1

Migration to IBM SmartCloud Notes Guidance on Migration Strategies and Tooling from On-Premises Mail Solution to SmartCloud Notes

December 2015

2

Table of Contents

PART 1 - INTRODUCTION 4

INTENDED AUDIENCE 4

PART 2 - HYBRID IMPLEMENTATION & CONFIGURATION 5

SMARTCLOUD NOTES HYBRID REFERENCE ARCHITECTURE 5 KEY VALUE PROPOSITIONS OF HYBRID CONFIGURATION 6 COMMON SMARTCLOUD NOTES HYBRID CONFIGURATION 7 SETTING UP THE HYBRID CONFIGURATION 12

PART 3 - HYBRID ACTIVATION & TESTING 16

SMARTCLOUD NOTES HYBRID ACCOUNT ACTIVATION 16 SMARTCLOUD NOTES HYBRID VALIDATION & TESTING 17 SMARTCLOUD NOTES ADMINISTRATION USER ACCOUNTS AND SYSTEM SETTINGS 18 PART 4 - USER/DATA TRANSITION & PROVISIONING OVERVIEW 22 ASSESSMENT, PLANNING & PREPARATION 22 PREPARING FOR USER/DATA TRANSITION 26 USER/DATA TRANSITION PROCESS 27

PART 5 - STAGING SERVER & FILEZILLA SETUP 34 ABOUT THE STAGING SERVER & TOOLS 34 CREATING & CONFIGURING OPT STEPS 35

PART 6 - CONFIGURING OTT DATABASE/SHELL SCRIPTS 36 CREATING & CONFIGURING OTT STEPS 36

PART 7 - REVIEWING OTT CONFIGURATION DOCUMENTS 37 STEP CONFIGURATION DOCUMENTS 37 TASK CONFIGURATION DOCUMENTS 39 MEMO CONFIGURATION DOCUMENTS 40

PART 8 - SCANNING, USER GROUPING & DATA CAPTURE 41 SCANNING THE EXISTING ENVIRONMENT 41 CREATING GROUPS & BATCHES OF USERS 42 CREATING THE IMPORT REQUEST 44 CAPTURING THE MAIL DATABASE REPLICAS 45

PART 9 - ENCRYPT, UPLOAD, IMPORT & PROVISION USERS 47 ENCRYPTING THE DATA FOR TRANSFER 47 UPLOADING THE ENCRYPTED DATA TO SMARTCLOUD NOTES 48 PREPARING UPLOADED DATA & PROVISIONING ACCOUNTS 49 PROVISIONING NEW USER ACCOUNTS 52

3

PART 10 - MAIL ONBOARDING MANAGER (MOM) 53 WHAT IS MOM? 53 MOM ARCHITECTURE 53 MOM CONSIDERATIONS 54 INSTALLATION & SETUP 54 DOWNLOAD MOM 62 LINK TO MOM DEMO 62

PART 11 - SMARTCLOUD UPGRADE FACTORY (SCUF) 63 WHY USE SCUF? 63 PRICING & HOW IT WORKS 64 CUSTOMER ROLES & RESPONSIBILTIES 65 PREREQUISITES 66

PART 12 - COMPARING MIGRATION OPTION & PROCESSES 67 WHEN TO USE SMARTCLOUD NOTES SERVICE-ONLY 67 WHEN TO USE SMARTCLOUD NOTES HYBRID 68 WHY USE OPT/OTT? 68 WHY USE MOM? 69 WHEN TO USE WHAT MIGRATION TOOL 69 MIGRATION PROCESS 71

4

Part 1 - Introduction With the emergence of Connections Cloud, companies are having renewed interest in evaluation of their messaging and social platforms. The ability to provide onboarding capabilities for companies to migrate to SmartCloud Notes is critical for technology adoption. This document will explore strategies for migration to SmartCloud Notes from an on premises mail solution exploring several options. It will provide guidance on the type of migration strategies customers should consider, how to assess, plan and prepare to before migrating, and specific capabilities required before and during migration. Topics such as implementing, configuring, activating, testing, transitioning, provisioning, staging, reviewing, scanning, grouping, encrypting, uploading, importing and comparing will be discussed.

Intended Audience We understand that information already exists but not in a single source document. It is designed to assist technical practitioners with the migration of mail from an on premises mail solution to SmartCloud Notes. The various methods and options can be evaluated and utilized by practitioners to create the best scenario for a customer. Each section of the document highlights important topics for migration. A solid understanding of the existing Domino cloud migrations and a fundamental Domino administration is key. The following highlights the intended audience:

Certified Practitioners - Technical practitioners who are certified to use the OPT/OTT, MOM and migration tooling for SmartCloud Notes should review this document. This can include Business Partners and Technical Services professionals.

Technical Sales – Technical sales professionals who require a deep understanding of the steps to migrate customers wishing to move to SmartCloud Notes.

IBM Business Partners wishing to better understand the opportunity and process for migration of on premises mail to SmartCloud Notes.

Customers wishing to gain knowledge about all the available options in order to choose the best method for their situation.

5

Part 2 - Hybrid Implementation & Configuration

Below is a logical diagram that illustrates the main components of the SmartCloud Notes

service and their placement relative to various network zones.

Figure 1 - SmartCloud Notes "Hybrid" Reference Architecture

The diagram in Figure 1 is called the “SmartCloud Notes Hybrid Reference

Architecture”. It is a logical diagram that illustrates the main components of the

SmartCloud Notes service and their placement relative to various network zones.

The red zone at the top contains all clients, mobile devices, and servers (including

customer networks) that might want to connect to SCN. These are all items that SCN

service does not manage and exist outside of our external firewall.

The yellow zone is the traditional DMZ, through which only authenticated users and

clients can pass, so it includes the authentication services.

The green zone contains the servers that make up the SCN service. This includes SMTP

and NRPC routing servers, BES and Traveler servers for mobile device support. Users

are hosted on 5-node Domino clusters, with each user having a replica on 2 nodes in a

cluster. Clusters are horizontally scalable to increase capacity as necessary.

6

Directory services are provided by Tivoli Directory Server and a synchronization service

is provided to ensure that TDS and customer directory replicas remain consistent.

Import servers are used as a temporary storage for existing mail databases being migrated

into the service where they can be scanned for virus and prepared for provisioning.

Hybrid refers to a specific configuration of the SmartCloud Notes customer account

within the service that allows existing IBM® Domino® customers to integrate the on-

premises environment and is a core strength and value proposition.

The customer Admin can choose if the mail users mail account exists on-premises or in

the SmartCloud Notes service.

Customers select the “Hybrid Environment” option when performing initial setup.

Key Value Propositions

– Customers can keep current environment

– Supports IBM® Notes®, browser, IMAP and mobile clients

– Users don't need to care who is Hosted or On-Premises

– Maintains the existing certificate hierarchy and domain structure

– Supports native NRPC mail routing

– No change required to continue accessing existing applications

– Existing mail databases can be transitioned in their entirety or with a selected

subset of data

Version requirements for on-premise Domino servers:

Figure 2 - Domino version requirements

7

"Hybrid" Basic Architecture

Most suitable for implementations where HA is not a requirement (e.g. pilot or smaller

customer implementations)

Figure 3 - Hybrid Basic Architecture

This simplest implementation above has a single on-premises domain, containing at least

one existing Domino server and uses a single passthru server for inbound connectivity.

The passthru server may even already exist for some customers so it is just a case of

validating server versions and doing the configuration.

8

"Hybrid" - High Availability Implementation

Figure 4 - Hybrid High Availability Implementation

The diagram in Figure 4 shows that the SCN configuration supports having up to 2 server

for each of the passthru, mail routing and directory replication servers. This provides a

more highly available integration.

Each pair of servers are designated as a primary and secondary in an active / passive

model. If the primary is not available the secondary is used; there is no load balancing of

connections or requests across the servers.

9

"Hybrid" - Multiple Domain Architecture

Figure 5 - Hybrid Multiple Domain Architecture

– Multiple Domino domains

– One domain designated as primary through which hybrid connectivity from

SmartCloud Notes is achieved

– Other domains become subordinates in the context of mail routing, free-time

lookup and directory replication

– Directory updates from downstream domains are replicated via the directory

replication hubs in primary domain

– Each domain is responsible to independently route mail directly to the

SmartCloud Notes service.

– Note: Once the account is configured for the primary domain the customer creates

group / connection documents for each additional domain in their environment.

10

"Hybrid" - Multiple Data Center Implementation

Suitable for large customers who have infrastructure in more than one data center.

Figure 6 - Multiple Data Center Implementation

– Single Domino domain

– Pair of customer data centers

– Pair of passthru servers (primary in one data center and secondary in the other

data center)

– Separate mail routing and directory replication hub servers in each data center

– Provides for both a level of local (within data center) resilience and DR

protection in the event of data center failure

Should the primary data center or the servers in it be unreachable for any reason, the SCN

service will connect via the secondary data center instead.

This assumes that in the back end on-premises environment, directories replicate and

mail routes appropriately between the data centers.

