack 2 IBM Domino 8.5.2 Passthru domain servers Any supported version of IBM Domino Use IBM Domino 8.5.2 for

© 2013 IBM Corporation

IBM SmartCloud™

SmartCloud for Social BusinessSmartCloud Notes

Hybrid ConfigurationIBM SmartCloud Notes Product Management

2 Fall 2013 © 2013 IBM CorporationIBM SmartCloud Notes - Hybrid Configuration

Agenda

SmartCloud Notes “Hybrid” Reference Architecture

Key Value Propositions of “Hybrid” Configuration

Common SmartCloud Notes “Hybrid” Configurations

Setting Up the “Hybrid” Configuration● Creating the SmartCloud Notes™ Customer Account● Configuring the SmartCloud Notes “Hybrid” Account Information● Validating and Testing the Configuration

Configuring general SmartCloud Notes account settings

Q & A


SmartCloud Notes™ “Reference” Architecture

Highlighted items are the key to hybrid integration


What Does “Hybrid” Mean ?

● In the context of SmartCloud Notes, it refers to a specific configurationof the SmartCloud Notes customer account within the service

● It allows existing IBM Domino® customers to integrate the on-premise environment and is a core strength and value proposition

● It defines the administrative model allowing more control using standard on-premise administration tools (Domino Administrator client, Domino Directory)

● As a “Hybrid” customer, the customer Admin can choose if the mail users mail account exists on-premise or in the SmartCloud Notes service.

● It is designed to support both transitory or perpetual coexistence● Customers select the “Hybrid Environment” option when performing initial setup


Agenda




Setting Up the “Hybrid” Configuration● Creating the SmartCloud Customer Account● Configuring the SmartCloud “Hybrid” Account Information● Validating and Testing the Configuration


Q & A


● Customers can keep current environment / investment in their existing Domino architecture

● Supports IBM Notes®, browser and mobile clients.

● Users don't need to care who is Hosted or On-Premises● e.g. user address lookup & mail routing just work

● Maintains the existing certificate hierarchy and domain structure● No cross-certification required● Users keep their existing ID files● Users keep their existing Internet mail addresses● SmartCloud Notes virtual servers are members of the same hierarchy / domain● Domino directories (primary, ex. dircat, etc.) are replicated into the service for synchronization

● Supports native NRPC mail routing● Preserves Domino specific items like database/document links and stored form content

● No change required to continue accessing existing applications

● Existing mail databases can be transitioned in their entirety● Encrypted content remains intact● Private items remain intact

● Flexibility in deployment / transition time scale

Key Value Propositions of “Hybrid”


Hybrid Environment – Administration & Directory

● SmartCloud Notes becomes an extension of the customer environment● User, Group and Policy management are performed as they are done today*● One or more directories are synchronized into SmartCloud Notes to provide common view of

users, groups, policies, etc.● Customer owns e-mail domains and receives all mail for those domains before routing to

SmartCloud Notes● Internal Domino server handles directory replication (Domino 8.5.1 FP2 +)

● List of directory replicas to be replicated– e.g. names.nsf, otherdomainnames.nsf, exdircat.nsf, etc.– Remote access via directory assistance is not supported

● All directories need to be replicated to the directory synch server● EDC's supported for mail routing and name picker only (can't be used for user selection for provisioning)● Careful directory planning is needed prior to configuring your SmartCloud Notes company account

* via the Domino directory and Administrator client


Hybrid Environment - Policies

● In a hybrid environment in which some mail files are on SmartCloud Notes servers and some are on-premises on company Domino servers, Domino Administrators can use explicit group policies to ensure that all users have the same Notes client experience...

See Using administrative policies

● Some policy settings are enforced for all SmartCloud Notes users and cannot be overridden by a group policy...

See Policy settings restrictions

● Other policy settings can be set by customer administrators and applied using explicit group policies via policy documents that are in their on-premises Domino directory...

