Server Consolidation and Dual Processors

HCL Domino Domino Forum
1

I have a client with a two server infrastructure and about 100 Notes clients. The main administration server (NDS1) is behind a firewall. The second server (NDS2) is in the DMZ, and contains replica’s of any database that may need to be accessed from the Internet as well as from within the walls. This setup has been working very well for a long period of time and may provide additional security since NDS2 is the mail gateway, web server, Intranet server. The firewall is open from DMZ to LAN using only port 1352 with an exclusive IP address. The downfall is that people often get confused about which of the two servers they are working on. This causes much data duplication, firewall loading, and save/replication conflicts.To improve this, I am considering consolidating the two machines into a single dual processor box. However, particular individuals at this client don’t like the idea of even having certain data on a server that is accessible via the Internet. So I have to sell security. I could setup the system with two NIC’s one with a LAN private IP and the other with a DMZ private to NAT through the firewall. This looks more like the two box system but in itself does not provide the security of the present system. It separates the NIC load which is good and is probably worth the cost of the NIC. I’m not sure exactly what type of installation would be best in this case to utilize processors effectively and offer the security requirement. Is it possible to setup NDS1’s data directory to share a folder with the data directory of NDS2 at the OS level?

Anyone have any opinions about how this could be setup?

2

Subject: Server Consolidation and Dual Processors

Do people need Notes client access to the dbs or can they use a browser ?

If a browser is OK then you could use a reverse proxy in the DMZ to manage the traffic through to the server behind the firewall.

If not then I like the idea already suggested of a cluster - simple to manage.

If you don’t want to cluster and only want one server then you could force the Notes client access from the Internet to use a VPN connection. This solves the security issues and would allow you to have only the one server that people can then access either from the LAN or across the VPN. This is a very common way to access Notes applications from the Internet.

In this scenario people who want to access their DWA from a public Internet location (such as a coffee shop) would still need to come in through a reverse proxy.

Martin

3

Subject: If the problem is data integrity…

…why not Cluster the servers and only Cluster Replicate the databases which are common to both? That way it doesn’t really matter which server you are using from a notes client since you will always be looking at the most up to date data?

Just another alternative for you to mull over…