EMC Syncplicity Panorama Connector for EMC · PDF fileReference Architecture . EMC Solutions ....

Reference Architecture

EMC Solutions

January 2015

EMC SYNCPLICITY PANORAMA CONNECTOR FOR EMC VNX STORAGE

• Secure mobile access to home directories and content repositories

• Remote control over user directories and files

EMC Syncplicity Panorama Connector for EMC VNX Storage Reference Architecture

2

Copyright © 2015 EMC Corporation. All Rights Reserved.

EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice.

The information in this publication is provided as is. EMC Corporation makes no representations or warranties of any kind with respect to the information in this publication, and specifically disclaims implied warranties of merchantability or fitness for a particular purpose.

Use, copying, and distribution of any EMC software described in this publication requires an applicable software license.

For the most up-to-date listing of EMC product names, see EMC Corporation Trademarks on EMC.com.

All trademarks used herein are the property of their respective owners.

Part Number H13815

3 EMC Syncplicity Panorama Connector for EMC VNX Storage Reference Architecture

Table of contents

Reference architecture overview ........................................................................................................... 5 Document purpose .......................................................................................................................... 5 Solution purpose ............................................................................................................................. 5 Business case .................................................................................................................................. 5 Technology solution ......................................................................................................................... 6

Solution architecture ............................................................................................................................ 7 Architecture overview ....................................................................................................................... 7 Hardware resources ......................................................................................................................... 7 Software resources .......................................................................................................................... 8

Key components ................................................................................................................................... 9 Introduction ..................................................................................................................................... 9 Syncplicity client .............................................................................................................................. 9 Load balancer (optional) .................................................................................................................. 9 Panorama Connector ........................................................................................................................ 9 RODC instance ................................................................................................................................. 9 Active Directory ................................................................................................................................ 9 On-premises content repositories .................................................................................................. 10

Network communications ................................................................................................................... 11 Overview ........................................................................................................................................ 11 Firewall rules .................................................................................................................................. 11

Sizing guidelines ................................................................................................................................ 12

Configuration considerations ............................................................................................................. 13 Active Directory account ................................................................................................................. 13 Security considerations.................................................................................................................. 13 Administrator console .................................................................................................................... 13 Network shares and home directories access ................................................................................. 14 SharePoint access ......................................................................................................................... 14

Remote file access with Syncplicity Panorama and VNX ..................................................................... 15 SharePoint on a VNX storage array ................................................................................................. 15 Network shares and home directories on VNX ................................................................................ 15

Conclusion ......................................................................................................................................... 17

References.......................................................................................................................................... 18


4


Reference architecture overview

This reference architecture describes the EMC® Syncplicity® Panorama™ Connector for EMC VNX® storage. It describes the architecture, key components, and configuration considerations of the solution. This document helps EMC partners and customers understand the implementation considerations, best practices, and the resources necessary for successfully deploying Syncplicity Panorama with VNX storage.

This solution provides enterprise users with seamless and secure mobile access to network shares, home directories, and SharePoint systems on VNX block and file storage. It offers a secure architecture for extending enterprise content management (ECM) systems, managing user access to those systems, and implementing content security controls on mobile devices.

The growth of corporate data and mobile computing has created a need for secure online file sharing for mobile devices. Data growth is overwhelming enterprise storage infrastructure and causing storage-related problems for IT organizations. The steady increase of bring-your-own-device (BYOD) users, who expect mobile access to corporate data, adds to the challenges faced by IT administrators.

Users who demand increased mobile functionality and the ease of use offered by consumer cloud storage services are sometimes circumventing IT organizations to get the services they want. The use of these services puts confidential data and intellectual property at risk.

IT organizations must adopt enterprise-grade solutions and security protocols to protect corporate data, and give mobile users access to their content to effectively enable BYOD file sharing. All this can be accomplished with Syncplicity Panorama, a software-based connector that works with any Server Message Block (SMB) or Common Internet File System (CIFS) storage to provide file sharing through mobile applications.

Syncplicity Panorama allows you to protect and extend the value of your existing EMC VNX storage infrastructure. It offers secure, on-premises enterprise file synchronization and sharing (EFSS) that enables mobile access to data that is stored across an enterprise, including home directories, file shares, and SharePoint sites.

