Careful planning is essential before virtualizing Exchange Server 2007. In this expert tip, you'll read why grouping externally facing servers is a good safety precaution when consolidating workloads and the significance that Exchange server roles play in your virtualization project.
When consolidating workloads though Exchange Server virtualization, I recommend that you group outward-facing virtual machines (VMs) onto a common host server. For example, if your client access server (CAS) is externally accessible, consider placing that VM onto the same host as your edge transport server. This will help protect your Exchange organization against an escape attack.
An escape attack occurs when a hacker escapes the confines of a VM and takes control of other VMs on the host server. To the best of my knowledge, no one has successfully performed an escape attack against a hypervisor-based virtualization platform yet. However, some security experts believe that it's just a matter of time before someone figures out how. Grouping externally facing servers onto a single host server ensures that, if an escape attack does happen, the hacker would only gain access to hardened servers that were already exposed to the Internet.
Virtualizing Exchange 2007 mailbox servers
Although it's easy to virtualize a mailbox server, doing so correctly is not as easy. Mailbox servers tend to be disk- and CPU-intensive, factors that must be considered
Some resources state that if you want to virtualize Exchange Server 2007, you should consider pairing mailbox servers and hub transport servers on the same host server. This is a good idea, but remember that hub transport servers use Jet databases for message queues. Depending on the volume of mail flowing through an organization and the arrangement of the virtual hard disks, the hub transport server and the mailbox server could compete for disk bandwidth.
Virtualizing Exchange Server unified messaging
Microsoft does not support virtualizing the Unified Messaging server role. A few Exchange administrators claim to have successfully virtualized their unified messaging servers without much trouble, but I don't recommend that you deploy this unsupported configuration.
Providing high availability
One confusing aspect of virtualizing Exchange Server 2007 is how to provide high availability. Exchange Server 2007 provides various high-availability solutions, but so do most virtualization platforms. This means that organizations that want to create a highly available Exchange Server deployment must determine which high-availability solution will best meet their needs.
Microsoft recommends using Exchange Server's HA features instead of hypervisor-based high-availability mechanisms that move VMs between virtualization hosts. Hypervisor-based high-availability mechanisms like Hyper-V's Live Migration are not Exchange Server-aware. Therefore, an unscheduled outage can cause data loss or database corruption during failover.
In contrast, native Exchange Server 2007 high-availability features are specifically designed to prevent data loss during failover. For example, cluster continuous replication (CCR) uses the transport dumpster to replay any messages that have passed through the hub transport during failover. This ensures that no messages are lost because of the server's unavailability during the downtime. Native hypervisor VM migration mechanisms do not include this feature.
Note: While it's usually pretty easy to decide how Exchange servers should be distributed among host servers, it is critical that you use backups to create an isolated virtualized Exchange Server deployment prior to shifting your production environment to a virtualized state. By doing this, you can stress-test virtual servers to make sure that they deliver the anticipated stability and performance.
About the author: Brien M. Posey, MCSE, is a five-time recipient of Microsoft's Most Valuable Professional (MVP) award for his work with Exchange Server, Windows Server, Internet Information Services (IIS), and File Systems and Storage. Brien has served as CIO for a nationwide chain of hospitals and was once responsible for the Department of Information Management at Fort Knox. As a freelance technical writer, Brien has written for Microsoft, TechTarget, CNET, ZDNet, MSD2D, Relevant Technologies and other technology companies. You can visit Brien's personal website at www.brienposey.com.
Do you have comments on this tip? Let us know.
This was first published in March 2010