Skip to main content

LevelBlue Completes Acquisition of Cybereason.  Learn More

LevelBlue Completes Acquisition of Cybereason.  Learn More

Services
Cyber Advisory
Managed Cloud Security
Data Security
Managed Detection & Response
Email Security
Managed Network Infrastructure Security
Exposure Management
Security Operations Platforms
Incident Readiness & Response
SpiderLabs Threat Intelligence
Solutions
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Operational Technology
End-to-end OT security
Microsoft Security
Unlock the full power of Microsoft Security
Securing the IoT Landscape
Test, monitor and secure network objects
Why LevelBlue
About Us
Awards and Accolades
LevelBlue SpiderLabs
LevelBlue Security Operations Platforms
Security Colony
Partners
Microsoft Security
Unlock the full power of Microsoft Security
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Loading...
Loading...

HOWTO: Moving SEG to a distributed architecture

Expand / Collapse


This article applies to:

  • MailMarshal (SEG)

Question:

  • How can I enhance SEG/MailMarshal performance and resilience?
  • How can I load balance MailMarshal? 

Information:

The aim is to have two load-balanced MailMarshal Node servers. MailMarshal is designed with just this sort of architecture in mind.

This article give basic conceptual information and general steps to achieve this aim. For full details of each step, see the documentation for your MailMarshal version.


Figure 1 shows a simple, one server MailMarshal installation:

Figure 1


Figure 1

Simply adding a second MailMarshal Node to the existing Array gives you the setup in Figure 2:
 

Figure 2


Figure 2

However, given that you have two Node servers, you need to implement some form of load balancing. The simplest way to do this is to set up DNS round-robin for the two IP addresses. Alternatively, set up an MX for each IP with equal priority on both.

With Figure 2, you end up with two uneven Node servers. Node 1 also functions as an Array Manager, and you may be running SQL server on the same machine.

Figure 3 shows an ideal, well balanced setup. The two Node servers are dedicated to the proxy processing task. The Array Manager and SQL Server roles have been moved to a third server.

Figure 3
Figure 3

Both Figure 2 and Figure 3 get you to a situation where failover is built in to your design. So, for example, when upgrading, you could upgrade one node at a time without any major downtime.

How to achieve your outcome

To get from Figure 1 to Figure 2:

  1. Make sure your existing MailMarshal Server is the same version as the version you are installing on the new system.
  2. Install MailMarshal on a new server.  During the install, select ‘Custom’. On the ‘Select Services’ page, select ‘SMTP Processing Node Only’.
  3. During the installation, when prompted, join the new server to your existing array. Or, when finished, run the MailMarshal Server Tool, and join the server to the array.
  4. On the original server, verify that the new server has been added under ‘Array Servers’ in the MailMarshal Console.
  5. Set up DNS round robin, or NLB, to include both servers.
  6. Configure incoming SMTP traffic to be delivered to the new shared hostname or IP address.
  7. Configure you internal mail server to deliver outbound mail to the new shared hostname or IP address.
  8. Test that both Node servers are seeing and handling traffic OK.

 

To get from Figure 1 to Figure 3:

There are several ways to achieve what you need. Here’s one possible path.

  1. Make sure your existing MailMarshal Server is the same version as the version you are installing on the two new systems.
  2. Install MailMarshal on a new Node (Node 1).  During the install, select ‘Custom’. On the ‘Select Services’ page, select ‘SMTP Processing Node Only’.
  3. During the installation, when prompted, join the new server to your existing array. Or, when finished, run the MailMarshal Server Tool, and join the server to the array.
  4. On the original server, verify that the new server has been added under ‘Array Servers’ in the MailMarshal Console.
  5. Repeat Steps 2 – 4 for Node 2.
  6. Set up DNS round robin, or NLB, to include both servers.
  7. Configure incoming SMTP traffic to be delivered to the new shared hostname or IP address.
  8. Configure your internal mail server to deliver outbound mail to the new shared hostname or IP address.
  9. Test that both Node servers are seeing and handling traffic OK.
  10. The original MailMarshal server is now decommissioned as a Node server, but retains the Array Manager function.  

Notes:

For even further resilience, you could set up the Array Manager on a Windows failover cluster.


To contact LevelBlue about this article or to request support:


Rate this Article:
     

Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster
.