The VNX family provides users with fast, seamless, and highly-available access to their data across an enterprise while end-user computing and storage IT administrators are assured that data is safe and secure. VNX offers high degrees of data security through its controller-based Data-at-Rest-Encryption (D@RE) operating environment.

For IT organizations that are considering cloud storage, the hybrid cloud model enabled by Syncplicity Panorama facilitates faster deployment and adoption, reduces risks, increases efficiency, and provides greater simplicity and storage choices. The hybrid cloud model compares favorably to the complexity of building an end-to-end solution or wholesale data migration to the cloud, the latter being what most cloud competitors such as Box, OneDrive, and Dropbox require.

Document purpose

Solution purpose

Business case


6

A key challenge faced by enterprise IT organizations that service mobile users is how to offer unified and seamless access to all enterprise content including home directories, network shares, and ECM systems like SharePoint. The difficulties in mobilizing enterprise content repositories include the following:

• Data migration – Not all IT organizations can migrate corporate data to the cloud in order to make it accessible to mobile devices.

• Secure data access – It is difficult to implement remote, easy, and secure access to on-premises user data.

• User experience – Users want to easily access and edit their files, and do not want to deal with security restrictions.

Syncplicity Panorama with VNX answers these challenges by offering the following business benefits:

• Mobile device access – Syncplicity Panorama with VNX allows administrators to make on-premises data available to mobile users without having to move that data to the cloud. Users can access home directories, network shares, and SharePoint sites on their mobile devices. Users can also view and edit their files on their mobile devices.

• Easy and secure access – Syncplicity Panorama uses a three-tier network access architecture with secure credentials for easy user access and preservation of existing authentication and access controls. VNX offers data security through its controller-based D@RE operating environment. A virtual private network (VPN) is not required.

• Mobile content control – Administrators can remotely wipe data, remotely reset passcodes, and use 256 bit Advanced Encryption Standard (AES) in transit and at rest on mobile devices to prevent data leakage. Administrators can provision or de-provision users for mobile access, and manage mobile device policies for users and groups.

Syncplicity Panorama with VNX bridges the gap between user demands for mobility and IT requirements for security. With Syncplicity Panorama, EMC provides enterprise customers with a single-vendor, single point of contact solution that simplifies deployment of EFSS.

Technology solution


Solution architecture

This section is an overview of the solution reference architecture that provides secure mobile access to existing content on network shares, home directories, and SharePoint sites.

EMC recommends that Syncplicity Panorama be deployed in a three-tier security architecture using a demilitarized zone (DMZ) and semi-private and private tiers as shown in Figure 1. Many enterprise environments use a DMZ and private two-tier security architecture. If you choose to have a semi-private security tier, EMC recommends that you deploy the semi-private security tier between the load balancer and the Panorama Connector to have better control of network traffic sent to the connector.

Figure 1. Syncplicity Panorama architecture

Table 1 lists the physical hardware used to test the connector in an environment running 50 concurrent requests.

Table 1. Panorama Connector hardware resources

Hardware component Configuration

CPU Intel Xeon CPU E5-26151 v2, 1.80 GHz

Memory 8 GB

Hard-disk space 500 GB

LAN capacity 1 Gbps

Mobile device iPad with iOS 7 or later

Architecture overview

Hardware resources


8

Table 2 describes the software required by the connector.

Table 2. Panorama Connector software requirements

Software component Configuration Considerations

Panorama Connector host software

Windows Server 2012 R2 or later (64-bit)

.NET Framework 4.5

Internet Information Services 7.5 or later

CA Signed SSL certificate (recommended)

The connector cannot be hosted on the same server that hosts the SharePoint sites, network shares, or user home directories.

The connector requires ASP.NET and Windows Authentication to be installed and enabled.

EMC does not recommend installing third-party applications or services on the connector host.

Syncplicity account Syncplicity Enterprise Edition The Enterprise Edition is required for SharePoint access, and for mixed cloud and on-premises storage.

SharePoint SharePoint 2010 or SharePoint 2013

The connector does not support SharePoint Foundation 2010 or SharePoint Online.

