WIXLIB

2Calculating Hardware RequirementsManaged systems per serverAgent Handler scalabilityAdding distributed Agent Handlers to your managed environment can help you scale your network.However, as the following figure shows, adding numerous Agent Handlers might result in diminishingreturns. This is the result of the fact that Agent Handlers must be in constant contact with the ePolicyOrchestrator database, and this connection can consume a significant amount of bandwidth.Figure 2-2 Number of managed systems by number of Agent HandlersTable 2-3 Client systems managed by ePolicy Orchestrator 4.6.0 with 1 hour ASCINumber of distributed Agent HandlersFour-core Agent HandlerEight-core SQL server164,8002137,400373,800459,400561,200Due to the bottleneck on the database server, McAfee recommends distributing up to three AgentHandlers to ePolicy Orchestrator for a network site if the database server has eight cores or fewer.If the ASCI value is more than one hour, multiply the number of client systems by your ASCI value.12McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

3Bandwidth UsageThis section identifies and describes the network traffic generated by ePolicy Orchestrator and itscomponents in a managed environment. It also covers product tuning information to help you balancebandwidth resources with the needs of the product.Use this information when customizing your deployment strategies and policy settings, to maximizenetwork efficiency and ensure that you do not exceed the bandwidth limitations of your environment.ContentsBandwidth requirements for initial deploymentBandwidth requirements to deploy managed productsBandwidth recommendations for repository distributionBandwidth requirements for initial deploymentWhen implementing ePolicy Orchestrator in your environment, you must distribute agents,components, and security products to manage and protect the systems on the network.Agent deployment and bandwidthDuring the initial setup of the managed environment, deploying the agent generates enough networktraffic that we recommend planning the deployment. Although the installation package for the agent issmaller than those of other products (such as VirusScan Enterprise), the agent must be deployed toeach client system you want to manage.This table shows the total bandwidth used on an ePO server, client system, and database server foragent 4.6.0 deployment.Table 3-1 Agent 4.6.0 deploymentAgent deploymentTotal (MB)Tx (MB)Rx (MB)ePolicy Orchestrator server5.044.830.21Client system4.640.044.60Database server0.420.180.24Actual deploymentThe first and most extensive use of bandwidth occurs when the agent installation package is deployedto client systems. You can deploy the agent installation package from the ePolicy Orchestrator consoleto sites, groups, or systems in the System Tree. Regardless of the method you use, deploying theagent installation package over the network generates traffic to each system.Base the agent deployment on the number of client systems you plan to manage, their location in thenetwork topology, and the amount of bandwidth you have available between the ePO server and thesesystems.McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide13

3Bandwidth UsageBandwidth requirements to deploy managed productsMcAfee recommends deploying agents: In stages — Do not push network utilization over 80% at any time for a given segment of resources. To individual sites or groups — This is especially important if you have more bandwidth-limitingfactors such as slower connections between geographic locations.Location of network impactAgent-deployment traffic occurs directly between the ePolicy Orchestrator server and the systems towhich the agent is deployed.Bandwidth requirements to deploy managed productsDeploying security products such as VirusScan Enterprise to client systems can be the mostbandwidth-intensive part of setting up a managed environment. Like the agent, security softwaremust be installed on each system you plan to manage.This table shows the total bandwidth (in megabytes) used to deploy specific managed products, aswell as the data transmitted and received by the ePolicy Orchestrator server, a client system, and thedatabase server.Table 3-2 McAfee product deployment14ProductDeploymentePO serverSQL serverClient tal(MB)Tx(MB)Rx(MB)Diskspace(MB)Agent ointEncryption forFiles andFolders ointEncryption forPC 4.494.66110.661.30109.36531.41Host Data Loss .2412.47126.78Host 13.100.1312.9743.02McAfeeNetworkAccess 1616.51MOVE-AV y 4.3911.19145.471.59143.88610.94McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