See Creating policies for service users

Note: An on-premises Domino administrator cannot open the SmartCloud Notes policy to view the settings. However, from the Domino Administrator client, they can view a detailed summary of the effective policy settings by viewing a policy synopsis for a selected user or group.

http://www-10.lotus.com/ldd/bhwiki.nsf/xpDocViewer.xsp?lookupName=Administering+SmartCloud+Notes:+Hybrid+Environment#action=openDocument&res_title=Using_administrative_policies_HY&content=pdcontent

http://www-10.lotus.com/ldd/bhwiki.nsf/xpDocViewer.xsp?lookupName=Administering+SmartCloud+Notes:+Hybrid+Environment#action=openDocument&res_title=Policy_settings_restrictions_HY&content=pdcontent

http://www-10.lotus.com/ldd/bhwiki.nsf/xpDocViewer.xsp?lookupName=Administering+SmartCloud+Notes:+Hybrid+Environment#action=openDocument&res_title=Creating_policies_for_service_users_HY&content=pdcontent


Agenda




Setting Up the “Hybrid” Configuration● Creating the SmartCloud Customer Account● Configuring the SmartCloud “Hybrid” Account Information● Validating and Testing the Configuration


Q & A


Version requirements for on-premises IBM Domino Servers:On-premises Server Type Supported Versions

Mail routing server(in the directory synchronization and mail routing domain)

IBM Domino 8.5.1 Fix Pack 2IBM Domino 8.5.2

Directory synchronization server (in the directory synchronization and mail routing domain)


Mail servers that request the free time ofSmartCloud Notes users


Passthru domain servers Any supported version of IBM DominoUse IBM Domino 8.5.2 for fastest response time forconnections from SmartCloud Notes to on-premises servers.

Hybrid Configuration Software Version Requirements


“Hybrid” – Basic Architecture

Single Domino domain

Single Domino passthru server

Single combined Domino mail routing and directory replication server

Customer data flow:On-premises Domino directory sync occurs with SmartCloud Directory Sync Server replicating with replication hub server via the passthru server

SmartCloud Notes NRPC mail from service users to on-premises users routed to mail hub via passthru server

On-premises NRPC mail sent to SmartCloud Notes users routed from on-premises mail (hub) server(s) to the service NRPC mail hub via network load balancers

Most suitable for implementations where HA is not a requirement (e.g., pilot or smaller customer implementations)


“Hybrid” – High Availability Implementation


Up to two Domino servers acting in passthru roles

Up to two Domino servers performing mail routing

Up to two Domino servers for directory replication


“Hybrid” – Multiple Domain Architecture

Multiple Domino domains

One domain designated as primary through which hybrid connectivity from SmartCloud Notes is achieved

Other domains become subordinates in the context of mail routing, free-time lookup and directory replication

Directory updates from downstream domains are replicated via the directory replication hubs in primary domain

Each domain is responsible to independently route mail directly to the SmartCloud Notes service.

Note: Once the account is configured for the primary domain the customer creates group / connection documents for each additional domain in their environment.


“Hybrid” – Multiple Data Center Implementation


Pair of customer data centers

Pair of passthru servers (primary in one data center and secondary in the other data center)

Separate mail routing and directory replication hub servers in each data center

Provides for both a level of local (within data center) resilience and DR protection in the event of data center failure

Suitable for larger customers who have infrastructure in more than one data center


“Hybrid” – 'Shim' Domain Between SCN & Existing Domains

Hybrid 'shim' domain inserted between SCN and multiple other existing domains

Existing domains are all subordinate (route mail and replicate directory through) the “shim” domain

Single passthru server (a second could be added for failover)

Separate mail routing and directory replication hub servers

Note: Once the account is configured for the shim domain the customer creates group / connection documents for each additional domain in their environment.


“Hybrid” – Leveraging Infrastructure-as-a-Service for Domino Applications


Single passthru server

Single combined Domino mail routing and directory replication server

Domino application and “hybrid” integration servers (like passthru) hosted on IBM SmartCloud Enterprise / Enterprise+ or IBM Softlayer

No Domino servers on customer network

Note: Customer DMZ and SmartCloud Enterprise firewall not shown


Hybrid Environment – Firewall Rules

● Follow the wiki instructions referenced below to ensure firewall configurations allow for proper traffic flow while minimizing risk of network attacks

● The risk of attack increases if you relax these rules

See Preparing the firewall

Important: All Notes installed clients that access hosted mail files in the SmartCloud Notes services also need to be able to reach outbound on TCP/IP port 1352 to the service

http://www-10.lotus.com/ldd/bhwiki.nsf/xpDocViewer.xsp?lookupName=Administering+SmartCloud+Notes:+Hybrid+Environment#action=openDocument&res_title=Preparing_the_firewall_HY&content=pdcontent


