VMware ACE EN-000042-00 Use and care manual

ACE Management Server
Administrator’s Manual
VMware ACE 2.5

VMware, Inc.
3401 Hillview Ave.
Palo Alto, CA 94304
www.vmware.com
2VMware, Inc.
ACE Management Server Administrator’s Manual
You can find the most up-to-date technical documentation on the VMware Web site at:
http://www.vmware.com/support/
The VMware Web site also provides the latest product updates.
If you have comments about this documentation, submit your feedback to:
[e-mail]
© 2007, 2008 VMware, Inc. All rights reserved. Protected by one or more U.S. Patent Nos. 6,397,242,
6,496,847, 6,704,925, 6,711,672, 6,725,289, 6,735,601, 6,785,886, 6,789,156, 6,795,966, 6,880,022,
6,944,699, 6,961,806, 6,961,941, 7,069,413, 7,082,598, 7,089,377, 7,111,086, 7,111,145, 7,117,481,
7,149,843, 7,155,558, 7,222,221, 7,260,815, 7,260,820, 7,269,683, 7,275,136, 7,277,998, 7,277,999,
7,278,030, 7,281,102, 7,290,253, 7,356,679, 7,409,487, 7,412,492, 7,412,702, and 7,424,710; patents
pending.
VMware, the VMware “boxes” logo and design, Virtual SMP, and VMotion are registered trademarks or
trademarks of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names
mentioned herein may be trademarks of their respective companies.
ACE Management Server Administrator’s Manual
Item: EN-000042-00

VMware, Inc. 3
Contents
AboutThisBook 7
1Introduction 9
FeaturesofACEManagementServer 9
SystemRequirements 11
RequiredHardware 11
SupportedOperatingSystems 11
SupportedExternalDatabases 12
SupportedProxies 12
RequiredWebBrowsers 12
Licensing 12
2PlanninganACEManagementServerDeployment 13
DeploymentComponents 13
HostSystemOptions 15
WindowsHosts 15
LinuxHosts 15
ServerApplianceOption 15
DatabaseOptions 16
ActiveDirectoryAuthenticationOptions 17
PerformingCapacityPlanning 17
DatabaseThroughputandScalability 18
LDAPThroughput 18
NetworkBandwidthandPolicyUpdateFrequency 19
ACEPolicyConfiguration 20
LoadBalancers 20
SecurityFeaturesandConsiderations 20
UsingSSLCertificatesandProtocol 21
AccessingACEManagementServerfromOutsidetheCorporateFirewall 22
DeploymentPlanningWorksheet 24

ACE Management Server Administrator’s Manual
4VMware, Inc.
3InstallingandConfiguringACE Management Server 25
PreparingforInstallation 25
ConfigureTLSinYourBrowser 26
InstallingandUpgradingACEManagementServer 26
InstallanACEManagementServeronaWindowsHost 27
InstallACEManagementServeronaLinuxSystem 28
InstallanACEManagementServerAppliance 29
VerifyThattheApacheServiceIsStartedorRestarted 31
StartandConfigureACEManagementServer 33
LogIntoACEManagementServer 34
4ConfigurationOptionsforACEManagementServer 37
PrerequisitesforConfiguringtheServer 37
CreateUsersandGroupsforIntegrationwithActiveDirectory 38
SetUpanExternalDatabase 39
CreatingaSystemDSNEntryforanExternalDatabase 40
IncreasetheNumberofDatabaseConnectionsAllowed 42
EnableDatabaseConnectionPoolingonLinux 43
SetUpaConnectionBetweentheServerApplianceandanExternal
Database 43
PrepareCustomSecurityCertificates 44
ViewthePropertiesoftheSelf‐SignedCertificateFile 45
StartingACEManagementServerConfiguration 45
ViewingandChangingLicensingInformation 46
UsinganExternalDatabase 46
CreatingAccessControl 47
UploadingCustomSSLCertificates 48
LoggingEvents 49
ApplyingConfigurationSettings 50
5Load‐BalancingMultipleACEManagementServerInstances 51
TypicalSetupUsingLoad‐BalancedACEManagementServerInstances 52
InstalltheRequiredServicesforLoadBalancing 53
UsetheSameSSLCertificateonAllServers 53
CreateNewSSLCertificatesandKeysforEachServer 55
InstallingandConfiguringtheLoadBalancer 57
VerifyThatACEInstancesAreUsingtheLoadBalancer 57

