Talon FAST™ - Best Practices - Cloud Distribution

3. ABOUT THIS GUIDEThe proceeding chapters in this guide are structured as follows:1. The Talon FAST product and pertinent configuration details2. Additional Talon FAST products (such as the Talon FAST software only installations)3. Operating Talon FAST with third-party software without impacting both performance and integrityThe procedures and recommendations in this guide are intended for experienced network and storage professionals whohave reviewed both the Talon FAST User Guide and the Talon FAST Release Notes. A certain level of network andproduct knowledge is assumed.Technical DocumentsTalon FAST Technical Documentation including the Talon FAST User Guide and Talon FAST Release Notes can be foundon the Talon Storage Customer Support website.Contact us at Customer SupportIf you have a technical question about your Talon FAST product please go to the Talon Storage Customer Support websiteat http://www.talonstorage.com/supportTalon Storage Solutions has a Technical Information Library (TIL) and an Online Support Center in order to answer yourquestions.If you prefer to contact Talon Storage Customer Support by phone, please call us at:Toll free: +1.877.280.4802Toll: +1.856.481.39906

4. TALON FAST DEPLOYMENTThis chapter provides recommendations for the deployment of the Talon FAST solution.The Talon FAST product can be purchased as:1. A Hardware/Software solution (Talon FAST Appliance)2. A Full Install installation (Talon FAST Software only installer package)3. An OVF template (Talon FAST Virtual Appliance based on VMware ESX 5.0 server)Talon FAST DeploymentThis section provides details to aid in choosing the right Talon FAST deployment for your environment. Talon Storagesupports the following Talon FAST deployment methods for the remote office location:Distributed File System (DFS)Direct Share MappingDistributed File System (DFS)The Microsoft Distributed File System (DFS) is a set of client and server services that allow a large enterprise to organizemany distributed Server Message Block (SMB) file shares into a distributed file system. DFS provides location transparencyand redundancy to improve data availability in the event of failure or heavy load by allowing shares in multiple locations tobe logically grouped under one folder or DFS root. Use the table below to review the advantages and disadvantages of thisdeployment.Direct Share Mapping.Clients are given network-path mapped drives, which connect directly to the Edge appliance cache. This is usually done witha UNC path of the client folder, for example:\\\\\\\.7

Disconnected operations/enhanced disconnection support:Read/write access to cached dataRead/write access to files open during disconnectionRead-only access to files not opened prior to disconnectionAbility to create new files and foldersRename newly created files and foldersNo renaming of non-empty foldersNo renaming of existing files/foldersChanges made during disconnection synchronized with data center on restoration of WAN link8

5. TALON FAST INSTALLATIONThis section describes best practices when installing Talon FASTPrepare a ChecklistPlease refer to your Talon FAST User Guide for full details on pre-installation requirements.Size Your Network by Determining Cache SizeThe cache on Edge appliances is used as a temporary, circular storage buffer to serve files from the data centerfile server on a per-request basis.When the cache is 95 percent full, the Talon FAST software uses a Least Recently Used (LRU) algorithm to purgecache files until the capacity is below 75 percent full. If the cache reaches 99 percent full before it can purgeenough files, the cache switches to read-only. No more data can be written until the cache capacity falls below 75percent. That means the cache remains read-only until there is more than 25 percent space available. One of thefollowing options can assist you in determining the right cache size for your Edge appliance:1. Modified Time is used to determine the amount of data modified by an end user over a given period of time.The results can help you determine remote backup sizing and in deciding how to size a network if data werebacked up from a remote site to a central site. Talon Storage sales engineers have a Return-On-Investment(ROI) calculator that can help determine the costs of remote backup versus centralized backup.2. TalonScanner, a Talon Storage provided tool can also help you to calculate cache size by determining theamount of data — modified or accessed — within a given period of time. See, “Quantify Total Data AccessUsing TalonScanner” on page 12.9

Preparing For Data MigrationOnce you have determined the deployment model that is right for your network environment, it is important to alsodetermine and plan your migration from the existing data storage model to Talon FAST.The primary objective of most WAFS projects is to consolidate and replace file and print servers in remote offices.Depending upon the amount of data to be migrated from the remote office to the data center, there are several methodsavailable to ease the transition to a Talon FAST solution.Considerations include:How much data is on the file server at the remote office?How much bandwidth is available between the remote office and the data center? Is the bandwidth constraineddepending on the time of day?What type of data (compressible or uncompressible) is going to be cached?What is the new data generation rate?Data Migration and Pre-populating a Talon FAST Edge ApplianceUse the procedure in this section to:1. Migrate data to the backend file server at the data center2. Pre-populate the Edge appliance cache with data from the local file server in the remote office.The following is assumed prior performing a data migration:Data from the local file server has been copied (using Robocopy) to some portable media or local network shareand has the capability to be shipped back to the data center and connected to the LAN.Depending on timing, you may choose to not allow users to edit or create files on the local file server until afterthe migration.To pre-populate data to the Edge appliance:- Use Robocopy to preserve file attributes, permissions, and ACLs by copying the data from the local file server tothe portable media, then ship to the data center and copy from the portable media to the backend fileserver.Example: robocopy.exe /e: /copyall /zb /r:30 /w:30 /np /log:\- Use Robocopy between the local file server and back end file server to synchronize changes since the last firstsynchronize (repeat step 2 a few times).Note: It should be understood that if the same data resides on the target and the source locations, Robocopy does not copydata if the file has not been modified unless otherwise specified by a “flag” operation.10

