48 Chapter 2  Designing and Planning Server High Availability RAID 5 offers a balance of performance and fault tolerance by implementing a stripe set (improved performance) with a parity check (redundancy). RAID 5, which requires at least three physical disks, splits the write operation across “ n –1” disks (that is, if you have five disks, the write operation is split across four of the disks) to improve performance. At the same time, the RAID controller calculates parity information and stores it on the remaining disk. The result is that, if a disk is lost, the data on that disk can be re-created by comparing the data on the surviving disks and the parity information. (In RAID 5, the parity informa- tion is distributed among the disks, so that the contents of any given disk are 1/ n parity info and ( n –1)/ n actual data.) Using a parity disk means lower cost per storage unit (with RAID 5, you lose only 1/ n of the storage space you bought, as opposed to half with RAID 1), but the performance gain of striping is partially offset by the calculation of the parity infor- mation. Thus, RAID 5 doesn’t offer quite the performance increase that RAID 0 does, but it does offer some write improvement along with redundancy not offered by RAID 0. RAID 0+1, sometimes called RAID 10 , offers both the performance increase of RAID 0 striping and the redundancy of RAID 1. In RAID 10, you build a RAID 0 stripe set and then implement a RAID 1 mirror of the entire stripe set. Because the RAID controller isn’t calcu- lating parity data, the RAID 1 mirror doesn’t introduce an offsetting performance decrease in offering the redundancy. However, as with any RAID 1 implementation, RAID 10 uses half the storage space purchased for redundancy, so only half of what you bough appears useable. Also, because a RAID 0 stripe set requires at least two disks, and because a RAID 0 mirror doubles the disk requirements, a RAID 10 set requires a minimum of four physical disks. Thus, RAID 10 is the more expensive than the other RAID levels we’ve discussed. Selecting RAID Levels for Exchange Storage In general, if money is no object, you should go RAID 10 on everything; it’s the best perfor- mance and offers full fault tolerance. To balance cost, performance, and fault tolerance, you should use RAID 5. If you need the least-expensive implementation of data redundancy, use RAID 1. And when you need speed but don’t care about fault tolerance (say, for a volume ded- icated to your page file), use RAID 0. When designing a storage system for Exchange Server 2007, however, you need to consider what data is being stored and why. The extensible storage engine (ESE) database employed by Exchange Server uses database and transaction log files to improve recoverability . If the data- base is ever lost or corrupted, you can recover the database up to the point of the failure by restoring a previous version of the database from backup and replaying the transaction log files that were made after the backup. The most common mistake people make when deploying Exchange Server is to store the data- base files and transaction log files on the same storage volume. If you do this and that storage volume later becomes damaged, then the odds that you can recover the database to the point of failure are seriously diminished. Many administrators (and, more frightening, server hardware vendors and consultants) suggest placing the database files and transaction log files on different partitions of the same RAID 1 or RAID 5 volume. This might let you keep it straight in your head, but it does nothing to improve performance or recoverability. Yes, using a RAID 1 or RAID 5 volume protects against the failure of a single physical disk. But what if two disks fail? (It’s been known to happen!) Or what if the RAID controller starts writing garbage instead of data? Then you’re in trouble. 81461.book Page 48 Wednesday, December 12, 2007 4:49 PM Define High Availability Solutions Based on Client Types and Client Loads 49 Database files and transaction log files should be stored on different RAID volumes. And, if possible, those RAID volumes should use different RAID controllers. As already mentioned, you should use RAID 10 volumes for both databases and transaction log volumes, if you have the budget to do so. If not, then RAID 5 offers a good balance for the random-access read/write operations of database files, and RAID 1 is okay for transaction logs. However, for absolutely the best performance for transaction logs, use RAID 10 across as many drives as you can and do not store anything else on the transaction log volume. Redundancy for Active Directory Services It’s no secret that Exchange Server is highly integrated with Active Directory (AD). All of the redundancy and fault tolerance you add to your Exchange organization design would be pointless if you failed to provide fault tolerance in the domain controllers