Windows 2008 and Windows 7 Configuration Document … · 4.3 Advanced Simulation - Installation...

Common Document

Configuration Notes for Microsoft Windows Server 2008 R2 and Microsoft Windows 7

Gruppe Deutsche Börse


02.11.10

Table of Contents

1 General 4

2 Supported Windows 2008 / Windows 7 Software Versions and Configurations 5 2.1 Supported OS Software Versions 5 2.2 Supported Windows 2008 / Windows 7 MISS and Workstation Configurations 5

3 Exchange Software compatible with the Windows 2008 / Windows 7 Software Operating Systems 6

3.1 GATE 3.5 Kits 6 3.2 Eurex 13.0 Kits 6 3.3 Xetra 11.0 Kits 7 3.4 CCP 6.0 Kits 7

4 Windows 2008 / Windows 7 – Installation Procedure 8 4.1 Simulation - Installation under Windows 2008 or Windows 7 9 4.2 Production - Installation under Windows 2008 or Windows 7 10 4.3 Advanced Simulation - Installation under Windows 2008 or Windows 7 10

5 Windows 2008 Server Configuration 11 5.1 Installing the Internet Information Services (IIS) 11 5.2 Configuring the Internet Information Services (IIS) 13

6 Creating user groups and users (Windows 2008 MISS Only) 18 6.1 Creating the file transfer group 19 6.1.1 Set rights for ftp groups 21 6.1.2 Assigning the ftp group to the FTP site 22 6.1.3 User Rights Assignments 23

7 Windows 2008 Configuration Issues 24 7.1 Password policies 24 7.2 Definition of Static Routes 24 7.3 Network interface binding order 25 7.3.1 A host with single network interface 25 7.3.2 A host with multiple network interfaces 25 7.4 Firewall Settings 27 7.4.1 Disabling the Windows 2008 Firewall 27 7.4.2 Changing User Account Control (UAC) Settings 28



02.11.10

8 Windows 7 Configuration Issues 30 8.1.1 Disabling the Windows 7 Firewall 30 8.1.2 Changing User Account Control (UAC) Settings 30



02.11.10

1 General

The purpose of this document is to provide the relevant information necessary for the installation of the GATE 3.5, Eurex 13.0, Xetra 11.0 and CCP 6.0 software on the Windows 2008 Server and Windows 7 Operating Systems. In general this includes:

1. The supported Windows 2008 and Windows 7 software versions and configurations (Chapter 2)

2. The Eurex 13.0, Xetra 11.0, CCP 6.0 and GATE software which is Windows 2008 / Windows 7 compatible and the software distribution process (Chapter 3)

3. The Windows 2008 / Windows 7 migration paths, (i.e.) the steps which have to be taken to perform a new installation from Windows 2008 / Windows 7 and subsequently install the GATE 3.5, Eurex 13.0, Xetra 11.0 and CCP 6.0 Software (Chapter 4).

4. Configuration of the Windows 2008 Server (Chapter 5)

5. Standard setup of user groups and user accounts in Windows 2008 (Chapter 6).

6. Known Windows 2008 / Windows 7 installation and configuration issues which may occur (Chapter 7 / 8).



02.11.10

2 Supported Windows 2008 / Windows 7 Software Versions and Configurations

2.1 Supported OS Software Versions

The following Operating System Versions of Windows 2008 (64bit) and Windows 7 (64bit) will be supported: MISS Workstation

(Windows 2008 R2) Workstation (Windows 7)

Operating System Windows 2008 Server R2 (64bit)

Windows 2008 Server R2 (64bit)

Windows 7 Prof. (64bit)

Service Pack N/A N/A N/A Language English English English

2.2 Supported Windows 2008 / Windows 7 MISS and Workstation Configurations

The following MISS/Workstation Combinations will be supported:

Workstation

Miss Server

O

racl

e So

laris

(s

parc

)

O

racl

e So

laris

(x

86

)

W

indo

ws

20

03

Ser

ver

+ R

2 1

)

W

indo

ws

20

08

Ser

ver

+ R

2 1

)

W

indo

ws

XP

2)

Win

dow

s 7

1)

