Exchange 2010 Disaster Recovery

I am wanting to add a 3rd 2010 Exchange server to my already existing environment, but I want to place this new server at a remote site as a DR system incase the primary site goes offline.

Currently, my remote offices are all connected to the Texas data center via VPN tunnels.  I have EX-01 and EX-02 at the primary site, each have the client, hub, and mailbox roles installed.

The Mailbox DBs are DAG'd together, EX-01 as the active server & EX-02 as the passive.  I do not have the CAS array load balanced at this time but would like to add this capability in the future.

Here is my Plan:

I'll add a secondary site in North Carolina and connect the primary site (Texas) to the secondary using VPN tunnels.

I'll stand up EX-02 at this site and add this server to the existing DAG and CAS array.

This server will hold passive copies of the Mailbox DB from EX-01

After this server is fully configured, I'd like to hardware load balance (HLB) the CAS array.  

My current scenario:

A natural disaster hits the Texas data center knocking it offline.  My users will be without email access (meaning I have no DR).

Scenario with EX-03.

A Natural disaster hits the Texas data center knocking it offline.  I'd update the external mx record to point to EX-03 at the data center in North Carolina.  I'd also update the CAS array internal DNS entry to point to EX-03 for remote offices.

Does this plan make sense?  Am I missing anything?

Can I include EX-03 in the HLB over VPN tunnels?  I'm not sure if this is possible as I have no experience doing this.
Exchange-DR-Online.vsd
Exchange-DR-Offline.vsd
tnimsAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

TazDevil1674Commented:
Hi

A DAG can span subnets but a CAS Array must be on the same subnet.

Essentially what you would have is:

EX-01 & EX02 = CASarray01

EX03 = CASarray02

All in same DAG.

You would have DNS entry for CASarray01 and CASarray02, when failing over to EX-03, change the IP of CASarray01 to match CASarray02.

There are some changes requried using Powershell to either Switchover/back or Failover/back...
0
tnimsAuthor Commented:
So what you are suggesting is that I would need to stand a domain controller at the DR data center in North Carolina separate from the site in Texas.

Texas Site = txd.test.com

NC Site = ncd.test.com
0
Simon Butler (Sembee)ConsultantCommented:
You must have a domain controller in the other site.
The CAS Array can be moved to the other site in the event of a data loss, as the CAS Array is just a DNS entry.

So that would allow you to have a load balancer for your primary site and then manually bring online the second location. Look at DAC mode for the database as well, and possibly configure the database for intrasite only automatic failover. That will stop it doing a failover to the second location when there is still a server in the main site.

Simon.
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

tnimsAuthor Commented:
OK so this is what I am understanding:

Primary site (Texas)

Domain Controller (txd.test.com)
EX-01  (Hub, CAS, Mailbox Role)
EX-02  (Hub, CAS, Mailbox Role)
DAG = enable DAC mode -> Includes EX-01, EX-02, EX-03
CAS Array = will only contain members of EX-01 & EX-02

DR Site (NC)

Domain Controller (ncd.test.com)
EX-03 (Hub, CAS, Mailbox Role)
DAG = enable DAC mode -> Includes EX-01, EX-02, EX-03
CAS array = will only contain EX-03 and is separate from the Primary site

If the primary site goes offline DR site will take over.  I'll need to point my remote office clients to EX-03 by updating the fqdn of the primary CAS array to EX-03.

By enabling DAC on the DAG, once the primary site comes back online, the mailbox DB on that site will not mount because of DAC.

That correct?
0
TazDevil1674Commented:
yes, there are other considerations too.

When you fail or switch over to your DR Site, you will need to update DNS.  I have included the script i use to perform these tasks for myself:

SwitchOver Procedure
A full procedure will need to be written however the following action will need to be undertaken in the event of a planned datacentre SwitchOver. Please refer to the datacenter switch.pptx (attached) as there are a number of different scenarios that could occur and this provides good advice depending on the situation.

Switchover databases
Move database to DR Site
Move-ActiveMailboxDatabase -Server "ex-01.domain.com" -ActivateOnServer "ex-03.domain.com"

****  See current Witness Server settings
Get-DatabaseAvailabilityGroup | fl
****
WitnessServer                          : fp-01.domain.com
WitnessDirectory                       : C:\EH_DAG_FSW
AlternateWitnessServer                 : fp-02.domain.com
AlternateWitnessDirectory              : C:\EH_DAG_FSW
****

*Set-databaseavailabilitygroup –witnessServer ex-03.domain.com -alternativeWitnessServer ex-01.domain.com
Set-DatabaseAvailabilityGroup -Identity DAG01 -WitnessServer "fp-01.domain.com" -WitnessDirectory "C:\EH_DAG_FSW" -AlternateWitnessServer "fp-02.domain.com" -AlternateWitnessDirectory "C:\EH_DAG_FSW"
Get-DatabaseAvailabilityGroup | fl
****
WitnessServer                          : fp-02.domain.com
WitnessDirectory                       : C:\EH_DAG_FSW
AlternateWitnessServer                 : fp-01.domain.com
AlternateWitnessDirectory              : C:\EH_DAG_FSW
****

**** Only required when link goes down without manual DB & FW move
Stop the Database availability Group
Powershell – stop-databaseavailabilitygroup –identity dag01 –activedirectorysite {primary AD site name} (-ConfigurationOnly (if node offline))

Restore the Database Availability Group
Powershell – restore-databaseavailabilitygroup –identity dag01 –ActiveDirectorySite {DR AD site name} –AlternativeWitnessServer <servername> -AlternateWitnessDirectory <witnessdirectory>
*****

