Planning Your Installation

A CTERA Portal installation comprises a cluster of one or more VMs (servers). Each server can host any combination of the following services:

Main database. Only one server can host the main database. The server that hosts the main database is called the primary server.
Secondary replication server. A passive database service to replicate the primary server. During server installation, you can turn on the replication service and select the primary server from which to replicate.
Application server. This server accepts connections and handles requests from Web and CTTP clients. Application servers are added to the cluster to increase client handling capacity. Any servers that are enabled as application servers automatically balance the connected clients between them, allowing for maximized capacity and availability.

Note

CTTP clients are CTERA edge filers and agents that communicate with the CTERA Portal application server using a proprietary secure, WAN optimized transport protocol. For details about CTTP, see What is the CTTP Transport Protocol.
Messaging server. This server enables sending notifications from the portal to various consumers, for example the Varonis Data Security Platform, which is a connector running on top of the CTERA Messaging Service.
Document preview server. This server is used to process document preview requests. The document preview server supports high availability. You can install one or more servers, in order to ensure uninterrupted document preview generation and redundancy in the event of a server failure.

By default, the first installed server is the primary, database, server, hosting the main database and application server. You can install any number of additional servers, for Scalability, Sizing, and Load Balancing and for Data Replication and Failover.

Scalability, Sizing, and Load Balancing

CTERA Portal is horizontally scalable. Additional servers can be added:

As application servers, to increase client handling capacity. Any servers that are enabled as application servers automatically balance the connected clients between them, allowing for maximized capacity and availability. The number of application servers deployed depends on the use case:
- ROBO (remote office, branch office) use case – The users connect to the local CTERA Edge Filers, each edge filer connection to a virtual portal is one connection, even if there are thousands of users connected to each edge filer. You require one application server for every 100 edge filers.
- FSS (file sync and share) use case – The users connect directly to a virtual portal. You require one application server for every 10,000 CTERA Drive Share users or 1250 CTERA Drive Connect users and a minimum of one virtual portal for every 100,000 users.
As messaging servers, to enable sending notifications from the portal to various consumers, for example the Varonis Data Security Platform, which is a connector running on top of the CTERA Messaging Service. In production environments that use the messaging service, the CTERA Portal must include three application servers defined as messaging servers.
As document preview servers. The document preview servers supports high availability. You can install one or more servers, in order to ensure uninterrupted document preview generation and redundancy in the event of a server failure.

Data Replication and Failover

The main database is stateful and contains critical data. You must replicate all such servers to maintain the availability of critical data. The application service is stateless, and therefore, any dedicated application servers do not require replication or backup. Failover between application servers is automatic.

Replicating the database is described as part of the installation for a CTERA Portal.

CTERA Portal includes a built-in replication function for achieving higher level of availability. Replication can be achieved using other platform dependent replication methods (such as SAN or VMWare-level replication).

Security

All internal communication between CTERA Portal servers is authenticated to prevent unauthorized access. Nevertheless, to follow the defense in-depth security philosophy, the primary database server, which stores sensitive data, should be placed in its own firewalled, isolated network, and only the application servers should be allowed to face the Internet.

Requirements

CTERA Portal is deployed as a 64-bit virtual machine or as an instance on a cloud provider. The following hypervisors are supported:

ESXi
Hyper-V
KVM
Nutanix AHV

The following cloud providers are supported:

AWS
Microsoft Azure

To install, you need the CTERA Portal virtual machine image for your platform, obtainable from CTERA support.

General Requirements

The following requirements apply to all platforms. For specific platform requirements, refer to the installation guide for the platform.

Web browser: The latest two releases of Apple Safari, Google Chrome, Microsoft Edge, and Mozilla Firefox.
SSH and SCP clients. For example, the freeware PuTTY.

Production Deployment Blueprint

A minimal production installation of CTERA Portal comprises of four 64-bit virtual machines: Two database servers (primary and secondary) and two application servers. The minimum two application servers are required for high availability and load balancing.

