|
| 1 | +## Prerequisites |
| 2 | + |
| 3 | +Before you create the availability group, you need to: |
| 4 | + |
| 5 | +- Set your environment so that all the servers that will host availability replicas can communicate. |
| 6 | +- Install SQL Server. See [Install SQL Server](install-sql-server.md) for details. |
| 7 | + |
| 8 | +## Enable AlwaysOn availability groups and restart mssql-server |
| 9 | + |
| 10 | +>[!NOTE] |
| 11 | +>The command used below is utilizing cmdlets from the sqlserver module that is published on the PowerShell Gallery. You can install this module using the Install-Module command. |
| 12 | +
|
| 13 | +Enable AlwaysOn availability groups on each replica that hosts a SQL Server instance. Then restart the SQL Server service. Run the following command to enable and the restart the SQL Server services: |
| 14 | + |
| 15 | +```powershell |
| 16 | +Enable-SqlAlwaysOn -ServerInstance <server\instance> -Force |
| 17 | +``` |
| 18 | + |
| 19 | +## Enable an AlwaysOn_health event session |
| 20 | + |
| 21 | +You can optionally enable AlwaysOn availability groups Extended Event (XE) session to help with root-cause diagnosis when you troubleshoot an availability group. Run the following command on each instance of SQL Server: |
| 22 | + |
| 23 | +```sql |
| 24 | +ALTER EVENT SESSION AlwaysOn_health ON SERVER WITH (STARTUP_STATE=ON); |
| 25 | +GO |
| 26 | +``` |
| 27 | + |
| 28 | +For more information about this XE session, see [Always On Availability Groups extended events](always-on-extended-events.md). |
| 29 | + |
| 30 | +## Database Mirroring Endpoint Authentication |
| 31 | + |
| 32 | +The replicas involved in the read-scale Availability Group will need to authenticate over the endpoint in order for synchronization to function properly. There are two main scenarios covered below that can be used for such authentication. |
| 33 | + |
| 34 | +### Service Account |
| 35 | + |
| 36 | +In an Active Directory environment where all secondary replicas on joined to the same domain SQL Server can authenticate utilizing the service account. You will need to explicitly create a login for the service account on each all SQL Server instances: |
| 37 | + |
| 38 | +```sql |
| 39 | +CREATE LOGIN [<domain>\service account] FROM WINDOWS; |
| 40 | +``` |
| 41 | + |
| 42 | +### SQL Login Authentication |
| 43 | + |
| 44 | +In environments where the secondary replicas may not be joined to an Active Directory Domain you will need to utilize SQL Authentication. The following Transact-SQL script creates a login named `dbm_login` and a user named `dbm_user`. Update the script with a strong password. To create the database mirroring endpoint user, run the following command on all SQL Server instances: |
| 45 | + |
| 46 | +```sql |
| 47 | +CREATE LOGIN dbm_login WITH PASSWORD = '**<1Sample_Strong_Password!@#>**'; |
| 48 | +CREATE USER dbm_user FOR LOGIN dbm_login; |
| 49 | +``` |
| 50 | + |
| 51 | +#### Certificate Authentication |
| 52 | + |
| 53 | +If you utilize a secondary replica that requires authentication with SQL Authentication use a certificate for authenticating between the mirroring endpoints. |
| 54 | + |
| 55 | +The following Transact-SQL script creates a master key and a certificate. It then backs up the certificate and secures the file with a private key. Update the script with strong passwords. Run the following script on the primary SQL Server instance to create the certificate: |
| 56 | + |
| 57 | +```sql |
| 58 | +CREATE MASTER KEY ENCRYPTION BY PASSWORD = '**<Master_Key_Password>**'; |