VMware, Inc. 5
Contents
6ManagingACEInstances 59
ViewingACEInstancesThattheServerManages 60
UsetheVMwareACEHelpDeskApplication 60
UsetheInstanceViewinWorkstation 61
SearchforanInstance 62
SortbyColumnHeadingandChangeColumnWidth 63
Show,Hide,andMoveColumnsintheInstanceView 64
CreateorDeleteCustomColumnsintheInstanceView 64
ViewInstanceDetails 65
Reactivate,Deactivate,orDeleteanACEInstance 65
ChangeaCopyProtectionID 66
ResettheAuthenticationPassword 66
AddInformationforCustomColumns 67
7TroubleshootingandMaintenance 69
TroubleshootingConfigurationProblems 69
ConnectionProblemsBetweenaLinuxACEInstanceandACEManagement
Server 69
ChangethePortAssignmentforACEManagementServer 70
DeletetheServerConfigurationFileandSetaNewAdministrator
Password 71
RestoreaBackupCopyofanSSLCertificate 72
ConfiguringMultipleACEManagementServerInstancestoUseSSL 73
DatabaseBackup 74
Appendix:DatabaseSchemaandAuditEventLogData 75
UsingDatabaseReportingTools 75
DatabaseSchema 76
QueryingtheAuditEventLogData 81
Glossary 85
Index 89

ACE Management Server Administrator’s Manual
6VMware, Inc.

VMware, Inc. 7
Thismanual,theVMwareACEManagementServerAdministrator’sManual,provides
informationaboutinstallingandusingtheVMware®ACEManagementServer,which
enablesyoutomanageACEinstancesinrealtime.UsingACEManagementServeris
optional,butdoingsoprovidesthefollowingbenefits:
ManageactivationofACEpackages.
Manageauthenticationofthoseactivatedpackages.
DynamicallydeliverpolicyupdatestomanagedACEinstances.
DynamicallydeliverinstancecustomizationdataformanagedACEinstanceswith
Windowsguestoperatingsystems.
Intended Audience
Thisbookisintendedforanyonewhoneedstoinstall,upgrade,oruseACE
ManagementServertomanageACEinstances.ACEManagementServerisintended
forACEadministratorswhomustmaintainandupdateACEpoliciesusedonvirtual
machinesdeployedthroughoutanenterprise.
Document Feedback
VMwarewelcomesyoursuggestionsforimprovingourdocumentation.Ifyouhave
comments,sendyourfeedbackto:
[email protected]
About This Book

ACE Management Server Administrator’s Manual
8VMware, Inc.
Technical Support and Education Resources
Thefollowingsectionsdescribethetechnicalsupportresourcesavailabletoyou.
To accessthecurrentversionsofthisbookandotherbooks,goto:
http://www.vmware.com/support/pubs
Online and Telephone Support
Useonlinesupporttosubmittechnicalsupportrequests,viewyourproductand
contractinformation,andregisteryourproducts.Goto:
http://www.vmware.com/support
Customerswithappropriatesupportcontractsshouldusetelephonesupportforthe
fastestresponseonpriority1issues.Goto:
http://www.vmware.com/support/phone_support.html
Support Offerings
FindouthowVMwaresupportofferingscanhelpmeetyourbusinessneeds.Goto:
http://www.vmware.com/support/services
VMware Professional Services
VMwareEducationServicescoursesofferextensivehands‐onlabs,casestudy
examples,andcoursematerialsdesignedtobeusedason‐the‐jobreferencetools.
Coursesareavailableonsite,intheclassroom,andliveonline.Foronsitepilot
programs andimplementationbestpractices,VMwareConsultingServicesprovides
offeringsto helpyouassess,plan,build,andmanageyourvirtualenvironment.To
accessinformationabouteducationclasses,certificationprograms,andconsulting
services,goto:
http://www.vmware.com/services

