1. Small Business: Implementing GroupWise® 6
Novell BrainShare 2002
Small Business: Implementing GroupWise® 6
Eric Raff
Designated Support Engineer
Novell, Inc.
David Crowther
Novell Small Business Manager
TUT125—Small Business: Implementing GroupWise 6

3. Vision…one Net Mission
A world where networks of all types—corporate and public, intranets, extranets, and the Internet—work together as one Net and securely connect employees, customers, suppliers, and partners across organizational boundaries
Mission
To solve complex business and technical challenges with Net business solutions that enable people, processes, and systems to work together and our customers to profit from the opportunities of a networked world

5. Novell Small Business Suite 6: What Do You Get in the Box?
Novell BrainShare 2002
Novell Small Business Suite 6: What Do You Get in the Box?
NSBS 6 pulls together everything you need to make things happen
It’s a full-service bundle that instantly transforms your business into a fully-networked powerhouse
50-user
maximum
Two server licenses
NetWare® 6
ZENworks® for Desktops 3.2
Partner applications
BorderManager® 3.6
GroupWise® 6
NSBS 6 Sample Configuration
TUT125—Small Business: Implementing GroupWise 6

6. Novell Small Business Suite 6: What Do You Get in the Box? (cont.)
Novell NetWare® 6
Novell iFolder™ instant access to data from any location
iPrint—Internet printing
Native file access for Windows, Mac, and UNIX
NetWare Remote Manager and NetWare WebAccess
Novell eDirectory™
Two NetWare 6 server licenses in the box
Novell GroupWise® 6
, calendar, scheduling, and document management
Wireless device support
Novell ZENworks® for Desktops 3.2
Full version
App distribution, management, and recovery
Workstation imaging and inventory management
Novell BorderManager® Enterprise Edition 3.6
Firewall, proxy/cache, remote access
VPN services
Novell Small Business Tools and Enhancements
Simplified install
Novell Easy Administration Tool (NEAT)
Novell Internet Connection Expert (NICE)
Partner products
Tobit FaxWare
Electronic faxing from the desktop
Network Associates NetShield and VirusScan
Server and desktop virus detection and recovery
FatPipe Internet
Modem pooling for a faster Internet connection

7. Introduction High-level architecture of GroupWise®
GroupWise install and configuration
GroupWise Client install and configuration
Expanding a GroupWise system
GroupWise Internet Agent (GWIA) install and configuration
GroupWise WebAccess install and configuration
GroupWise Remote Access options
GroupWise tips and tricks
GroupWise best practices

8. High-Level Architecture of GroupWise
GroupWise is administered through ConsoleOne®
GroupWise maintains its own directory store
Directory store is fully replicated
Administration point is the Domain database (WPDOMAIN.DB)
GroupWise system components
Domain (WPDOMAIN.DB)
Message Transfer Agent (MTA)
Various gateways (GWIA, WebAccess, fax)
Post Office (WPHOST.DB)
Post Office Agent (POA)

9. Basic Layout of GroupWise System
Drop-down list acts as filter for domains, MTAs, post offices, POAs, gateways, libraries, distribution lists, resources, nicknames, and users
GroupWise Gateway (GWIA)
GroupWise Domain
GroupWise Post Office

10. GroupWise Client Install and Configuration
GroupWise 32-bit client runs on Windows platforms (Win95, 98, ME, NT 4, 2000, XP)
Install is initiated by running SETUP.EXE from Client\Win32 directory of the GroupWise software distribution directory (SDD)
Can be installed to local machine or run from a network location with minimal code on workstation
Auto Update Algorithm allows the client to automatically be updated when newer versions are released

11. GroupWise 6 Client Modes
Online
Data store is on server
Client has a persistent Client Server (C/S) connection to the Post Office Agent (POA)
Mail is sent and received immediately
Cache
Data store is on the local hard drive
Client does not maintain persistent connection
Implies that a connection is readily available to the POA
Mail is sent immediately, and received every ten minutes by default
Remote
Client is considered out of office
Mail is sent and received only when a send/receive is issued or scheduled
Connection options are Internet access or dial-up access

12. Switching Client Modes
Switching to or from online mode requires GroupWise client restart
Switching between Cache and Remote mode does not require restart
Tip: Cache and Remote can and should share the same message store
Drop-down list of available client modes

13. GroupWise Client Options
Allow administrator to set global settings that affect all users at the Domain, Post Office, or User level
Can be locked down by the administrator
Doing this prevents end users from modifying their client options
Are accessed by highlighting the Domain, Post Office, or User from the GroupWise View
Then right-click and select GroupWise Utilities|Client Options

14. Some Available Client Options
Environment
General—allow shared folder creation, check spelling before send, allow use of POP and IMAP accounts, etc.
Client Access—fill vs. limited licensed accounts, client access mode, etc.
File Location—archive path, custom views path
Cleanup—delete mail after X days, allow purge of items not backed up, etc.
Send
Sent options—wild card addressing, allow use of reply to all rules, allow use of “Internet Mail” tracking, etc.
Mail, Appointment, Task, Note—status tracking, sent items, etc.
Disk Space Management—limit size of mailbox, size of sent item
Date and Time
Calendar—include myself when sending appointment, month display options, work days, work schedule, show week number
Busy Search—days to search, range and time to search, etc.