| 59 | +CREATE CERTIFICATE dbm_certificate WITH SUBJECT = 'dbm'; |
| 60 | +BACKUP CERTIFICATE dbm_certificate |
| 61 | + TO FILE = 'C:\Program Files\Microsoft SQL Server\MSSQL14.MSSQLSERVER\MSSQL\DATA\dbm_certificate.cer' |
| 62 | + WITH PRIVATE KEY ( |
| 63 | + FILE = 'c:\Program Files\Microsoft SQL Server\MSSQL14.MSSQLSERVER\MSSQL\DATA\dbm_certificate.pvk', |
| 64 | + ENCRYPTION BY PASSWORD = '**<Private_Key_Password>**' |
| 65 | + ); |
| 66 | +``` |
| 67 | + |
| 68 | +At this point, your primary SQL Server replica has a certificate at `c:\Program Files\Microsoft SQL Server\MSSQL14.MSSQLSERVER\MSSQL\DATA\dbm_certificate.cer` and a private key at `c:\Program Files\Microsoft SQL Server\MSSQL14.MSSQLSERVER\MSSQL\DATA\dbm_certificate.pvk`. Copy these two files to the same location on all servers that will host availability replicas. |
| 69 | + |
| 70 | +Ensure on each secondary replica that the service account for SQL Server has permissions to access the certificate. |
| 71 | + |
| 72 | +#### Create the certificate on secondary servers |
| 73 | + |
| 74 | +The following Transact-SQL script creates a master key and a certificate from the backup that you created on the primary SQL Server replica. The command also authorizes the user to access the certificate. Update the script with strong passwords. The decryption password is the same password that you used to create the `.pvk` file in a previous step. To create the certificate, run the following script on all secondary replicas: |
| 75 | + |
| 76 | +```sql |
| 77 | +CREATE MASTER KEY ENCRYPTION BY PASSWORD = '**<Master_Key_Password>**'; |
| 78 | +CREATE CERTIFICATE dbm_certificate |
| 79 | + AUTHORIZATION dbm_user |
| 80 | + FROM FILE = '/var/opt/mssql/data/dbm_certificate.cer' |
| 81 | + WITH PRIVATE KEY ( |
| 82 | + FILE = '/var/opt/mssql/data/dbm_certificate.pvk', |
| 83 | + DECRYPTION BY PASSWORD = '**<Private_Key_Password>**' |
| 84 | + ); |
| 85 | +``` |
| 86 | + |
| 87 | +## Create the database mirroring endpoints on all replicas |
| 88 | + |
| 89 | +Database mirroring endpoints use the Transmission Control Protocol (TCP) to send and receive messages between the server instances that participate in database mirroring sessions or host availability replicas. The database mirroring endpoint listens on a unique TCP port number. |
| 90 | + |
| 91 | +The following Transact-SQL script creates a listening endpoint named `Hadr_endpoint` for the availability group. It starts the endpoint and gives connection permission to the service account or SQL Login that you created in a previous step. Before you run the script, replace the values between `**< ... >**`. Optionally you can include an IP address `LISTENER_IP = (0.0.0.0)`. The listener IP address must be an IPv4 address. You can also use `0.0.0.0`. |
| 92 | + |
| 93 | +Update the following Transact-SQL script for your environment on all SQL Server instances: |
| 94 | + |
| 95 | +```SQL |
| 96 | +CREATE ENDPOINT [Hadr_endpoint] |
| 97 | + AS TCP (LISTENER_PORT = **<5022>**) |
| 98 | + FOR DATA_MIRRORING ( |
| 99 | + ROLE = ALL, |
| 100 | + AUTHENTICATION = CERTIFICATE dbm_certificate, |
| 101 | + ENCRYPTION = REQUIRED ALGORITHM AES |
| 102 | + ); |
| 103 | +ALTER ENDPOINT [Hadr_endpoint] STATE = STARTED; |
| 104 | +GRANT CONNECT ON ENDPOINT::[Hadr_endpoint] TO [<service account or user>]; |
| 105 | +``` |
| 106 | + |
| 107 | +The TCP port on the firewall must be open for the listener port. |
| 108 | + |
| 109 | +For more information, see [The database mirroring endpoint (SQL Server)](http://msdn.microsoft.com/library/ms179511.aspx). |
0 commit comments