Oracle Solaris

(sparc) supported possible supported possible supported supported

Oracle Solaris

(x86) possible supported supported possible supported supported

Windows 2003

Server R2 1) possible possible supported possible supported possible

Windows 2008

Server R2 1) possible possible possible possible possible supported

1) only 64 bit version 2) only 32 bit version



02.11.10

3 Exchange Software compatible with the Windows 2008 / Windows 7 Software Operating Systems

For the migration to Windows 2008 an update to the existing GATE 3.5 software is required. The Eurex 13.0, Xetra 11.0 and CCP 6.0 kits are already compatible with the new operating systems. The GATE 3.5 Update Kits are available for download from the Eurex, Xetra or CCP website.

The following software kits are therefore required for the installation under Windows 2008 or Windows 7.

3.1 GATE 3.5 Kits

GATE 3.5 Simulation environment:

• GATE 3.5 Simulation Full Kit: GateR35S.msi

• GATE 3.5 Simulation Update Kit: gater35s_upd3.pl

GATE 3.5 Production environment:

• GATE 3.5 Production Full Kit: GateR35.msi

• GATE 3.5 Production Update Kit: gater35_upd3.pl

GATE 3.5 Advanced Simulation environment:

• GATE 3.5 Advanced Simulation Full Kit: GateR35A.msi

• GATE 3.5 Advanced Simulation Update Kit: gater35a_upd3.pl

3.2 Eurex 13.0 Kits

Eurex 13.0 Simulation environment:

• Eurex 13.0 Simulation Full Kit: EurexR130S.msi

Eurex 13.0 Production environment:

• Eurex 13.0 Production Full Kit: EurexR130.msi

Eurex 13.0 Advanced Simulation environment:

• Eurex 13.0 Advanced Simulation Full Kit: EurexR130A.msi



02.11.10

3.3 Xetra 11.0 Kits

Xetra 11.0 Simulation environment:

• Xetra 11.0 Simulation Full Kit: XetraR110S.msi

Xetra 11.0 Production environment:

• Xetra 11.0 Production Full Kit: XetraR110.msi

Xetra 11.0 Advanced Simulation environment:

• Xetra 11.0 Advanced Simulation Full Kit: XetraR110A.msi

3.4 CCP 6.0 Kits

CCP 6.0 Simulation environment:

• CCP 6.0 Simulation Full Kit: CCPR60S.msi

CCP 6.0 Production environment:

• CCP 6.0 Production Full Kit: CCPR60.msi



02.11.10

4 Windows 2008 / Windows 7 – Installation Procedure

Although an upgrade of the Windows 2003 Server to Windows 2008 Server R2 and Windows XP to Windows 7 are supported by Microsoft, Eurex, Xetra and CCP strongly recommends the a new installation of the Operating Systems prior to the installation of the GATE 3.5 and Eurex 13.0, Xetra 11.0 or CCP 6.0 software. The information contained within this document refers to a new installation only and assumes that a network connection between the MISS servers and its respective workstations has been established.

Important:

The “Administrator” account automatically created by the Windows 7 installation is disabled by default. Prior to installing the GATE 3.5, Eurex 13.0, Xetra 11.0 and CCP 6.0 software the Administrator account must be enabled and provided with a password. The Administrator account must be used for the installation of the Exchange software on both the Windows 2008 MISS server and the workstation. The Administrator account in Windows 7 can be enabled by removing the check mark in the following window:

Click Start > Computer (right click) > Manage

Select Local Groups and Users > Users > Administrator (right click) > Properties



02.11.10

When performing the installation of the exchange software from network drivers the following warning may possibly be displayed but can safely be ignored by clicking “Run”.

For detailed information relating to the installation of the GATE 3.5, Eurex 13.0, Xetra 11.0 and CCP 6.0 software please refer to the respective Installation Guides which are available for download from the respective website. 4.1 Simulation - Installation under Windows 2008 or Windows 7

The following section details the steps to be performed for the new installation of the Eurex 13.0 Simulation software (same as for Xetra 11.0 and CCP 6.0).