Set up and configure the Edge appliance in accordance with the standard Talon Storage appliance setup procedures. Referto the Talon FAST User Guide for more information.- Configure the appliance IP, DNS, WINS.- Join the appliance to the domain.- Upload the Talon FAST license key.- Configure service account user.- Add the Talon FAST core to the Edge appliance and assign the Talon FAST server name and Talon FAST IPaddress.- At the end of the business day, mark the local fileserver as read-only.- Use Robocopy to synchronize the final delta changes.- Validate or update file permissions on the backend file server if needed.- Verify that the Edge appliance is working in the remote office,On the Edge appliance browse to T:\FASTData\\\\ (This will create a file structure on the cache.)- Stop WAFS on the Edge appliance:- Launch the Services management console and locate the Talon Tum service.- Right-click on the service, select “Properties”, and select “Stop”.Use Robocopy to copy data from local fileserver to the Edge Talon FAST.Map local fileserver onto the Edge.- Copy all data from the local fileserver share to the Edge at-D:\FASTData\\\\(Make sure that the file structure is exactly the same on each location as it relates to the backend.)- From the command line at the location e:\tcfscacheoot enter the following command-- attrib –R D:\FASTData\* /S /D'This will remove the read-only attribute on the cache.- To start the WAFS service on the Edge Talon FAST, launch the Services management console and locate theTalon Tum service. Right-click on the service, select Properties and select Start the service.- To verify that the Edge Talon FAST is connected to the Core, from the command prompt navigate to T:\ andtype:-- dir/s FASTData\\\\Verify that the data is available. Check the total size of the share on the Talon FAST Edge and compare to thebackend; they should be similar in size.11

Talon Scanner ToolQuantify Total Data Access Using TalonScannerTalonScanner is a Talon Storage provided tool that assists in determining the amount of data either modified or ccessedwithin a given period of time. Request a copy of TalonScanner from your Talon Storage systems engineer. Last AccessedTime is used to determine the amount of data accessed over a period of time. Since the Edge appliance cache is arepository ofthemost recently accessed files, Last Accessed Time is an accurate method to determine how to size a Edgeappliance cache.TalonScanner has many display options, including the number of files versus the total size of those files. It displays collectedinformation in a pie chart, bar chart, or in tabular format for export to a spreadsheet.The TalonScanner can size any mounted drive. To determine the amount of data accessed in a period of time, mount thenetwork share to be analyzed to a drive letter and run TalonScanner against that drive letter. Once the drive has beenscanned, click the Accessed tab on the main panel.The image below shows 10 GB of total data under the selected tab over a ten year period. To size an Edge appliance cacheto hold 90 days of active data, total the columns from Today, Yesterday, 1‐7 days, 8‐30 days and 31‐90 days. This totalindicates a cache size of 3 GB (928 MB, 2 GB, and 175 MB).12

6. TALON FAST APPLIANCE CONFIGURATIONMany Talon FAST appliance support requests are a result of simple configuration errors. Most of these errors can beavoided by understanding the system and its requirements. This section describes and details best practices whenperforming initial configuration steps.1. Ensure the primary Ethernet Port is enabled.License keys are generated against the MAC address of the primary ethernet port. Ensure that the correspondingethernet port is enabled.2. Network Adaptor LabelingNetwork adapters should not be renamed or disabled. This interferes with the operation of Talon FAST services.3. Avoid Duplex MismatchesOne of the largest network problems experienced by server vendors is a condition known as duplex mismatch. Thisproblem occurs when a network switch attempts to auto-negotiate the speed and duplex settings between itselfand another piece of equipment (typically an application or storage server).Occasionally, the network switch will negotiate correctly and later re-negotiate and incorrectly set the duplexsetting for the network connection. The network switch expects a half-duplex connection while the Core applianceexpects a full-duplex connection. The reason why this occurs is often unknown and not diagnosable. The end resultis extremely poor Talon FAST performance.To avoid this, manually configure all network switch ports to which Talon FAST appliances or file servers areconnected as “full-duplex”. Ensure that link speed and duplex setting of the network adapter on the Edge and Coreappliances match the port settings on the network switch.4. Ensure End User Drive MappingsBefore the appliances are put into production, ensure that end users have correct drive mappings.5. Commonly Used TCP PortsThere are several TCP ports used by Talon FAST services, refer to the Talon FAST User Guide for a complete list.Talon FAST TService (WAFS) 6621 – 662513

7. REMOVING A BROKEN APPLIANCEIn the event an appliance becomes inoperable but can still boot up with drives available, perform these steps according towhether the appliance is Core or Edge.Core ApplianceCopy the following files from the inoperable appliance to the corresponding new appliance:1. C:\Program Files (x86)\TalonFAST\OpenHandleDB\openhandles.db2. C:\ProgaramFiles(x86)\TalonFAST\FastShare$\Scheduler\policydb.xmlOn the new appliance do the following.- Assign the same IP address and appliance name to the new appliance.✍Note: Detailed steps on how to perform many of these tasks are available in the Talon FAST User Guide.Edge Appliance- Assign the same IP address and appliance name to the new appliance.Failover Appliance- Please refer to the failover chapter of the Talon FAST user guide.14

8. TALON FAST GLOBAL SERVICES CONFIGURATIONSThe sections below describe best practices when performing Talon FAST global services configurations.The Talon FAST Service AccountThe Talon FAST service account enables Talon FAST to perform file system operations on the data center file servers.The Talon FAST service account is a domain user account that must have backup and restore privileges on the associateddata center file servers. Though the account is a “user” account, the owner of the files and folders is always the end user.Talon FAST appliances must be added to the domain before the Talon FAST service account is configured on theappliances. Failure to configure appliances in this order will result in the Edge and Core appliance not working correctly witheach other.The following steps describe how the Talon FAST service account is used by the Talon FAST solution:The desktop user requests a file from the data center file serverThis request is routed to the Talon FAST core appliance in the remote officeThe Edge appliance aggregates requests for file service from all users to provide better WAN optimizationThe requests for file services are sent to the Talon FAST appliance at the data centerThe Core appliance uses the Talon FAST service account on behalf of the user in order to process requests to thefile server.The following are requirements when setting up the Talon FAST service account:It must be a domain user (does not require domain admin privileges)It must have “Run As Service” privilegesIt must be a member of the data center file server’s local “backup operators” group. The “backup operators”group must have backup and restore privileges on the local file server in the data center.Its password should be set to “Never Expire”If Share Level Security is being used, then the Talon FAST service account must have “Full Control” permissions at theShare Level.For detailed instructions on creating a service account, refer to the Talon FAST User Guide.15