11

"Hybrid" - 'SHIM' Domain between SCN & Existing Domains

Figure 7 - SHIM Domain between SmartCloud Notes & Existing Domains

– Hybrid “shim” domain inserted between SCN and multiple other existing

domains

– Existing domains are all subordinate (route mail and replicate directory through)

the “shim” domain

– Single passthru server (a second could be added for failover)

– Separate mail routing and directory replication hub servers

For customers who have many on-premises domains, especially if they are chains of non-

adjacent domains, that means directory replication and mail routing has to propagate

through those domains.

To be able to flatten the directory replication and mail routing topology to make each

domain logically closer to SCN, a domain can be inserted to host the directory and mail

routing servers.

Since it is inserted between SCN and the existing domains we call it a “shim” domain. It

can then be configured to replicate and route mail with each other domain effectively

only one hop away.

12

"Hybrid" - Leveraging Infrastructure-as-a-Service (IAAS) for Domino Applications

Figure 8 - Hybrid Leveraging Infrastructure-as-a-Service (IAAS) for Domino Apps

– Single Domino domain

– Single passthru server

– Single combined Domino mail routing and directory replication server

– Domino application and “hybrid” integration servers (like passthru) hosted on

IBM SoftLayer or other IaaS providers

– No Domino servers on customer network

– Note: Customer DMZ and optional SoftLayer firewalls not shown

Setting Up Hybrid Configuration

Many customers want to remove all infrastructure from their networks, but hybrid is

designed to connect to existing environment where application servers might remain.

A customer can make use of services such as IBM SoftLayer IaaS or more traditional

partner hosting models to support those non-SCN servers.

Provided there is connectivity between SCN and where the servers reside, and between

the network and the servers for client access, the hybrid solution will function fine.

13

Firewall rules are an important part of the correct functioning of the SCN

implementation. Follow the rules to ensure firewall configurations allow for proper

traffic flow while minimizing risk of network attacks.

Create the company account for Connections Cloud. The customer needs to provide the

name of their organization and contact information for the initial administrator account.

Select Hybrid Environment. The first choice an administrator makes is whether or not

they want to set up the SCN account as “hybrid”. For an existing Domino customer, to

set up in hybrid mode, they check the box and confirm their choice.

Initially, the account setup page will display a set of 5 steps marked in red with a warning

triangle. It simply means that the information required for each of those configuration

items has not yet been provided.

Run the pre-configuration test tool to see that the existing environment is in good shape

to proceed.

Enter server details and click Run Test to test configuration. Fill out the relevant

information based on what servers are being used in what roles, which directories are to

be synchronized, etc.

The output of the test can be viewed immediately on the screen. This output is also

written to a file called liveserverconfig.log in the Notes client data directory on the

workstation where the tool is run. Inspect the output and look for any reported problems.

Create Server OU Certifier for Connections Cloud Virtual Server Name Registration.

Configure a Directory Sync Server. Provide at least one domino server and directory file

name. Do not check the box that says “Do not use this Domino Directory for

provisioning” or you will not be able to select users in the directory for provisioning later.

This should only be selected if the directory being configured is an extended directory

catalog.

After saving the configuration, the sync status will show “Error”. This is not a problem at

this time as we have not yet told Connections Cloud or the on-premises Domino

environment how to connect with each other.

Configure the Mail Routing Hub. Provide at least one domino server and domain name.

Configure virtual mail server common name. Provide a base common name to be used

for virtual server name creation. The mail server base name is used to generate all of the

common names for the virtual mail servers in Connection Cloud for the account.

14

Configure the Passthru server. The Passthru server must use an IP Address that is

routable from the internet. Enter at least one domino Passthru sever, hostname and

associated domino domain name.

*Note - We recommend using a host name rather than IP address in the middle field

so that any changes in IP address can be done in DNS rather than having to

remember to edit this configuration.

Upload Certifier ID that will be used to create virtual server identities. You must not

upload a certifier that is already used in the on-premises environment.

Confirm all information entered and click "Enable My Account" to prepare for directory

synchronization and activation.

Prepare for account activation. Click "Download Configuration Tool" to download the

tool. The account setup page will indicate 2 new outstanding steps with the red warning

triangle. This indicates the steps have not been done yet, not that there are any problems.

When downloading the NSF, save it to the workstation file system before opening it in

the Notes client.

Note: Administrator and remote console access are required to run this tool. If you

make any configuration changes, you must download and re-run the tool again.

The domain configuration tool has 3 modes of operation.

1. Begin pre-configuration test (reports back on the state of the on-premises)

2. Begin configuration report (perform a dry run...no actual changes are made)

3. Configure servers (update the on-premises server configurations)

Domain Configuration Tool Results - Log file

Clicking the View log file button in the configuration tool will display contents of the log

file.

liveServerConfig.log file is stored in the data directory of the client used to run the

database.

It is useful to keep copies of the log files when the configuration tool is run as historical

documentation of what was configured and when. It also a great source of information

for troubleshooting purposes.

Confirm SCN server are connecting to the Passthru server. Look for sessions containing

virtual server names from the service and of type PASSTHRU.

Confirm SCN servers are connecting to Mail Routing/Directory server(s). Sessions for

SCN virtual servers representing the directory sync service means that SCN is

successfully accessing the server via Passthru.

Directory Sync Status. If the SCN service is connected to the directory server and can

access the directory, the status should be reported as OK.

15

If not there will be an error status and clicking on the directory server name will display

more details about the problem.

After running the Domain Configuration Tool the service should be able to connect to

perform the initial directory synchronization process. The SCN account setup page will

indicate that step is complete and that the Internet domain verification is still not done.

Click on Internet Domain Verification to confirm that your Internet domain is ready to

be validated. The service performs domain name verification to prevent abuse of

SmartCloud Notes accounts and requires you to create a CNAME record to prove

ownership of a domain.

16

Part 3 - Hybrid Activation and Testing

Account Activation

– Go to the Account Setup page

– Click the Activate My Account button to complete initial hybrid setup

Looking at your account setup now, you should see both directory sync and domain

ownership steps are complete, as signified with the green check.

You should also now see that an “Activate My Account” button has appeared if both of

those steps are complete. You can click that button once, and you should then see the

Congratulations! response indicating that the account activation is complete.

Figure 9 - Account Activation

Looking at your account setup now, you should see both directory sync and domain

ownership steps are complete, as signified with the green check.

You should also now see that an “Activate My Account” button has appeared if both of

those steps are complete. You can click that button once, and you should then see the

Congratulations! response indicating that the account activation is complete.

ID Vault

– IBM creates the ID vault when the customer account is created.

– In order for a user's ID file to be uploaded to the ID vault, you must issue a Vault

Trust Certificate from a parent certifier of the user ID file to the ID vault certifier.

– After the Vault Trust Certificate is issued, only IDs of users with SmartCloud

Notes accounts are uploaded to the ID vault.

– Issue the certificate after the on-premises directory has been synchronized with

the SmartCloud Notes directory.

17

Note: If you try to manage the vault and see a “error not found in view index” then the

directory indexes might not yet have refreshed and you can use updall -r to do that from

the hub server console.

1. Select Add or remove organization... and click Next

2. Click the Add or Remove button

3. Select the organization and click Add

4. Click OK

5. Click Next

6. Click Configure

7. “Choose a Certifier ID File” dialog

2. Select the certifier ID file and click Open

3. Enter that password and click OK

4. Click Done

You are done when you see the message that you have successfully managed the ID vault

and that the certifier was successfully added.

Confirm SCN Servers are Connecting to the Passthru Server

– Look for sessions containing virtual server names from the service and of type

PASSTHRU

– The virtual server names contain the OU certifier that was uploaded during hybrid

configuration

Confirm SCN Servers are Connecting to Mail Routing / Directory Server(s)

– Similar sessions from the SCN service containing virtual server names should be

visible on the console of the mail routing / directory replication servers

Additional Outbound Connection Testing / Validation

– After Directory Synchronization reports it is complete

• Ensure that a Domino console trace from the customer mail routing hub

server to any of the SmartCloud Notes servers that can be seen connecting

to Passthru server

A group contains allocated servers for the customer, but not all will be running; failing to

connect to one of them is to be expected.

You will see an error about not being authorized to connect initially; this is expected

because the trace command tries an anonymous connection first.

Configuration Test

– Web-based tool to allow you to test what the service can see

– If you run this before directory synchronization has completed, there will be a lot

of errors because synchronization has not yet completed

18

Go to the Configuration Test link in the UI and click the Run Tests button to start the

test execution.

These tests should be run any time you make changes to the hybrid setup or whenever

you are troubleshooting problems between SCN and the on-premises environment.

SmartCloud Notes Web Administration (User Accounts & System Settings)

– If you are not still logged in, log in as the administrator again

– Navigate to the IBM SmartCloud Notes option

Figure 10 - SmartCloud Notes Web Admin

With completion of the account activation, a wider set of SCN specific configuration and

administrative options become available.

From the IBM SmartCloud Notes navigation link on the left, the SCN specific

administration section now provides additional access into these other areas.

19

System Settings - SmartCloud Notes Account Setup

There are many new options listed below the Configuration Test item that were not there

before account activation was completed.