and global catalog servers that Exchange uses constantly. In each AD site where you have Exchange Server 2007 computers, have an appropriate number of domain controllers and global catalog servers. Implement redundancy, even if it means having an extra domain controller or global catalog server in an AD site. Deploy your domain controllers and global catalog servers on solid, reliable, fault-tolerant hardware. AD is your foundation; build it right. Define High Availability Solutions Based on Client Types and Client Loads Knowing how to build fault tolerance and redundancy into your Exchange Server 2007 com- puters and supporting services is only the first step in designing a highly available Exchange system. You also need to understand the various Exchange Server 2007 roles, how they oper- ate, and the appropriate method for adding redundancy or fault tolerance to each role. Implementing Redundancy for Hub Transport Servers Exchange Server 2007 breaks functionality into separate server roles. All message flow in Exchange Server 2007 requires the Hub Transport server role. Thus, if your Hub Trans- port server is down, then you cannot send messages to anyone: Not even to users on the same Exchange Server 2007 Mailbox server. Not even to users whose mailboxes are in the same mailbox database. Not even to yourself! Therefore, unless you are deploying Exchange Server 2007 on a single server in an environment that doesn’t require high avail- ability, you need redundancy for the Hub Transport server role. Hub Transport Redundancy within the Site More. That’s all it takes. Nothing fancy, nothing challenging. To provide redundancy for Hub Transport servers within an Active Directory (AD) site, you simply install more of them. 81461.book Page 49 Wednesday, December 12, 2007 4:49 PM 50 Chapter 2  Designing and Planning Server High Availability When a message is placed in a Mailbox server’s submission queue, the Mailbox server noti- fies a Hub Transport server in its AD site that the message is ready to be processed. If the Mail- box server doesn’t reach the first Hub Transport server it tries to contact, then it just tries another Hub Transport server in the same site, as shown in Figure 2.1. If the Mailbox server can’t reach any Hub Transport servers in the same AD site, then the message just sits in the submission queue until a Hub Transport server in the same AD site is available. You don’t need any clustering or load balancing to implement redundancy for the Hub Transport role. When you install a Hub Transport server, it is listed in AD and registered with Domain Name System (DNS) servers. When the Mail- box server needs to notify a Hub Transport server that a message is ready to process, it finds all of the registered Hub Transport servers in the same AD site. Thus, merely adding additional Hub Transport servers in each AD site increases the availability of the Hub Transport role. FIGURE 2.1 Hub Transport server redundancy Domain controller Query: Hub Transports in this site? Response: HT1, HT2 Mailbox server Notice: Message in submission queue Hub Transport server “HT1” Notice: Message in submission queue Hub Transport server “HT2” 1 2 3 4 81461.book Page 50 Wednesday, December 12, 2007 4:49 PM Define High Availability Solutions Based on Client Types and Client Loads 51 Hub Transport Redundancy between Sites Likewise, for site-to-site message-routing redundancy, you just need multiple Hub Transport servers in each AD site. If a Hub Transport server in one site needs to route a message to another site, then it retrieves the list of Hub Transport servers in the target site. If the first server on the list is unavailable, then the sending Hub Transport server just tries the next one on the list. If the second one isn’t available, it tries the next one and so on. If none of the Hub Transport servers in the target site are available (if, for example, the WAN link to that site is down), and if another route to that AD site is available for transferring mes- sages, then the sending Hub Transport server will attempt to route the message through an inter- mediary site. In that case, the sending Hub Transport server in the originating site retrieves the list of Hub Transport servers that exist in the intermediary site and tries to route the message to the first server on the list and, if that server is unavailable, then the sending Hub Transport server tries each listed server until it finds an available Hub Transport server or exhausts the list. If that happens, then the sending Hub Transport just looks for the next-higher-cost route to the original destination site. The list of Hub Transport servers in an AD site is delivered in round-robin fashion. That is, each time a computer requests the list of Hub Transport serv- ers for an AD site, the order of the list is rotated. For example, assume a site has four Hub Transport servers: Hub-A, Hub-B, Hub-C, and