VMware, Inc. 9
1
TheVMwareACEManagementServerenablesyoutomanageVMwareACEinstances,
todynamicallypublishpolicychangesforthoseinstances,andtotestanddeploy
packagesmoreeasily.
Thischapterincludesthefollowingtopics:
“FeaturesofACEManagementServer”onpage 9
“SystemRequirements”onpage 11
Features of ACE Management Server
ACEManagementServeroffersscalabilityandreliability:
Youcanincreasecapacitybyaddingnetworkresourcessuchasloadbalancersand
extraserverhardware.
Fortestingenvironments,thedefaultembeddedbackingstoreprovidesasimple
andefficientdatabasesolution.ToscaleACEManagementServerforproduction
deployments,youcanconfigureanduseanexternalrelationaldatabase
managementsystem(RDBMS).
InWindows,multithreadedprocesseshandleserverrequests.InLinux,multiple
processeshandleserverrequests.Ifoneprocessfails,anothertakesover.
ACEManagementServeroffersActiveDirectoryintegration:
YoucanuseActiveDirectorytoauthenticateusersofACEinstances.
YoudonotneedaschemachangeforyourexistingActiveDirectory.
LDAPisusedtoaccessActiveDirectory.
Introduction 1

ACE Management Server Administrator’s Manual
10 VMware, Inc.
InformationaboutWindowsdomainuseraccountstatesisprovidedinclearand
usefulmessages.Reasonsforloginfailuresarepresentedas“lockedout”or
“passwordexpired.”
ACEManagementServeractsasanActiveDirectorypasswordchangeproxy.
YoucanusetheinstancecustomizationfeatureinACEwithyourownestablished
namingconventionstoassociateuserswithmachines.
Securityfeaturesincludethefollowing:
EncryptedcommunicationsbetweenserverandclientstraveloverHTTPStraffic.
Passwordsarestoredsecurelyinhashedforminthebackingstore.
FlexibledatabaseoptionsallowuseofanembeddeddatabaseorexternalRDBMS
tostoreACEinstancedataandpolicies.
ACEManagementServeriseasytoinstallandconfigure.Clienttrafficcanbeproxied
byeasilyavailableproducts.Theserveruseseasilyavailablesoftwarecomponents:
ApacheWebserver2.0
ThedefaultSQLitedatabasestore
Theserversetupusesindustry‐standardprotocols:
HTTPSandLDAP
XML‐RPCformessageencapsulation
ACEManagementServeroffersextensibilityandavailability:
YoucancreateandusemorethanoneACEManagementServer.Whenyouuse
morethanoneserver,youcansettheserversupsothattheysharethesame
databaseforloadbalancingorincreasedfaulttolerance.
AWindowsACEManagementServercanbeonthesamesystemasWorkstation.
YoucandesignateasingleACEManagementServername,suchas
https://ace.policyserver.company.com,anduseDNSlookuptotranslate
thehostnametoanaddress.TheaddressiscachedifaDNSserverisnotavailable.
Additionally,youcanusedifferentACEManagementServerinstancesifusers
travelbetweenofficesindifferentgeographiclocations.
NOTEYourservernamemustbeeitherthemachinenameinEnglishorthe
IP address.Internationalcharactersarenotsupported.

VMware, Inc. 11
Chapter 1 Introduction
System Requirements
ThefollowingsectionsdescribetheACEManagementServersystemrequirements.
Required Hardware
Aminimumofan800MHz‐compatiblex86andx86‐64architectureprocessor
Compatibleprocessorsinclude:
Celeron,PentiumII,PentiumIII,Pentium4,PentiumM(includingcomputerswith
Centrinomobiletechnology),Xeon(includingPrestonia),AMD,Athlon,
Athlon MP,AthlonXP,Duron,Opteron,AMD64Opteron,andAthlon64
ExperimentalsupportforIntelIA‐32eCPU
40MBoffreespaceisrequiredforbasicinstallation.VMwarerecommendsatleast
10GBoffreediskspace.
An8‐bitdisplayadapterisrequired.
Forlocalareanetworking,anyEthernetcontrollerthattheoperatingsystem
supportsissufficient.
Supported Operating Systems
FollowingarethesupportedoperatingsystemsforACEManagementServer:
WindowsServer2003WebEditionSP1andSP2,WindowsServer2003Standard
EditionSP1andSP2,WindowsServer2003EnterpriseEditionSP1andSP2
(includes64‐bitandR2editions)
WindowsXPProfessional(includes64‐biteditions)
Windows2000ServerServicePack4andWindows2000AdvancedServerService
Pack 4
RedHatEnterpriseLinuxAdvancedServer4.0withUpdate 4.
SUSELinuxEnterpriseServer9ServicePack3