**** Shut down FP-01 & EX-01/EX-02

**** Change DNS in Domain Contorller
Configure DNS entries for casarray01.domain.com to x.x.x.x (IP address of EX-03)
Configure DNS entries for webmail.domain.com to x.x.x.x (IP address of EX-03)

Update CAS urls & change permissions on OWA and ECP directories
Set-ActiveSyncVirtualDirectory –Identity "ex-03.domain.com\Microsoft-Server-ActiveSync (Default Web Site)" –InternalUrl "https://webmail.domain.com/Microsoft-Server-ActiveSync" -ExternalUrl $Null
set-OwaVirtualDirectory –Identity "ex-03.domain.com\owa (Default Web Site)" –InternalURL "https://webmail.domain.com/owa" -ExternalUrl $Null -formsAuthentication $true
Set-EcpVirtualDirectory -Identity "ex-03.domain.com\ECP (Default Web Site)" –InternalURL "https://webmail.domain.com/ECP" -ExternalUrl $Null -formsAuthentication $true
Set-oabVirtualDirectory -Identity “ex-03.domain.com\OAB (Default Web Site)" –InternalURL " https://webmail.domain.com/OAB" -ExternalUrl $Null
Set-ClientAccessServer –Identity "ex-03.domain.com" –AutoDiscoverServiceInternalUri “https://webmail.domain.com/autodiscover/autodiscover.xml”
Set-WebServicesVirtualDirectory -Identity "ex-03.domain.com\EWS (Default Web Site)" -internalurl “https://webmail.domain.com/EWS/Exchange.asmx” -BasicAuthentication:$True
**** Don't restart IIS until after next step

Mailbox database update Public Folder - you should have a public folder database on the DR
get-mailboxdatabase | Set-mailboxdatabase -publicfolderdatabase “DRPFdatabase”

Verify DBs on DC02 & PF is SDC01
Get-MailboxDatabase | ft name,server,Pub*
****
**** Need to restart IIS - ELEVATED CMD PROMPT (don't use iisreset /noforce! - just do IISRESET)


Switchback Procedure

**** Check servers are powered on etc - DC01-EXC01 & FP01

**** Change DNS in WIN-DC01-ADC01
Configure DNS entries for casarray01.domain.com to Primary Site
Configure DNS entries for webmail.domain.com to Primary Site

#Update CAS urls & change permissions on OWA and ECP directories
Set-ActiveSyncVirtualDirectory –Identity "ex-03.domain.com\Microsoft-Server-ActiveSync (Default Web Site)" –InternalUrl "https://mail2010dr.hrconnect.nigov.net/Microsoft-Server-ActiveSync" -ExternalUrl $Null
set-OwaVirtualDirectory –identity "ex-03.domain.com\owa (Default Web Site)" –InternalURL " https://mail2010dr.hrconnect.nigov.net/owa" -ExternalUrl $Null -WindowsAuthentication $True -Basicauthentication $false
Set-EcpVirtualDirectory -Identity "ex-03.domain.com\ECP (Default Web Site)" –InternalURL "https://mail2010dr.hrconnect.nigov.net/ECP" -ExternalUrl $Null -WindowsAuthentication $True -Basicauthentication $false
Set-oabVirtualDirectory -Identity "ex-03.domain.com\OAB (Default Web Site)" –InternalURL " https://mail2010dr.hrconnect.nigov.net/OAB" -ExternalUrl $Null
Set-ClientAccessServer –Identity "ex-03.domain.com" –AutoDiscoverServiceInternalUri “https://mail2010dr.hrconnect.nigov.net/autodiscover/autodiscover.xml”
Set-WebServicesVirtualDirectory -identity "ex-03.domain.com\EWS (Default Web Site)" -internalurl “https://mail2010dr.hrconnect.nigov.net/EWS/Exchange.asmx” -BasicAuthentication:$True

**** Only required when link goes down without manual DB & FW move
Start the database availability group
Start-DatabaseAvailabilityGroup -Identity DAG01 –ActiveDirectorySite {primary site}

Ensure the proper quorum model is being used
Set-DatabaseAvailabilityGroup -identity "DAG01"
**** 
Ensure all database are in a healthy state before switchback.. This may take a while depending on the length of the outage. If database go into a “failed” stated they will need to be to reseed. If database in “suspended” state they will need to be resumed.

**** Restart Service MICROSOFT EXCHANGE ACTIVE DIRECTORY TOPOLOGY

**** Cluster move - Admin command prompt
cluster group "cluster group" /moveto:ex-01

Set Witness Server
Set-DatabaseAvailabilityGroup -Identity DAG01 -WitnessServer "fp-01.domain.com" -WitnessDirectory "C:\EH_DAG_FSW" -AlternateWitnessServer "fp-02.domain.com" -AlternateWitnessDirectory "C:\EH_DAG_FSW"

Move mailboxes
Move-ActiveMailboxDatabase -Server ex-03.domain.com –ActivateOnServer ex-01.domain.com

Mailbox database update Public Folder
get-mailboxdatabase | Set-mailboxdatabase -publicfolderdatabase “MainPFdatabase”

**** Need to restart IIS - ELEVATED CMD PROMPT (don't use iisreset /noforce! - just do IISRESET)

Open in new window

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
tnimsAuthor Commented:
Thank you all for your help.  I was able to test this in a test environment.  One thing I ran into while I was testing is that if I have the DAG set to DAC mode and if I lose my primary site completely, the DR site will not mount as it cannot contact the primary site to determine if a server is online.  To resolve this, I disabled DAC mode and on the DB copy in the DR site, I made it so that the copy must be manually mounted/activated in case of an emergency.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.