Software for network shares and home directories

Windows Server 2012 R2 or Windows Server 2008 R2

VNX1 File OE 7.1.x.x or later , or VNX2 File OE 8.1.x.x or later

Software resources


Key components

This section briefly describes the key components used in this solution, including:

• Syncplicity client for iPhone/iPad

• Load balancer (optional)

• Panorama Connector

• Read-only domain controller (RODC) (optional)

• Active Directory

• On-premises VNX-based repositories (network shares/home directories/SharePoint)

Syncplicity client for iPhone/iPad (IOS 7 and above) enables secure access to on-premises repositories such as SharePoint, network shares, and home directories.

EMC recommends that you use a load balancer in front of the Panorama Connector and configure it to terminate the Secure Sockets Layer (SSL). This offloads SSL processing and balances client traffic through the connector.

The Panorama Connector is a virtual machine that sits on a network share and allows users to access enterprise content sources such as home directories, file shares, and Microsoft SharePoint via mobile applications.

The Panorama Connector is installed on a Windows server, which should reside in your corporate DMZ or semi-private security tier network. On-premises content can be on VNX storage solutions that support either SMB or CIFS protocols.

The Panorama Connector acts as an intermediary for public Internet users and allows secure access without requiring a VPN. The connector has an administrator console with a set of security policies that determine how users can access content.

RODC is a read-only domain controller that hosts read-only partitions of an Active Directory Domain Services database. An RODC instance allows you to easily deploy a domain controller where having domain passwords stored locally is considered a security threat, such as in an extranet or in an application-facing role. RODC is deployed in the same security tier as the Panorama Connector, as shown in Figure 1.

You can place the RODC instance in the DMZ if a semi-private security tier is not available. If you do not have an RODC instance, then it is possible to use the existing Active Directory instance in your internal network, but it is not recommended for security reasons.

The Panorama Connector uses Active Directory or local user accounts to govern mobile user access to on-premises content repositories. See Configuration considerations on page 13 for user management options.

Introduction

Syncplicity client

Load balancer (optional)

Panorama Connector

RODC instance

Active Directory


10

An on-premises content repository is an existing ECM system such as SharePoint, network shares, or home directories that are on VNX storage solutions. Panorama Connector supports Microsoft SharePoint Server 2010 and 2013.

On-premises content repositories


Network communications

This section describes the Syncplicity Panorama network architecture. The network communications flow as follows:

1. Syncplicity client traffic coming in from any mobile device connects to Port 443 of the external facing firewall in the DMZ.

2. The external firewall forwards the client traffic to the load balancer’s virtual IP address.

3. The Web load balancer either forwards the inbound SSL traffic on port 443 or performs SSL termination and forwards HTTP traffic on port 80 to one of the Panorama Connector servers on port 9000.

4. The Panorama Connector uses the RODC and Internet Protocol Security (IPsec) to query the Active Directory in order to discover the home directories or network shares associated with users.

5. The Panorama Connector communicates with SharePoint content repositories on either port 443 or port 80 and communicates with network shares using the SMB/CIFS protocol on port 445.

6. The requested files are sent to the client.

Table 3 provides firewall rules for Panorama Connector implementations.

Table 3. Firewall rules for Panorama Connector deployment

Firewall Rules

External firewall Internet to load balancer using HTTPS (port 443)

Semi-private firewall Load balancer to Panorama Connector using HTTPS or HTTP (port 443 or 80)

Corporate network firewall Connections to SharePoint servers using HTTPS or HTTP (port 443 or 80)

Corporate network firewall Connections to network share servers using SMB/CIFS (port 445) as well as TCP/UDP ports 137, 138, and 139

Overview

Firewall rules


12

Sizing guidelines Each Panorama Connector can handle 50 concurrent requests, where the load generated by 10,000 provisioned users is usually equivalent to a peak concurrency of 50 users. A provisioned user is one whose account is activated by IT for use with Syncplicity.

The best practice configuration is to run two connectors in a load-balanced configuration. This configuration should be able to support 100 concurrent requests, or the typical activity generated by 20,000 provisioned users. More connectors can be added behind the load balancer to provide additional capacity.