1. Install Windows 2008 R2 on the MISS or Workstation and/or Windows 7 on the workstation.

2. Install the GATE 3.5 Simulation Kit for Windows: Gater35S.msi

3. Install the GATE 3.5 Simulation Update Kit 3 for Windows: gater35s_upd3.pl

4. In the case of a MISS installation, ensure the Internet Information Services (IIS) are installed (See Chapter 5)

5. Install the Eurex 13.0 Simulation Kit for Windows: EurexR130S.msi or

Install the Xetra 11.0 Simulation Kit for Windows: XetraR110S.msi or

Install the CCP 6.0 Simulation Kit for Windows: CCPR60S.msi



02.11.10

4.2 Production - Installation under Windows 2008 or Windows 7

The following section details the steps to be performed for the new installation of the Eurex 13.0 Production software (same as for Xetra 11.0 and CCP 6.0).


2. Install the GATE 3.5 Production Kit for Windows: Gater35.msi

3. Install the GATE 3.5 Production Update Kit 3 for Windows: gater35_upd3.pl


5. Install the Eurex 13.0 Production Kits for Windows: EurexR130.msi or

Install the Xetra 11.0 Production Kits for Windows: XetraR110.msi or

Install the CCP 6.0 Production Kits for Windows: CCPR60.msi

4.3 Advanced Simulation - Installation under Windows 2008 or Windows 7

The following section details the steps to be performed for the new installation of the Eurex 13.0 Advanced Simulation software (same as for Xetra 11.0).


2. Install the GATE 3.5 Advanced Simulation Kit for Windows: Gater35a.msi

3. Install the GATE 3.5 Advanced Simulation Update Kit 3 for Windows: gater35a_upd3.pl


5. Install the Eurex 13.0 Advanced Simulation Kit for Windows: EurexR130A.msi or

Install the Xetra 11.0 Advanced Simulation Kit for Windows: XetraR110A.msi



02.11.10

5 Windows 2008 Server Configuration

5.1 Installing the Internet Information Services (IIS)

Internet Information Services (IIS) is the web server software included with Windows 2008. IIS isn’t added by default when Windows 2008 is installed. The IIS software must be activated so that the MISS Server can receive reference data files, reports and software files from Eurex, Xetra and CCP.

In order to install the IIS, select the “Turn Windows features on or off” option which can be found by clicking Control Panel > Programs > Program and Features

Under the Server Manager select the option “Roles” and then “Add Roles”



02.11.10

Select the “Web Services (IIS)” role

Select the “FTP Server” from “Select Role Services” to install for Web Server (IIS). All other Web Server settings (default settings) can be removed.



02.11.10

5.2 Configuring the Internet Information Services (IIS)

Start the Internet Information Services (IIS) Manager which can be found by clicking Start > Administrative Tools and expand the tree to reveal the “Sites” branch.



02.11.10

Select the “FTP Authentication” option in the main window and enable the “Basic Authentication” option.

Under the “Sites” option of the Connections window select the “Add FTP Site” option.



02.11.10

Define the FTP site as follows

Modify the Binding and SSL settings to add the IP address of the WAN interface and “Allow SSL” connections.



02.11.10

Now define the users who have access to the FTP server and their appropriate permissions as required. Please Note that the user accounts (described in section 6) require at least WRITE access.

During the installation of the Eurex 13.0 or Xetra 11.0 or CCP 6.0 Kits make sure to change the FTP root directory to match the “Physical path” entered during the definition of the FTP site in the earlier step by clicking the “Change” button.

Based on the example above the following FTP root directory entry should be made.



02.11.10



02.11.10

6 Creating user groups and users (Windows 2008 MISS Only)

The GATE, Eurex, Xetra and CCP software requires that users and groups are created for administrators, file transfer accounts and traders. Administrative users must also belong to the respective ftp group.

Before starting to use or verify the GATE / Eurex / Xetra or CCP Front End installation, the following users and groups should be created.