Figure 11 - SmartCloud Notes Account Setup

SmartCloud Notes Account Setup - Instant Messaging

The options under Instant Messaging control how the SCN web UI or Notes embedded

Sametime client are integrated with community services, not whether chat and awareness

are available to the user via general web chat or rich client.

When disabled (the default), there is no presence awareness in the SCN web UI, but an

end user can still manually configure a Sametime client to independently connect to

SmartCloud IM.

SmartCloud Notes Account Setup – Default Time Zone

This time zone option is used only for newly provisioned mail databases where a default

set of free-time should be published, even if the user has not yet set their preferred time

zone or work schedule. Typically this should just match the location of the majority of

the users in the company.

20

SmartCloud Notes Account Setup - Email Notifications

This option allows an administrator to specify the email addresses to which notifications

of problems with the service can be sent. Currently, this is limited to alerts about

problems with directory synchronization.

SmartCloud Notes Account Setup - Email & Calendar Options

The Calendar Details option enables the collection of summary data for display when

using the group calendar function, to show a limited amount of data about appointments.

SmartCloud Notes Account Setup - Email Management

There are a number of controls on this page related to email management. The absolute

maximum message size allowed in SCN is 100MB. Limiting the message size allows a

customer to reject messages that are over some size lower than this maximum.

Mail retention governs how long the soft delete period should be. By default it is 14 days

but can be up to 90 days long.

SCN also provides a method to purge mail data over a certain age. When enabled, the

customer decides for how long data can live in the mail database.

SmartCloud Notes Account Setup - Inbound Mail Routing

The Inbound Internet Mail Routing page shows who is responsible for handling incoming

SMTP mail for each verified domain owned by the customer.

SmartCloud Notes Account Setup - Email Filters (Spam)

Email filters provide some level of customization for how the Protector SMTP hygiene

filters process inbound SMTP mail.

The system filter is default for all customers and cannot be removed. It is the fundamental

spam filter and applies to all mail.

SmartCloud Notes Account Setup - Email Filters (White/Black Listing)

In addition to the spam filter, an administrator can define white and blacklists that contain

either individual email addresses or domains. For each rule, they choose deliver to

Inbox, deliver to Junk or block.

SmartCloud Notes Account Setup - Email Filters (Newsletter)

The keyword filter rule currently has one category of content defined and that is

Newsletters. Adding this rule will allow Protector to use its newsletter detection

algorithms to filter this kind of email based on the configured action.

SmartCloud Notes Account Setup - IMAP Email Access

SCN supports the use of IMAP clients and administrators can control whether or not

users are allowed to use IMAP clients. By default, IMAP support is turned off.

21

SmartCloud Notes Account Setup - Password Management

The expiry of passwords in Notes IDs can be enabled and set to an expiration duration.

SmartCloud Notes Account Setup - Name Finder

The Name Finder option controls how type-ahead and searching works for addressing

users in SCN web. By default using the basic option, when a user begins typing on the

To / CC / BCC fields a simple type-ahead text list of user names is shown from which to

choose.

SmartCloud Notes Account Setup - Journaling Options

Although this option is called “journaling” it is not the same as Domino message

journaling. It relates to the logging of mail delivery and client access events into log

files, stored in a default format, that a customer can download and import into a data

warehouse and then run reports.

System Settings - Security

Security Settings for Connections Cloud overall are set outside of the SCN specific

administration, using the Security link under Systems Settings.

A customer can control password expiry interval, what info to display to a user who

clicks the Forgot Password link on the login page and the use of application passwords.

Application passwords are for mobile device usage, are system generated but managed by

the user, and can bypass IP address range restrictions (since you never know where a

mobile device might be connected).

The IP address range restriction allows the administrator to specify from which set of

networks their users should be allowed to connect.

System Settings - Theme An administrator can make some limited cosmetic changes. Changing the theme gives

access to 9 preset color combinations, while the 10th

option (the rainbow) allows the

administrator to set explicit RGB color combinations for the main UI components.

In addition, an administrator can upload a logo image which they can choose to display in

the top left-hand corner of the top navigation bar which runs persistently across the entire

page, no matter what service is being used.

22

Part 4 - User/Data Transition and Provisioning

There are 4 main phases associated with user and data transitioning and provisioning.

1) Assessment

2) Planning

3) Preparation and Validation

4) User/Data Provisioning Process

Figure 12 - Assessment, Planning and Preparation

The first three phases focus efforts towards the ultimate goal of moving users and their

historical data.

With this method, customer assistance is increased as customer and IBM risk is

decreased.

The Domino Configuration Tuner (which is shipped for free with Domino) can be used to

gather detailed information about servers.

The SCN pre-config tool can be used to assess the readiness of the current Domino

environment for hybrid configuration.

23

Assessment is where a thorough understanding of the current environment and business

requirements is done. It is important to understand in detail the current environment, to be

able to make good informed decisions about what changes need to occur for a successful

move to SCN.

Planning (or sometimes Design) is the creation of the desired state, thinking through what

will be required and defining the appropriate sequence of events to realize it. The

information gathered during assessment is vital to being successful in planning the path

to cloud.

OPT (Onboarding Planning Tool) is provided to certified practitioners. OPT helps

understand user, mail database and client usage and also helps to segment the user

population into manageable groups for transition planning.

Prep / Validation (or sometimes Build) is the execution of the plans.

OTT (Onboarding Transition Tool) is provided to certified practitioners and assists

with the execution of the user move. It leads the practitioner through a set of automated

or semi-automated steps for each logical group of users being processed.

MOM (Mail Onboarding Manager) is available to be downloaded by any administrator

of a Connections Cloud organization that has SmartCloud Notes or Connections Cloud

S1 subscriptions.

OPT, OTT and MOM will be discussed in greater details later in a separate topic.

A pre-sale Technical and Delivery Assessment (TDA) is a technical inspection of a

completed solution design. Technical Subject Matter Experts (SMEs) who were not

involved in the solution design participate to determine:

a. Will it work?

b. Is the implementation sound?

c. Will it meet customer requirements and expectations

The TDA also helps to ensure that important areas of prerequisites, capabilities and

dependencies are discussed and understood early to reduce the possibility of road blocks

or surprises during implementation.

Typical Customer Responsibilities:

– Assessing Domino applications and impact of client upgrades to 8.5.1 FP5+

– Fixing application problems

– Assessment and planning of end state directory architecture, mail routing and

replication

– Assessment, planning and changes to existing security policies / procedures

– Assessment and planning of end state architecture for customization / integration

with other systems

– Network capacity planning and any associated network routing changes

24

– Fixing existing problems or issues in the on-premises Domino environment

– Creation and staging of client installation packages

– Planning and execution of client upgrades or new installations

– Establishing and testing hybrid environment setup; implementation of passthru

server(s), directory replication and mail routing between on-premises and

SmartCloud Notes environments

– Transformation management including end user communication plans,

communication content, delivery of enablement, etc.

– Post-transition decommissioning of mail files and mail servers

Assessment Phase:

The diagram below indicates phases and a collection of activity areas, but no idea of

overall sequence.

Figure 13 - Assessment

The diagram in Figure 13 indicates phases and a collection of activity areas, but no idea

of overall sequence.

Design and Planning Phase:

• Determine the mixture of services required to satisfy collaboration / user

needs and what data transition is required

• Plan for connectivity between on-premises and SmartCloud Notes data

center

• Determine a high level schedule for overall implementation

• Determine the sequence of deployment for user segments / business units /

locations and the associated Connections Cloud services

• Define the coexistence that will be required to support the transition

(hybrid)

• Determine how the business is going to be prepared for the transition

Figure 14 - Design and Planning

The network is a critical component in a SaaS and is often overlooked; customers think

their existing Internet connection(s) will be enough but that is not always true.

The overall sequence / schedule needs to be mapped out. The rate of transition is

important i.e. how many users per day or week are moved to SCN.

25

Preparation Phase:

A large part of the preparation activity is the set up of the SCN hybrid configuration and

associated infrastructure such as network connectivity or SAML identity provider.

There is also the corresponding testing of the various components that are configured to

ensure that the SCN hybrid, etc. are working properly.

Provisioning of new user accounts should be tested end to end.

If Notes client installation or upgrades are needed, then the deployment tools and install

kits need to be set up and tested.

Figure 15 - Preparation

Pilot Transition:

It is important to run a pilot of the transition process early in the deployment phase. The

process as implemented by the OPT and OTT tools is fairly strict. It has been proven to

work and deliver a known outcome that is a very transparent transition for the end user.

– The pilot is used to test the process / solution on real users:

• A set of users should be invited to participate

• Communication and enablement material is validated with the pilot user

set

– For existing IBM Notes users, the following occurs for pilot users:

• IBM Notes clients may be upgraded

• The mail files are replicated to an on-premises staging server and

encrypted

• The encrypted replicas are uploaded to the SCN data center via FTP

• The databases are prepared and once ready, the associated users are

provisioned in the SmartCloud Notes service

• The Domino Directory entries are updated to point mail server entries to

new SmartCloud Notes mail server(s)

• IBM Notes client configurations are updated to reflect new SmartCloud

Notes mail server(s) and final replication occurs with on-premises replica

Production Transition:

Production deployment is similar to the pilot process flow, except that it is repeated as

many times as necessary to process the user population in logical batches (or groups).