The Panorama Connector only enables mobile access to existing on-premises ECM systems such as SharePoint, network shares, and home directories that are on VNX storage solutions. The connector does not require storage sizing because it does not store any data.

Contact EMC presales to help you build and size SharePoint sites, network shares, or home directories using VNX with the Panorama Connector. Refer to Configuration considerations on page 13 and References on page 18 for more on best practices and sizing for SharePoint sites, network shares, and home directories on VNX.


Configuration considerations

Panorama Connector requires an Active Directory account with query privileges so it can query the directory. The account must be unique. You are prompted to enter the account credentials after installing the connector. The connector uses the Active Directory account to find users and groups.

If you are configuring the connector for network share access, the connector also uses the Active Directory account to find the home directories of any network shares associated with users.

The connector host must include Internet Information Services (IIS) and should be hardened in accordance with Microsoft best practices. This includes Windows hardening and IIS hardening. For more information, refer to Microsoft TechNet under the IIS section at http://technet.microsoft.com/.

The connector installation wizard automatically installs two IIS features:

• A Web service that allows the connector to access the network share server

• An administrator portal that is used to access and configure the connector

The IIS Web service and administrator portal can use HTTP, but EMC recommends HTTPS. If using HTTP, the connector accepts requests on port 80 in clear text. If using HTTPS, the connector accepts requests on port 443 with an SSL certificate.

The connector installer also creates an x509 certificate called SyncplicitySecureCredentialCertificate. The Connector service uses the certificate to create the credential tokens. If you are using multiple connectors on separate servers, then export the SyncplicitySecureCredentialCertificate certificate to each server to allow users to leverage multiple connectors using the same credentials.

The Web service takes requests from clients on port 443 unless SSL offload is being performed by the load balancer. EMC recommends using SSL to connect to the administrator portal.

Panorama Connector has an administrator console that you can use to perform the following management tasks:

• Add, edit, or remove connections from the connector to SharePoint sites or network shares

• Enable or disable the home directory, which allows the connector to automatically retrieve the user’s associated home directory on the network share via Active Directory

• Add, edit, or remove home directory bookmarks

• Add, edit, or remove policies that allow you to specify which users and groups can access specific network shares, and add restrictions such as requiring a password. This feature is only available for network share access. The policies for SharePoint access are part of Syncplicity account administration.

Active Directory account

Security considerations

Administrator console

http://technet.microsoft.com/


14

• Allow or deny access to SharePoint sites or network shares to individual users or groups of users

• Remotely wipe data from users’ mobile devices

The connector’s administrator policies and the Syncplicity account policies contain some of the same policy settings. In case of a conflict, the Syncplicity policies have higher priority.

Panorama Connector allows users to access network shares regardless of whether or not a user has a Syncplicity account. Users with the Syncplicity application but no Syncplicity account can log in directly to the network shares and perform various actions on files such as edit, rename, copy, and delete, if their permissions allow the actions. However, users can only access files that they can access directly on the network share.

Administrators can use the administrator console to configure security policies to govern access. With Syncplicity Enterprise Edition, you can use your Syncplicity policies to further control access to content and monitor user actions performed through the connector.

The connector can be configured to search Active Directory to discover each user’s home directory on the network share. Part of the discovery process includes automatically bookmarking users’ home directories with an administrator-specified default name, such as “Home Directory.” If a home directory is not associated with the user’s account in Active Directory, an error message tells the user that a home directory is not defined.

The Panorama Connector allows users to access files in SharePoint document libraries when it is configured for SharePoint access. Users can browse, upload, download, delete, rename, and check in/check out the same files on mobile devices that they are able to access directly through SharePoint.

The connector requires the Syncplicity Enterprise Edition license to access SharePoint. User access is controlled through Syncplicity policies, and users’ actions through the connector are audited and logged.

Network shares and home directories access

SharePoint access


Remote file access with Syncplicity Panorama and VNX With Syncplicity Panorama and VNX storage arrays, IT administrators can provide and manage mobile file access for hundreds to thousands of users. Whether the files are on a SharePoint site, network share, or in users’ home directories, Syncplicity Panorama and VNX offer several features for data security and user management.