Hub-D. When the first request for Hub Transport servers is made, the list returned is “Hub-A, Hub-B, Hub-C, Hub-D.” The second time the list is requested, the response is “Hub-B, Hub-C, Hub-D, Hub-A.” For each subsequent request, the server pre- viously listed first is moved to the end of the list. This process provides an ele- mentary form of load distribution without requiring that the Hub Transport servers be configured for true load balancing. This concept is illustrated in Figure 2.2. Implementing Redundancy for Client Access Servers As with previous versions, Exchange Server 2007 supports a variety of clients. The preferred client is Microsoft Office Outlook 2007, but all versions of Outlook will work with Exchange Server 2007. Outlook relies upon the messaging application programming interface (MAPI). Other clients include Microsoft Office Outlook Web Access (OWA), which is a web-based cli- ent; any Internet client that uses Post Office Protocol 3 (POP 3) or Internet Message Access Protocol 4 (IMAP 4), such as Windows Mail and Outlook Express; and Windows Mobile cli- ents that use Exchange ActiveSync (EAS). In Exchange Server 2007, Client Access servers are required for any non-MAPI client. Thus, if you’re using any client other than Microsoft Office Outlook and the Client Access server fails, the non-Outlook users will be unable to access their mailboxes. Additionally, several Outlook 2007 features, such as Autosiscover and the Availability service, require the Client Access server as well. So, if the Client Access server fails, Outlook 2007 users may have difficulty using their mailboxes or using all features of Outlook. 81461.book Page 51 Wednesday, December 12, 2007 4:49 PM 52 Chapter 2  Designing and Planning Server High Availability FIGURE 2.2 Round-robin listing of Hub Transport servers Implementing redundancy for Client Access servers is a little more complicated than for Hub Transport servers, but not much. The first step is the same: install multiple servers in each AD site with a Mailbox server. However, the Client Access servers installed in each site should be load balanced. One option for load-balancing your Client Access servers is to use third- party load-balancing hardware. Another option is to implement Windows Network Load Balancing (NLB). NLB lets an administrator add a shared IP address to the network interface cards (NICs) of all members in the NLB cluster. Because, from the client perspective, all Client Access servers appear to be servers with identical content, NLB can be used for both high availability and scalability. Watch for the phrase “servers with identical content” whenever you take a Microsoft exam. Whenever you see these words, ask yourself, “Will NLB address this issue?” Most of the time you see that phrase, NLB is at least part of the correct answer. Active Directory site “Y” Mailbox server Response: Hub Y-2, Hub-Y3, Hub-Y1 Domain controller Hub-Y1 Hub-Y2 Hub-Y3 AD site link Active Directory site “X” Hub-X1 Hub-X2 Hub-X3 Query: Hub Transports in site “Y”? Response: Hub-Y1, Hub Y-2, Hub-Y3 Query: Hub Transports in site “Y”? 1 2 34 Mailbox server Domain controller 81461.book Page 52 Wednesday, December 12, 2007 4:49 PM Define High Availability Solutions Based on Client Types and Client Loads 53 Regardless of whether you select NLB or third-party load-balancing hard- ware, the Address (A) records that will be used to point to the Client Access servers should be pointed to the shared IP address. This goes for not just the names that users will type in the address bar of their web browsers for OWA and the server-name fields of other clients for POP3 or IMAP4, but also for the records that Outlook 2007 needs, such as the “autodiscover” record that is required for the Autodiscovery feature. Implementing Network Load Balancing NLB is supported on Windows 2000 Advanced Server, Windows 2000 Datacenter Server, and all editions of Window Server 2003. NLB is implemented at the NIC level. To implement NLB, you enable NLB in the properties of the NIC and configure the NLB properties, such as the shared IP address and the fully qualified domain name (FQDN) of the cluster, and the dedicated IP address this cluster member will use when communicating with other cluster members. All members of an NLB cluster must be a member of the same IP subnet. (The shared IP address must also be one of the IP addresses configured for the NIC in the IP properties.) Additionally, you should attach your NLB cluster members to a hub rather than a switch. Because switches filter packets based on media access control (MAC) address, it is highly possible that attaching your NLB cluster members to a switch would interfere with the proper filtering/forwarding decision for packets addressed to the virtual MAC address assigned to the shared IP address. Because hubs do not filter packets, connecting your NLB cluster members to a hub then