– The remaining users are scheduled in batches

• Depends on user demographics, volumes of data, organizational change

requirements, etc.

• Processes are repeated iteratively until all users moved

– For existing IBM Notes users, the following occurs for each batch of users:

• IBM Notes clients may be upgraded

• The mail files are replicated to an on-premises staging server and

encrypted

26

• The encrypted replicas are uploaded to the SCN data center via FTP

• The databases are prepared and once ready the associated users are

provisioned in the SmartCloud Notes service

• The Domino Directory entries are updated to point mail server entries to

new SmartCloud Notes mail server(s)

• IBM Notes client configurations are updated to reflect new SmartCloud

Notes mail server(s) and final replication occurs with on-premises replica

Preparing for Transition:

In order to be able to execute the user transition process, a number of prerequisites need

to be in place before you start.

– SmartCloud Notes hybrid integration is already implemented, tested and

functioning properly

– Staging server and tools are implemented and connected to customer network

– Staging server has access to all mail servers and mail databases in scope

– Partner has appropriate accounts/roles within customer company account

– Secure FTP (over SSL/TLS) access to SmartCloud Notes data center is available

– End user IBM Notes clients meet minimum software version requirements

– End user mail databases are configured appropriately

Staging Server Setup:

Figure 16 - Staging Server

The staging server is a temporary Domino server on which to run IBM tools that help to

manage the transition process. Once users are transitioned it can be removed.

27

It must be a Windows server running Domino 8.5.3 (or higher) 32-bit application. It

does not require a lot of hardware resources, its primary role is to run a single Domino

server that the admin might access, so the workload is very light.

1. On-premises data preparation (FTP)

Figure 17 - On-premise Data Preparation (FTP)

To capture the data, the staging server pulls full or selective replicas of the existing mail

databases from the existing mail servers across the customer network, to its local storage.

To reduce the time taken to replicate, it is desirable to place the staging server as close to

the source mail servers as possible from a network point of view.

The staging server generates a file of metadata about each user and database within a

dataset. We call this the manifest, and it is an XML file that is used to describe the dataset

to SCN once it has been uploaded.

No data ever leaves the customer network without being encrypted.

Note: An alternative to FTP is to put the data onto USB-connected removable storage.

This provides a way to move a very much larger volume of data in a relatively short (few

days) amount of time by shipping the device to the SoftLayer data center.

28

1. On-premise Data Preparations (Removable Storage)

Figure 18 - On-premise Data Preparation (Removable Storage)

An alternative to FTP is to put the data onto USB-connected removable storage. This

provides a way to move a very much larger volume of data in a relatively short (few

days) amount of time by shipping the device to the SoftLayer data center.

29

2. Upload Mail Content to SCN Data Center

Figure 19 - Upload

The encrypted data is uploaded to the SCN FTP service across the Internet.

Using secure FTP protects the communication during upload, and because the data is

already encrypted, it is protected at rest when it lands on the FTP service.

30

3. SCN Data Ingestion (FTP)

Figure 20 - Data Ingestion

Once the data upload is complete, the SCN database import service can read the

encrypted files from the FTP service, decrypt them, read the manifest and prepare the

databases it describes for provisioning. The same applies for removable storage.

3. SCN Data Ingestion (Removable Storage)

Figure 21 - Data Ingestion (Removable Storage)

31

4. SCN Provisioning

Figure 22 - Provisioning

At provisioning time, for each user being provisioned, the SCN service will decide on

which pair of servers in a cluster a user will be hosted; a primary (home) server and its

cluster partner.

Each of those servers know on which database import server to find the replica of the

mail database for that user. Instead of creating a new empty mail database, each server

streams a replica copy from the import server to its own storage.

The server decision also determines the corresponding cluster and pair of servers in the

DR data center to which the user should belong, and a second set of replicas are created

on the DR cluster server pair in the background.

32

5. Directory Synchronization

Figure 23 - Directory Synchronization

Once the database replicas are in place on the primary server and cluster partner in the

primary data center, it is safe to update the directory entry for the user.

This change updates the references to the mail server and mail file path entry to point at

the databases now running on the SCN servers, instead of the on-premises servers.

Through the directory sync process, this change propagates back to the on-premises

Domino environment as well. Once the change reaches those servers, all new mail for the

users who were provisioned, will be routed to the SCN servers instead.

The transition tools create a message in each user's Inbox, effectively a welcome to SCN

message, with instructions about what they should do next to access the SCN service.

33

6. Desktop Update Process

Figure 24 - Download, Setup and Catch-up Process

Users can log in with a web browser right away and be productive.

Users who use a Notes client must download a small NSF database which contains code

to reconfigure their Notes client to point at SCN instead of their on-premises mail server.

This database cannot be shared between users and will not work for any other user.

This tool also causes the client to perform a catch-up replication cycle between the on-

premises and SCN replicas to ensure any changes since the database upload are captured.

Lastly the tool shuts down the Notes client so that the location switch can take effect.

7. On-Premises Clean Up

Once the user have switched over, the on-premises mail file replicas can be

decommissioned and finally so can the on-premises mail servers.

34

Part 5 - Staging Server & FileZilla Setup

Staging server basics

– Designed to run stand-alone (separate domain) but connected into existing

environment to be minimally invasive

– Domino 8.5.3 (or later, including Domino 9) server with some additional tools:

• Runs in isolated domain but using a server ID that belongs to the customer

certificate hierarchy to remove need for cross-certification

• Requires access to mail servers which users to be transitioned are homed

• Requires mail servers trust the staging server ID for remote agent access

• Requires ACL access to all mail files belonging to users being

transitioned – preferably manager

• Requires access to the server through which the Domino directory

replicates with SmartCloud Notes

• Remote access if managing from outside of customer network

Staging server requirements

– Hardware Requirements

• Dual Core Intel / AMD CPU

• 2 GB RAM

• Gigabit Ethernet network port

• Sufficient disk to support 2x in flight data volume

– Software Requirements

• Microsoft Windows Server

• IBM Domino Server 8.5.3 (32-bit) or later

• Remote access

– Additional Domino Server utilities deployed as part of the OTT database

implementation:

• encryptdb.exe

• unrdsync.exe

– Additional scripts deployed as part of the OTT database implementation:

• setenv.bat

• unread-sync.bat

– Additional tool to be downloaded from SourceForge:

• tee.exe

FileZilla is not required, but is a good implementation that supports the following

required capabilities:

• Implicit FTP over SSL/TLS

• SSL session reuse

• Resumable transfers

– Install the latest FileZilla client for Windows

32-bit on the BP#HUB Domino server

• Download from:

http://filezilla-project.org/download.php?type=client

35

Onboarding Planning Tool (OPT)

– This tool assists in planning and preparing for the transition of users and their data

– Assists the user to analyze the current user, client and mail database environment

• Can be run from Administrator workstation with zero server impact – or –

• Can be run in a scheduled fashion from an existing Domino server

– Assists in defining the sequence and grouping of the user population into

manageable chunks for further processing

– User Batch Planning

• Sequencing and grouping of users / databases into logical deployment

groups

• Filters the overall user population into those who are ready to move and

those who are not

Assists with identifying important relationships between users that must be considered

during scheduling

Note: Running OPT as early as possible can be preventive maintenance because it can

uncover activities that the customer needs to perform.

Creating and Configuring OPT Steps

1. Server-Based Install

2. Signing the Database

3. Setting the ACL

4. External Agent Log

5. Log Database: Show in "Open Application" Dialog

6. Agent Log - Setting the ACL

7. Setup Wizard - Welcome

8. Setup Wizard – Current and Future Client Types

9. Setup Wizard – Minimum Client Version

10. Setup Wizard – Initial Scan Document

11. Setup Wizard – Directory Server

12. Other Scan Types

13. Setup Wizard – Additional Server Selection

14. Setup Wizard – Scan Summary

15. Setup Wizard – Execution Option

16. Setup Wizard – Running Scan

17. Basic Setup Complete

18. Initial Scan Results

19. User Profile – Warnings and Errors

20. Domino Directory (names.nsf) Usage

36

Part 6 - Configuring OTT Database/Shell Scripts

Onboarding Transition Tool (OTT)

– This tool assists in executing the transition of users and their data

– Provides automation for most tasks within the transition process

• Must be run from a Domino server

– Is responsible for the following key activities during the transition:

• Tracking the status of users as they move through the transition stages of

the overall process

• Pulling user batch definitions from the OPT tool

• Creating replica stubs of the databases associated with the users in a batch

• Checking the status of replicas and measuring their “completeness” for

transfer

– e.g. document count, unread count, replication history entries

• Generating the manifest XML metadata that describes the user and

database replicas, and starting encryption

• Checking that encryption completed successfully

• Monitoring the directory for indications that users have been provisioned

and activated

• Depositing end user communications in the on-premises Inbox of users

once activated

Creating and Configuring OTT Steps

1. Onboarding Transition Tool (OTT) - Install

2. Signing the Database

3. Setting the ACL

4. Agent Log

5. Agent Log – Setting the ACL

6. Initial Configuration

7. Configuration – Updates from OPT

8. Configuration Profile – Basic Configuration

9. Configuration Profile – Full Transfer Configuration

10, Initializing the Database

11. Initializing the Database – Enable Process New Mail Agent

12. Initializing the Database – Sign the OTT / OPT Database

13. Initializing the Database – Deploy Shell Scripts / Executables

14. Initializing the Database – Initialization Complete

15. Configuring the SETENV.BAT Script – Customer ID

16. Configuring the SETENV.BAT Script – Paths

17. Mail-In Database Definition

18. Mail Server to Staging Server Replication

19. Trusted Servers

20. Restart the mail server

21. Data Transfer Manager Account Setup

22. Data Transfer Manager Account Capabilities

37

Part 7 - Reviewing OTT Configuration Documents

OTT – Step Configuration – Overview

– Step documents describe and control the sequence in which the processes are

executed on the users

– The process selects users according to current and next steps and current status

OTT – Step – pulldirectory

– pulldirectory pulls user information from OPT into the OTT user profiles and

populates information about the mail files into each OTT user profile

– e.g.

