WIXLIB

Configuration Overview Guide

4/21/2016 Blackbaud NetCommunity 7.0 Configuration Overview US 2016 Blackbaud, Inc. This publication, or any part thereof, may not be reproduced or transmitted in any form orby any means, electronic, or mechanical, including photocopying, recording, storage in an information retrievalsystem, or otherwise, without the prior written permission of Blackbaud, Inc.The information in this manual has been carefully checked and is believed to be accurate. Blackbaud, Inc., assumesno responsibility for any inaccuracies, errors, or omissions in this manual. In no event will Blackbaud, Inc., be liablefor direct, indirect, special, incidental, or consequential damages resulting from any defect or omission in thismanual, even if advised of the possibility of damages.In the interest of continuing product development, Blackbaud, Inc., reserves the right to make improvements inthis manual and the products it describes at any time, without notice or obligation.All Blackbaud product names appearing herein are trademarks or registered trademarks of Blackbaud, Inc.All other products and company names mentioned herein are trademarks of their respective holder.ConfigOverview-2016

ContentsConfiguration Overview1The NetCommunity Server Service Oriented ArchitectureSecurity Considerations12Firewall Configuration2Windows Server ConsiderationsPerformance ConsiderationsRecommended Default ConfigurationService Security Requirements3NetCommunity Web Server3399Blackbaud Database12The Raiser’s Edge Database13RE7Service Web Service/BBAppfx Web Service14Plugin Service WS16Performance and Custom Configuration Related SettingsBlackbaud NetCommunity Web Server1717

chapter 1Configuration OverviewThe NetCommunity Server Service Oriented Architecture1Security Considerations2Windows Server Considerations3Performance Considerations3Recommended Default Configuration3Service Security Requirements9Performance and Custom Configuration Related Settings17The NetCommunity Server Service OrientedArchitectureBlackbaud NetCommunity Server is built on a Service Oriented Architecture (SOA).The following table lists the services involved in the application:NameTypeBlackbaud NetCommunityASP.Net Web ApplicationThe Raiser’s Edge DatabaseSee The Raiser’s Edge documentationBlackbaud NetCommunity DatabaseSee Blackbaud NetCommunity systemrequirements documentRE7Service Web Service for The Raiser’s Edge Blackbaud CoreComponents (includes BBAppfx service)ASP.Net Web ServiceThe Raiser’s Edge Client ApplicationWindows ApplicationBlackbaud Management ConsoleWindows ApplicationThe Raiser’s Edge deploy folderDirectoryPluginService WSASP.Net Web ServiceBlackbaud Payment Service (BBPS)Web ServiceMail Service WSASP.Net Web Service

2 CHAPTER 1In case of client hosted installations, most of these services are deployed at the Customer site. Thereare many possible configurations for the actual deployment of the various services. The exactconfiguration for a particular customer varies based on a number of factors:lThe existing IT/web/database infrastructure of the customerlThe number of machines available to the customerlThe customer’s ability and willingness to add new hardwarelThe customer’s license requirements with regard to SQL Server and Windows ServerlThe customer’s preference for firewall, router, and domain controller topologylThe customer’s preference for accessibility of various parts of the applicationThere is not a “one size fits all” configuration that works for every customer. To enable our customerand services team to best decide about deployment issues, this document describes the requirementsfor each service along with notes about any special security considerations to take into account.Note: Although this document includes potential performance information, note that performanceand response times are affected by many factors related to hardware (such as RAM, processor speed,and hard disk subsystem performance), network configuration (such as NIC performance, cable type,topology, operating system, parameters, and traffic), and the database (such as size, number ofconcurrent users, and the type of activities each user performs).Security ConsiderationsSecurity is a sensitive topic these days, especially related to Internet applications. The complexity ofthe Blackbaud NetCommunity server system, with its many interrelated services, means one must payparticular attention to security issues. For each service, there are a number of security issues to address:lIs the service visible to the public Internet?lOn which side of a firewall should the service be located?lIf behind a firewall, which ports should be open to access the service?lDoes the service need to access other services over a public network?lCan the service be locked down to intranet users only?lAre secure communications required with the service?Each service has different requirements regarding the accessibility of the service and the need forsecure communication with the service. This document describes in detail the requirements for eachservice and suggests possible ways to secure the service.Firewall ConfigurationThe concept of a firewall is an essential part of any web application deployment. Firewalls can beimplemented in software or hardware, and there are many possible configurations. To isolate trafficfrom the public Internet, a single firewall can be used at the perimeter of the network. To add adegree of safety, one popular configuration is to employ a secondary firewall, which creates a DMZzone to further isolate the public Internet server from the internal network. The key to the effective use

