Exchange Server 2010 Client Access Server Array

Client Access Server Array Pre-Requisites

Two or more Exchange Server 2010 Client Access Servers can be configured as a CAS array using NLB as long they are not also installed as Mailbox servers that are members of a Database Availability Group (DAG).

The reason is that DAG members utilize Windows Failover Clustering, which can’t co-exist with NLB.

To demonstrate the setup of a CAS array the following servers have been provisioned.

Server #1

• Operating System: Windows Server 2008 64-bit R2
• Name: EX3.exchangeserverpro.local
• Primary Interface: 192.168.0.34/24
• Secondary Interface: 192.168.0.36/24

Server #2

• Operating System: Windows Server 2008 64-bit R2
• Name: EX4.exchangeserverpro.local
• Primary Interface: 192.168.0.35/24
• Secondary Interface: 192.168.0.37/24

The IP address allocated to the NLB cluster will be 192.168.0.38.

Installing the Exchange Server 2010 Client Access Server Pre-Requisites

On each server, from an elevated Windows PowerShell prompt, run the following commands.

PS C:> Import-Module ServerManager

Note: In my lab the servers are also Hub Transport servers, and so I installed both sets of pre-requisites. I also use the -Restart switch to automate the restart of the servers, however you can remove this if you wish to control when the servers are restarted.

For only the Client Access Server pre-requisites:

PS C:> Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server,Web-ISAPI-Ext,Web-Digest-Auth,Web-Dyn-Compression,NET-HTTP-Activation,RPC-Over-HTTP-Proxy -Restart

For the Client Access Server and Hub Transport Server pre-requisites:

Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server,Web-ISAPI-Ext,Web-Digest-Auth,Web-Dyn-Compression,NET-HTTP-Activation,RPC-Over-HTTP-Proxy -Restart

After the servers are restarted run the following command, again from an elevated PowerShell window.

Set-Service NetTcpPortSharing -StartupType Automatic

Installing the Exchange Server 2010 Client Access Server Role

From an elevated command prompt run the following unattended setup command.

Note: Again, my lab servers are also Hub Transport servers.

For only the Client Access Server role with Management Tools:

C:adminExchange Server 2010> setup /m:install /r:ca,mt

For both the Client Access and Hub Transport Server roles with Management Tools:

C:adminExchange Server 2010> setup /m:install /r:ca,ht,mt

Installing Windows Network Load Balancing

On each of the servers, from an elevated PowerShell window run the following commands.

PS C:> Import-Module servermanager

PS C:> Add-WindowsFeature NLB

Creating the NLB Cluster

After both servers have been prepared the NLB cluster can be created.  On the first server launch the Network Load Balancing Manager from Administrative Tools.

From the Cluster menu choose New.

Connect to the first server for the NLB cluster.

Choose the interface that is to be used for the cluster, and then click Next.

Accept the default Host parameters and click Next.

Click Add and enter an IPv4 address for the NLB cluster, then click OK.

Click Next to continue.

Enter a name for the cluster.  In this example I’m using casarray.exchangeserverpro.local.  Click Next to continue.

Although the port rules can be made more specific, in this example the default rule is acceptable.  Click Finish to complete the creation of the NLB cluster.

At this stage you should have a single host NLB cluster that is successfully converged.

Right-click the cluster name and choose Add Host to Cluster.

Enter the name of the second server and click Connect.  Choose the interface to be used for the cluster and clickNext.

Accept the default Host Parameters and click Next.

There are no changed necessary to the port rules, so click Finish.

You should now have a dual host NLB cluster that is successfully converged.

One final step, on each of the NLB members run the following command to allow the NLB virtual IP address to be reachable from outside of the subnet that it resides in.

netsh interface ipv4 set int "NLB" forwarding=enabled

Replance “NLB” with the name of your NLB interface on your server.

Creating the Client Access Server Array

Now that the NLB cluster has been formed we can create the CAS array in Exchange Server 2010.

First, register a DNS record for the NLB cluster name.

Next, launch the Exchange Management Shell on one of the Exchange servers and run the following command.