• Mail server

• Mail path

• Template

• Replica ID

• Size

• Document Count

OTT – Step – replicastub

– replicastub creates a replica stub on the Staging Server for each source mail

database

OTT – Step – checkreplica

– checkreplica periodically checks the status of the Staging Server replicas against

source replicas

– It rechecks the user status in OPT

OTT – Step – writemanifest

– writemanifest generates an XML file called the manifest for the batch of users

– Contains metadata about each user and mail file to be uploaded:

• SMTP email address

• First name

• Last name

• Home server

• Mail file path

• Staging replica path

• Replica ID

• Client access method

• Description

– Special “device” indicates Selective Transfer

– Also starts encryption

This also does a check of OPT status (it’s the final check before sending users to

SmartCloud Notes).

38

OTT – Step – Validate Encryption

– Validate Encryption makes sure encryption finished, and was successful

– If all .END files exist and are correct size, Validate Manifest runs validation

process on server

– That process ensures manifest is correctly formed, and checks for 1:1 match

between manifest and .END files

– If batch is good, Validate Manifest encrypts the manifest

OTT – Step – checkmailserver

– checkmailserver periodically checks for the change of the mail server to a

SmartCloud Notes server:

• Checks the directory replica on the synchronization hub

• Checks the directory replica on the home mail servers

– For each Full Transfer user where the change has occurred in both places, creates

the Welcome Message

In the migration process this is where the practitioner sends the mail files to the service

and provisions the users. OTT can’t see any of that – all it can do is wait for the Person

document to change.

OTT – Step – Selective Transfer Replication

– Selective Transfer Replication does “catch up replication” for Selective users

• Sends new mail to Staging Server

• Changes replica ID of Staging Server replica to match cloud server

• Sends new mail to cloud

– When complete, it sends the Welcome Message

– Automatically restarts process to deal with errors within the sequence (e.g.

network errors)

OTT – Welcome Messages

– OTT generates a “Welcome” message for each user who has been activated

• i.e. mail servers have been updated

– The message is written directly into their on-premises Inbox

• It’s not “delivered mail” but it looks like it

• Messages are generated from a pre-defined “template” document that can

be tokenized for personalization

OTT – Welcome Message – Defining the Memo to Use

– Supplied Step document for Full Transfer computes memo based on

DetectedClientType user profile item

– Can be replaced with any formula

• Select by Country (e.g. from OU in Notes Name or mail template version)

– Ensure there is a Memo document matching all possible formula results

– Can manually select and assign a single memo from a list of those available

– Corresponding document supplied for Selective just uses a simple selection, but

you can use a formula if required

39

OTT – Step – processnewmail (Full Transfer only)

– processnewmail processes incoming messages received from users to indicate

either:

• Notes client reconfiguration has been successful or failed.

• Browser users have responded to a request to reply to their “welcome”

email.

– Moves user onto next step of process and updates their status

– Ignores emails which don’t match what it expects

OTT – Step – disablereplication (Full Transfer only)

– disablereplication disables replication in on-premises mail files

• Home server

• Any cluster replicas

Note: This requires that the staging server have manager access to mail files

OTT – Step – delreplica (Full Transfer only)

– delreplica will create an Administration Process request to delete the on-premises

replica for each user who reaches the Create Replica Delete Request Step:

• Creates an individual request per home server and cluster partner

• Does not submit a “delete all replicas” request

– Customer administrator must approve the deletions like any other database delete

request

OTT – Step – detectdeletion (Full Transfer Only)

– detectdeletion monitors the administration process requests to verify when

deletions have been executed.

– At this point the user has been transitioned and cleanup has completed.

OTT – Task Configuration – Overview

– Task documents describe and control the processes which happen in parallel to

the Step agents

OTT – Task – Monitor In-Flight Users

– Currently implements Folder Monitoring

– Users who modify folder names during transition might get unexpected results

e.g. folder names revert to previous name after replication

Folder Monitoring: What To Do?

– There is no good way to prevent folder issues without making the end user’s

experience worse

• If you try to prevent them from creating folders, they end up with private

desktop folders, which don’t appear at all after transition to service

– Notes users – Client Configuration Tool

40

• As part of Catch-up replication, this tool detects problem folders and fixes

them

– Spots renames and re-renames them, and copies folder design from

Inbox

• Doesn’t help web-only users – Client Configuration Tool is a Notes

database run on the client

– OTT Folder Monitoring

• Communication (outside OPT/OTT) to tell user about the problem

• Scheduled agent to monitor mail files “in flight”

– Starts after encryption of the databases (status “Encryption

Complete”); finishes after provisioning (status “User Provisioned”)

Folder Monitoring - Initial Notification

– User receives email telling them they should stop modifying folders until they are

provisioned

OTT – Task – Direct Replication (Full Transfer only)

– Direct Replication is the process to replicate the home server’s mail file to the

SmartCloud Notes server

– Does not use the replica on the Staging Server

– This will replicate any content which has changed in the on-premises replica to

the SmartCloud Notes replica

– Intended for web-only users (Notes client users will run the Client Config tool)

OTT – Memo Configurations

– Memo Configurations are used to generate messages sent to users

– Listed under Memo Configuration part of Administration outline

– Used for “Welcome” message and Folder Monitoring message contents

OTT – Memo Configuration Structure

– Message template allows you to customize the appearance of the messages

OTT – Full Transfer “Both” User Notification

– Complete from / to addressing and subject as appropriate

OTT – Memo Configuration – Notes User Notification

– Very similar information is typically presented in each memo

– Slight variations in the links and instructions depending on whether the user will

use only Notes, browser or both clients

41

Part 8 - Scanning, User Grouping and Data Capture

OPT Navigation

– Navigation pane gives a rough suggestion of a sequence of work, starting with

“Setup”, then “Collecting Information”, and so on

OPT – Scan Control Document

– Open the Collect Information | Scan Mail view and open the scan control

document

OPT – Scheduled Scans

– OPT will warn you if the scheduled agent is not enabled

– If you enable it here, you should re-sign the database

OPT – Server Documents

– Servers view shows the types of servers being scanned

OPT – Global Settings

– When you open OPT for the first time, the Startup Wizard collects enough

information to get you started

– Configuration information is stored in a profile document within OPT

OPT – Global Settings – Agent Logging

– If you created an Agent Log database for OPT, make sure this configuration is

pointing to it.

– Select the Agent Log Database option, click the Choose Agent Log Database

button and pick the OPT agent log database from the picker.

OPT – Global Settings – Configuration Options

– You can override the default maximum number of days for Selective Transfer

• But do so with care, as the default has been chosen to give good

performance

OPT – Running Scans

– Select the Scan Mail view

– Click the Run Selected Scan(s) action to initiate the scan

OPT – Scan Summary

– Scan results summary indicates number of users processed

OPT – Scan Logs

– Scan results summary indicates numbers of users processed, errors, warnings, etc.

OPT – User Profile – Warnings and Errors

– Warnings can be acknowledged to indicate they have been read and understood.

42

– Select the check box next to warning(s) and click the Acknowledge Selected

Warnings button to proceed.

OPT – User Profile – Acknowledged Warning

– Click the Restore Selected Warnings button to undo an incorrect

acknowledgment

OPT – Scan Acknowledgment

– At the view level, column icon also changed to show acknowledged warning for

this user.

OPT – Rescanning Users

– After resolving issues:

• Select those users and click the Rescan Mail Statistics action button to

refresh user status for just the selected users

• A full rescan can be done by going back to Scan Mail view

OPT – Client Usage View

– Switch to the Resolve Issues | Client Usage view

– Select some users to update and click Set Client Types:

• Set all users to have future browser.

• Set some users to both Notes and browser.

OPT – Client Usage – Set from Mail Statistics Document

– A single user entry can be updated from the Messaging Info tab:

• Edit Settings button changes types being used

• Set button allows specific version information to be selected

OPT – Users By Errors/Warnings

– Switch to the Resolve Issues | Users By Errors/Warnings view

OPT – Defining Custom Grouping Criteria

– You can define up to 5 custom grouping views / criteria

OPT – Assigning Users to Groups

– To assign users to a location, go to the Assign Users to Batches | Locations view

OPT – Setting up Provisioning Profiles

– Navigate to the Provisioning Profiles view

– OPT comes with a selection of profiles

OPT – Creating User Batch

– Navigate to the Batch Definitions view

– Click the Create Batch action button

43

OPT – Assigning Full Transfer Users to Batch

– To assign users to a batch, select the user entries and click the Assign to Batch

action.