Storage design is one of the most important elements of a successful Microsoft SharePoint deployment. The VNX family delivers industry innovation and enterprise capabilities for SharePoint deployment in a scalable, easy-to-use solution. This storage platform combines powerful and flexible hardware with advanced efficiency management and protection software to meet the demanding needs of SharePoint workloads.

Panorama Connector provides mobile access to existing on-premises network shares and home directories (CIFS shares). This helps enterprises administer home directories in two key ways:

• Administrators can use VNX’s flexible language for specifying home directory mapping rules to specify mapping behavior for hundreds or even thousands of users with a single rule.

• Users can see their unique home directory views when logging into the same CIFS share.

VNX CIFS shares implemented with fault-tolerant storage provide safe, secure, and simple network-accessible storage so that enterprise users can easily access their user-level data.

Management of home directories can be burdensome to the storage administrators, so VNX provides an integrated home directory feature that significantly reduces the administrative burden by shifting the directory and share management to VNX.

In the typical business environment, user home directories are not shared. Each home directory is intended for one specific user. Consequently, the system or domain administrator must:

1. Determine where the user’s home directory will exist.

2. Create a directory on the file server to act as the user’s home directory.

3. Create a CIFS share to give the user access to the home directory.

4. Secure the CIFS share.

5. Set the home directory field in the user’s profile on the domain controller to reflect the appropriate home directory location.

VNX Home Directory eliminates the need for three of these steps. VNX Home Directory uses CIFS login information and a database to provide a unique, secure home directory view to each user. The home directory view that users see is defined by rules stored in the home directory database. A VNX administrator can configure the database to meet an organization’s specific needs.

SharePoint on a VNX storage array

Network shares and home directories on VNX


16

VNX for File Operating Environment (OE) 8.1.3.72 introduces a parameter that allows users to connect to their home directory using a \\server\username[$] path while still being able to use the traditional \\server\HOME path. This syntax is useful for migrating users’ home directories from another vendor’s arrays to a VNX array.

Providing support for the \\server\username[$] path eliminates the need for manual changes from a \\server\username[$] path to a \\server\HOME path. VNX Home Directory also has important benefits for disaster recovery (DR) and migration. VNX’s CIFS configurations can be replicated to remote sites for DR purposes, and the home directory database configuration can be easily replicated.

In migration scenarios, the home directory database and user file systems can be migrated to the new VNX Data Mover with minimal downtime. After the home directory database has been migrated, users can be referred to the new VNX Data Mover where they can see their home directories as they existed on the previous VNX Data Mover without the need for IT to change the universal naming convention (UNC) path.


Conclusion Syncplicity Panorama and VNX storage arrays help IT departments manage both business data growth and users who want to access that data remotely from mobile devices. It also gives users easy access to their personal business data, and gives IT administrators an easy way to manage that access. A storage solution with Syncplicity Panorama and VNX can satisfy the storage needs of both IT administrators who value security and users who value mobility.


18

References The following resources, which are located on EMC Online Support and EMC.com, provide additional and relevant information. Access to these documents depends on your login credentials. If you do not have access to a document, contact your EMC representative.

• EMC VNX Home Directory: A Detailed Review

This white paper is an overview of the VNX Home Directory feature and how to configure rules to automate the process of creating and assigning home directories to users.

• VNX Video: Home Directory

This video reviews home directory challenges and home directory solutions.

• Microsoft SharePoint Server: Best Practices and Design Guidelines for EMC Storage

This white paper provides best practices and key decision points for planning and deployment of Microsoft SharePoint server on the VNX storage solution and other EMC storage products.

The following documents, which are located on the Syncplicity website, provide useful information about Syncplicity Panorama.

• Syncplicity Panorama Release Notes

• Syncplicity Panorama Connector Installation Guide

https://support.emc.com/

http://www.emc.com/index.htm

Date post:	21-Mar-2018
Category:	Documents
Upload:	lamngoc
View:	226 times
Download:	2 times

EMC Syncplicity Panorama Connector for EMC · PDF fileReference Architecture . EMC Solutions ....

Documents