For each environment create the appropriate ftp groups:

Eurex Xetra

FFM

Xetra

FF2

Xetra

ISE

Xetra

XIM

Xetra

Vienna

CCP

FTP group eurexft xetraft xetra2ft xiseft xximft xwbagft Ccpft

For each environment create the appropriate user account:

Eurex Xetra

FFM

Xetra

FF2

Xetra

ISE

Xetra

XIM

Xetra

Vienna

CCP

Production eurnet xnet51 xnet61 xnet55 xnet57 xnet68 cnet20

Simulation eurnet01 xnet52 xnet62 n/a n/a xnet69 cnet21

Advanced Simulation

eurnet03 xnet53 n/a n/a n/a n/a n/a

GATE requires a group for administration (default: “gategrp”) and for traders (default: “gatetrd”). Administrator users (default: “gateadm”) must belong to the “gategrp” and “gatetrd” groups. The trader users must belong to the “gatetrd” group. If a trader user is also required to be able to trade on the MISS, this user must be also part of the “gategrp” group. Other users, as required, must be members of group "gatetrd". Note: Every user within the gategrp group can start or stop the GATE architecture and all exchange Xervices! User names and passwords must be a minimum of 5 characters in length otherwise the login to GATE is not possible.

For a detailed description of the operation and technical features, see the

• “Eurex Front End Installation Guide 13.0”

• “Xetra Front End Installation Guide 11.0”

• “CCP Front End Installation Guide 6.0”



02.11.10

6.1 Creating the file transfer group

The following section shows how to create the file transfer groups, user accounts and assign the users to the appropriate group. Please note that the following screenshots may differ according to the installation configuration, which you have chosen. The following section explains the creation of users and groups using “Eurex” and the Server Manager.

Click Start > Administrative Tools > Server Manager

Expand the “Configuration” branch to display the “Local Users and Groups” section

Click with the right mouse key on the “Users” entry and select “New User”

The password for each of the accounts will have been provided to you by the exchange.

Please make sure that the options “User cannot change password” and “Password never expires” are selected and the option “User must change password at next logon” is deselected



02.11.10

Click with the right mouse key on the “Groups” entry and select “New Group”

Click the “Add” button to add the newly created users to the eurexft group (Note: multiple users may be entered separated by a “;”)



02.11.10

6.1.1 Set rights for ftp groups

Click Start > Administrative Tools > Local Security Policy and select “Local Policies” followed by “User Rights Assignment”.

Double-click the “Allow log on locally” option and then click the “Add User or Group” option.

Please Note: In order to be able to select the “eurexft” group the “Object Types” button needs to be clicked and the “Groups” box checked. Enter the “eurexft” in the dialogue box.



02.11.10

6.1.2 Assigning the ftp group to the FTP site

Once the ftp group has been created and has the appropriate user accounts assigned, the group has to be given the appropriate rights to access the FTP site created above.

Start the Internet Information Services (IIS) Manager which can be found by clicking Start > Administrative Tools and expand the tree to reveal the “Sites” branch and select the FTP site created in the earlier step (e.g.) Transfer and select the “Edit Permissions” options.

Click the “Security” tab followed by “Edit” button followed then by the “Add” button. Enter “eurexft” into the dialogue box and click the “OK” button.



02.11.10

The following dialogue will now be displayed. Ensure the “Read” and “Write” options are checked and press “OK”.

6.1.3 User Rights Assignments

In addition to the “Allow log on locally” for the ftp group the following user group assignments are required.

User / Group Rights assignment

gategrp Allow log on locally

gatetrd Allow log on locally

gateadm Act as part of the operating system

The “Act as part of the operating system” assignment for the “gateadm” user is assigned in the same was as the “Allow log on locally” described in section 6.

Important!

The “gateadm” user must also be a member of the ftp group e.g. “eurexft” and “Administrators” group.



02.11.10

7 Windows 2008 Configuration Issues

7.1 Password policies

In order to ensure that the FTP passwords provided by the exchange are accepted by the Windows 2008 operating system and do not expire the following steps must be performed.

Click Start > Administrative Tools > Local Security Policy and expand the “Account Policies” / “Password Policies” branch.

The password complexity options and password aging functionality need to be disabled as shown below.

7.2 Definition of Static Routes

The IP address of the MISS interface (WAN) is defined by the exchange and needs to be configured on the respective network interface. In addition, static routes need to be defined.