OPT – Assigning Selective Transfer Users to Batch

– Assign a different set of users to a second batch using a Selective provisioning

profile

– Switch to the Manage Batches | Batches by Transition State to see your two

batches

OPT – Assigning Recommended Users to Batch

– To assign users who fail keep together rules to the batch:

• Select the user entries in the right hand view and click the Assign To This

Batch action

OPT – Acknowledging Keep Together Warnings Instead

– To acknowledge the warning for users who fail keep together rules:

• Select the user entries and click the Acknowledge action

• Red exclamation changes to yellow circle column icons

OPT – Finalizing the Batch Membership

– You can either resolve issues and rescan users or remove them from the batch

OPT and OTT – Dealing with Errors

– Although fixing errors in OPT before transferring to OTT is desirable, it is not

required

• OTT is the final “gatekeeper”: it will prevent you from encrypting a batch

if there are errors in OPT

• OPT will prompt you to confirm that you want to proceed

Data Transfer Manager Account Setup

– To access the SmartCloud Notes administration interface to manage the data

import and provisioning requires an account with “Data Transfer Manager” role:

• Step 1: Customer admin can create an account without any subscriptions

• Step 2: Connections Cloud Client Services Group (CSG) must assign the

DTM role to that account

SCN Admin UI – Log in with Data Transfer Manager Account

From a web browser log into Connections Cloud with the account that has the “Data

Transfer Manager” role.

Data Transfer Manager Account Capabilities

– Accounts with “Data Transfer Manager” role have a limited set of capabilities

• Read-only access to most of the SmartCloud Notes administration settings

• Access to User Provisioning with Mail File Transfer controls to manage

44

SCN Admin UI – Create First Migration Control Document

– Click the New Control Document button.

– Insert your name and email address.

– Insert company name in the description - full or selective batch description.

– After completing the form click the Submit button

SCN Admin UI – FTP Space Usage

– The SCN FTP service allows a certain amount of reusable space per customer

• Available + Used on control document = customer maximum

– Tip: Allocate more space than you think you’ll need; if it's not needed it is

returned for other use immediately after the upload is validated.

SCN Admin UI – Open Migration Control Document

– At the control document list, click on the request number link to open it

– Cancel Request button stops any further processing of this batch and deletes all

associated data

– Reset FTP Password button used to enter a new password for this request

SCN Admin UI – Download the Encryption Key File

– Click the Download Key button to save a copy of the key to the staging server

Domino data directory

– Key file name generated from customer ID_control number.mky

Repeat These Steps to Create a Second Control Document

– Need one control document for each of the Full and Selective transfer batches

• Use the Description field to distinguish the two control documents

OTT – Import User Batch from OPT

– Click Import Batch button to import a user batch from OPT:

• Select the correct OPT batch name from the list

– Set the date of transfer to match your control document estimated date

– Click OK to import the user information from OPT

– Repeat for both of the batches you marked ready for transfer in OPT

OTT – Imported User Profile Information

– Open an individual user profile document to see the information inside

– This ensures that OTT is able to access both sources for future tasks

OTT – Completing the Batch Documents

– You should provide OTT the same batch information:

• Go to the Batches | by Name view

• Edit the batch document corresponding to the OPT batch

Batch Document – Optional Features

– Replication Hub

• Defaults to values in the Configuration Profile

45

• Can be set differently for each batch

– Initial User password

• Allows you to record the password you plan to use for users in the batch

• Assumes you want to use the same password for all users in the batch

OTT Batch Document – Saving the Document

– Saving the batch document updates all user profiles belonging to that batch with

the new Control Number, and password if present.

OTT – Manually Executing Agents

– From the dashboard:

• Click link next to the current step of the process to move users to next step

• Only processes the batch being displayed in the dashboard

– From the Actions menu:

• Click Actions | Run Agent on Server and then either As Console

Command or With Summary, then choose agent from list

OTT – Create Replica Stubs

– Go to the User | by Status view:

• Click Actions | Run Agent on Server | With Summary

• Choose the Create Replica Stubs agent

OTT – Checking Replica Stub Creation

– Go to the Domino Administration client and select the staging (hub) server:

• Switch to the Files tab

• Navigate to the customer ID / control number and lower directories to see

the replica stubs

OTT – Initializing and Replicating the Databases

– Go to the server console of the staging (hub) server:

• Enter a pull replication command to initialize and replicate the source

mail databases to the staging server

• Do not use 2-way replication

OTT – Checking the Replicas

– Go to the Domino Administration client and select the staging (hub) server:

• Switch to the Files tab

• Navigate to the customer ID / control number and lower directories to see

the replicated databases

OTT – Checking Replication

– A replication history entry is written into a replica when a successful replication

cycle is completed

– We use the date and time stamp information later in the process

• Click Actions | Run Scheduled Agent | With Summary

• Choose Check Replication

46

Inspecting the Replication History Entries – Source Mail Server

– For a “pull only” replication, initiated by the staging server to the source mail

server

Inspecting the Replication History Entries – Staging Server

– For a “pull only” replication, initiated by the staging server to the source mail

server

OTT – Users On Hold

– If a problem is detected or you want to halt processing for a user, they can be put

into a Hold status:

• Open the user document to see the reason(s) on the Quality Check tab

• At view level, select users and choose Tools | Remove Error Hold(s) to

progress user once problem(s) are resolved

OTT – Running / Overriding Data Quality Checks

– Quality Checks can be re-run independently of checking replication history with

two selection models:

• On the individually selected users / staging server replica

• All users / staging server replicas belonging to a batch

– Override Quality Checks action runs on selected users:

• Used when there is a known legitimate reason for a quality check failure

Unread Marks – Synchronizing Source and Staged Replicas

– If quality checks are failing because of unread mark differences, you can run this

unread mark synchronization tool

– On the staging server, start a command prompt as administrator:

• Change to the c:\migrate directory

• Run the unread-sync.bat script with control number and source mail

server as parameters; repeat for both batches

47

Part 9 - Encrypt, Upload, Import and Provision Users

Encrypting Data – Process Readiness Checkpoint

– At this point the following should be true for each batch:

• The OTT Batch document must be complete (a document created

automatically on import will not be complete until it’s been saved)

• There is an encryption key on the staging server or attached to the OTT

Batch document (if attached, it is detached to file system when the

manifest XML file is created)

• There is a set of fully replicated mail databases on the staging server

assigned to the batch

• The mail databases have all passed quality checks (or have been

overridden for legitimate reasons)

• Unread marks have been synchronized between source and staged replicas

(if necessary)

OTT – Creating the Manifest File and Starting Encryption

– On the dashboard, click the Start Encryption link

• Confirm execution and review results dialog

• Note the path for the manifest file (ending .man)

• Repeat for both batches of users

• Check log file for each batch in c:\migrate\logs to see encryption output

– Can also use the Write Manifest XML action button in a batch view

What is the “Manifest XML” (.man) File ?

– The manifest XML contains meta-data to describe the data set being sent to

SmartCloud Notes for processing:

• Contains a schema description against which content can be validated

• Contains information about the customer, batch and staging server

• Contains one row per user / database that is included in the batch:

– User name, email address, mail server, mail path, replica ID,

staging path and client access type, description

OTT – Encryption Process

– During encryption, each database is:

• Taken offline

• Used to generate the encrypted version of the database with a .END

(Encrypted Notes Database) extension

– Encryption tool writes actions to log file in c:\migrate\logs directory with a file

name structure of customerID_controlNumber.log

– You can also see the encryption tool screen output in the Staging Server console

OTT – Encryption Result Output

– Batch log file in c:\migrate\logs lists all the databases processed by encryption

tool

48

OTT – Validating the Manifest File

– From the dashboard, click the Check Encryption link

• Can also be run using the Validate Encryption agent

– Users moved to Encryption Complete state and manifest is encrypted

Validation Process

– The validation process

• Checks that the expected .END files exist

• Checks that the .END file matches the size of the corresponding NSF to

within the configured tolerance

• If both the above are true, it runs encryptdb.exe’s validation process

– Checks the manifest is syntactically correct

– Check that all database files listed in the manifest are present as

.END files

• If all of the above are correct, it encrypts the manifest

OTT – Re-running Encryption or Validation

– The encryption and validation processes are carried out by the encryptdb tool, and

could fail for any number of reasons

– If they fail, reset the users back to the relevant stage and re-process them

FTP – Updating the SmartCloud FTP Site Definition

– Click the Site Manager icon to bring up list of site connections:

• Insert the user ID for the batch into the User field

• Click Connect to make connection to SmartCloud Notes FTP service

FTP – Validating the Connection

– Enter the password when prompted

– Details about the processing and status are shown in the messages window pane

FTP – Testing Throughput

– After establishing a connection to the FTP service, research expected throughput

– Set FileZilla to use the maximum number of parallel connections to ensure it is

pushing as much data over the connection as it can

Click Edit | Settings...| Transfers and then set Maximum simultaneous

transfers = 10

FTP – Uploading the Encrypted Data to SmartCloud Notes

– Once connected to the FTP service:

• Navigate to the output directory c:\end-files\<controlNumber> where the

encrypted data for the batch is stored

• Select both the manifest file and the directory of mail databases

• Drag to the landing zone root directory /

• Validate that all data is transferred successfully

• Files can be deleted and replaced if necessary

49

SCN – Validating the Uploaded Data

– From a web browser log into Connections Cloud with the account that has the

“Data Transfer Manager” role:

• Open the control document for the batch being processed

• Click the FTP Upload Complete button

• The manifest and database set will be validated

SCN – Failed Validation of Upload

Figure 25 - Failed Validation

Figure 25 shows the output when the FTP validation fails. The page provides details of

the failure but also specifically states what caused the failure. You can now correct the

problem and click the FTP Upload Complete button again to perform another validation.