ACE Management Server Administrator’s Manual
12 VMware, Inc.
Supported External Databases
AnSQLitedatabaseengineisembeddedintheACEManagementServer.Althoughthis
databaseisadequatefortestingpurposes,useoneofthefollowingexternaldatabases
inproductionenvironments:
Windows‐basedservers–MicrosoftSQLServer2000orhigher;
Oracle Database 10g
IfyouuseaMicrosoftSQLServerdatabase,thedatabasemustbehostedona
systemthatusesthesamelocaleasthesystemthathostsACEManagementServer.
Forexample,ifACEManagementServerisinstalledonaJapanesesystem,the
databaseservermustalsobeinstalledonaJapanesesystemandmustuseJapanese
collation.
Linux‐basedservers–PostgreSQL7.4orhigher;RedHatEnterpriseLinux
AdvancedServer4.5orhigher.
Supported Proxies
YoucandeployACEManagementServerwiththefollowingHTTPSproxysolutions:
ApacheProxy–Usingmod_proxy
ZeusTechnologyLoadBalancer–Acommerciallyavailableloadbalancerand
trafficmanagementsolution
Required Web Browsers
Thebrowser‐basedACEManagementServerSetupapplicationandtheVMwareACE
HelpDeskapplicationrequireoneofthefollowingWebbrowsers:
MozillaFirefox1.52orhigher
InternetExplorer6.0orhigher
Licensing
YoumustconfiguretheserverandentertheserialnumberintheserversetupWeb
application.Ifyoudonot,youcannotconnecttotheserverinWorkstation.
Yourserialnumberisontheregistrationcardinyourpackage.Ifyoupurchased
VMwareACEonline,theserialnumberissentbyemail.WorkstationandACE
instancescannotconnecttoanACEManagementServerwithanexpiredornonexistent
license.

VMware, Inc. 13
2
ThischapterprovidesguidelinesfordeployingVMwareACEManagementServer
instances,includingcapacityplanningandbestpractices.Thischapterincludesthe
followingtopics:
“DeploymentComponents”onpage 13
“PerformingCapacityPlanning”onpage 17
“SecurityFeaturesandConsiderations”onpage 20
“A c c e s s i n g ACEManagementServerfromOutsidetheCorporateFirewall”on
page 22
“DeploymentPlanningWorksheet”onpage 24
Deployment Components
AtypicalACEManagementServerdeploymenthasthefollowingcomponents:
OneormoreACEManagementServerinstances–Configuringmultipleservers
tousethesamedatabaseincreasesthenumberofACEclientsyoucanmanageand
guaranteeshighavailability.
Databaseserver–Forproductiondeployments,VMwarerecommendsOracle
Database 10gorMS‐SQLforACEManagementServerinstalledonaWindows
host,andPostgresforACEManagementServerinstalledonaLinuxhost.
(Optional)ActiveDirectorydomaincontroller–ToenabletheACEManagement
ServerActiveDirectoryintegration,youmustconfigureACEManagementServer
tocommunicatewithyourdomaincontroller.
Planning an ACE
Management Server
Deployment 2