[PS] C:>New-ClientAccessArray -Name CASArray -Site "Default-First-Site-Name" -Fqdn casarray.exchangeserverpro.local

Name                Site                 Fqdn                           Members
----                ----                 ----                           -------
CASArray            Default-First-Sit... casarray.exchangeserverpro.... {EX3, EX4}

Substitute the Name, Site, and FQDN as appropriate for your environment.

Updating Existing Mailbox Databases

When the CAS array has been established any new mailbox databases created on servers in that Active Directory Site will be configured with the CAS array as their RpcClientAccessServer.

However any existing mailbox databases need to be manually updates so that those mailbox users begin connecting to the new CAS array.

You can see here that the existing mailbox database on server EX2 is still configured with a standalone Client Access server as its RpcClientAccessServer.

[PS] C:>Get-MailboxDatabase -Server EX2 | fl name, rpc*

Name                  : Mailbox Database 02
RpcClientAccessServer : EX3.exchangeserverpro.local

To update all databases on the server with the new RpcClientAccessServer run the following command.

[PS] C:>Get-MailboxDatabase -Server EX2 | Set-MailboxDatabase -RpcClientAccessServer casarray.exchangeserverpro.local

The change can be seen by running the same command as earlier.

[PS] C:>Get-MailboxDatabase -Server EX2 | fl name, rpc*

Name                  : Mailbox Database 02
RpcClientAccessServer : casarray.exchangeserverpro.local

Note that any existing Outlook profiles will not automatically update from the single Client Access Server to the new CAS array name. Those clients will not automatically failover to an alternate member of the CAS array when there is a server failure. You will need to update those profiles for them to receive the high availability benefits of the CAS array. This is one reason that it is important to establish CAS arrays prior to migrating user mailboxes to Exchange Server 2010.

Share your thoughts

How to setup an Exchange 2010 CAS Array to load balance MAPI

Since Exchange 2010 CAS servers now handle all internal and external client traffic to Exchange mailbox servers including Outlook MAPI traffic, the need for a highly available CAS array is critical to your design.

So how do you load balance MAPI traffic? I found a some useful bits of information to help out:

1. Load balance your CAS servers in a CAS array by whatever method you choose – Both Hardware LB or Windows Network LB are supported load balancers
2. Create a MAPI A record in your internal DNS infrastructure that resolves to the Virtual IP Address (VIP) of the CAS load balancing array.  The DNS entry, for example, could be outlook.school.edu
3. Configure your load balancing array to load balance the MAPI RPC ports:
   1. TCP 135
   2. UDP/TCP 6005-65535; or set static ports
4. Use the new-clientaccessarray cmdlet to create the CAS array object. Such as:

New-ClientAccessArray –Name “School CAS Array” –Fqdn “outlook.school.edu” –Site “Boulder”

More here.

5.  You need to revisit any Exchange databases that were created before the CAS array was created and set the rpcclientaccessserver property to match the newly created CAS array. Such as:

Set-MailboxDatabase DB1 -RpcClientAccessServer “outlook.school.edu”

For more on Exchange Server 2010 CAS visit here.

Share your thoughts

Exchange ActiveSync and Outlook Mobile Access errors occur when SSL or forms-based authentication is required for Exchange Server 2003

http://support.microsoft.com/?kbid=817379

Disable the forms-based authentication for the Exchange virtual directory

To create a secondary virtual directory for Exchange that is based on steps 1 through 7 of the following procedure, make sure that forms-based authentication is disabled for the Exchange virtual directory before you make the copy. Before you follow these steps, disable forms-based authentication in Exchange System Manager. Then restart Internet Information Services (IIS). To do this, follow these steps:

1. Open Exchange Manager.
2. Expand Administrative Groups, expand the first administrative group, and then expand Servers.
3. Expand the server container for the Exchange Server 2003 server that you will be configuring, expand Protocols, and then expand HTTP.
4. Under the HTTP container, right-click the Exchange Virtual Server container, and then click Properties.
5. Click the Settings tab, clear the Enable Forms Based Authentication check box, and then click OK.
6. Close Exchange Manager.
7. Click Start, click Run, type IISRESET/NOFORCE, and then press Enter to restart Internet Information Services (IIS).