15. Expanding a GroupWise System
Installing additional Domains and Post Offices
Installing GroupWise Internet Agent (GWIA)
Installing WebAccess gateway

16. Installing Secondary Domain and Post Office
Creating secondary domain provides level of fault tolerance
Add secondary domain to host various gateways in the GroupWise system
Review Link Configuration after domain is created and verify that domains communicate over TCP/IP
Create additional Post Offices for political as well as technical reasons
Verify that Post Office links are IP from both Domain and POA perspective
F10 | Configuration status from MTA
F10 | Message Transfer Status from POA

17. GroupWise Internet Agent (GWIA)
Provides the ability to send and receive Internet mail
Takes GroupWise proprietary formatted mail and converts it to SMTP format
Can then deliver mail to destination Internet host
Also takes inbound SMTP mail and brings it into the GroupWise system for delivery by the MTA and POA
Allows POP3 and IMAP4 clients to connect to it
Facilitates the retrieval of GroupWise from any POP3 or IMAP4–compliant client
Can act as an LDAP server to respond to LDAP requests
This allows LDAP clients to query GWIA to find names, phone numbers, and addresses of GroupWise users
Can run on either a NetWare or NT platform

18. Prerequisites to Installing GWIA
GroupWise Domain installed and functioning
Access to the Domain database from GWIA server
Access to Novell eDirectory™ while installing GWIA
Prerequisites to sending Internet mail
Dedicated Internet connection or dial-up access
Registered DNS name and IP address*
In-addr.arpa entry should exist for the domain name*
Prerequisites to receiving Internet mail
Registered DNS Name with corresponding Mail Exchange (MX) record(s)
* Not a must to send; must have in place if destination is doing reverse DNS lookups on sending SMTP server

19. Example of Mail Exchange Record
C:\>nslookup
Default Server: ns2.novell.com
Address:
> set type=mx
> novell.com
Server: ns2.novell.com
novell.com MX preference = 10, mail exchanger = prv2-mx.provo.novell.com
novell.com MX preference = 20, mail exchanger = cpl-mx.novell.nl
novell.com MX preference = 5, mail exchanger = prv-mx.provo.novell.com
novell.com MX preference = 5, mail exchanger = prv1-mx.provo.novell.com
novell.com nameserver = NS1.WESTNET.NET
novell.com nameserver = ns.novell.com
novell.com nameserver = NS.UTAH.EDU
prv2-mx.provo.novell.com internet address =
cpl-mx.novell.nl internet address =
prv-mx.provo.novell.com internet address =
prv1-mx.provo.novell.com internet address =
NS1.WESTNET.NET internet address =
ns.novell.com internet address =
NS.UTAH.EDU internet address =
>
From an NT class workstation you can issue the C:\nslookup command to perform a DNS lookup
Use this slide for large graphics
Tip: the command >server (name or IP of DNS server) points the query to a different DNS server

20. Internet Connectivity Options
In order for GWIA to send and receive Internet mail, it must be able to access the Internet
You have two options to this Internet connectivity
1. Always-on broadband connection (DSL, cable modem, ISDN, fractional T1, T1 line, etc.)
2. Dial-up access through an ISP

21. Broadband: Always-on Connection
Receive static IP address(s) from ISP
Can be assigned to the broadband firewall/router, then use Network Address Translation (NAT) to facilitate Internet connectivity from all machines in the network
Must set up a static NAT on firewall that will take all data on port 25 from the public address, and send it to the IP address of the server where GWIA is running
This IP address can be assigned to the NetWare server, which will act as the firewall for your organization
Register DNS Name that points to this static IP address
Enter an MX record for your registered Domain name

22. Dial-up Internet Access
Enter MX record with highest preference (lowest number) that points to static IP address that GWIA will use
When Internet connection is up, in-bound mail is sent directly to GWIA
Enter MX record with second-highest preference that points to ISP Extended TURN (ETRN) server
ISP will queue inbound mail for your company on their server when the GWIA is not up and active
Configure NetWare 6 server to dial ISP
Can use the NICE utility from within NEAT

23. Installing GWIA
GWIA is installed by running INSTALL.EXE from the GroupWise Software Distribution Directory\Internet\gwia directory
What is a Relay Host?
GWIA can be configured to use a Relay Host
A relay host is simply another SMTP agent to which GWIA will send all of its outbound Internet mail
Does not deliver mail to the recipient’s SMTP server, but simply hands everything to the Relay Host

24. Configuring Dial-up Settings
When using a dial-up connection to the ISP, you will need to configure the GWIA to use this dial-up session
Configure GWIA to connect to ETRN server under Dial-up Settings
Configure GWIA to send and receive via profiles under Scheduling
Configure GWIA to use /MH switch to send all outbound mail to ISP
Mail is received from ISP only when “Polling Interval” threshold is met