The following sections describe how to determine the current number of active sessions and the number of licensed users.Determining the Number of UsersTo determine the current number of active sessions on the Edge appliance FASTData Volume:- Open a command prompt, Start > Run > type cmd > click “OK”- Type net sessions .A list of active sessions displays.- Count the number of sessions.- From the number of sessions, count the total number of unique users. The number of users that count toward theappliance license total is based on the number of unique users logged in to the system. For licensing purposes youcan count multiple instances of the same user as a single user.Determining the Number of Appliance UsersTalon FAST appliance licensed users include:- All connections to the appliance, including print jobs.- The same user logged in from two different client PCs either due to terminal services (or fast user switching) orbecause there are services running on the client that use a different user's credentials.- A client PC mapped drive to the FASTData share or its subfolders is one connection to FASTData. However, SMBclients drop sessions when they have no open files or directories, therefore every mapped drive on a client PC isnot a FASTData user all of the time. Client PC drive mappings to other shares or multiple client mappings toFASTData subfolders are not considered users.Migrate Print Services to the Edge ApplianceIf Print Services is in use on the Edge appliance, migrate printers to Edge appliances and reinstall the printers on client PCs.16

9. PERFORMANCE AND NETWORKThe following sections describe best practices when performing Talon FAST performance and network configurations.Multiple DomainsEnsure that a two-way trust exists between the multiple domains on the network.Recommendation: Co-locate the CIFS file servers and Core appliance on the same domain.Improve User Access Using Data Pre-population✍Recommendation:Pre-populate the Edge appliance with data in advance of its use (to “warm” the cache) so users will experience faster fileaccess times.Operating System Security UpdatesTalon Storage verifies Microsoft security updates and determines the applicability to the Talon FAST software immediatelyupon release from Microsoft (usually on a monthly basis). Updates that are determined to be critical are verified within 72hours of their release by Microsoft. Once verified and classified, OS updates are available on the Talon Storage support site.Recommendation: Subscribe to the tech alert New Software Updates and Tech Alerts on Talon Storage's support site athttp://www.Talon Storage.com/support/Subscribing to this alert will add you to the mailing list that automatically sends you a notification when newly certifiedMicrosoft OS updates and patches are available.✍Recommendation:Do not apply Microsoft patches on the Talon FAST appliances without verifying against the updated list of testedMicrosoft patches. Doing so may result in a breach of Talon FAST software policies.17

10. USING DOMAIN BASED DFSConfigure Windows Server 2008 Domain-Based DFS WAFS Solution for Talon FASTObjectives:- Provide a unified namespace solution for both Talon FAST Cached file/folder structures- Introduce Client-side referral-based failover/failback solution based on Windows PKT info- Exclude ANY other targets from the Windows Client referral listSite definitions / links:Each Active directory site/subnet has to be defined in Active Directory Sites and Services. In order to document the logicalnetwork topology, which allows efficient replication of Active Directory, all subnets must be included and linked to aspecific site definition.It is recommended to configure site links based on a star-topology, i.e. Edge1 -> HQ (cost 200), Edge2 -> HQ (cost 500), butinclude the physical network topology in the design process of configuring Active Directory sites. If no altered ActiveDirectory replication traffic is in place you can keep the site costs the same (200). Site links define the scope of DFSManagement target evaluation.Step 1: Create Site Links: (if more than two sites)1. Double click “Inter-Site Transports”2. Right click “IP“3. Select “New Site Link”4. Type a name describing which sites will use this link (i.e. Chicago-Boston)5. Select sites from “Sites not in this site link”6. Click “Add”7. Click “OK”Repeat steps 2-7 for each site link that needs to be created18

Step 2: Configure “Query Policy” and Global Catalog:1. Double click on a site,2. Double click “Servers”3. Double click “name of domain controller”4. Right click “NTDS Settings” and select “Properties”5. Set the Query Policy to “Default Query Policy”6. Check “Global Catalog”Step 3: Bridge Links:1. Return to the main screen and double click2. “Inter-Site Transports”.3. Right click “IP and select “Properties”4. Confirm “Bridge all site links” is checked.5. If it is not checked closest site selection will fail.6. Close “Active Directory Sites and Services”Site Costing configuration:In order for closest site selection to work on link targets, Inter-site Topology Generator (ISTG) must be running on Windows2003 or Windows 2008, and for closest site selection to work on link and root targets, all domain controllers must berunning Windows 2003 or Windows 2008. Please use DFSUTIL in order to enable site costing:WINDOWS 2003: Dfsutil /root:\\lab.hammerbill.local\dfsroot /SiteCosting /enableWINDOWS 2008 : Dfsutil property sitecosting enable \\lab.hammerbill.local\dfsrootDomain Controller (DC) site costing is controlled separately on each DC using the following registrykey:HKLM\System\CurrentControlSet\Services\Dfs\Parameters\SiteCostedReferrals DWORD 1 or 0Please validate that the registry entry is applied, and schedule a reboot of the respective DC.19

DFS Root Configuration:By default a Domain-Based DFS root namespace includes all sites based on Lowest Cost, which can introduce issues in termsof client failover. In DFS Management you can configure target failover solution based on "Exclude Targets outside ofClients site" in order to circumvent that scenario. For each namespace configure "Allow Client Failback". Please follow thesteps below in order to complete the DFS configuration.If you manage the DFS root from a Windows Server 2003 R2 or Windows Server 2008 R2 server you can generate thefollowing structure as follows. In the exhibit below we are using "\\lab.hammerbill.local\dfsroot" as a namespace, and"TalonStorage" as a target referral.✍Note: In order for CIFS to work correctly while using domain DFS roots, the following must be noted:Example:\\domain.com\domaindfsrootdfslink1\\FS1\domaindfsroot (root level target)\\FS2\share1 (link level target)dfslink2 ...Adding domain name to the CIFS server list is not enough to optimize the DFS root.FS1(hosting server) must be added to the CIFS server list. This would optimize the Dfsroot share(including the DFS links). Alternatively, you can choose to just add the DFS link target server (FS2) to optimizedfslink1. In this case, dfslink2 accesses would go un-optimized.1. Download the DFS management snap-inThe DFS Management console has been included since Windows Server 2003 R2, and allows extensiveconfiguration of a DFS infrastructure. In order to comply with Talon FAST best practices you should use themanagement snap-in.http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=704520

2. Configure the DFS namespace as followsSelect the Namespace \\lab.hammerbill.local\dfsroot, and right-click propertiesSet the order value to "Lowest Cost" and check "Clients Failback to preferred targets"Cache duration should be set to 1800 seconds, the exhibit shows 60 seconds (Test purposes only)Click OK to confirm the configuration change21

