Most organizations who are upgrading an Encryption Management Server cluster in a production environment wish to avoid any downtime.
The natural approach is to point all endpoints to one cluster member while the first of the remaining cluster members is upgraded and then point all endpoints to the first upgraded server while the remaining ones are upgraded.
However, this approach does risk the possibility of data inconsistencies occurring. This is because data replication does not occur between cluster members unless the cluster members are running the same release of Encryption Management Server.
This issue is particularly relevant when undertaking an upgrade to a major release where you need to backup the system, install from ISO media and restore the backup. This is simply because the upgrade takes far longer than a "PUP" or minor upgrade. For example, when upgrading to release 10.5 or above from 10.4.2 MP5 or below.
Consider the scenario where there are 2 servers in a cluster, server1 and server2:
At step 5 you may have a data inconsistency issue which will only be resolved after step 6.
Symantec Encryption Management Server 10.5 and above.
Clearly one way of avoiding this potential data inconsistency is to stop all traffic reaching any cluster member until at least one cluster member is upgraded. In other words, a period of downtime.
While this is the safest option, it may not be desirable or practical. Therefore, consider doing the following while the first cluster member is being upgraded in order to mitigate the issue:
If Directory Synchronization is usually enabled, disabling it will do the following:
To disable Directory Synchronization, in the administration console, navigate to Consumers / Directory Synchronization and click on the Disable button. It will then appear like this. Click on the Enable button to enable it again:
Once the first cluster member has been upgraded and all endpoints are pointed to it, Directory Synchronization can be enabled on it.
Pausing the Web Email Protection service will do the following:
To pause the Web Email Protection service, in the administration console, navigate to Services / Web Email Protection and click on the Pause button. It will then appear like this. Click on the Resume button to resume it:
Once the first cluster member has been upgraded and all SMTP traffic is pointed to it, its Web Email Protection service can be resumed.
As you can see, these mitigation measures do not completely prevent any potential data inconsistency issues but they do minimize them.