Agenda




Setting Up the “Hybrid” Configuration● Creating the SmartCloud Notes Customer Account● Configuring the SmartCloud Notes “Hybrid” Account Information● Validating and Testing the Configuration


Q & A


Creating the Company Account in SmartCloud Notes

● The customer has no responsibility to perform initial account setup; it is done by the SmartCloud for Social Business Customer Service Group on behalf of the customer

● Creating the customer account is the culmination of processing an initial customer order for a defined set of SmartCloud for Social Business offerings and associated numbers of subscriptions

● Prior to implementation, it is important to devote time to thoroughly planning the end state architecture / configuration as making changes later may require tear down and set up again

● Customers need to provide some basic information:● Name of the company as it will appear in SmartCloud Notes● Name and email address for the initial administrator account● Other administrator contact information (address, phone)


Company Account Setup Complete

Once the setup is completed, the information provided should be visible and things are ready to move forward.


Administrator Account Activation Invitation

The customer administrator receives the welcome email with a link to follow to activate their account.


Administrator Account Activation Submission

The administrator sets a new password, language, time zone, accepts TOU and then submits

Once complete, their admin account should show active in the company account user list


Agenda






Q & A


Selecting Hybrid Configuration

Click to start the

setup process


Initial Hybrid Configuration Status

Visual status of outstanding steps

First, populate and run the Pre-configuration

Test Tool


Download the Pre-Configuration Test Tool


Enter Server Details and Run Configuration Test

After entering information requested click “Run Test”


Hybrid Pre-configuration Test – Screen Output


Hybrid Pre-configuration Test – Screen Output with log file


Configure Directory Sync Server


Configure Mail Routing Hub

Provide at least one Domino server and domain name here

Define your Mail server base name


Configure Passthru Server

DNS host names are preferred in these configuration items

Enter at least on Domino passthru server, host name and associated Domino domain name


Create Server OU Certifier for SmartCloud Virtual Server Name Registration


Upload Certifier ID

Upload organizational unit certifier that will be used to

create virtual server identities


Confirm All Information Entered


Preparing for Account Activation

To Prepare your account use the Domain Configuration Tool


Downloading the Domain Configuration Tool


Domain Configuration Tool – Three modes of operation

Important: If you make any configuration changes, you must download and re-run this tool.

Note: administrator and remote console access are

required to run this tool

Three modes of operation; pre-configuration testconfiguration report Configure servers


Configuration report (Dry Run where no actual changes are made)


Domain Configuration Tool – Configure servers

Important: If you make any configuration changes, you must download and re-run this tool.

Note: administrator and remote console access requirements

to run this tool

Note: review the log file results


Preparing for Account Activation● After running the Domain Configuration Tool the service is now able to and does sync the directory● Once completed that will be shown as below

● To verify that the configuration tool has successfully updated the Domino on-premises environment, check the following documents for the updates reported in the Domino Configuration Results output...

● There will be three new entries in the domain's Domino Directory ACL

● There will be a new on-premises passthru server document

● There will be three new groups in the Domino Directory


Internet Domain Verification● The service performs domain name verification to prevent abuse of SmartCloud Notes accounts● The service uses a CNAME record for the purpose of verifying a domain name● If a Global Domain Document does not exist it should be created now

● The list of Internet domain names that populate the Internet Domain Verification window is pulled from your on-premises Global Domain documents after directory synchronization● If the list is incomplete or includes unwanted Internet domains, edit the Global Domain documents to include the correct domain name information and synchronize the directories again before proceeding to verify ownership of your domain.

Note: It is not always necessary to validate all domains in the list, but users can only be provisioned with SmartCloud Notes subscriptions if their SMTP e-mail domain suffix corresponds to a validated domain.


Internet Domain Verification● The service requires you to create a CNAME record to prove ownership of a domain. ● After the CNAME record is created, it may take time for your hosting service DNS to replicate it to the Internet so that the service can resolve it via DNS.

1.

2.

3.

1. Click “Verify Ownership” and the screen expands to show the steps2. Notes the process steps and perform a copy paste of the unique key to avoid misinterpretation of letters and numbers (l, 1, O, 0) and create the CNAME record3. After creating the CNAME record come back to this screen and click “Begin Verification”4. A pending verification appears in yellow. Do not restart the verification unless advised by IBM Support 5. A verified domain is reflected as shown

5.