3. Configure the DFS referral to exclude any target references- Select the referral "TalonStorage" and right-click properties- For the "TalonStorage" reference, specify "Exclude targets outside of the client's site" and "Clients Failbacktopreferred targets"- Cache duration should be set to 1800 seconds, the exhibit shows 60 seconds (Test purposes only)- Click OK to confirm the configuration change22

4. Open the Target Referrals listed in the "TalonStorage" referral list- Right-click each FAST Edge referral, and deselect "Override" setting for referral- Right-click the native backend referral, and select "Override", followed by "Last among all targets"- Click OK to confirm the configuration changeRepeat steps 3 and 4 for each referral and target referral list in the namespace.Make sure, that your target referral list contains the FQDN of the referral path.With the above settings Windows XP SP2+, Vista, or 7 clients will only receive the local Talon FAST edge and the nativeback-end file server referral in its "DFS Tab" or Partition Knowledge Table.23

Final Steps:In order to complete the configuration of a distributed Domain-Based DFS infrastructure, create a replica of the namespaceon each domain controller. By creating a local namespace replica, you will increase file system operations performance, asthe clients will use the local domain controller. Completing the steps below can be done remotely, from any WindowsServer or client, using the DFS Management console:1. Right-Click the “\\lab.hammerbill.local\dfsroot” namespace2. Click “Add Namespace Server”3. Select Domain Controller which will host a replica of the DFS root4. Complete the steps in order to create a DFS root replicaImportant: Windows Server 2003/2008 Standard only allows a single namespace replica. All enterprise versions of bothWindows Server 2003 and Windows Server 2008 allow multiple Domain-Based DFS roots.Conclusion:By using the FQDN as a UNC path, you will introduce a unified namespace and failover solutions for all users in yourenterprise network. This simplifies the process of managing data structures, collaborating data between users, and mappingdrives on Microsoft Windows clients.By implementing a Domain-Based DFS root, using “Exclude Targets outside of Clients site” functionality for the targetreferral, in conjunction with the “Client-Side Target Failback” script, you will be guaranteed 100% proper failover/failbackoperations. Microsoft Clients will NEVER failover to any unwanted path.24

When to Disable ICMP Redirect on a Core ApplianceICMP redirect messages are used by routers to notify the hosts on the data link that a better route is available for aparticular destination.Example: The two routers R1 and R2 are connected to the same Ethernet segment as Host H. The default gateway for HostH is configured to use router R1. Host H sends a packet to router R1 to reach the destination on remote branch office host10.1.1.1. Router R1, after it consults its routing table, finds that the next-hop to reach host 10.1.1.1 is router R2. Now routerR1 must forward the packet out the same Ethernet interface on which it was received. Router R1 forwards the packet torouter R2 and also sends an ICMP redirect message to Host H. This informs the host that the best route to reach host10.1.1.1 is by way of router R2. Host H then forwards all the subsequent packets destined for Host 10.1.1.1 to router R2.If Talon FAST is set up in an environment like the one above the following symptoms may be seen:Edge was connected to the Core but after few days the Edge appliance cannot ping the Core appliance and viceversa.No SCIP connections between the Edge and Core appliances.Core appliance can connect to other devices on the network.Edge appliance can connect to other devices on the network. Run a route print on the Core appliance to check if the anyspecial Edge IP address has been added to the routing table.If it has, you may wish to disable ICMP redirect on the Core by setting the following registry key value:HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters] "EnableICMPRedirect"=dword:00000000More information is available at http://support.microsoft.com/kb/195686.Keep Domain Controllers LocalKeep domain controllers locally available in the branch office to maintain good bandwidth.Talon FAST in combination with other Vendor Network DevicesTalon FAST can be integrated in an environment utilizing the benefits of other network devices such as a PacketShaper.25

11. TALON FASTSOFTWARE INSTALLER PACKAGEThis chapter outlines best practices and recommendations for the Talon FAST software installations. For more detailedinformation on configuring your Talon FAST software, please refer to the Talon FAST User Guide and the Talon FASTSoftware Only Installation Guide.Installing and Configuring Talon FASTThis section describes best practices when using the Talon FAST software installer package.Copy the Talon FAST software installer package to the desktop of the Microsoft Windows 2008 R2 serverInstall .NET Framework v4.0 according to Language LocaleSelect run as administrator and launch the executable from the desktop to begin the Full Install installationIf the server you plan to install Talon FAST on is a non-English language locale, you must install the .NETFramework v4.0 specific to the language locale before installing Talon FAST. For example, if your server’slanguage locale is German, you must install the German .NET Framework v4.0.The .NET Framework v4.0 language pack is available for download from http://www.microsoft.com/enus/download/details.aspx?id=17851Hard disk drive partitions must be created following the minimum requirements described in the Talon FASTSoftware Only Installation GuideDuring the Talon FAST Full Install installation a number of Windows components are installed. You will have toremove these components if you do not complete the installation process.Cache Space Location (CSL) RequirementsBefore configuring the size of your cache space you need to understand the requirements of the Cache Space Location(CSL):Core and Edge appliances: Wide dictionary data files, ARC (acceleration) data files, log and debug files, and registry hiveconfiguration data; all utilize the CSL.Edge appliances only: Data and metadata cached files residing on the CSL require a minimum of 20 GB, although it isrecommended that a location be selected that has as much space available as possible. Inadequate disk space can limitcache performance.Storage: It is recommended that the CSL path should be located on a separate partition or disk for the following reason:The Cache Purge feature operates on a volume basis with the assumption that the disk is full of cached files. If the CSL isshared with program or system files the data will be purged more aggressively. This will reduce CPU and file cachingperformance.In general, file server performance improves when data with similar access patterns are stored in the same physical locationon the disk.26