3Bandwidth UsageBandwidth recommendations for repository distributionTable 3-2 McAfee product deployment (continued)ProductDeploymentePO tal(MB)Tx(MB)Rx(MB)Diskspace(MB)Policy 2646.31Rogue System 5.74Detection 4.6.05.530.210.310.150.165.440.065.375.46Site 4.7315.43Solidcore 5.1.0 3.96320.555.2597.19SQL serverClient systemMethods to minimize impact when deploying productsConsider these suggestions to minimize traffic generated by deploying products. Deploy the product to segments of the System Tree, rather than all systems at once. For example,schedule the deployment task to run for one group at a time. Use randomization intervals to distribute the deployment to a group over a period of time. Schedule the deployment task to run at local time, which is the default setting. This is helpful ifyour enterprise has offices in different time zones. Create and configure distributed repositories to localize network traffic during product deployment.Before running the deployment task, replicate the deployment package from the master repositoryto the distributed repositories. The deployment task generates traffic between the agent and thenearest repository only. However, after an installation, the agent sends properties to the server.Updating from the closest distributed repository localizes the traffic for product deployment.Bandwidth recommendations for repository distributionIf the ePO server is managing systems across the Wide Area Network (WAN), McAfee recommendsthat you create distributed repositories on each Local Area Network (LAN) for client updates.McAfee recommends that you create at least one distributed repository per LAN.Number of distributed repositoriesSystems in LANNetwork Bandwidth (LAN)100 Mbps1 Afee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide15

3Bandwidth UsageBandwidth recommendations for repository distributionSystems in LANNetwork Bandwidth (LAN)100 Mbps1 Gbps20,00020230,000303Recommendations for the serverIf WAN bandwidth is 6 Mbps, approximately two distributed repositories are updated per minute.McAfee recommends following these steps to avoid network bandwidth saturation.1Create an incremental replication task for each distributed repository in each LAN.2According to bandwidth (WAN) in Mbps, set each task to run sequentially at the minimum of theminutes of the corresponding randomization interval, to avoid overlap.Bandwidth (WAN)Randomization interval (minutes)6 Mbps15 Mbps24 Mbps33 Mbps42 Mbps51 Mbps6Recommendations for each client1Add the local distributed repository to the repository list in the agent policy.2Select the repository by Ping Time.3Create an agent update task with a randomization interval according to this table.Table 3-3 Recommended interval (minutes) for 1 Gbps network bandwidthSystems in LANDistributed repositories in 201010,00060402020,000120804030,00018012060Table 3-4 Recommended interval (minutes) for 100 Mbps network bandwidthSystems in LAN16Distributed repositories in LAN123451,00060302015102,00012060403020McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

3Bandwidth UsageBandwidth recommendations for repository distributionTable 3-4 Recommended interval (minutes) for 100 Mbps network bandwidth (continued)Systems in LANDistributed repositories in 501007550McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide17

3Bandwidth UsageBandwidth recommendations for repository distribution18McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

4Concurrent UsersThe ePolicy Orchestrator server is able to handle multiple user (http) requests. McAfee has calculatedthe results of the average page load time versus the number of concurrent user requests with data of100,000 managed nodes plus 13,000,000 events and 100,000 RSD Detected System Properties.Concurrent users and the effect on dashboard page loadingPage load time is the time it takes the ePolicy Orchestrator server to respond to a user request to fullyload a dashboard page in the web browser.Test scenario A number of users concurrently launched a specific dashboard. When the dashboard was fully loaded, each user refreshed the dashboard immediately andrepeated this 20 times.The following chart shows the average dashboard page load time across all dashboards for all testedproducts (those listed in the "Which products were tested" section in the Purpose of this guide. Adetailed listing of load times by user for each product is included in Appendix A: Complete dashboardpage load time by number of users.Average dashboard load time by number of usersMcAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide19

4Concurrent UsersConcurrent users and the effect on dashboard page loading20McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