SCN – Post Upload Validation

– Once the SmartCloud Notes service has validated the uploaded data set:

• The FTP login account for that request becomes read only

• The data for that batch can no longer be changed on the FTP server via the

FTP client

• The import server will generate a list of users belonging to that request

from the content of the manifest XML file

• Those users can then be selected in the UI for further processing

SCN Admin UI – Log in with Data Transfer Manager Account

If not still logged in, from a web browser log into Connections Cloud with the account

that has the “Data Transfer Manager” role.

SCN Admin UI – List of Control Numbers

– Control Documents page lists all available control documents / batches of users

SCN Admin UI – Open Migration Control Document

– At the control document list, click on the request number link to open it

50

SCN Admin UI – Select Users to Import

– At the user list, check / uncheck the boxes to choose user databases to be imported

SCN Admin UI – Checking User Status by Level

– The submitted users no longer appear in the list because their status changed

– Change the status filter to Ready to Import

– Only the users that were selected should now be shown in the list

– The Ready to Import status tells the import server to prepare these databases

Clicking the Import Selected Users button changes the status of the user from Created to

Ready to Import and they disappear from the original list.

SCN Admin UI – Checking All User Status Across Request

– Click the Status tab to see summary counts of users in each status

• The import server will then see that it has work to do and will import,

decrypt, virus scan, etc. for selected users

SCN Admin UI – Users Ready for Provisioning

– After importing the rest and filtering on status Ready to Provision, you can see

all users ready for provisioning

SCN Admin UI – Import Errors

– Filter the user list by the Error status

– Look at error text in view and click user name to open user document to read

processing history details:

• If the error condition is transient, correct it and click the Restart Selected

Users button

• If the error is terminal, cancel the user and re-process them in another

request if necessary

SCN Admin UI – Log in with Administrator Account

From a web browser log into Connections Cloud with the account that has the

“Administrator” role.

SCN Admin UI – Provisioning Estimates

– At the control document list, click on the request number link to open it

– Click on the Users tab:

• Change the status filter to Ready to Provision

• Select one or two users in the list

• Click the Provisioning Estimate button

SCN Admin UI – Selecting Users for Provisioning

– On the Users tab:

• The same users should have remained selected in the list

• If not, select one or two users again

• Click the Provision Selected button

51

SCN Admin UI – Selecting Messaging Subscription(s)

– On the resulting Provisioning Options page choose the subscription(s) to apply

to all selected users:

• Click the Next > button

SCN Admin UI – Selecting Subscription and Mail Template

– On the resulting Provisioning Options page, choose the template to apply to all

selected users:

• Page through list to locate the desired template and click Select next to it

Click the Next > button

SCN Admin UI – Setting Initial Temporary Password

– On the resulting Provisioning Options page, choose the temporary password to

apply to all selected users:

• Enter a one time use temporary password

Click the Next > button

SCN Admin UI – Confirming Provisioning Options

– On the next Provisioning Options page, review the selections and user list:

• If changes are required, click the < Back button

• To submit provisioning requests, click the Confirm > button

• Return to the request Status tab to check progress

SCN Admin UI – Provisioning Progress

– Click the Request Provisioning button:

• The status will show progress of submission of provisioning requests to

the provisioning queue

• Once all are submitted click the Return to Control Document button

• Check the Status tab for completion of requests

SCN Admin UI – Successful Provisioning

– Look at user document to read full processing history details

– Top entries relate to Import part of process – starting with “Created....”

– Lower entries relate to Provisioning part of process – starting with “User

selected for provisioning...”

SCN Admin UI – Provisioning “Complete”

– What does the provisioning “complete” status mean:

• The SCN messaging subscription was associated with the user's

Connections Cloud account

• The service decided on which primary and DR cluster nodes to place the

user mail file replicas

• The directory entry for the user was updated with the new server and mail

file name information

• The directory information will be synchronized and replicated with

the on-premises directory replica

52

• The user can now log in via a browser and can set up their Notes client

• New mail will flow to the SmartCloud Notes mail server for the user

and will stop being delivered to the on-premises mail server

SmartCloud Notes – Provisioning New Users

– In hybrid implementations, new users must be registered in the on-premises

Domino directory

• SCN has no access to the other certifier ID files used for user registration

– Once the new directory entry has synchronized into SCN, the user can be selected

and provisioned

SCN Admin UI – Log in with Administrator Account

From a web browser log into Connections Cloud with the account that has the

“Administrator” role.

SCN Admin UI – Search For User(s) To Be Provisioned

– Enter part of the user name or email address in the search box and click

magnifying glass button

– Select the desired user(s) from the list and click Provision Selected

SCN Admin UI – Selecting Messaging Subscription(s)

– On the resulting Provisioning Options page choose the subscription(s) to apply

to all selected users

SCN Admin UI – Selecting Subscription and Mail Template

– On the resulting Provisioning Options page, choose the template to apply to all

selected users

SCN Admin UI – Setting Initial Temporary Password

– On the resulting Provisioning Options page, choose the temporary password to

apply to all selected users

SCN Admin UI – Confirming Provisioning Options

– On the next Provisioning Options page, review the selections and user list and

then confirm

SCN Admin UI – Provisioning Progress

– Click the Request Provisioning button:

• The status will show progress of submission of provisioning requests to

the provisioning queue

• Once all are submitted you click Return to Provisioning button

– You will see a summary display with a status bar showing progress of the

submission of provisioning requests into the provisioning queue.

53

Part 10 - MOM (Mail Onboarding Manager)

What is MOM?

– Enables customer's SmartCloud Notes Administrator to migrate Notes mail files

themselves

– It is a single executable that can be installed on a Window server, and

communicates with the SCN service via https using REST APIs.

– The administrators configures the tool to access on-premises Domino directory

and mail servers / mail databases using a server ID that has relevant access.

– Other methods are too complex for customers to do themselves

– OPT/OTT tools were developed as an IBM service asset and not end users tooling

– Migrators can select users, configure settings and provision users form within the

Onboarding tool

– Migrating is "point and click" experience

– Minimal client configuration

– Tool is downloaded from the web and has automatic updates so that services

updates are automatically supported

Mom Architecture

Figure 26 - Mail Onboarding Architecture (MOM)

54

MOM Considerations

– How well prepared is my company for migrations?

– How complex is my on-premises environment?

– What type of migration is best for my network topology?

– Does my Domino Admin have the time to manage the transfer?

– What kinds of command and control do I need to manage migration?

Login

– Browse to the URL of the MOM server

– http://<url_to_mom_server>:8080

– Login the same way you login to the cloud using an account that has the

Administrator role

Installation and Setup

– Enter login credentials (usually email/password)

– Enter Domino Directory

– Enter Domino credentials

– Summary of information submitted

Figure 27 - Install and Setup

Create Groups

– List is created from on-premises users who are eligible for migration to the Cloud.

– Select 'Create New Transfer Group'

– Add Name of Group

– Select users you want in group and drag over to group

55

Figure 28 - Create Group

Create Settings

– For every group of users, you need settings for each.

– Select from a variety of settings and give it a name

Figure 29 - Create Settings

56

Create Settings

– Select Subscriptions

Figure 30 - Select Subscriptions

57

Create Settings

– Transfer Options

Figure 31 - Transfer Options

58

Create Settings

– Mail template/Extension Form

Figure 32 - Mail Template/Extension Form

59

Create Settings

– Use pre-transfer instructions (optional)

Figure 33 - Pre-transfer Instructions

60

Create Settings

– Post-provision instructions (mandatory)

– Last message user will receive in old inbox

– Give instructions on how to connect to new mail file

Figure 34 - Post-Provision Instructions

61

Create Settings

– Review button for summary of settings

– Click Continue to name settings group

Staging - Upload and Provision (The View)

– Set of users along with settings that are ready to migrate

– Option to start immediately or schedule transfer

Figure 35 - The View

Staging - Upload and Provision (List View)

– More detailed status of each file

Figure 36 - The List View

62

Mail Onboarding Manager Facts

– REST API interface to onboarding

– User Interface designed by IBM Design Team

– Major UX initiative for IBM Connections Cloud

– Continuous Delivery Model

– User and customer feedback, issues are treated as priorities

Download the Mail Onboarding Manager

– Accessible by administrators of any organization with SmartCloud Notes or

Connections Cloud S1 subscriptions

Figure 37 - Download MOM

YouTube Link to MOM demonstration:

https://www.youtube.com/watch?v=hek4q4LEqbI

63

Part 11 - SmartCloud Upgrade Factory (SCUF)

Why Use SCUF?