Determine Cache Space SizePlan cache space requirements by estimating the cache size needed by evaluating the amount of data typically accessed byusers over an extended period.Use Static IP AddressesRecommendation: Use static IP addresses on Microsoft Windows Server 2008 R2 hosting the Talon FAST Software ,especially those configured as an Talon FAST core or where the remote traffic redirection will be used for CIFS namespacetransparency.System operations:Perform Backups on Data Center ServerPerform data backups on the data center file server and not to Talon FAST based machines. Specifically, do not back upthe Cache Space Location folder FASTData (T: partition) or the Talon FAST FASTData (D: partition) physical drive. Installingbackup software co-located with the Talon FAST software is not recommended. Some backup software may install kernelfilter drivers that conflict with the Talon FAST file system drivers.Use of Operating System Auto UpdatesIf Windows updates are installed automatically, be aware that these updates may adversely affect services and certificationpolicy. See, “Operating System Security Updates” on page 17.Performance TuningFree up CPU and Memory ResourcesThe Talon FAST software package is a demanding application in both CPU and memory usage; other resourceintensive applications such as Exchange, SQL Server, and Web applications, should not be installed on the same server.27

12. TALON FAST ANTIVIRUS BEST PRACTICESThis section outlines the best practices for anti‐virus applications included as part of Talon FAST optimization.Client-Side SoftwareTalon Storage Solutions has tested common antivirus software packages including Symantec and McAfee for use on ourTalon FAST appliances (both core and edge) and on other hardware systems configured to run our software. Talon StorageSolutions will continue to test additional antivirus software packages to support specific customer environments.Installation1. The antivirus software package should be certified by Talon Storage Solutions.2. The antivirus software package (like any other certified software) should only be installed on drive C.Restrict File ScanningApplications that scan files and/or folders in order to gather statistics or other data sometimes only look at the metadata ofthe file without reading any data within the file. Other scans actually open each file in order to determine the type of datapresent in the file. In the case of pictures, music or video files, they may even create thumbnails or provide some additionalinformation about the contents of the file.Scans that cause file opens should be avoided on the edge appliance. Any open of a file will cause the edge appliance toretrieve the file from the data center file server and cache it locally. Scanning to gather statistics or provide thumbnails topicture files could cause the edge appliance to retrieve and cache more data than for which the appliance was sized. Clientsidesoftware that searches, indexes and/or scans network files and folders causes unnecessary metadata and datatransfers over the WAN resulting in additional load on the appliance and should be avoided.Antivirus software installed on the data center file server and on client PCs is generally adequate protection againstnetwork viruses. That said, Talon Storage Solutions allows data on its edge and core appliances to be scanned, ensuringcomplete point-to-point protection.Antivirus scanning should be employed on the operating system and Talon FAST software partitions of the edge applianceto provide total antivirus scanning coverage for the environment. The D drive and T drive (FAST partition) should beexcluded from virus scanning. The D drive may be configured for real-time protection. Talon FAST processes must beexcluded from scanning. Also, user’s mapped network drives should not be scanned.28

Configure ExclusionsAntivirus software should never scan drive D or drive T on the Edge appliance. Antivirus software scans of drives D and Twill result in numerous file open requests for the entire cache namespace. This will cause file fetches over the WAN to allfile servers being optimized at the data center. WAN connection flooding and unnecessary load on the Edge appliance willoccur thereby resulting in performance degradation.The following Talon Storage processes should not be scanned:C:\Program Files (x86)\TalonFAST\Bin\Tum.exeC:\Program Files (x86)\TalonFAST\Bin\Tservice.exeC:\Program Files (x86)\TalonFAST\Bin\Tapp.exeC:\Program Files (x86)\TalonFAST\Bin\Tafsutils.exeC:\Program Files (x86)\TalonFAST\Bin\TalonBackendService.exeC:\Program Files (x86)\TalonFAST\Bin\TalonDRSynchService.exeC:\Program Files (x86)\TalonFAST\Bin\Twanop.exeC:\Program Files (x86)\TalonFAST\Bin\Twccpd.exeC:\Program Files (x86)\TalonFAST\Bin\Optimus.exeReminder:Client PC antivirus scans should not be performed on network mapped drivesOn-access scanning applications (SMS) should not scan network mapped drivesOn Talon FAST edge devices exclude drive T from any type of scanning29

McAfee®This chapter outlines best practices for McAfee Virus Scan Enterprise version targeted for Talon FAST appliances based onWindows Server 2008 R2.Baseline ProtectionAfter completing a typical installation of the McAfee Virus Scan Enterprise the configuration specifics are documented asbelow, including On-Access Scanning, Full and Targeted Scan.30

Excluding Services and Processes Using McAfee Virus Scan ConsoleThis section describes how to exclude Talon FAST processes on Server and Remote Appliances from McAfee antivirusscanning.✍Note: Ensure that Talon FAST processes, services and drives are excluded on antivirus servers and clients and as a grouppolicy for Talon FAST users, if applicable.1. Double-click the McAfee On-Access Scanner icon on the Virus Scan Console.31

2. Select configure different scanning policies for high-risk, low-risk and default processes.3. Click Exclusions.32

4. Add the D: and T: drive to the exclusion list and include subfolders.✍Verify that D:\ and T:\ have been excluded from the default processes.33

4. Click Scan Items.5. Deselect When writing to disk.34

6. Click Low-Risk Processes.7. Click the processes tab.8. Click Add.9. Add the following processes:C:\Program Files (x86)\TalonFAST\Bin\DiskScrub.exeC:\Program Files (x86)\TalonFAST\Bin\Optimus.exeC:\Program Files (x86)\TalonFAST\Bin\Tafsshare.exeC:\Program Files (x86)\TalonFAST\Bin\Tafsutils.exeC:\Program Files (x86)\TalonFAST\Bin\TalonBackendService.exeC:\Program Files (x86)\TalonFAST\Bin\Tapp.exeC:\Program Files (x86)\TalonFAST\Bin\Tcpaccel.exeC:\Program Files (x86)\TalonFAST\Bin\TcpAccelService.exeC:\Program Files (x86)\TalonFAST\Bin\Tservice.exeC:\Program Files (x86)\TalonFAST\Bin\Tum.exe35

10. Click Scan items.11. Deselect When writing to disk and When reading from disk.12. Click Exclusions.13. Add the D: and T: drive to the exclusion list and include subfolders.✍Verify that D:\ and T:\ have been excluded from the low-risk processes.36