connecting that hub to a switch eliminates this problem. An example of Client Access server configuration with NLB is shown in Figure 2.3. While you could use a virtual LAN (VLAN) to implement an NLB cluster by using cluster members that are in different physical locations, few Exchange deployments would benefit from such a configuration. Further, implementing an NLB cluster on the Internet-facing side of cluster members that reside in different locations and have different Internet connections would not load-balance across the Internet connections. Instead, all traffic would need to be routed through one of the Internet connections and then directed internally to the NLB cluster members in the other locations. Round-Robin DNS You could attempt to load-balance across Internet connections by using round-robin Address (A) records in DNS. In fact, some might suggest using round-robin records instead of NLB clustering for Client Access server high availability. While using round-robin for balancing across Internet connections is fine, using round-robin in place of NLB for Client Access servers in the same AD site is not preferred, for two reasons:  Round robin entries are rotated only by the authoritative DNS server; any DNS server that caches a round-robin response will provide the IP address list in the same order until the time to live (TTL) for the cached entry expires. 81461.book Page 53 Wednesday, December 12, 2007 4:49 PM 54 Chapter 2  Designing and Planning Server High Availability FIGURE 2.3 Client access servers and Network Load Balancing  Round-robin records do not truly balance load; instead, round-robin records, at best, bal- ance the initial contact, and they don’t take into account the variety of factors that can dis- rupt the balance, such as DNS caching and offline servers. NLB, does a somewhat better job of distributing load based on actual requests (as opposed to initial contact) and rebal- ances whenever cluster membership changes. Implementing Redundancy for Unified Messaging If you implement Unified Messaging, then you are using Exchange Server 2007 to manage phone calls, voicemail, and faxes. Thus, if your Unified Messaging server, or any other component, such as a Voice over IP (VoIP) gateway, fails, then your voice and fax services could be unavail- able. This scenario is arguably even worse than losing email. So, if you’re going to implement Unified Messaging, you must build redundancy into your Unified Messaging components. Fortunately, implementing redundancy in your Unified Messaging isn’t very difficult. First you should have multiple Unified Messaging servers in each site where you deploy Unified Messaging servers. But beyond that, you must have multiple paths for the calls to reach the Unified Messaging servers. This means you must have redundancy in your VoIP gateways. Switch Hub Zone file CAS A 192.168.0.10 CAS1 A 192.168.0.1 CAS2 A 192.168.0.2 DNS server Mailbox server Hub Transport server Client Access server Client Access server Unique: CAS1, 192.168.0.1 NLB: CAS, 192.168.0.10 Unique: CAS2, 192.168.0.2 NLB: CAS, 192.168.0.10 81461.book Page 54 Wednesday, December 12, 2007 4:49 PM Define High Availability Solutions Based on Client Types and Client Loads 55 In corporate phone systems, calls are typically delivered by trunk lines to a private branch exchange (PBX). A PBX is a device that works like a phone-company switching system but it is located in the corporate office and is often owned and managed by the business rather than the phone company. In traditional PBX phone systems, each office extension is directly wired to the PBX, and the PBX routes calls from extension to extension or between an external trunk line and an internal extension. In VoIP phone systems, extensions are not directly wired to a PBX but are, instead, config- ured as clients on an IP-based network. A VoIP gateway or hybrid IP-PBX device routes calls to extensions by using IP. PBX hunt groups are used to associate the PBX to a VoIP gateway. If you deploy multiple VoIP gateways, you can create multiple hunt groups to balance call volume between your VoIP gateways. VoIP gateways locate Unified Messaging servers by using dial plans . When trying to hand off a call, a VoIP gateway will try each Unified Messaging server in the dial plan until one accepts the call. If you’ve deployed multiple VoIP gateways, then configure a single dial plan on each VoIP, and configure each dial plan to include all available Unified Messaging servers. That way, your inbound calls will not be affected by the failure of either a Unified Messaging server or a VoIP gateway. This concept is illustrated in Figure 2.4. FIGURE 2.4 Full redundancy for Unified Messaging servers 1000 1000 Incoming call on trunk line PBX Hunt group Hunt group VoIP gateway Dial plan Unified Messaging server Unified Messaging server Hub Transport server Hub Transport server Dial plan Mailbox