At the command prompt, a command with the following syntax needs to be entered.

route –p add network-destination mask 255.255.255.0 gateway address metric 1

Example addresses for Eurex:

route –p add 90.53.253.0 mask 255.255.255.0 90.53.245.21 metric 1

route –p add 90.54.253.0 mask 255.255.255.0 90.53.245.22 metric 1

The routes defined in this way will be set up permanently and are available after a reboot of the system.



02.11.10

7.3 Network interface binding order

A name resolution for all MISSes and Workstations, on which the GATE front end software is installed, must be configured. For performance and availability reasons Deutsche Börse recommends that static name resolution through the hosts file. Furthermore, with regard to the name resolution on a single MISS or WS – the following cases have to be distinguished:

7.3.1 A host with single network interface

- If the computer name is set to match the GATE LAN hostname of the machine (i.e. the hostname assigned to the interface connected to the members LAN), then no further steps are necessary.

- If the computer name is NOT set to match the GATE LAN hostname of the machine,

then the optional qualifier <computername> in the [MISS]/[WS] sections within the configmbr.ini has to be set to the computer name of the machine manually, to avoid problems with the GATE name resolution (for configuration details: see Operations Guide GATE 3.5).

7.3.2 A host with multiple network interfaces

- If the computer name is set to match the GATE LAN hostname of the machine, then the network interface whose IP address is assigned to this GATE LAN hostname must be on the first position of the Windows network service binding order.

To verify the binding order: Click Start > Control Panel > Network and Internet > Network and Sharing Center and select the option “Change Adapter Settings”

If the following window appears without the addition menu bar



02.11.10

Press the “ALT” key to reveal the “hidden” options and select the “Advanced” / “Advanced Settings Option”

The current binding will be displayed and the connection order can be changed accordingly by using the arrow buttons next to the “Connections:” window.



02.11.10

- If the computer name is NOT set to match the GATE LAN hostname of the machine,

then the optional qualifier <computername> in the [MISS]/[WS] sections within the configmbr.ini has to be set to the computer name of the machine manually. Furthermore, if …

- the computer name does also NOT match a Xervice WAN hostname (i.e. a hostname

assigned to an interface connected to an exchange WAN), then no further steps are necessary.

- the computer name does match a Xervice WAN hostname, then the network interface

whose IP address is assigned to this Xervice WAN hostname must be on the first position of the Windows network service binding order (see above).

7.4 Firewall Settings

In order to ensure that the transfer of USIM libraries, reference data files and reports can be transferred to the MISS and to guarantee the correct communication between the MISS and Workstation, the use of the Windows 2008 firewall should be disabled on both the WAN and LAN interfaces.

7.4.1 Disabling the Windows 2008 Firewall

To disable the Windows 2008 firewall:

Click Start > Control > Panel > System and Security > Windows Firewall and select the option “Turn Windows Firewall on or off”



02.11.10

Disable the Firewall be clicking the appropriate radio buttons

7.4.2 Changing User Account Control (UAC) Settings

The “gateadm” account used for the administration of the Exchange software must be a member of the “Administrators” group in order to be able to access system resources (e.g.) Task scheduler. When the “gateadm” account is assigned to the “Administrators” group it is entitled to have the same privileges as the “Administrator” account itself. However in the default setting the Operating System will request confirmation before performing any tasks requiring system privileges. “gateadm” does not receive “Administrator” privileges by default, only on request.

As there is no interaction during the start of the MISS, the use of the scheduler functionality which automatically attempts to start the MISS multiple times, for example, will fail. In order to disable the so called User Account Control.

Click Start > Control > Panel > System and Security and select the option “Change User Account Control settings”



02.11.10

Move the sliding bar to the option “Never notify”



02.11.10

8 Windows 7 Configuration Issues

8.1.1 Disabling the Windows 7 Firewall

To disable the Windows 7 firewall:

Click Start > Control > Panel > System and Security > Windows Firewall and select the option “Turn Windows Firewall on or off”

8.1.2 Changing User Account Control (UAC) Settings

Click Start > Control > Panel > System and Security and select the option “Change User Account Control settings”

Move the sliding bar to the option “Never notify”

Windows 2008 and Windows 7 Configuration Document … · 4.3 Advanced Simulation - Installation...

Documents

Transcript of Windows 2008 and Windows 7 Configuration Document … · 4.3 Advanced Simulation - Installation...