Riverbed - CIFs WAN Optimization and Acceleration that just works

Riverbed is a leader in the WAN Optimization Controller space. We have implemented these devices at a client that had users in remote offices using a network file server (via VPN) and were experiencing less than stella performance. Anyone that has done CIFs file sharing over WAN, knows that it is painfully slow - it is by design intended for local use, not over low bandwidth, high latency WAN connections.

Summary of the setup:

• Topology, hub/spoke arrangement.
• Branch office users, save files to the main office file server.
• Files are typical office docs, pdfs, and images - upto 100megs+ in size.
• Branch location slowest links are ADSL.
• VPN connection already exists.
• XP Clients to Windows 2003 file server.
• Branch offices are NOT on the Active Directory - just have a \\x.x.x.x\share shortcut on the desktop.
• The head office AD has an account that matches their local login usernames and passwords.

 Riverbed Steelhead units dropped into the Head Office, and at the branch offices. These units sit inline after your firewall LAN port, and the network switch. If there is a crash on the Riverbed Steelhead unit, the electronics will do an auto failover, and will route the traffic straight through the device (there is 2 cables connecting into the switch on the Riverbed unit).

Tip: Manually set the port speed on your switches to match the port speed on the Riverbed interfaces.

We also optioned the RSP (Riverbed Services Platform) kit on the head office Riverbed Steelhead unit. This enables a low capacity, virtualized version of their Steelhead Mobile unit. You can additionally deploy VMs such as domain controllers with the RSP kit, although this wasn't tested.

Using a 10 pack of Mobile clients, we were able to connect users at the remote offices that did have a VPN connection, but didn't have enough users to warrant a Riverbed Steelhead device.

If we wanted mobile users to utilize the Riverbed Mobile client, we would need these users to first connect via VPN.

Before and after file transfer/open/save tests over the VPN showed a 25x + improvement. Even the first pass, with the Riverbed installed, CIFs traffic is optimized, but the massive gains happen after the Riverbed's have "seen" the data before.

These devices do not come cheap, but it is probably one of the coolest, drop in, turn it on, technology solutions I have seen implemented for a long time.

OpenSolaris 2008.11 - NAS testing

I have been doing some testing of OpenSolaris 2008.11 - as a NAS.

Some reasons for investigating this, and learning yet another operating system, has been due to not being entirely happy with some of my Linux/CentOS NAS setups - for the following reasons:

• Documentation for all the bits I needed to setup are scattered all over the internet
• There are so many variations/flavours of Linux, again, makes finding the correct documentation a pain
• Active Directory, Windows ACLs - kind of work after hours of playing around. Not perfect.

So after reading lots on OpenSolaris, and seeing the second major release come out, I decided to look a bit under the hood - and I have been impressed. From what I have seen so far from Sun's efforts on OpenSolaris, it is a viable alternative to Linux (as a NAS), at the right cost - free! Some advantages:

• Quick to find the documentation I need - documentation can be found at or is linked from http://www.opensolaris.org and http://www.opensolaris.com
• Sun has built CIFs with AD/Windows ACL integration - clearly documented (well must easier to find than for Linux)
• There is less steps needed to set everything up compared to previous Linux solutions I put together
• ZFS - snapshotting!
• iSCSI sharing of ZFS volumes - bring on some VMWare ESXi love!
• This is based on Solaris - its gotta be rock solid - at least it makes me think it is vs my previous Linux solutions

To get myself up to speed with OpenSolaris features - I downloaded the trial version of NexentaStor - installed it on hardware and VMs and just played around. Nexenta has rolled their own version on OpenSolaris, put a web gui on it, and optimised it for NAS operation.

The web based GUI for configuring everything is super simple to use. I think I will option this product in future for clients wanting multi-terrabyte NAS/iSCSI solutions. Previously, I have implemented several Open-E solutions - not a bad product, but I really wish it has the flexibility of ZFS and the simplicity of OpenSolaris AD to unix user and group mappings!

For soho clients, they may not want to fork out for the cost of NexentaStor, so I decided to learn OpenSolaris and set it up like NexentaStor. Solaris Express Community Edition does include some ZFS web gui tools, kind of like a subset of stuff you can do on NexentaStor, but it hasn't been rolled into OpenSolaris yet.

Future posts to come from my OpenSolaris testing... Some Amazon EC2 OpenSolaris testing... Some Amanda backup software testing...

open-e - Testing

 Got an open-e DSS Lite (1TB) free install working at a clients. What I have done so far is tested this thing with BackupExec 11D.

Great news is that is does backup, you have to make sure that you select it to back up from the legacy backup agents (also make sure under the Veritas backup agent you have it setup with your BE11D server address and a password - AND create a login account in BE with that password).

Next to test is volume replication and snapshots. Wanting to replace the linux setup I put in place last year, and get around the issue of more than 1 library cartridge getting used for a full backup on the weekends.

Will post up any new finds later (including a FreeNAS install for another that requires a very simple NAS setup).

Update on Tuesday, January 13, 2009 at 5:34PM by Victor Hong

Since testing Open-E and Backup Exec 11D backups, it seems the full retail version now does NOT support Backup Exec 11D. Only supports up to Backup Exec 10.

The following is found on the forums, and was repeated from Open-E support regarding this problem:

To backup the Open-E-NAS-R3 or DSS 

We discovered that the following setting worked with Symantec Backup Exec 11d 

• We configured the NAS  in Windows (PDC)
• The Backup agent was set to none.  When enabled we ran in to problems backing up data on the NAS.
• Not sure if this is required but we made the Backup Exec service account a superuser
• We configured the Backup Exec service account full access to the share that needs to be backed-up.

On the backup server:

• We used the Backup Selection option
• We Browsed the Domain
• We Browsed from the Domain to the NAS server
• We Browsed on the NAS to the share
• We created several data backup sets to create policies and jobs
• We found that for this NAS we had to select :

“Allow use of any available network interface, subnet, or protocol for remote agents not bound to the above network interface, subnet, or protocol.” 

What I did was run some tests on small backups - this time with Backup Exec 12.5. Performance of backups in Backup Exec and Open-E via CIFs is pretty slow (well slower than backing up with something that uses a working agent), but the jobs work (even though there is always an error from Backup Exec that it can not start the remote agent).

Also note that in your job properties, to specify your network interface, then tick the "Allow use of any available network...." option, as that is the only way for the setting to take (pay attention to the job summary after you click OK.

Another note, for making backup selections of shares on the windows network in Backup Exec, you *may* need to have a remote agent installed (I always have in all my tests) - saw this mentioned on the Symantec forums.