5Database SizingWhen planning for hardware purchase, an important factor to consider is the amount of storage spaceyou will need.Beyond the initial installation of ePolicy Orchestrator to a server, the portion of your environment thatexperiences the most growth is the database.Consider the data in these tables to plan appropriately for your database storage needs.Table 5-1 ePolicy Orchestrator installation sizeRequirementSize (MB)Database826.25Database transaction log235.56Total1061.81Table 5-2 Database size requirementsRequirementSize (KB)For a client system30.72For an event1.74Calculating database size requirementsTo calculate the size of the database, use this formula: Installed database size (number of clients xclient system size) (number of events generated x event size).For example, in an environment with 1,000 clients and 10,000 events, the calculation is 1061.81MB (1,000 x 30.72KB) (10,000 x 1.74KB) 1108.80MB.The following table lists the size of the database, based on the number of events generated and thenumber of client systems being managed. Use this data to plan appropriately for your storage needs.Table 5-3 Database size by number of events and client systemsEventsSystem nodes5001,000 5,000 10,000 50,000 100,000 150,00 200,000 250,000 300,00001,077 001,094 001,111 001,128 001,145 001,162 001,179 ee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide21

5Database SizingTable 5-3 Database size by number of events and client systems (continued)EventsSystem nodes500221,000 5,000 10,000 50,000 100,000 150,00 200,000 250,000 300,00070,0001,196 001,213 001,230 000 1,247 000 1,264 000 1,281 000 1,298 000 1,315 000 1,332 000 1,349 000 1,366 000 1,383 000 1,400 000 1,417 ee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

AAppendix: Dashboard page load timesThe following table provides a detailed list of dashboard page load times by product and number of users.Page load time is the time it takes the ePolicy Orchestrator server to respond to a user request to fullyload a dashboard page in the web browser. For more information on the test scenario in which thisdata was generated, see Concurrent users and the effect on dashboard page loading.Table A-1Dashboard page load times by number of usersDashboardLoad time (seconds) by number of users15102030405060708090100Audit1.27 2.82 5.07 10.64 15.48 23.78 30.10 33.05 40.42 50.16 52.69 55.68DLP: StatusSummary1.72 2.85 6.44 11.99 17.77 23.91 32.35 34.07 39.13 45.77 52.54 63.74EWS Dashboard1.33 4.48 5.43 10.02 15.80 21.57 23.60 31.33 38.30 45.38 57.19 53.22EndpointEncryption1.11 2.90 4.93 10.92 15.34 23.03 28.74 35.54 41.01 43.29 45.02 58.66ExecutiveDashboard1.23 3.13 5.04 9.62GroupShield forExchange 7.01.48 2.67 5.56 10.33 16.78 20.16 28.90 30.76 38.36 52.23 47.54 56.67Host IPS:Dashboard1.35 4.47 6.73 10.48 15.87 22.73 30.55 35.72 42.15 50.10 54.17 58.4415.11 19.52 24.58 31.09 41.15 46.16 55.16 57.25Host IPS: Triggered 1.50 2.64 5.56 11.12 15.98 21.82 32.78 36.08 43.34 52.90 53.57 64.73SignatureMEG ActivityDashboard1.16 4.52 6.37 10.02 16.42 23.34 30.57 34.86 42.82 48.45 52.84 60.20MEG Server Status1.07 2.51 4.36 10.09 15.78 21.84 27.77 27.60 39.35 47.19 57.31 60.14MRA Rollup: RiskAdvisory1.49 2.75 4.77 11.34 16.18 20.16 29.11 30.66 39.04 44.53 52.52 52.44MRA: Threat Action 1.31 2.58 4.62 9.87Advisory15.40 20.46 28.80 29.31 42.19 42.91 56.42 58.38MRA: ThreatDashboard1.43 2.83 4.81 10.82 15.75 20.88 29.68 32.15 39.71 36.50 54.20 58.71MVM Summary1.33 2.55 4.51 10.61 16.24 20.22 29.28 31.07 41.13 42.01 48.87 56.68MVM WebAssessmentSummary1.58 2.70 5.19 10.99 16.36 23.42 26.23 32.18 40.03 44.66 52.19 59.94MWG 6.xDashboard1.33 2.70 4.15 10.62 16.89 23.44 32.15 31.63 39.39 40.53 55.32 54.66MWG 7 Dashboard1.39 2.61 5.06 10.47 16.71 23.32 30.87 31.28 38.03 41.33 47.24 57.94McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide23

