Disaster Recovery Zimbra NE 5.0.17

[hspcd]

We have two data centers, one is a primary/production data center and the other is our DR data center located approximately 600 miles away. We are running ZNE 5.0.17 in a single-server configuration in our Primary center as a VM under XenServer. We have SAN snaps and remote replication of the VM and the /opt/zimbra SAN volume that are stored at the DR center. We're working on a bigger DR plan and we're trying to figure out the best way to recover our Zimbra platform if our Primary center goes away.

The options I've thought of are listed below, with caveats, and I'm hoping to get some advise from the folks on this forum as to which way to go.

Option 1: Recover with replicated Virtual Machine & Data
Since our Zimbra server is running as a Citrix XenServer VM, and we already replicate (via SAN) the OS volume and the /opt/zimbra volume out to our DR center, we could simply recover the VM with little trouble I think.

Caveat: We would like to have a live Zimbra server running in our DR center to act as a secondary MX host to the outside world so that if our Zimbra server in our Primary center went down (and it wasn't a site-wide outage but something we could fix after several hours) senders' emails would get queued up on the Zimbra server out in our DR center to be delivered to the Primary when it was brought back online.

Option 2: Recover to a running Zimbra server in our DR center
This would depend on whether having a running Zimbra server in our DR site is feasible and recommended. The caveat from the first point is relevant and we'd like to have a 2nd mail server that could take inbound mail through the gateway in our DR center and use it both as a secondary MX host as well as a DR target for fast recovery of mailboxes.

Ideally, we could go with Option 2 since it provides us with a secondary MX host. What do the folks here think?

Thanks,
Clay

[Rich Graves]

If your primary is going to be down for less than a day, I'd just let the mail queue on the sending side. I would rather let my correspondents know that their urgent email has not been received.

I don't see Option 2 as very compelling, but if you really want a secondary MX, 1+2 could be: do a multi-node installation, with a VM at the DR site running LDAP and MTA only. I wouldn't view integrating mailbox role into an always-on DR VM as advisable -- too much room for error. Just run two VMs.

[hspcd]

Rich,
Thanks for your insight. If we did a multi-server install as you recommend, would we be able to restore all mailboxes to the Zimbra server in the DR center if we had a complete site failure at the Primary? Or would it be best to bring up the replicated VM (of the Primary) at the DR center and then route all inbound mail through it?

Thanks

[cmcbride]

In regards to the secondary MX plan with the active server listening at the DR site.... Be aware that it's highly likely that the secondary MX will receive spam emails directly (its a common spam method). Depending on how things are setup this might cause problems. If you have a failover server IP configured as a 2ndary MX but don't want any mail to show up on that server unless there's a failure, then I'd control inbound SMTP via firewall or some other method. Dont add a server as an MX record if you're not willing to have it receive, filter, and route email...