• Introduction
• What You Received
• Deployment Options
• DataProtector Agent Installation Instructions
• Configuring the Connected Service with an Internet Firewall
  • Overview
  • Protocols
  • Server Subnets
  • Port Numbers
  • DNS
  • Registration vs. Subsequent Connections
  • SOCKS-Compliant Proxy Servers
  • Other Proxy Firewalls
• Packet filtering firewalls
• Internet Connections
  • Modem, Cable, DSL, LAN Connections
  • AOL, Prodigy, CompuServe, Juno and similar ISP connections
  • Transmission Times/Backup Tips

This guide is for those customers of the Connected DataProtector Small-Business Service who have received an email containing download, registration and support information. This instructional guide outlines the options available to you – and provides instructions for – deploying the DataProtector Agent on each machine that will be using the Service. If you have not subscribed to the Connected Small Business Service, please do so before continuing with the instructions below.

What You Received

The following items will be electronically forwarded to you from Connected fulfillment upon successful validation of your company’s credit card.

• Community Registration Codes, password and technician ID
• Welcome letter email containing:
• Technician Login and password
• Web address for Connected Help
• How to get technical support (free web help and email) information
• Portal account number – for billing reference
• Location of FAQs
• Support Center Information

The Setup executable you will download is a self-executing program that will install the DataProtector Agent on a user’s machine and walk the user through the process of installation and their first backup*.

*Note: Not intended for servers or multimedia. The ability to deselect files is enabled with this service plan. Improper use of this function could result in users deselecting files required for Heal.

• Email – (the recommended method) The Setup/DataProtector Agent is light enough to be attached to an email and broadcast throughout your company. Average size of the Agent is 3MB. The Setup should be copied/saved from the email to the local PC and executed locally. For companies with strict email security, we recommend using WinZip to zip up and forward the executable.
• CD – Save the Setup/Agent to CD. The CD can be used for on-the-spot deployments to PCs. Simply copy the Setup from the CD to the target PC and run the setup locally.
• Shared Drive – Save the Setup/Agent to a shared drive to which your company members have access. The Setup should be copied to the local PC and executed from the user’s PC.

DataProtector Agent Installation Instructions

The following instructions should be followed closely by those who wish to install the Connected DataProtector Agent successfully.

• Choose “Registering New Account.”
• Note your registration number and your registration password (you may print screen).
• Fill in your name and corporate information.
• *IMPORTANT* – Enter a data Encryption key, as this is your password to unlocking your data. It is critical not to lose/forget your encryption keys.
• Choose the appropriate firewall protection – Connected operates on port 16384. This port must be open to communicate with the Data Center. (Please refer to the section on firewalls).
  • The software will test the connection to make sure that the Agent can contact the Data Center Server.
  • See “Overview” section below for firewall details***.
• Click “Finish” - Connected will register the account on the Data Center Server.
• Print out Account Information.
• For maximum backup efficiency, leave the backup “Scheduler” default setting as is.
• Click “Next.”
• The Agent defaults to backing up your entire disk. This process time varies depending on your connection to the Internet.

You are now ready to complete your initial backup. It is not unusual for an initial backup to take several hours. We recommend you initiate this backup in the evening to run overnight. Each backup thereafter will generally take a few minutes.

• The Agent will initiate. Click “Backup Now” at the bottom of the window.

Connections are initiated from the backup clients inside the firewall. Connections are NEVER initiated from the outside.

The program can work with all types of firewalls, including packet-filtering, circuit-filtering, SOCKS-compliant Proxy or Mapped Proxy firewalls. For most firewalls, some configuration of the firewall by the firewall administrator is needed. If your network requires explicit connection to the firewall to initiate outgoing connections, the backup software must be configured for your firewall

The requirements for running the Connected Small-Business Service are consistent with security best-practices. They do not create an opening for incoming connections, and outgoing connections can be limited to specific ports at specific known IP addresses. As an added security measure, all data is 128-bit or DES-encrypted before leaving the PC; it remains encrypted though transmission, and is stored encrypted at the Connected Secure Data Centers.

The following additional information is useful to a firewall administrator for configuring a firewall to permit outgoing connections to the backup servers.

Back to Top

Server Subnets - Each user's DataProtector Agent software connects to a primary and an alternate server in order to provide high availability. Currently, all servers reside in the subnet 12.159.133.0-63 (also expressed as 12.159.133.0/26) and in the subnet 66.151.228.0-255 (also expressed as 66.151.228.0/24). The DataProtector software must have access to both of these subnets. Should these addresses change in the future, notice will be given to allow firewall changes and the DataProtector software can be automatically updated with the new addresses.