C ON F IGURA TION O VERVIEW3of firewalls is that they be correctly configured to allow only the minimum access required. Thisdocument has an “Accessible From” section and “Needs Access To” section for each service in theBlackbaud NetCommunity Server application. To provide guidance when configuring firewalls, thesesections describe the minimum required access to and from each service.None of the customer site web services require access from the Internet, only the BlackbaudNetCommunity application. If your firewall supports rules based on only port numbers (as opposed tospecific URLs), you may want to create a second website in IIS that uses a port other than 80, such as8001. Using the firewall policy, you can restrict access to port 8001 and only allow port 80 to be opento the Internet.Windows Server ConsiderationsWorker Process IdentityThe worker process model can be configured by establishing one or more application pools. You canconfigure each application pool to run under a different identity. The default application pool isconfigured to run as the user “NT Authority\Network Service”. Therefore, when discussing the identityof the worker process in this document, any reference to the user account “ASPNET” should beconsidered the identity used by the worker process of the application pool configured for the virtualdirectory, which by default is “NT Authority\Network Service”.Performance ConsiderationsBecause an unpredictable number of users with unpredictable usage patterns access the BlackbaudNetCommunity web application, this application is the major area of concern. In addition, becauseBlackbaud NetCommunity sometimes requests data from the RE7Service web service (The Raiser’sEdge) or the BBAppfx web service (Blackbaud Core Components), the service is likely to be a hotspotfor performance. The exact performance characteristics for the application vary, based on the numberof community users, the kinds of content the customer defines, the mix of pages the customer creates,and the usage patterns of the community users.The Blackbaud NetCommunity Server SOA scales up and scales out. This means the BlackbaudNetCommunity web application and the entire web services support is load-balanced across multiplemachines. If the website becomes popular to the point of providing unacceptable response times, youcan add a second or third web server to split the load. Likewise, if the RE7Service web service orBBAppfx web service becomes a bottleneck, you can add other machines in that role.Recommended Default ConfigurationThe SOA provides flexibility so you can move services between machines as required. However, themore machines involved, the greater the cost for configuration and possibly software licenses.Alternatively, a customer may want to run the Blackbaud database on an existing SQL Server instanceand dedicate the web server to run the IIS/ASP.Net services. Each configuration has trade-offs withregard to complexity, security, and resources.

4 CHAPTER 1The recommended default configuration should be considered just that — a recommendation toestablish a baseline configuration. Each customer may choose to customize this configuration basedon specific requirements.The minimum recommended baseline consists of the following machines:— Fire Wall from Internet to DMZ —Open Ports: 80, 443, 8001 (Intranet Addresses ONLY!)DMZServer 1Blackbaud NetCommunity web application (port 80, 443) Blackbaud Core Components (install on Server 1 forThe Raiser’s Edge 7.x solutions)— Fire Wall from DMZ to Intranet —Open Ports: 80IntranetServer 2RE7Service Web Service for The Raiser’s Edge (port 80), or Blackbaud Core Components (install on Server 2 fornon-Raiser’s Edge 7.x solutions) Plugin Service WS (port 8001)Server 3The Raiser’s Edge SQL Server database or Blackbaud databaseFor visual assistance in deciding the configuration for your organization, see the following diagram sof Blackbaud NetCommunity’s architecture for The Raiser’s Edge. For installation information, seethe Infinity Platform Installation and Upgrade Guide.

C ON F IGURA TION O VERVIEW5

6 CHAPTER 1For visual assistance in deciding the configuration of Online Campus Community for yourorganization, see the following diagram of Blackbaud NetCommunity’s architecture for OnlineCampus Community. For installation information, see the Infinity Platform Installation and UpgradeGuide.

C ON F IGURA TION O VERVIEW7

8 CHAPTER 1For visual assistance in deciding the configuration of Online Admissions at your organization, see thefollowing diagram of Blackbaud NetCommunity’s architecture for Online Admissions. Forinstallation information, see the Infinity Platform Installation and Upgrade Guide.

C ON F IGURA TION O VERVIEWService Security RequirementsNetCommunity Web ServerService TypelASP.Net web applicationAccessible FromlPublic Internet (for donor facing pages) (HTTP HTTPS)lIntranet (for administrative pages)Note: Administrative pages may be optionally made available over the public Internet. If you plan tohave the administrative site available over the Internet, we recommend you enable SSL for youradministrative pages. For information about how to enable SSL, see the Infinity Platform Installationand Upgrade Guide.Needs Access To9