SCUF compliments existing services offerings for Messaging Data Migration. Best

method when customer wants to move fast at minimum cost.

Figure 38 - Migration Options

Why SmartCloud Upgrade Factory

* Allows customers to move to SmartCloud Notes from Exchange or Domino rapidly at a

low cost. Pricing is based on per user basis.

* Available to ALL customer who have purchased IBM Verse.

* Automated review of your current mail boxes with recommended remediation

* Full Fidelity Mail migration, including email, calendar and to-dos.

* Provides an easy to use pricing tool available to the field for pricing and estimates

upgrade duration.

* Includes Level 2 Help Desk during the migration.

* Personalized assistance with onboarding and provisioning

* Integration with existing on-premise Exchange or Domino environment to ensure users

can communicate.

64

Sample Pricing Scenarios

Figure 39 - Pricing Scenarios

SCUF simple Migration Path (How It Works)

Figure 40 - How SCUF Works

65

What does a customer need to do?

– Make available the current mail administration team

– Provide IBM access to the Exchange or Domino environment

– Ensure environment meets the minimum requirements for SmartCloud mail

– Provision and configure the SmartCloud account https://ibm.biz/BdFfLs

– Continue to manage and administer current environment until upgrade is complete

– Put into place a temporary coexistence solution

– Schedule and prepare 1,500 (MS) or 2500 (Domino) mailboxes per week

– Provide first level support to users during the transition

– Own communications, training and enablement for users during the project

Project Roles and Responsibilities

Figure 41 - IBM/Customer Roles & Responsibilities

To meet SCUF Requirements

– Assumes the customer meets the technical requirements of Connections Cloud

– If they do not, contact a Solution Architect or other local ISSC representative for

a customer estimate

– Customer must be compliant with the SCUF readiness checklist

https://ibm.biz/BdE26B

66

Customer Prerequisites

– Customer is responsible for remediation of non-compliant mailboxes or

environmental components prior to and during the project

– Customer provides the required hardware/systems needed to create a hybrid

environment and upgrade users. Customer may elect to procure a SoftLayer

environment to house the hybrid environment.

– For Exchange: IBM will move 300 mail files per day, 5 days per week

– For Domino: IBM will move 500 mail files per day, 5 days per week

– Average mailbox size is 500Mb

– IBM will require remote access to the customer environment to manage the

transition

– Customers need to ensure adequate help desk support to accommodate 1500/2500

users provisioned per week

– Only one Active Directory Domain is supported

– Public Folders and PSTs will not be migrated

– Resource Reservations is out of scope

Migration Flow (Who Does What Activities?)

Figure 42 - Activity Chart

67

Part 12 - Comparing Migration Options & Processes

Media Transfer

– Best used when moving high data volumes in short period of time

– Requires Industry Cloud Solutions (ICS) Engagement

FTP Upload

– Same tool and onboarding preparation as media transfer

– Transfer method is difference (Electronic vs Physical)

– Requires Certified Business Partner or ICS Engagement

When to use SmartCloud Notes Service-Only

Figure 43 - SmartCloud Notes Service-Only

The diagram in Figure 42 displays the criteria and requirements for choosing SmartCloud

Notes Service-Only option.

68

When to use SmartCloud Notes Hybrid

Figure 44 - SmartCloud Notes Hybrid

The diagram in Figure 43 displays the criteria and requirements for choosing SmartCloud

Notes Hybrid option.

Why Use OPT/OTT

– Best suited for large scale migrations

– Supports the ability to migrate users on USB which can be much more efficient

than using FTP or MOM for a large number of big mail files

– A single 8TB drive can possibly hold all of your mail files for migration

– OPT has more configuration options than MOM, therefore, can be adapted to non-

standard environment/requirement

– OPT has the ability to work with multiple Domino domains, MOM can only

migrate users from a single domain

– Business Partners/ICS have created tooling in conjunction with OPT/OTT to

create composite dashboards for multi-site migrations

– Certified Business Partners and ICS specialists are very knowledgeable and can

assist with the migration

– OPT/OTT but it works extremely well for its designated purpose and MOM tool

is not as flexible with fewer points of control in the process

– Note: It is certainly possible that a project might combine the use of OPT / OTT

and MOM tools depending on specific requirements

– Running OPT as early as possible can be preventive maintenance because it

usually uncover activities that the customer need to perform

69

Why Use MOM

– OPT/OTT requires a Certified Business Partner or ICS which can be expensive

– OPT/OTT requires the coordination of several different tools/technology stack

– FTP or USB, SmartCloud Notes Administration Web UI, SmartCloud Integration

Services (SCIS) to do bulk provisioning. This complexity is hidden by the

Business Partner/ICS professional but this method has many moving parts

– Other migration processes can be too complex for customers to do themselves

– 'Jump Start' participants have found process overwhelming

– Multiple tools, OPT/OTT, SmartCloud Notes web admin 3rd party tools

– FTP requires firewall changes

– OPT/OTT were developed as an IBM services asset and not end user tools

– Not internationalized

When to Use What Migration Tool

Figure 45 - MOM versus OTT

MOM - SCUF - OPT/OTT - White Glove

Figure 46 - Migration Options

70

Bulk User Provisioning

Bulk User Provisioning is a service that is available through the integration and migration

site to create new accounts in the cloud environment. This function does not migrate data

and accounts. For data migration, check the migration options section of this document.

Bulk User Provisioning saves you time and automate the administration of your cloud

subscriptions and subscribers (users). It is achieved by setting up an on-premises

integration client and uploading a comma separated values(csv) file to the Enterprise

Integration Site as shown in the figure x below.

Figure 47 - Bulk User Provisioning

The integration client is a computer system (can be a virtual machine) that connects to

your IBM Domino Directory, Microsoft Active Directory, Tivoli Directory Server, or any

other LDAP source. The integration client can be an administrative workstation that just

creates the csv file or it can be a full function server that hosts IBM Security Directory

Integrator to read changes from the corporate directory automatically.

The IBM Softlayer cloud can host the integration client with both setup types, removing

the need for additional hardware costs, and risks of hardware failure. The integration and

migration site (FTP Server) allows customers upload provisioning files over an

authenticated SSL encrypted channel.

71

Migration Process

On-Premises - this is where the source mail files are located

Staging - ICS/BP will add this to customer environment. (OPT/OTT is installed here)

FTP Upload - this is where files are transferred (yellow zone)

SmartCloud Notes Admin - Users are managed via Admin

SmartCloud Notes Service - final destination for user mail files

Figure 48 - Mail Migration Diagram 1

1. Create Hybrid connection to the Cloud

2. Establish Staging server

3. Identify group of users to migrate

4. Pre-check selected users for obvious issues

5. Go to SmartCloud Notes Administration to create migration request which will create

6. encryption key to encrypt data that will be send to service

7. Go back to Staging and create replicas of selected users

72

Figure 49 - Mail Migration Diagram 2

8. OTT will run additional quality checks

9. OTT will do a sync to make sure new replicas unread marks are up to date

10. Encrypt the files before the transfer to SmartCloud Notes

11.Optional: Pre-notify end users

12. FileZilla requires Port 990 and has its own firewall requirements

13. Go to SmartCloud Notes Admin, click button to indicate upload is complete and

ready to proceed

14. Files will be decrypted from FTP landing zone, virus scans will run and wait for

further instructions

15. Migrator must monitor to ensure processes are completed

73

Figure 50 - Mail Migration Diagram 3

16. Migrator can select which users that want to provision

17. Choose Subscriptions and entitlements

18. Choose mail templates, language preferences, initial password

19. SmartCloud Notes Service will take that request and move and create the users

20. SmartCloud Notes Service will update the home server in the Domino Directory

indicating the user is no longer located on-premises but in the Cloud

21. Catchup Replication will initiate to get any mail which was delivered while the

transfer was in process

22. Notify end users which is the last email stating the users have been move to the Cloud

74

Please Note

IBM’s statements regarding its plans, directions, and intent are subject to change or

withdrawal without notice at IBM’s sole discretion.

Information regarding potential future products is intended to outline our general product

direction and it should not be relied on in making a purchasing decision.

The information mentioned regarding potential future products is not a commitment,

promise, or legal obligation to deliver any material, code or functionality. Information

about potential future products may not be incorporated into any contract. The

development, release, and timing of any future features or functionality described for our

products remains at our sole discretion.

Performance is based on measurements and projections using standard IBM benchmarks

in a controlled environment. The actual throughput or performance that any user will

experience will vary depending upon many factors, including considerations such as the

amount of multiprogramming in the user’s job stream, the I/O configuration, the storage

configuration, and the workload processed. Therefore, no assurance can be given that an

individual user will achieve results similar to those stated here.