Create a secondary virtual directory for Exchange server

You must use Internet IIS Manager to create this virtual directory for Exchange ActiveSync and Outlook Mobile Access to work. If you are using Windows Server 2003, follow these steps:

Create the virtual directory

1. Start Internet Information Services (IIS) Manager.
2. Locate the Exchange virtual directory. The default location is as follows:
   Web SitesDefault Web SiteExchange
3. Right-click the Exchange virtual directory, click All Tasks, and then click Save Configuration to a File.
4. In the File name box, type a name. For example, type ExchangeVDir. Click OK.
5. Right-click the root of this website. Typically, this is Default Web Site. Click New, and then click Virtual Directory (from file).
6. In the Import Configuration dialog box, click Browse, locate the file that you created in step 4, click Open, and then click Read File.
7. Under Select a configuration to import , click Exchange, and then click OK.

   A dialog box will appear that states that the “virtual directory already exists.”

8. Select the Create a new virtual directory option. In the Alias box, type a name for the new virtual directory that you want Exchange ActiveSync and Outlook Mobile Access to use. For example, type exchange-oma. Click OK.

Note If the server is Microsoft Windows Small Business Server 2003 (SBS), the name of the Exchange OMA virtual directory must be exchange-oma. The integrated setup of Microsoft Windows Small Business Server 2003 creates theexchange-oma virtual directory in IIS. Additionally, it points the ExchangeVDir registry key to /exchange-oma during the initial installation. Other SBS wizards, such as the Configure E-mail and Internet Connection Wizard (CEICW) also expect the virtual directory name in IIS to be exchange-oma.

Configure the virtual directory

1. Right-click the new virtual directory. In this example, click exchange-oma, and then click Properties.
2. Click the Directory Securitytab.
3. Under Authentication and access control, click Edit.
4. Make sure that only the following authentication methods are enabled, and then click OK:
   • Integrated Windows authentication
   • Basic authentication
5. On the Directory Security tab, under IP address and domain name restrictions, click Edit.
6. Click the option for Denied access, click Add, click Single computer, and then type the IP address of the server that you are configuring.
7. lick OK two times.
8. Under Secure communications, click Edit. Make sure that Require secure channel (SSL) is not enabled, and then click OK.
9. Click OK, and then close IIS Manager.
10. Click Start, click Run, type regedit, and then click OK.
11. Locate the following registry subkey:
    HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesMasSyncParameters
12. Right-click Parameters, click to New, and then click String Value.
13. Type ExchangeVDir, and then press Enter. Right-click ExchangeVDir, and then click Modify.
    

    Note ExchangeVDir is case-sensitive. If you do not type ExchangeVDir exactly as it appears in this article, ActiveSync does not find the key when it locates the exchange-oma folder.

14. In the Value data box, type the name of the new virtual directory that you created in step 8. For example, type/exchange-oma. Click OK.
15. Exit Registry Editor.
16. Restart the IIS Admin service. To do this, follow these steps:
    1. Click Start, click Run, type services.msc, and then click OK.
    2. In the list of services, right-click IIS Admin service, and then click Restart.

If you want to reuse Forms-based Authentication on the Exchange server, follow these steps to re-enable Forms-based Authentication on the /Exchange virtual directory in Exchange System Manager.

1. Open Exchange Manager.
2. Expand Administrative Groups, expand the first administrative group, and then expand Servers.
3. Expand the server container for the Exchange Server 2003 server that you will be configuring, expand Protocols, and then expand HTTP.
4. Under the HTTP container, right-click the Exchange Virtual Server container, and then click Properties.
5. Click the Settings tab, click to select the Enable Forms Based Authentication check box, and then click OK.
6. Close Exchange Manager.
7. Click Start, click Run, type IISRESET/NOFORCE, and then press Enter to restart Internet Information Services (IIS).WAZOO

Share your thoughts

Use the Shell to re-create the Discovery system mailbox

Use the Shell to re-create the Discovery system mailbox

1 Comment