Optional Configurations

HP CR includes a Disaster Recovery Solution that inherits its configuration from your existing system. When in use, the Disaster Recovery Server automatically updates names and connections to connectors, components, etc.

The Disaster Recovery solution supports a single server or a clustered system. It allows switching between the primary data center and failover, and back again. The accuracy of data recovered from your environment depends on the sync timing. For example, if your system syncs 5 minutes behind, there would be a 5 minute data loss in recovery. Also, the database and the files must be synced at the same time to ensure integrity.

Also note, the Disaster Recovery Server is designed to be a “cold” option and is not expected to be used as an active production system.

For more information on setting up server clusters and failover, see Setting up a Server Cluster.

Requirements

Before you begin setting up your system for Disaster Recovery, make sure you have completed the following requirements.

• Installed a primary server.
• Applied a Disaster Recovery license (and any other licenses needed).

Installing and configuring a Disaster Recovery server

1. Begin by configuring a replication of a FileShare and database(s) for your system.
2. Install HP CR on your Disaster Recovery server using the same installation options that you applied to your production server. Set up your Disaster Recovery server to use the replicas you created in Step 1. Your primary production server must be currently on-line.
3. When the Configuration wizard appears, select Disaster recovery configuration on the Welcome screen.
4. On the Disaster Recovery Standby screen, enter the Server Name of your production server and click Next.

Note: If you are configuring the Disaster Recovery server as a failover cluster, enter the Primary server name.

5. On the Existing Database screen, enter the name of your SQL Server.
6. Select either Use Windows Integrated Authentication or Use SQL Authentication Login. If required, enter the appropriate Username and Password. Then click Next.
7. On the Select Existing Database screen, select your preferred database from the list of existing databases and click Next.
8. On the File Share screen, enter or browse to the File Share Location you want associated with your Disaster Recovery Server. Click Next.
9. The Ready to Configure screen appears. This screen identifies whether you are configuring Disaster Recovery for a single server or a clustered environment. Click Next to configure the Disaster Recovery system.
10. The Completed screen appears. Click Finish to close the Configuration wizard.

Note: If you are configuring a “cold” cluster environment, repeat steps 4 through 10 above, as needed.

11. Power down the Disaster Recovery server(s).
12. In the Server Administrator, with your Primary server highlighted, select Action > Recovery Settings... The Disaster Recovery Settings screen appears.
13. Edit the Backup Site entries as needed and select OK.
14. To bring your Disaster Recovery server(s) back on-line, first power up the server(s).
15. Open the Server Administrator. You may need to wait several minutes for Services to start.
16. Select Action > Recovery Settings... to return to the Disaster Recovery Settings screen. Confirm and/or edit the Backup Site entries as necessary. Click the Switch Site button.
17. A message appears warning you that any services running will be stopped. Any other error messages that appear are likely normal, given that the production servers would be off-line in a real disaster.
18. Restart the Disaster Recovery server (or just the services) to bring the server fully on-line.
19. Bring the Disaster Recovery servers off-line.
20. Make needed repairs to the Primary server. Services should be stopped.
21. On the Disaster Recovery Server’s Server Administrator, select Action > Recovery Settings... and click Switch Sites to return to Primary settings. The Disaster Recovery Server disconnects and services stop.
22. Power down the Disaster Recovery server(s).

23. Perform any manual steps required to sync the Disaster Recovery database & FileShare back with the Primary server.

24. Restart the Production server (or start services). The Disaster Recovery server(s) are ready for the next time.

 

Data Encryption is available for all messages that move through the server. This includes the Messages folder, data as it is exchanged between the Server and the SQL server database, and Server Property files. The System Administrator determines whether Data Encryption is enabled or not. System files are encrypted using Advanced Encryption Standard (AES). Encryption certificate acquisition and storage is the responsibility of the System Administrator. Database information is encrypted using Transparent Data Encryption (TDE), which is configured by the SQL Administrator.

Requirements

To use the Data Encryption feature, you need to acquire an encryption certificate from a certificate vendor. Make sure that the encryption certificate is enabled for Key Exchange.

Note: HP is not responsible for the certificate or the data if the certificate is lost.

Importing the Encryption certificate

To use the encryption certificate, import the encryption certificate(s) to the server’s certificate store. While you can use the Windows Certificate Manager to do so, HP CR recommends using the omcertutils tool included in the server/bin folder.