If the CTERA Messaging service is deployed, the minimal production installation comprises of five 64-bit virtual machines: Two database servers (primary and secondary), and three application servers that also function as messaging servers.

For more details about the CTERA Messaging service, see Managing the CTERA Messaging Service.

Additional application servers may be deployed for further load balancing.

Note

Three, and only three application servers function as messaging servers. Any additional servers function purely as application servers for load balancing.

Optionally, one or more preview servers can be deployed for document previews.

The following table details the requirements per CTERA Portal Server in a production environment.

Server	Minimum Requirements	Notes
Primary Database Server	8 vCPU, 32GB RAM, 200GB data pool (SSD), 200GB-400GB archive pool (Magnetic)	The data pool should have at least 2000 IOPS and should be sized around 1% of the expected global file system size. For ESXi environments, each server is deployed with a 250GB data pool. The archive pool size should be around 2% of the expected global file system size.
Secondary, Replication, Database Server	The replication database server must have the same configuration as the primary database server.	–
Application Server	8 vCPUs, 32GB RAM, 100GB data pool (Magnetic) or, with the CTERA Messaging service: 8 vCPU, 32GB RAM, 250GB data pool (Magnetic)	An application server can handle up to 10,000 clients. When the number of expected clients will be near 10,000, 8 vCPUs and an additional 16GB RAM is recommended. When the CTERA Messaging service is enabled, the data pool size should be a minimum of 250GB but a more accurate amount can be calculated as follows: `data_pool = number_of_daily_audit_events × 4.3` where 4.3 is 3 retention days multiplied by 1.2 for the message size and then a 20%buffer. CTERA recommends separate servers to use as messaging servers. For ESXi environments, each server is deployed with a 250GB data pool.
Preview Server	8 vCPUs, 32GB RAM, 60GB data pool (SSD)	–

Notes

All resources allocated to a server must be dedicated to that server and not shared with other servers. You must not run non-CTERA applications on any of the CTERA Portal servers.

CTERA recommends seeking guidance from CTERA support for a more accurate estimation of the required sizing.

Test Deployment Blueprint

The following table details the minimal requirements in a test configuration, with a single 64-bit virtual machine deployment.

Warning

Do not use this setup for production.

If the CTERA Messaging service will not be part of the test deployment:

Single server, 4 vCPUs, 8GB RAM, 100GB SSD storage.

If the CTERA Messaging service will be part of the test deployment:

Single server, 4 vCPUs, 24GB RAM, 250GB SSD storage.

Note

In a test deployment with messaging, you specify the primary database server as the messaging server. If you defined more than one server for the test deployment, you cannot set the primary database server as a messaging server and you then require 3 application servers.

Other requirements

Access from the virtual machine to a Storage Area Network (SAN) or directly attached hard drive.
Specific ports must be open. For details, see Port Requirements.
A DNS name for the CTERA Portal installation. This can be changed after the installation.
An ICAP Server and license if the antivirus feature will be used.
Best Practices:
- At least two ICAP antivirus servers are required for high availability (HA) and load balancing. If no ICAP server is available, scanning will stop, and users will receive error messages when attempting to open files which were not scanned.
  - Antivirus server sizing and the number of servers in the cluster should be determined in consultation with the ICAP antivirus vendor.
- At least 2 background scanning servers are required for HA.
  A single server from the designated background scanners is elected active. If this server fails, another eligible server is elected.
An SMTP mail server address and port for sending notifications.

Port Requirements

To allow access to and from the Internet on the firewall on each machine that will operate as an application server or database server, ensure the relevant network ports are open.

In addition, portal servers communicate with each other over specific ports. These ports also need to be opened but do not need Internet access.

For the inbound and outbound port tables and the internal port table, see Port Tables and CTERA Portal Ports Diagram.

ESXi

General Requirements

Specific Requirements