ACE Management Server Administrator’s Manual
14 VMware, Inc.
(Optional)HTTPloadbalancer–Usealoadbalancertohelpscalethecapacityof
yourACEManagementServerdeployment.
(Optional)HTTPproxy–IfclientswillaccessACEManagementServerfrom
outsidethecorporatefirewall,VMwarerecommendsusinganHTTPSproxyinthe
DMZ.YoucanuseACEManagementServerwithApacheProxyandZeus
TechnologyLoadBalancer.
ForanexampleofanACEManagementServerdeployment,seeFigure 2‐1.
Figure 2-1. Comprehensive ACE Management Server Deployment
ACEManagementServeroffersconvenienceandflexibilityinitssetupoptions.
YoucaninstalltheserveronWindowsorLinuxhosts.Fortestingpurposes,youcan
downloadandruntheserverasavirtualappliance.ACEManagementServerincludes
itsownsecuritycertificatesandembeddeddatabase,butyoucanuseanexternal
databaseandusecertificatesfromacertificateauthorityifyouprefer.Youcanalso
configureACEManagementServertouseActiveDirectoryforauthentication.
ACE Management Server
(one or more)
Active Directory
domain controlle
r
(optional)
database
server
proxy for ACE Management Server
service through corporate firewall
(optional)
WSAE client
(within
corporate
network)
load
balancer
(optional)
ACE Player client
(outside corporate network)
ACE Player client
(within
corporate
network)
LDAP
Kerberos
ODBC
HTTPS
HTTPS
HTTPS
HTTPSHTTPS

VMware, Inc. 15
Chapter 2 Planning an ACE Management Server Deployment
Host System Options
YoucaninstallACEManagementServeronaWindowshost,aLinuxhost,orasa
virtualappliance.IfyousetupmultipleACEManagementServerinstances,theymust
allbethesametype.
Windows Hosts
IfyouplantointegratewithActiveDirectory,VMwarerecommendsthatyouinstall
ACEManagementServeronaWindowshost.
TheWindowsACEManagementServerusestheWinLDAPlibrarybundledwithyour
WindowsoperatingsystemtointegratewithActiveDirectory.Internaltestingresults
indicatethattheWindowsimplementationprovidesbetterperformancethanLinux.
Linux Hosts
YoucaninstallACEManagementServeronaLinuxhostanduseActiveDirectoryfor
authentication,eventhoughperformanceisslowerthanonWindowshosts.Ifyouplan
touseaLinuxhostinproductionenvironments,usetheLinuxinstallerratherthanthe
ACEManagementServerappliance.IfyoudonothavethesupportedLinuxoperating
systemsinstalledonaphysicalserver,youcancreateavirtualmachine,installa
supportedLinuxoperatingsystem,andinstallACEManagementServerinthevirtual
machine.
Server Appliance Option
TheACEManagementServerapplianceisaself‐contained,preinstalled,and
preconfiguredACEManagementServerpackagedwithasmallLinuxoperating
systeminavirtualmachine.Theapplianceisconvenientandquicktosetupinatesting
environmentbutisnotrecommendedforproductionenvironments.
Bydefault,theapplianceattemptstoconfigureitsnetworkbyusingDHCP.Ifyoudo
notwanttouseDHCP,youcanusethebrowser‐basedACEManagementServerSetup
applicationtoconfigurethenetworksettings.Youcanusethesameinterfacetoupdate
theappliancewhenupdatesbecomeavailable.
YoumusthaveaccesstoaWebbrowser(Mozilla1.52orhigherorInternetExplorer6.0
orhigher)tochangenetworksettingsorobtainupdatesfortheappliance.

ACE Management Server Administrator’s Manual
16 VMware, Inc.
Database Options
ACEManagementServeroffersthefollowingdatabaseoptions:
EmbeddedSQLitedatabase–ThedefaultmodeofACEManagementServer
workswithanembeddedSQLite3databaseengine.TheSQLitedatabaseengineis
initializedduringserverinstallationandrequiresnospecialconfiguration.
The embeddeddatabasesupportsuptoseveralgigabytesofdata.
TheSQLitedatabaseisfilebasedandisnotdesignedtobeeffectivelysharedacross
multipleprocesses.Ifyouusethird‐partytoolstoaccessthedatabaseforaread
operation,therefore,youcannotdependontransactionalisolationofthepending
writeoperationsoftheACEManagementServer.
Theembeddeddatabaseisadequatefortestingpurposes,butVMware
recommendsthatyouuseanexternaldatabaseinproductionenvironments.
Supportedexternaldatabase–Inproductionenvironments,useasupported
externaldatabaseasabackingstoreforACEManagementServer,throughODBC
connectivity.Supportedexternaldatabaseenginesarethefollowing:
OnWindows,MicrosoftSQLServer(SQLServer2000orSQLServer2005)and
OracleDatabase10g
OnLinux,PostgreSQL7.4orhigher
UsinganexternaldatabasewithACEManagementServeroffersthefollowing
benefits:
OnlinebackupsothatyoudonothavetoshutdownACEManagementServer
tobackupthedatabase.
Enhancedsecuritymodel.Youcanfine‐tunepermissionstoaccesssensitive
data.TheSQLitedatabaseengineprovidesfile‐systembasedsecurity.
Performancefine‐tuning.
Abilitytouseexternaldatabasemanagementandreportingtools.
AbilitytouseloadbalancerswithmultipleACEManagementServer
instances.YoumustuseanexternalRDBMSasthebackingstore,becausethe
SQLitedatabaseisnotdesignedtobeeffectivelysharedacrossmultiple
processes.
NOTEIfACEManagementServerisdeployedintheDMZ,useanexternal
databaselocatedinsideyourcorporatenetworkbehindafirewall.

