Configuring EMS HA

To configure EMS HA:

1. Install SQL Server Management Studio on EMS-1 and EMS-2. This is necessary to create a SQL user later in the configuration process. It is also useful to test database connectivity prior to the installation.
2. From any server that can connect to the newly created database, log in to the database using SQL Server Management Studio. Use the credentials that you configured in Configuring Microsoft SQL database clustering. The example also uses EMS-1 to test connectivity.
3. Create a SQL user:
   1. In Object Explorer, right-click Logins, then select New Login.
   2. Select SQL Server authentication.
   3. Enter the desired password.
   4. Deselect Enforce password policy.
   5. On the Server Roles page, select sysadmin. Click OK.
4. In Object Server, right-click the SQL server, then select Properties.
5. On the Security page, under Server authentication, select SQL Server and Windows Authentication mode. Click OK.
6. EMS 7.2 does not rely on FILESTREAM for file synchronization between EMS nodes. Instead, it uses network share. For information on this change, see Differences between network share and FILESTREAM. Install EMS:
   1. Create and share a folder on the network. This file share is used to share files between EMS nodes. All EMS nodes should be able to access the file share. During EMS installation, the installer mounts the file share as the W:\ drive. Ensure that the W:\ drive is free on all EMS nodes. The recommended disk size for network share depends on the number of FortiClient installers that are uploaded at a time.

   2. You must disable Network access: Do not allow storage of passwords and credentials for network authentication in Local Group Policy Editor. Otherwise, it causes installation issues. Do the following on both EMS nodes:

      1. Open Local Group Policy Editor.
      2. Go to Local Computer Policy > Windows Settings > Security Settings > Local Policies > Security Options.
      3. Double-click Network access: Do not allow storage of passwords and credentials for network authentication.
      4. Select Disabled, then click OK.
   3. On EMS-1, open Command Prompt as an administrator.
   4. Run the following command:

      FortiClientEndpointManagementServer_7.2.4.0983_x64.exe SQLServer=DBVIP SQLUser=emsha SQLUserPassword=123456789 InstallSQL=0 ScriptDB=1 FileStorageNic=\\Server\fileshare FileStorageNicUser=LAB\administrator FileStorageNicPass=Admin123! BackupDir=\\EMS-1\backup DBInitialSize=31MB DBInitialLogSize=4MB DBGrowth=11MB DBLogGrowth=11% DBLoginTimeout=31 DBQueryTimeout=61

      Parameter	Description
      ScriptDB=1	Specifies that this is the primary active server.
      BackupDir	Configured to \\EMS-1\backup, which is a locally shared folder on EMS-1. EMS and the SQL service user must have read/write/modify permissions to this folder.
      FileStorageNic	Fileshare path.
      FileStorageNicUser	Username for account with read/write/modify permissions to the shared folder.
      FileStorageNicPass	Password for account with read/write/modify permissions to the shared folder.

      The following is an example of the command when using a named SQL instance. In this example, the SQL instance is EMSNAMED: FortiClientEndpointManagementServer_7.2.4.0983_x64.exe SQLServer=DBVIP\EMSNAMED SQLUser=emsha SQLUserPassword=123456789 InstallSQL=0 ScriptDB=1 FileStorageNic=\\Server\fileshare FileStorageNicUser=LAB\administrator FileStorageNicPass=Admin123! BackupDir=\\EMS-1\backup DBInitialSize=31MB DBInitialLogSize=4MB DBGrowth=11MB DBLogGrowth=11% DBLoginTimeout=31 DBQueryTimeout=61

   5. On EMS-2, open Command Prompt as an administrator. Run the following command:

      You must use a unique backup directory for each EMS node. The following shows BackupDir values for an example HA configuration with one primary (EMS 1) and two secondary EMS nodes (EMS 2 and 3): Primary (EMS 1): BackupDir=\\EMS-1\backup Secondary (EMS 2): BackupDir=\\EMS-2\backup Secondary (EMS 3): BackupDir=\\EMS-3\backup All EMS nodes share the same FileStorageNic.

      FortiClientEndpointManagementServer_7.2.4.0983_x64.exe SQLServer=DBVIP SQLUser=emsha SQLUserPassword=123456789 InstallSQL=0 ScriptDB=0 FileStorageNic=\\Server\fileshare FileStorageNicUser=LAB\administrator FileStorageNicPass=Admin123! BackupDir=\\EMS-2\backup DBInitialSize=31MB DBInitialLogSize=4MB DBGrowth=11MB DBLogGrowth=11% DBLoginTimeout=31 DBQueryTimeout=61

      Parameter	Description
      ScriptDB=0	Indicates the upgrade does not execute scripts to upgrade the database because you upgraded the database in step c.
      BackupDir	Configured to \\EMS-2\backup, which is a locally shared folder on EMS-2. EMS and the SQL service user must have read/write/modify permissions to this folder.
      FileStorageNic	Fileshare path.
      FileStorageNicUser	Username for account with read/write/modify permissions to the shared folder.
      FileStorageNicPass	Password for account with read/write/modify permissions to the shared folder.

      The following is an example of the command when using a named SQL instance. In this example, the SQL instance is EMSNAMED:

      FortiClientEndpointManagementServer_7.2.4.0983_x64.exe SQLServer=DBVIP\EMSNAMED SQLUser=emsha SQLUserPassword=123456789 InstallSQL=0 ScriptDB=0 FileStorageNic=\\Server\fileshare FileStorageNicUser=LAB\administrator FileStorageNicPass=Admin123! BackupDir=\\EMS-2\backup DBInitialSize=31MB DBInitialLogSize=4MB DBGrowth=11MB DBLogGrowth=11% DBLoginTimeout=31 DBQueryTimeout=61

7. Configure EMS:
   1. Log in to EMS on the primary server, EMS-1.
   2. Go to Dashboard > Status > License Information widget > Configure License.
   3. For License Source, select File Upload.
   4. Click Browse and locate the license key file.
   5. Click Upload. The license is automatically synchronized to EMS-2. You do not need to upload two licenses.

      

   6. Go to System Settings > EMS Settings. Enable Remote HTTPS access.
   7. In the FQDN field, enter the FQDN based on the A record that you created in Configuring Active Directory and DNS settings. These settings will be synchronized to EMS-2.
8. If desired, generate installers from EMS-1 to autopopulate the EMS server address. If you have a separate installer, enter the EMS FQDN when registering FortiClient to EMS.

   

9. Stop EMS services on EMS-1 to test the failover.