Symantec Endpoint Protection x64 12.xThis chapter outlines best practices for Symantec Endpoint Protection version 12.x targeted for Talon FAST appliancesbased on Windows Server 2008 R2.✍Note: Ensure that Talon FAST processes, services and drives are excluded on antivirus servers and clients by using grouppolicy for Talon FAST users, if applicable.Baseline ProtectionThe configuration specifics are documented as listed below for a typical installation of the Symantec EPO suite (includingVirus and Spyware protection, Proactive Threat Protection and Network Threat Protection):This Symantec EPO base installer automatically enables a firewall script upon ‘first’ install. It is mandatory to have consoleaccess.37

Application ExclusionsIn order to guarantee the best performance for the Talon FAST product and its included components it is mandatory toexclude Talon FAST processes from all protection mechanisms by changing the User-Defined Exception list for thefollowing processes and paths:This list is subject to change, but please visit our Talon Storage Solutions best practices page athttp://www.talonstorage.com/support in order to get the latest requirements for this application.38

File System Auto-ProtectionIn order to guarantee the best performance for the Talon FAST software it is mandatory to change settings for File SystemAuto-Protection, disabling “Scan files on remote computers” and associated advanced settings.39

File System Auto-ProtectionBelow you can find an outline of the advanced options as adjusted for Talon FAST software. It is recommended to ONLYscan a file when modified and disable the associated file cache.40

Network Threat ProtectionMicrosoft Windows Server 2008 R2 by default includes a Windows Firewall. Talon FAST software automatically provides ascript to perform firewall maintenance, allowing ports associated with Talon FAST product. It is mandatory to disable allSymantec EPO Firewall settings except DDoS and port scan detection.41

Sophos VirusScanThis section outlines best practices for Sophos Virus Scan version 9.5 targeted for Talon FAST appliances based on WindowsServer 2008 R2.Baseline Protection (Central Configuration)After completing a typical installation of the Sophos Virus Scan the configuration specifics are documented as below. Wewill describe the procedure to configure Sophos Virus Scanning from a central configuration perspective.42

Excluding Services and Processes Using Sophos Control CenterThis section describes how to exclude Talon FAST processes on Server and Remote Appliances from Sophos antivirusscanning.✍Note: Ensure that Talon FAST processes, services and drives are excluded from antivirus scanningServers and clients and as a group policy for Talon FAST users, if applicable.1. Double-click the Sophos Configure Scanning icon on the Sophos Control Center.2. Click the On-access scanning button.43

3. Click on the Windows Exclusions tab.44

4. Add the following items to the excluded items list. C:\Program Files (x86)\TalonFAST\Bin\ D: T:5. Click OK45

6. To verify the central configuration results on a client we use the Sophos Endpoint Security and control panel.7. Click antivirus and HIPS.8. Click On-access scanning.46

9. Click the exclusions tab to verify the settings.Sophos built in FirewallMicrosoft Windows Server 2008 R2 by default includes a Microsoft Windows Firewall. Talon FAST software automaticallyprovides a script to perform Microsoft Windows firewall maintenance, allowing ports associated with Talon FAST product.Talon recommends the use of the Microsoft Windows firewall.47

Talon FAST Optimized Software: SecurityThis section outlines the best practices using security applications included as part of Talon FAST optimization.Microsoft Firewall- Retain Firewall Settings as DefaultRecommendation: Leave Microsoft Firewall settings and services at the default setting of OFF and not started for standardTalon FAST installations.Recommendation: Leave Microsoft Firewall settings and services at the default setting of ON and started for appliances alsobeing used as domain controllers.SMS/SCCM (Microsoft)- Restrict SMS/SCCM ScansIf a Microsoft SMS server or Distribution Point is running on a Talon Storage appliance, the SMS server scans all availabledrives looking for SMS packages. This creates unnecessary metadata and data transfer between the Edge and Coreappliances causing an unnecessary load on the Edge appliance. A path should be hard-coded in the SMS configuration thatdoes not include Edge appliance the D or T drives.If the Talon FAST server is also an SMS client and software inventory is enabled, you must exclude the cache volume usingexisting SMS files on the root of the drive. SMS distribution and secondary sites do not require the SMS client be installed.To avoid SMS/SCCM scan’s use the following commands on the appliance.“ Cd\C:\Program Files (x86)\TalonFAST\Bin> “ “ tafsutils –sms Skpswi.dat ” After running the tafsutils command the file Skpswi.dat is placed on the FASTData share, in order to disable SMS scans ofthe FASTData share.48

13. TALON FAST APPLICATIONS BEST PRACTICESAutoCAD® (Autodesk)The sections below describe best practices when using AutoCAD with the Talon FAST product.Disable Digital SignaturesDigital signatures contribute to slow browsing of AutoCAD folders and files through Talon FAST appliances. For fasterbrowsing, disabling digital signatures is recommended. In 2001, Autodesk introduced Digital Signature Extension, which letsAutoCAD attach digital signatures to any files compatible with the AutoCAD 2000 drawing file format. In AutoCAD 2004 and2005, you can digitally sign drawings directly without using the extension.During the AutoCAD installation a shell extension loads displaying a specific icon with the file in Windows Explorer, or in theOpen/Save dialog box if it is digitally signed. To determine whether a file is digitally signed, the shell extension scans eachdrawing file as it is displayed. Folders that contain many drawing files cause this activity to slow the system and decreaseproductivity.✍Note: Digital signatures in AutoCAD and in AutoCAD LT can be turned off from the Registry Editor or through theAutoCAD or AutoCAD LT application. The process to turn off the digital signature feature is different for AutoCAD and forAutoCAD LT users.Disabling Digital Signatures Using Registry Editor for AutoCAD & AutoCAD LT- Open the Registry Editor.- Browse to HKEY_CURRENT_USER\Software\Autodesk\Autodesk Digital Signatures.- Right-click on IconOverlayEnabled and select Modify.- Select Disable.Disabling Digital Signatures for AutoCAD LT- Double-click the acsignopt.exe file.It can be found either in the c:\winnt\system32 directory or in the c:\windows\system32 directory. The SignatureValidation Options window displays.- De-select Validate digital signatures and display special icons.- Click OK.- Reboot the server.49