VMware, Inc. 17
Chapter 2 Planning an ACE Management Server Deployment
Active Directory Authentication Options
ActiveDirectoryintegrationprovidesthefollowingbenefits:
PermitsjoininganoperatingsystemthatisrunninganACEinstancetothedomain
remotely.
Providessearchfunctionssoyoucanquicklyfindaparticularindividualorgroup.
EnablesyoutouseActiveDirectoryUsersandGroupstoconfigurerole‐based
accesstothefeaturesofACEManagementServer.
Performing Capacity Planning
ACEManagementServerenablesyoutomanageACEinstancesandpoliciesinreal
time.ThenumberofclientsthatasingleACEManagementServercanservedepends
onseveralkeyfactors:
Databasethroughputandscalability
LDAPthroughput(ifyouareusingActiveDirectory)
Networkbandwidthavailableforincomingclientrequests
ACEpolicyconfiguration
Loadbalancersforverylargedeployments(morethan5,000clients)
Table 2‐1listsrecommendationsforthenumberofclientssupportedbasedonthe
hardwareyouareusing.Thefiguresforrecommendedclientsreservesomeserver
processingpowersothatinteractiveclientsreceiveresponsesinatimelyfashionand
theserversatisfiesincreasesindemand.
Table 2-1. Number of Clients Supported
Hardware Recommended Clients
2‐GHzAMD2‐wayserver(Opteron280,4GBRAM) 6,000
2‐GHzIntel2‐waydesktopmachine(4GBRAM) 4,000

ACE Management Server Administrator’s Manual
18 VMware, Inc.
Database Throughput and Scalability
Forproductiondeployments,VMwarerecommendsthatyouuseOracle,MS‐SQL,or
Postgresasyourdatabaseplatform.
Morethan95percentofthestoragespacethatanACEManagementServerrequiresis
usedtologeventinformation,whichisanaudittrailofalltransactionsperformed
throughACEManagementServer.Table 2‐2listsrecommendeddatabasesizesbased
onthenumberofclientsbeingserved.
Thefiguresinthetablearebasedona90‐daydatabasearchivalperiod.Backupthe
databaserecordsevery90daysandkeepeventlogsfor90days.YoucanconfigureACE
ManagementServertopurgeeventlogsevery90days.
Theauthenticationeventgeneratesmostofthedatabecauseaneventisgenerated
everytimesomeoneattemptstoauthenticatetoACEManagementServer.Youcan
configureACEManagementServertologlesseventinformation.See“LoggingEvents”
onpage 49.
LDAP Throughput
ACEManagementServercancommunicatewithyourActiveDirectorydomain
controllertoauthenticateusercredentials.Yourdomaincontrollerinfrastructure
handlestheLDAPtrafficrequiredtosupportthenumberofclientsthatyouanticipate.
IntegratingwithActiveDirectorythroughLDAPisimplementeddifferentlyinthe
WindowsACEManagementServerthanintheLinux‐basedACEManagementServer.
TheWindowsACEManagementServerusestheWinLDAPlibrarybundledwithyour
Windowsoperatingsystem.TheLinuxACEManagementServerusesathird‐party
KerberosLibraryandOpenSSL.VMwareinternaltestingresultsindicatethatthe
WindowsimplementationprovidesbetterperformancethanLinux.
Table 2-2. Database Storage Recommendations
Number of Clients Recommended Database Size
100 50Mb
1,000 500Mb
10,000 5,000Mb