25. GWIA Scheduling Settings

26. GWIA will send mail only when any of the Queue Thresholds are met
GWIA Profile Settings
GWIA will send mail only when any of the Queue Thresholds are met
GWIA will retrieve mail only on the Polling Interval—not when a Queue Threshold is met and it dials to send

27. Access Control Options on GWIA
You can set up access control options on GWIA to limit what services are available (POP, IMAP, SMTP in and out) to a wide variety of users or groups
Properties of GWIA | Access Control | Settings is where these levels of access control are administered
Create profiles that contain the access
Associate users or groups to specific profiles

28. Access Control Settings Class of Service
Services that can be enabled or disabled
Exceptions to the membership of this profile

29. Antivirus Options for GroupWise
GroupWise message store is encrypted and compressed data
As of today, no product will find viruses in GroupWise message store
GroupWise Antivirus Agent (GWAVA)
Works at the MTA level only
Allows scanning of viruses between domains
Allows attachment type and size filtering
Guinevere
Works at the SMTP level
Allows all inbound and outbound Internet mail to be scanned via standard desktop antivirus software
Allows disclaimer to be added to all outbound Internet mail
Save all inbound and outbound mail for legal or archiving purposes
See February 2002 issue of NetWare Connect magazine for additional information

30. GroupWise WebAccess
A GroupWise gateway that allows users to access their GroupWise mailbox and documents from any browser
Supports many different devices and browsers, including cell phones, palm OS devices, Windows CE devices (iPaq, Jornada, etc.)
                              

31. Components of WebAccess
WebAccess application
Runs on a web server as a Java servlet
It is responsible for interacting with the various web browsers that are used to access the mailbox
Communicates with the WebAccess Agent
WebAccess Agent
Runs on NetWare or NT platforms
Is responsible for retrieving user’s mail from the message store and can be thought of as a “client”
Is responsible for rendering attachments when viewed from a browser

32. Installing WebAccess
Installing WebAccess on NetWare 6 requires a few manual steps
NetWare 6 uses the Apache Web Server with the Tomcat Servlet Engine by default
Procedure is outlined in Novell TID , Configuring GW6 SP1 WebAccess on Apache Web Server and the Tomcat Servlet Gateway

33. Configuring the WebAccess Application
After WebAccess application has been installed, you can administer it by going to the details of the eDirectory objects that were created during the install
These objects are located in the eDirectory Tree view and by default are created under the Domain object
Items of interest you can configure
Timeout value for WebAccess sessions
Log-out URL that users are sent to after logout

34. Configuring the WebAccess Agent
Select to view gateways from GroupWise view in ConsoleOne
Next, go to details of the WebAccess agent
Items that can be configured here
Number of threads the agent will use to process requests
Encryption key used to encrypt data sent between agent and application
Tip: if multiple agents have been installed, this encryption key must be the same for each agent
Access control settings
Can restrict who has access to the WebAccess gateway

35. Securing WebAccess
WebAccess must communicate with a browser of some sort
It may be desirable to encrypt this data with SSL encryption
To configure the Apache WebServer to use SSL you must edit the HTTPD.CONF file found in the SYS:\Apache\Conf directory
Look for the line
<IfModule mod_tls.c>
SecureListen 443 "SSL CertificateIP"
</IfModule>
This line tells Apache to use the certificate called SSL CertificateIP to encrypt all data across port 443
This is the name of the SSL certificate as found in your eDirectory Tree
Tip: it may be desirable to get a new SSL Certificate generated by a third party that is more universally accepted
See TID for how to import a third-party certificate

36. GroupWise Remote Access Options
POP3 access through GWIA
IMAP4 access through GWIA
Browser access through WebAccess
Remote/cache client access through Live Remote MTA
Remote/cache client access through Proxy Post Office

37. GroupWise 6 Tips and Tricks
After installing GWIA, check the send and receive SMTP threads and make sure they are adequate
Default to two send, four receive
Use GroupWise Diagnostics to view all information about GroupWise Objects
Helpful to identify the tie between GroupWise and eDirectory objects
Run GWCheck utility to find GroupWise accounts that have not been used in XX days
Action = Audit Report

38. GroupWise 6 Tips and Tricks (cont.)
Back up features and fault tolerance by running in cache mode in the GroupWise client
GroupWise Import Export utility can be used to export all users with FID
See TID
Enable LDAP authentication at POA level to facilitate and enforce password policies
Set up two rules on any GroupWise resources to automatically accept or decline appointments
See TID
If MAPI32.DLL is smaller than 621K, you are not running the full version of Windows Messaging

39. GroupWise 6 Best Practices
Develop and set up clean-up policies
Expire reduce items older than X days
Expire reduce items larger than X size
Set up scheduled maintenance operations
Structure check on user and message databases nightly
Contents check on user and message databases at one per week
Always try to use TCP/IP connections throughout the GroupWise system

40. GroupWise 6 Best Practices (cont.)
Enable Internet addressing on new installs of GroupWise
Do not scan domain or post office directories with antivirus software
GWAVA is the only solution that facilitates virus scanning inside the GroupWise system
Have users run in cache mode whenever possible
For more information
BrainShare session TUT224—GroupWise 6 Deployment and Best Practices