To import the certificate, open Command Prompt and enter omcertutils -import [path to certificate] [password]

• If the path to the certificate includes spaces, you must quote the path.
• If there is no password on the certificate, no password needs to be supplied.

The omcertutils tool must be run as Administrator. If you are on Windows 2008, you need to be logged in as the Service Account to properly import the certificate. (It will succeed if you login as another user, but the services will not be able to find it.)

Note: If your system environment is a server cluster, repeat this step on each individual machine.

Enabling Data Encryption

To enable data encryption

Make sure you are Administrator on the system, open Command Prompt and enter omcertutils -apply [certificatename].

The certificate name is the value used for the certificate’s Subject field when it was created.

When it appears, read and agree to the legal warning by typing YES to continue.

The existing server disk files are encrypted. The process duration varies based on the number of files. Encryption is enabled and the Services are started.

Note: In the case of a server cluster, perform these steps only on the primary.

Disabling Data Encryption

To disable data encryption

Make sure you are Administrator on the system, open Command Prompt and enter omcertutils -remove.

This command stops Services, decrypts all files, disables future encryption, and then restarts the Services. The process duration varies based on the number of files.

Note: In the case of a server cluster, perform these steps only on the primary.

Configuring the SQL Database

SQL database information is encrypted using Transparent Data Encryption (TDE), which needs to be independently configured by the SQL Administrator.

Note: The DSN Server name must exactly match the SQL SSL certificate subject name (most likely a FQDN) . Also, you need to add Encrypt = yes to the DSN. To do so, stop Services, make the Registry change, and then restart Services.

For more information on database encryption, refer to Microsoft documentation: Create Database Encryption Key (Transact - SQL)

 

HP CRoffers support for using the server in a SQL Always On Availability Group environment.

Note: The relevant SQL Always On Group must be configured before installing the server.

After installing the server, the Server Administrator needs to update the database DSN entries to allow the configuration to work with SQL Always On functionality.

Configuring the server for SQL Always On

1. Complete the configuration of your SQL Always On Availability Group.
2. Install the server, selecting the Primary SQL server for the database.
3. To change the DSN settings for the Primary SQL server, navigate to this registry key:

• HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Omtool\Genifax\Current Version\DSN

Edit two sections of the DSN as follows:

• Change the Driver= section to {SQL Server Native Client 11.0}
• Change the Server= section to TCP:YOURLISTENERHERE, YOURPORTNUMBER For example: Driver={SQL Server Native Client 11.0}; Server=TCP:TestAccuListner, 1433; Database= HP CR; Trusted_Connection=Yes

This change needs to be made on the following four DSN entries:

• ActivityDB
• ArchiveDB
• DB
• DBMETADATA

And depending on your configuration, this change may also need to be made for these DSN entries within the Server Administrator:

• Billing Archive
• Volume Lists
• Audit

 

To use TLS v1.2 in your environment, you will need to acquire a certificate with the appropriate signature algorithm. You will also need to enable TLS v1.2 on the server and on the relevant HP devices. You may also need to update relevant DSN entries on the server.

Note: The latest server release supports SSL/TLS v1.2 only on Windows 2012 and 2016.

Enabling TLS 1.2 on the Server

If you were previously using TLS v1.0 or v1.1, when you are turning those off and selecting TLS v1.2 instead, you also need to edit the server's DSN entries to point to the correct SQL Server driver.

1. To change the DSN settings for the SQL Server driver, navigate to this registry key:

• HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Omtool\Genifax\Current Version\DSN

2. Edit the Driver={SQL Server} section of the DSN to Driver={SQL Server Native Client 11.0}

• For example:
• Driver={SQL Server Native Client 11.0}; Server=TCP:TestAccuListner, 1433; Database= HP CR ; Trusted_Connection=Yes
• This change needs to be made on the following four DSN entries:
  • ActivityDB
  • ArchiveDB
  • DB
  • DBMETADATA
• And depending on your configuration, this change may also need to be made for these DSN entries within the Server Administrator:
  • Billing
  • Archive
  • Volume Lists
  • Audit

Enabling TLS 1.2 on your HP device

Sign in to the device via your browser and:

For FutureSmart 3 devices — Go to the Networking tab, select Mgmt. Protocols, and in the Web Mgmt. Secure Communication section, select the TLS 1.2 check box. Click Apply.

For FutureSmart 4 devices — Go to the Networking tab, select Secure Communication, and in the SSL/TLS Protocol section, select the TLS1.2 check box. Click Apply.