VMware, Inc. 19
Chapter 2 Planning an ACE Management Server Deployment
Network Bandwidth and Policy Update Frequency
TheamountofnetworkbandwidththatACEManagementServerandACEinstances
requiredependsonthefrequencyofpolicyupdatesthatyouconfigure.Table 2‐3shows
theamountofbandwidthneededwhenyouuseapolicyupdatefrequencyvalueof
10 minutes.
VMwarerecommendsthatforlargedeployments(morethan5,000clients),you
increasethetimebetweenpolicyupdatesbyclientsbecausethisreducestheamountof
requiredbandwidth.
Table 2‐4showsthebandwidthneededwhenthepolicyupdatefrequencyvalueisset
to30minutes.
Theamountofnetworkbandwidthrequiredcanalsobehigherifyourpolicysetisvery
complex.
VMwarerecommendsthatyouhaveaseparatenetworklinkbetweenACE
ManagementServerandyourdatabaseserver,sothattrafficcomingandgoingfrom
ACEManagementServertoitsclientsdoesnotinterferewiththetraffictoandfrom
yourdatabaseserver.
Table 2-3. Network Bandwidth Required with a Policy Update Frequency of 10 Minutes
Number of Clients Bandwidth Required
100 0.125Mb/sec.
1,000 1.25Mb/sec.
10,000 12.5Mb/sec.
Table 2-4. Network Bandwidth Required with a Policy Update Frequency of 30 Minutes
Number of Clients Bandwidth Required
100 0.04Mb/sec.
1,000 0.4Mb/sec.
10,000 4Mb/sec.

ACE Management Server Administrator’s Manual
20 VMware, Inc.
ACE Policy Configuration
TheconfigurationofACEpoliciescanaffectperformance.Youcanincreasetheamount
ofdatathatistransferredbetweenACEManagementServerandACEPlayerbyusing
oneofthefollowingmethods:
Hostpolicies–Enablinghostpolicies(suchashostnetworkquarantine)requiresthat
ahost‐sidedaemonretrievesthehostpoliciesfromtheACEManagementServer.
Complexnetworkquarantinepolicies–Ifthesetofrulesthatmakesupyour
networkquarantineisverylarge,thetransferoftheserulesfromtheACE
ManagementServertotheclientscanaffectthescalability.
ThenumbersshowninTable 2‐3andTable 2‐4areestimatesofrequired
bandwidthgivenaverage‐sizerulesetsfornetworkquarantine.Youcanviewthe
sizeofyourpolicysetbyexaminingtheACEfiledirectoryandcountingthesize
ofthe.vmplfile.Anaveragepolicysetis15KBorless.
Load Balancers
TheACEManagementServerclient‐serverprotocolisbuiltontopoftheHTTPS
protocol.YoucanuseHTTPload‐balancingsoftwareandhardwaresolutionstoscale
anACEManagementServerdeploymentbeyondthecapacityofasingleserver(orfor
high‐availabilitydeployments).
ACEManagementServerscalesinalinearfashionwhenanenterprise‐gradeHTTPS
loadbalancerisused.SeeChapter 5,“Load‐BalancingMultipleACEManagement
ServerInstances,”onpage 51.
Security Features and Considerations
Bydefault,ACEManagementServerusestheSecureSocketsLayer(SSL)protocolto
provideencryptedandsecurecommunications.
Followingisanoverviewofsecurityfeaturesandrecommendationsonhowto
configuretheACEManagementServertoavoidsecurityproblems:
TraffictoandfromclientsisprotectedbyHTTPS–Bydefault,ACEManagement
Servercreatesaself‐signedcertificatewhenyouinstallittouseforHTTPStraffic.
Thesecertificatesaresecure,butyoucanalsoconfigureACEManagementServer
touseyourowncertificateandkeypairs.
TrafficfromACEManagementServertoActiveDirectoryisencrypted–Ifthe
serverisintegratedwithanActiveDirectoryservice,itcommunicateswiththeservice
throughanSSL‐protectedlink.LDAPtrafficisencryptedattheapplicationlayer.
CredentialsareprotectedbyusingtheKerberosprotocoltoauthenticatecredentials.