Disabling Digital Signatures for AutoCAD- Locate any drawing file in Windows Explorer or in any file dialog box.- Right-click the drawing file name and select Enable/Disable Digital Signature Icons. The Signature ValidationOptions window displays.- De-select Validate digital signatures and display special icons.- Click OK.- Reboot the server.Implementing AutoCAD Registry Setting Using AD Group Policies- Create a registry file called autocad.reg on the desktop.- Open the autocad.reg file in Notepad and add the following: Windows Registry Editor Version 5.00[HKEY_CURRENT_USER\Software\Autodesk\Autodesk Digital Signatures] "IconOverlayEnabled"=dword:00000000- Save the autocad.reg file.- Copy the autocad.reg file to the logon share.- Create a batch file called autocad.bat.- Open Notepad and add the entry @echo off regedit /s \\ServerName\Share\autocad.reg- Save the autocad.bat script in the NETLOGON share on a domain controller at%systemroot%\sysvol\sysvol\\scripts- Start the Active Directory Users and Computers snap-in by clicking Start > Administrative Tools > Active DirectoryUsers and Computers.The Active Directory Users and Computers page displays.- In the console tree, right-click the local domain and select Properties.- Click the Group Policy tab, click New.Type a name for the new policy (for example, AutoCAD Digital Sign), and press Enter.- Right-click the new policy name, select Properties.- Click the Security tab.- De-select the Apply Group Policy checkbox for the security groups that should not have this policy applied.- Select the Apply Group Policy checkbox for the groups that should have this policy applied.- Click OK.- Click the Group Policy tab. Select the appropriate group policy object (for example, AutoCAD Digital Sign), andclick Edit.50

The Group Policy Object Editor displays- Under User Configuration, expand Windows Settings.- Click Scripts (Logon/Logoff).- Right-click Logon, select Properties. The Logon Properties window displays.- Click Add. The Add a Script dialog box displays.Type the full UNC path to the shared folder that contains the script.Example: \\ServerName\SysVol\domain.packet\scripts\qq.bat.✍Note: Do not browse to the location. Use the UNC path to the shared folder.- Click OK.- Click Apply.- Click OK to close.Close the Group Policy Object Editor Console and the Active Directory Users and Computers snap-in. Have all users log outand log back into the domain controller. The end user PCs now have the following registry setting installed:HKEY_CURRENT_USER\Software\Autodesk\Autodesk Digital Signatures"IconOverlayEnabled" =0Set AutoCAD Sheet Set Manager VariablesIn addition to disabling the digital signatures on AutoCAD files, the following AutoCAD variables related to Sheet SetManager should be set as indicated in the sections below.Access and Edit Variables- Open the AutoCAD command window.- Type the name of the variable followed by the value to set it to.- Exit AutoCAD normally to save the new variable value.Toggle Data Sheet Refresh StateThe SSMSHEETSTATUS variable controls how the status data in a sheet set is refreshed.- Set the SSMSHEETSATUS variable to 0. The status data in a data sheet does not automatically refresh.- Or Set the SSMSHEETSTATUS variable to 2. The status data will be refreshed when the sheet set is loaded orupdated.This setting also indicates that the status data will be refreshed based on the time interval set by SSMPOLLTIME.Set Data Sheet Refresh Rate IntervalsThis variable controls the time interval between automatic refreshes of the data sheet status data. The time interval is inseconds and valid values are between 20 and 600. The default value is 60. Set SSMPOLLTIME to 600.51

Excluding Drawing Files from Antivirus Scanning✍Recommendation: Keep AutoCAD drawing (DWG) files excluded from antivirus scans to accelerate the file open and filesave processes.CAD/CAM PDM on Talon FASTApplications that use an attached database component that manages file-open locks are not supported, for example, theCAD/CAM PDM application.Microsoft Exchange ServerKeep Encryption DisabledIf you need Talon FAST to accelerate your Exchange mail service, any encryption setup between the client and theExchange server must be disabled. Encrypted traffic cannot be accelerated.Compression Must be Turned OffAny Microsoft Exchange Server or collaborative applications offering the user the option to compress data, must bedisabled. This application level of compression will greatly reduce the effectiveness of the WDC and Zlib compressionalgorithms.Set Protocol Acceleration RulesFrom the Core WDC Rules under the Acceleration tab,- select the All Ports checkbox for the Exchange server.52

MicroStation® (Bentley)This section describes best practices for Bentley Micro Station version 8.x.Keep Domain Controllers Co-located with Talon FAST✍Recommendation: Keep the Microsoft domain controller co-located with each instance of an Talon FAST appliance inthe data center and in remote locations. This localizes authentication and Micro Station security and results in better TalonFAST solution performance.Copy Reference Files LocallyBentley Micro Station creates drawing files with the extension of .dng. For best performance, copy the .dng files to the datacenter file server and the cell files to the local client PC. The cell, or reference, files, are static and unchanging so a local celllocation ensures that unnecessary WAN traffic is eliminated. In addition, DFS-R should be installed on the Edge appliancelocal partition (T:\) and used for data refresh and replication.For fastest performance, use Active Directory on the Edge appliance to maximize .dng file load time and re-liability.Recovery Best PracticesFor best recovery in the event of a power or network outage, map shared folders to the data center file server and to theEdge appliance. In addition, define the environment variable responsible for permitting cell storage on the client PCs ratherthan using the UNC path alone.Keep Auto-Save Disabled✍Recommendation: Due to the way in which Bentley Micro Station responds to WAN outages, the Micro station auto-savefeature should be disabled and clients save Micro Station files manually.In the event of a network or WAN outage, Micro Station times out and displays a window that offers the options of retryingor cancelling the save operation. Micro Station does not offer a "Save As" option for files open on client PCs from the datacenter file server. The retry option causes Micro Station to retry the save operation for 300 seconds or until thenetwork/WAN connection is reestablished, causing Micro Station to appear as if it has frozen.If a packet arrives during the retry operation, it causes the clock to reset and the operation starts from the beginning. Thecancel option causes Micro Station to write the changes to a temporary file and then close. Once the original .dng file isreopened, the changes are applied to it from the temporary file. To disable auto-save, access the Preferences menu fromthe MicroStation application. Turn Automatic Save Design Changes on but leave the two available configuration variablesundefined.Disable Antivirus Scanning on .dng FilesFor best performance, disable automatic antivirus scanning of.dng files53