server VoIP gateway 81461.book Page 55 Wednesday, December 12, 2007 4:49 PM 56 Chapter 2  Designing and Planning Server High Availability Unified Messaging servers need to have high-speed, reliable connections to the VoIP gate- way, which, in turn, require high-speed, reliable connections to the PBX. While Unified Mes- saging servers require a connection to Mailbox servers, Unified Messaging servers do not necessarily require high-speed, reliable connections to all supported Mailbox servers. When users create their own custom prompts, such as a personalized voice mailbox greeting, those prompts are stored in the individual user mailboxes. If a Unified Messaging server is processing a call for a user, and the Unified Messaging server cannot access that user’s mailbox, then the Unified Mes- saging server will not have access to that user’s custom prompts and will, therefore, be required to use a default prompt instead. Implementing Redundancy for Mailbox Servers If all Hub Transport servers go down, no mail flows; but users can still get to the mailbox, so they can still read email that been received, check their calendars, and so forth. If all Client Access servers go down, then access through non-MAPI clients, such as OWA or EAS, is unavailable but users can still access their mailboxes by using Outlook. Failure of all Edge Transport servers affects mail flow only between the Exchange organization and the Internet, and failure of all Unified Messaging servers affects just that the Unified Messaging services. But when any Mailbox server fails, the users who have mailboxes on that server do not have access to any of their email, calendars, contacts, or anything else stored in the mailbox. Thus, the Mailbox server is clearly the most important role to make highly available. Redundancy Options for Mailbox Servers With previous versions of Exchange Server, Mailbox servers could be clustered to provide high availability. Clustered Mailbox servers required Windows Clustering, which relies upon a shared disk subsystem and expensive cluster-compatible hardware. This is still supported in Exchange Server 2007, but there are some new options as well. Let’s look at all of the options, starting with the traditional clustering. Single Copy Cluster Previously, Exchange Server supported both active/active and active/passive clustering. Active/ active clusters could contain only two nodes; in the event of a node failure, the remaining active node had to do all of the work of the failed node as well as all of its own work. Active/passive clus- ters, the preferred option, could contain up to eight nodes, one of which had to be passive and ready to take over if one of the active nodes failed. Exchange Server 2007 still supports traditional, shared-disk subsystem clustering. How- ever, only active/passive clustering is supported. In Exchange Server 2007, a traditional cluster is known as a single copy cluster (SCC). SCC still requires the expensive, specialized server hardware that Windows clustering has always needed, which means that it’s not necessarily the easiest option to configure for Mailbox high availability. An example of a three-node SCC clustered mailbox implementation is shown in Figure 2.5. 81461.book Page 56 Wednesday, December 12, 2007 4:49 PM Define High Availability Solutions Based on Client Types and Client Loads 57 FIGURE 2.5 Three-node single copy cluster (SCC) clustered Mailbox server Bear in mind that “single copy” doesn’t have to mean that there’s really only a single copy. Assuming that your shared storage relies upon a storage area network (SAN), you could employ SAN mirroring to ensure that you have a backup copy of the database in case the SAN is lost. There’s another option if you want clustered servers and redundant data storage. It’s called cluster continuous replication, and we’ll discuss shortly in the section that bears that name. However, first we’ll cover a data-redundancy option that requires only a single server. Local Continuous Replication In addition to SCC, Exchange Server 2007 offers two new options for Mailbox high availabil- ity: Local continuous replication and cluster continuous replication. Local continuous repli- cation (LCR) is a new feature of Exchange Server 2007, available in both Standard Edition and Enterprise Edition, that copies all transactions in a storage group to a backup-copy storage group on another volume on the same Exchange Server 2007 computer. When LCR is used, an administrator can quickly recover from a data-volume failure and nonreplicated database corruption by mounting the backup database in place of the original production database. When such an event occurs, the Exchange administrator must manually make the switch from Logs Database Cluster resource Logs Database Cluster resource Shared storage system Active Mailbox server Active Mailbox server Passive Mailbox server Private Network 81461.book Page 57 Wednesday, December 12, 2007 4:49 PM [...]