4.


Final Account Activation


ID Vault

Click Tools, ID Vaults, Manage and follow the prompts along the lines of these three ID Vault slides

● IBM creates the ID vault when your customer account is created● In order for a user's ID file to be uploaded to the ID vault, you must issue a Vault Trust Certificate from a parent certifier of the user ID file to the ID vault certifier● After the Vault Trust Certificate is issued, only IDs of users with SmartCloud Notes accounts are uploaded to the ID vault.● Issue the certificate after the on-premises directory has been synchronized with the SmartCloud Notes directory.


Agenda







Configuration Test

Seven test suites or categories:1.Certifier2.Domain Configuration3.Vault Configuration4.Server Configuration5.Directory Sync6.Mail Server Access7.Mail Hub Server


Configuration Test (examples of results)


Configuration Test (examples of results)

Seven test suites or categories:1.Certifier2.Domain Configuration3.Vault Configuration4.Server Configuration5.Directory Sync6.Mail Server Access7.Mail Hub Server


Agenda






Q & A


SmartCloud Notes Web Administration


Administration - SmartCloud for Social Business (1 of 2)

Hypothetical Example – not an IBM recommendation

Topic Sub-Topic Policy Notes

Security

Password Expiration (web) Enabled for 90 days Approved and consistent with on-premises

Password Sync Enabled

Password Reset Support Enabled custom message and URL for support Approved and consistent with on-premises

Application Passwords Not enabled What is the mobile governance guidance?

IP Address Ranges Not enabled

Instant Messaging Pointing to on-premises ST Approved and plan to switch to the service IM once all users are moved in

Default Zone Set to Eastern US

Email Management

Limit Message Size No enabled

External Forwarding Enabled Approved and consistent with on-premises

Link Style Enabled for both Notes web linksInsures the group now using browser only for mail can open the occasional doc link in their v6.5 client

Mail Retention in Trash Folder Enabled, set to 60 days

Delete Older Email Enabled, set to 3 years Retention policy now enforced

Manage Routing to External Domains Enabled Routing to accomplish data loss protection


Administration - SmartCloud for Social Business (2 of 2)

Hypothetical Example – not an IBM recommendation

Topic Sub-Topic Policy Notes

Inbound Internet Mail Routing Not configured Mail routes through on-premises first

Name Finder Basic Quick Search Evaluating a change to the Standard setting

Email Filters Not configured To be configured once mail routes to the service

IMAP Email Access Enabled for all users

Password Expiration (Notes client) Enabled for 90 days

Mail TemplatesStandard Using 8.5.3

Default Using 8.5.3 English

Custom None used at this time

Extension Forms Files

Templates None used at this time

Custom Extension Forms Files None used at this time


System Settings - Notes Account Settings: Instant Messaging


System Settings - Notes Account Settings: Time Zone


System Settings - Notes Account Settings: Email Management


System Settings - Notes Account Settings: Email Management (cont)


System Settings - Notes Account Settings: Inbound Mail Routing


System Settings – Notes Account Settings: Email Filters

New in this update is the ability to set several Options● EXISTING - Address Filter – Allow, Filter or Block● NEW - Spam System Filter – Allow, Filter or Block● NEW - Keyword filter added – Newsletters – Allow, Filter or Block● NEW - Display “Report as Spam” menu in the SCNotes web UI● NEW - Send periodic junk mail report to all users


System Settings – Notes Account Settings: Email FiltersEmail Filters – updates in GA8 – available for “service only” customers or “hybrid” customers who have their MX record pointed at the service

● Address Filter – Allow, Filter or Block● NEW - Spam System Filter – Allow, Filter or Block● NEW - Keyword filter added – Newsletters – Allow, Filter or Block● NEW - Display “Report as Spam” menu in the SCNotes web UI● NEW - Send periodic junk mail report to all users

Address Filter – Allow, Filter or Block


System Settings – Notes Account Settings: Email FiltersEmail Filters updates in GA8 – available for “service only” customers or “hybrid” customers who have their MX record pointed at the service


Spam System Filter* – Allow, Filter or Block (default is Block)

* When set to “Filter (to deliver to Junk folder)” spam captured by content filtering is delivered to the Junk folderNote: certain spam is blocked via IP filtering and is not delivered to Junk folder