Lotus Notes® (IBM)Keep Encryption DisabledIf you need Talon FAST to accelerate your Lotus Notes mail service, any encryption setup between the client and theDomino server must be disabled. Encrypted traffic cannot be accelerated.Compression Must be Turned OffAny Lotus Notes or collaborative applications offering the user the option to compress data, must be disabled. Thisapplication level of compression will greatly reduce the effectiveness of the WDC and zlib compression features.Set Protocol Acceleration RulesFrom the Core WDC Rules under the Acceleration tab, use port 1352 for the Domino server.ProjectWise® (Bentley)This section describes best practices for Bentley ProjectWise version 8.x.Keep Domain Controllers Co-located with Talon FASTRecommendation: Keep the Microsoft domain controller co-located with each instance of an Talon FAST appliance in thedata center, and in remote locations. This localizes authentication and ProjectWise security, and results in better TalonFAST solution performance.Open PortsThe following applies to ports used by Talon FAST appliances and ProjectWise:Port 5800 should be open bidirectionally.Port 5800 should be open to all internal FTS; the routing section in dmskrnl.cfg lists all FTS=5800. Alternatively,open port 5800 to the application server and use FTS=5800, AppServer.The gateway and router portions of the dmskrnl.cfg file should be configured so that client PCs can access the filesappropriately. Use server=webserver in the gateway section, where webserver is the public IP address of the Webserver.54

Use Local Reference FilesThe performance of the Talon FAST solution is enhanced if ProjectWise local reference files are used. Local reference filesallow ProjectWise Explorer to use any local working directory file without recopying it unless is has been updated. Followthese instructions to use local reference files:Verify that the working directory for ProjectWise is configured on the client PC and not to a server mapped drive.Enable the following user document settings:- Leave local copy on check in and free- Use up to date local copy on check out- Use up to date local copy on copy out- Caching Files Locally-Caching can be enabled so that files are cached locally if ProjectWise 8.5 is in use and the file transfer server is local to theclient PCs.55

Microsoft Office 2010The following articles describe some of the features and functionality in order to improve user experience in opening files,temp file creation and saving of Microsoft Office document types inTrust Center SettingsAdd the network location to the trusted locations:In the Office program, Click File > Options > Trust Center, click the Trust Center settings button. Click Trusted locations, andadd the network path to the trusted locations.You can also allow access to all network shared files by highlighting the related checkbox.Robustified UNCThis issue appears to be specific to running Office 2007 or Office 2010 on Windows Vista or Windows 7. It also appears tohappen more often to network shares that are either part of a Distributed File System (DFS) structure or located on storagehardware which isn’t running on Windows like a dedicated NAS system.The solution is to disable a feature called “Robustified UNC” via the registry;Office 2007 KeyHKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\OptionsOffice 2010 KeyHKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\OptionsValue name: DisableRobustifiedUNCValue type: REG_DWORDValue: 1While the registry key is located in the Word hive, it actually applies to all other Office applications as well. Due to itslocation, it could be required to close all open Office applications before changes to take affect (or simply restart yourcomputer).While the effect of the registry key has not been publicly documented by Microsoft, the “Robustified UNC” feature affectsthe security mechanisms used when opening a file from or saving a file to a network share in Office applications. Disablingthe “Robustified UNC” feature could also solve issues such as documents not opening when double clicked from a networkshare (while Word does open) or hangs or slow performance when opening/saving files that are located on a networkshare.56

If you are using Office 2007, make sure you’ve applied all updates before trying to implement this registry key as the optionto turn it off might have been added by a Service Pack or update.If changing this registry key does not solve your immediate issue, it is recommended to remove it again.If the registry change does solve your issue, it is still recommended to remove the key and test Office behavior wheneveryou install an Office update as the “Robustified UNC” feature might get a fix (Microsoft is aware of the issue). In any case,use the registry change with caution until the full effect of the key has been published by Microsoft so you can understandthe risk in full.Microsoft Office PowerPoint 2010PowerPoint sets files Read-only After Saving.This behavior occurs only with PowerPoint presentations that are saved with the PPTX extension.In order to avoid this behavior the following settings has to be changed on the Microsoft Windows client.In Windows Explorer, turn off the Details pane. To do this, use the following steps:- Open Windows Explorer- Select Organize - Layout and un-check the Details pane option57

APPENDIX A: GLOSSARYAppliance Talon Storage-supplied Talon FAST hardware solution which includes drop-in plug-and-play servers built onMicrosoft Windows Server 2008 R2 Standard on which Talon FAST is installed.CIFS Common Internet File System, is a proposed standard protocol (using TCP/IP) that lets programs make requests forfiles and services on remote computers on the internet.DFS Distributed File System, is a client/server-based application that allows clients to access and process data stored on theserver as if it were on their own computer using a cached copy to the users’ computer.Failback When a client is automatically routed back through the Talon FAST appliance after an outage. During the outage,the client would have been forced to go native to the data center.Full Install A software-only data center Talon FAST solution delivering full Talon FAST functionality on commercial offthe-shelfserver class hardware.Talon FAST edge Talon FAST appliance or server located at the branch office location. The Edge appliance or servercaches data located on file servers in the main data center providing key IT services such as Domain Controller, DNS/DHCPservice, Web proxy, software and application distribution, and print services.Talon FAST core Talon FAST appliance or server located at the data center. The Core appliance or server connects to themain data centers file servers, serving as a protocol gateway for communications with Talon FAST edge appliances orservers distributed at remote offices.TCP Acceleration A technology utilized by Talon FAST to improve response times for all TCP based applications byswapping out traditionally slow TCP with a transport protocol optimized for faster data transmission over WANconnections.WDC The Wide Dictionary Compression feature of Talon FAST enables optimization of HTTP, SharePoint, and FTP trafficacross the wan. By creating inclusion and exclusion rules on Talon FAST, you can control what TCP traffic is optimizedusing WDC.WAFS Wide Area File Services, a technology used by Talon FAST providing real-time, read-write global access to files overCIFS/NFS across the WAN. Talon FAST WAFS is built on a true distributed file system, and utilizes branch office caching, aswell as latency and bandwidth optimizations such as data streaming and aggregation, read-ahead, file differencing, andwide-dictionary compression.58