... establish redundancy for Edge Transport servers … edge1 edge2 exchange2 007.tld exchange2 007.tld Zone file A 20 8 .21 5. 129 .147 A 20 8 .21 5. 129 .148 IN MX 10 edge1 .exchange2 007.tld IN MX 10 edge2 .exchange2 007.tld DNS server Mailbox server Hub Transport server Edge Transport server edge1 .exchange2 007.tld 20 8 .21 5. 129 .147 Edge Transport server edge2 .exchange2 007.tld 20 8 .21 5. 129 .148 Using multiple MX records is... servers Those servers block unwanted messages and scan all email for viruses before forwarding the remaining messages to your Exchange system This process is illustrated in Figure 2. 9 FIGURE 2. 9 Exchange Hosted Filtering example Zone file edge A exchange2 007.tld IN MX 10 exchange2 007.tld IN MX 10 exchange2 007.tld IN MX 10 20 8 .21 5. 129 .147 filter1 .exchange2 007.hst filter2 .exchange2 007.hst filter3 .exchange2 007.hst... Mbx1 and Mbx2 B Remove Exchange Server 20 03 from Mbx1 and Mbx2 C Perform an in-place upgrade to Exchange Server 20 07 on Mbx1 and Mbx2 D Install Exchange Server 20 07 on two additional servers E Configure Mbx1 and Mbx2 as an active/passive SCC cluster F 8 Configure Mbx1 and Mbx2 as an active/passive LCR cluster You are responsible for designing the storage group layout for your Exchange Server 20 07 Mailbox... B cas1 A IN A 1 92. 168.10.10 1 92. 168.10.10 C exchange2 007.local IN MX 10 cas2 exchange2 007.local D exchange2 007.local IN MX 10 cas3 exchange2 007.local 81461.book Page 75 Wednesday, December 12, 20 07 4:49 PM Review Questions 75 10 You are implementing high availability for your Exchange Server 20 07 organization Employees of your company access their mailboxes over the Internet by using Microsoft Office... filter3 .exchange2 007.hst Mailbox server Q ha MX uery ng f : e2 or 00 7 tld ”? “e 2 1 Hub Transport server xc fi fi lter R fil lter2 1.e es te e xc po r3 x ha n ex ch n se ch an ge2 : an ge 00 ge 20 7 20 07 hs 07 hs t h t st DNS server Edge Transport server edge .exchange2 007.tld 20 8 .21 5. 129 .147 Internet 4 Scanned/clean email message 3 Exchange hosted filtering servers Email message Sending email server filter1 .exchange2 007.hst... their Edge Transport servers and assign the same priority as the existing MX records E Disable RBL filtering on the Edge Transport server 20 You are responsible for message hygiene for your Exchange Server 20 07 organization When Exchange Server 20 07 was deployed, several of the antispam features of Exchange Server 20 07 were configured, and Microsoft Forefront Security for Exchange Server was installed... failure, and (2) additional servers must not be required Which of the following technologies should you configure for your Mailbox servers? A LCR B CCR C SCC D NLB E RAID 0 81461.book Page 74 Wednesday, December 12, 20 07 4:49 PM Chapter 2 74 7 Designing and Planning Server High Availability You are upgrading from Exchange Server 20 03 to Exchange Server 20 07 You currently have an active/active cluster of Exchange. .. high-availability Exchange Server 20 07 solution and your Mailbox server uses SCC or CCR as part of its high-availability strategy, then a minimum of four servers is required: the active Mailbox server; the passive Mailbox server; and a pair of redundant servers for the Hub Transport, Client Access, and, if used, the Unified Messaging roles And if your high-availability Exchange Server 20 07 organization design. .. filter1 .exchange2 007.hst filter2 .exchange2 007.hst filter3 .exchange2 007.hst Several third parties also offer similar hosted filtering services Anti-Malware Product Considerations Although Exchange Server 20 07 includes some very comprehensive antispam and antivirus features, you might elect to use third-party products along with or instead of the Microsoft 81461.book Page 69 Wednesday, December 12, 20 07 4:49... options Vendor reputation and technical support Exchange Server 20 07 integration and support Updates for Exchange Server 20 07 and Forefront Security products are delivered through Microsoft Updates You can ensure your Exchange Server 20 07 computers get these updates by configuring Automatic Updates, implementing Windows Server Update Services (WSUS), or using the Inventory Tool for Microsoft Updates (ITMU) . file edge2 .exchange2 007.tld 20 8 .21 5. 129 .148 … edge1 A 20 8 .21 5. 129 .147 edge2 A 20 8 .21 5. 129 .148 exchange2 007.tld IN MX 10 edge1 .exchange2 007.tld exchange2 007.tld IN MX 10 edge2 .exchange2 007.tld DNS server Mailbox server Hub. Transport server Edge Transport server Edge Transport server edge1 .exchange2 007.tld 20 8 .21 5. 129 .147 81461.book Page 63 Wednesday, December 12, 20 07 4:49 PM 64 Chapter 2  Designing and Planning Server. 12, 20 07 4:49 PM 52 Chapter 2  Designing and Planning Server High Availability FIGURE 2. 2 Round-robin listing of Hub Transport servers Implementing redundancy for Client Access servers