Keyword Filter – “Newsletters” Allow, Filter or Block




Display to end user – Report as Spam – requires use of a specific new template, browser users will see the menu item by default



● Address Filter – Allow, Filter or Block● NEW - Spam System Filter – Allow, Filter or Block● NEW - Keyword filter added – Newsletters – Allow, Filter or Block● NEW - Display “Report as Spam” menu in the SCNotes web UI● NEW - Send periodic junk mail report to all users Send junk mail report to end

user – admin specifies the number of reports sent each day (send every X hours)


System Settings – Notes Account Settings: IMAP Email Access


System Settings – Notes Account Settings: Password Expiration


System Settings – Notes Account Settings: Name Finder


SmartCloud Notes web – Name Finder – Click on “To:” hot spotCurrent experience - “Basic” option● Click on the To: hot spot opens the Select

Addresses dialog● type “mar” moves the user down the sorted

directory view to the first instance where the last name that starts with “mar”

● No change from prior experienceNew August Update - “Basic Quick Search”

● Type “john” into the Select Addresses Search for field and results show people with “john” in their given name or surname


SmartCloud Notes web – Name Finder – Type in the “To:” fieldNew August Update - “Basic” & “Basic Quick Search”

● Type “john” into the To: field and search returns results on “john” in either given name or surname


IBM SmartCloud Notes - Name Finder in the new Standard modeEnhanced web user addressing experience, select the correct “Smith” with confidence*

1. Search in the “To:” fieldType a partial name, view results where the given or surname match; view Picture, Title, Department, Location and Internet address from the directory

2. Search via “Select Names”Type a partial name, view results where the given or surname match; view Picture, Title, Department, Location and Internet address plus users' “Reports To” information from the directory; further refine results by sorting on Title, Department, Location or Manager

* Addressing configuration shown requires Name Finder be set to Standard which is a Limitied Availability capability which requires a customer request to Support to enable the configuration option, see Configuring the name finder

Note: Pictures and names fictitious

2.

1.

Results for “John” show John and Johnson as a given or surname

http://www-10.lotus.com/ldd/bhwiki.nsf/xpDocViewer.xsp?lookupName=Administering+SmartCloud+Notes:+Hybrid+Environment#action=openDocument&res_title=Configuring_the_name_finder_HY&content=pdcontent


System Settings – Notes Account Settings: Journaling Options


Reference Materials

SmartCloud Notes Service Information● Data Sheets, Overview Documents, Solution Briefs & White Papers

SmartCloud Notes Documentation● Administering SmartCloud Notes: Hybrid Environment

SmartCloud Support Information● Support Options for Administrators● Technical Support● System Requirements

https://www.ibm.com/cloud-computing/social/us/en/customerresources/

http://www-10.lotus.com/ldd/bhwiki.nsf/xpDocViewer.xsp?lookupName=Administering+SmartCloud+Notes:+Hybrid+Environment#action=openDocument&content=catcontent&ct=prodDoc

https://www.ibm.com/cloud-computing/social/us/en/supportoptions/

https://www.ibm.com/cloud-computing/social/us/en/support/

https://www.ibm.com/cloud-computing/social/us/en/systemrequirements/


Legal Disclaimer

© IBM Corporation 2013. All Rights Reserved.The information contained in this publication is provided for informational purposes only. While efforts were made to verify the completeness and accuracy of the information contained in this publication, it is provided AS IS without warranty of any kind, express or implied. In addition, this information is based on IBM’s current product plans and strategy, which are subject to change by IBM without notice. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, this publication or any other materials. Nothing contained in this publication is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software.References in this presentation to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and/or capabilities referenced in this presentation may change at any time at IBM’s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. Nothing contained in these materials is intended to, nor shall have the effect of, stating or implying that any activities undertaken by you will result in any specific sales, revenue growth or other results.IBM, the IBM logo, Lotus, LotusLive, IBM SmartCloud, Lotus Notes, Notes, Domino, Quickr, Sametime, WebSphere, UC2, PartnerWorld and Lotusphere are trademarks of International Business Machines Corporation in the United States, other countries, or both. Unyte is a trademark of WebDialogs, Inc., in the United States, other countries, or both.Microsoft and Windows are trademarks of Microsoft Corporation in the United States, other countries, or both.All references to “ISSL ONPREMA TEST COMPANY”, “SCNBP0” and “ONPREMA” refer to a fictitious company and are used for illustration purposes only.