AAppendix: Dashboard page load timesTable A-1Dashboard page load times by number of users (continued)DashboardLoad time (seconds) by number of users15102030405060708090100NAC Summary1.34 2.66 5.24 11.74 16.92 23.45 30.49 34.81 36.48 46.53 51.24 57.20NSP NetworkSecurity PlatformSummary1.45 2.88 5.38 11.44 16.45 24.28 26.96 36.38 41.98 54.11 53.39 58.24PA: ComplianceSummary1.69 2.61 5.77 10.93 18.20 23.89 29.31 31.59 44.11 45.68 55.62 61.82PA: MS PatchStatus Summary1.56 2.56 5.53 10.40 17.62 23.02 30.08 34.13 43.67 39.64 50.99 55.23PA: PCI Summary1.87 2.92 6.00 11.28 16.70 23.47 29.09 35.71 39.93 44.42 52.08 53.57PortalShield forSharePoint1.34 2.88 5.33 10.12 15.74 23.20 28.99 33.69 41.68 36.61 53.86 62.71ProductDeployment1.55 2.90 5.77 9.75RSD Summary1.45 2.89 5.72 10.76 16.12 22.55 28.43 32.06 39.05 38.05 47.32 62.90SAE : Activity1.44 2.58 5.42 10.76 16.44 22.04 26.54 31.67 40.33 46.12 53.73 60.44SAE : Authorize/Prohibit Lists1.37 2.52 5.19 10.70 16.17 22.25 30.47 37.71 34.83 47.44 53.83 55.34SAE : ContentSummary1.49 2.55 5.31 10.24 16.75 21.10 28.26 31.40 37.57 47.48 53.18 59.97SAE : SecuritySummary1.38 2.65 5.41 10.81 17.18 21.61 30.90 31.12 41.92 45.52 47.01 51.7416.96 23.79 31.69 32.38 39.96 50.54 49.02 60.47SAE : Single1.63 2.50 5.69 10.51 16.16 22.32 29.00 34.29 43.04 50.68 53.70 51.12Rating Factor Block/WarnSAE : Warned/Blocked1.32 4.01 5.21 10.79 15.25 22.67 27.87 36.54 44.78 40.95 55.07 63.10Solidcore:Application Control1.43 4.38 5.20 11.05 16.08 23.55 62.26 35.70 42.62 46.55 55.46 63.40Solidcore: ChangeControl1.44 2.49 5.44 10.47 16.99 22.46 29.10 32.41 41.28 41.56 56.56 57.98Solidcore: Integrity 1.64 2.64 6.19 12.33 17.35 23.99 28.73 33.48 37.31 48.43 50.51 55.16MonitorThreat Events1.57 2.56 5.09 9.5915.79 23.02 30.55 32.17 44.82 49.60 51.74 54.60Trends1.50 2.45 5.60 10.15 17.21 23.41 30.28 37.30 41.51 45.70 59.87 59.57VSE: CurrentDetections1.64 2.52 5.65 10.22 17.48 23.67 28.56 35.29 40.44 43.86 56.44 61.06VSE: Trending Data 1.47 2.47 5.64 10.22 17.54 21.79 28.13 31.96 42.04 50.69 51.52 63.9324ePO Summary1.43 2.80 5.96 10.81 15.05 22.94 29.52 37.47 41.17 51.32 51.34 61.81Average Page LoadTime (seconds)1.44 2.90 5.39 10.64 16.41 22.51 30.03 33.27 40.67 45.78 52.78 58.43McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

IndexAdocumentation (continued)typographical conventions and icons 5about this guide 5CMconventions and icons used in this guide 5McAfee ServicePortal, accessing 6DSdocumentationaudience for this guide 5product-specific, finding 6ServicePortal, finding product do

Endpoint Encryption for Files and Folders 4.0.0 Endpoint Encryption for PC 6.1.0 GroupShield for Microsoft Exchange 7.0.1 . McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 23. Table A-1 Dashboard page load times by number of users (continued) Dashboard Load time (seconds) by number of users .