Back to Top

DNS - The Connected DataProtector Agent connects to a server using the server's IP address, not its name. Therefore, name resolution and access to a name server are not required.

Back to Top

SOCKS-Compliant Proxy Servers - The Connected DataProtector Agent software can be configured to connect out through a SOCKS proxy server. The IP address (or the DNS) of the proxy server and the port number on which it listens for connections must be known in order to configure the backup software. SOCKS is designed to allow outgoing connections and responses back to those connections, but to prevent other incoming packets. This is consistent with Connected Service. If your SOCKS proxy server has been set up with additional restrictions on outgoing connections, it is necessary to include Connected subnets in the permitted destinations.

When prompted by the Agent setup program to select a Firewall option, select the, "Use SOCKS proxy firewall" radio button and enter your proxy server information. (Note: The default setting for SOCKS TCP Port is 1080).

The IP addresses that must be mapped will appear when you attempt to run the client software, or can be seen by selecting Options/Connection.../Firewall in the client software. The destination port number is always 16384. The firewall administrator may choose any available port numbers on the firewall. Finally, the Agent must be configured with the IP address or the DNS of the firewall and the firewall port numbers that were chosen.

When prompted by the DataProtector Agent to select a Firewall option, select the, "Use proxy firewall server(s)" radio button. Then enter the firewall mapping that was configured on your firewall: Enter the IP Address or DNS of your firewall into the "Firewall IP address" field for both Secure Data Centers. Enter the port numbers chosen by the firewall administrator.

1. Permit TCP/IP outbound to port 16384 to subnets 12.159.133.0-63 (12.159.133.0/26) and 66.151.228.0-255 (66.151.228.0/24).

2. If your firewall requires you to explicitly permit the response packets to come back, do so by permitting TCP/IP inbound to ports 1024-5000 from the subnets listed above, for an already-established connection. It is NOT necessary to permit a connection originating from outside the firewall.

3. We do not utilize UDP or ICMP. IMPORTANT: If your question is not answered in the FAQs, please complete a Support Request.

Cable modems have certain limitations that could affect your connectivity. For example:

Cable service can be either one-way or two-way, depending on the provider. One-way service relies on an analog modem and phone line for uploads. This limits the upload speed to 33.3 Kbps. The more people on a node, the slower each connection could be. Service providers can tie a specific data rate or percentage of total bandwidth to each user. Providers do move bandwidth around among users selectively. Since most users don't need constant-megabit-per-second connections — they need high speeds for loading a Web page but not for viewing it — cable operators will take advantage of this burst of usage and divide bandwidth among multiple users.

DSL service comes in several flavors, with varying throughput rates, technical limitations, and prices. Speed: The most common form for businesses and home users — the one we refer to simply as DSL — is asymmetric DSL, or ADSL, which supports peak downstream speeds of 144 Kbps to 2.2 Mbps but upstream rates only from 90 Kbps to 640 Kbps. Your backups will run at the upstream rate.

Distance: The line's performance degrades with distance from the central office. All else being equal, users 5,000 feet from the central office will get better throughput than those 15,000 feet away. Beyond 18,000 feet service is generally unavailable.

ISP: One advantage of ADSL service is a dedicated connection that won't degrade as more users in your area sign on (as cable will). Still, performance not only varies depending on how far you are from the central office but also on the efficiency of your ISP's network. Even the fastest DSL connections can't cure bottlenecks at an ISP, such as slowdowns during peak hours.

Generally, DSL upload transmission speed is rated at an average of 256K. Therefore, a data stream of 100MB would upload in 54.50 minutes.

LAN connections, including DSL and cable, provide a continuously open channel to the Internet. Like DSL and cable, LANs do not necessarily assure a high rate of transmission. You still have to go through an Internet gateway and through several routers, so the variables that create bottlenecks still exist and can affect throughput.

Back to Top

AOL, Prodigy, CompuServe, Juno, and similar ISP connections - If you will be connecting to us via ISPs who provide their own dialer instead of using the standard Windows dialer, it will be necessary to open your Internet connection before running our software. You will not be able to use scheduled backups that run automatically, but all other features are unaffected.

• Avoid peak hours. We recommend using automatic backups that are scheduled to run in the earliest morning hours, between midnight and dawn.
• Close applications that aren't essential during the backup. There may be one or more background applications running at the same time. Use Windows Task Manager to check this.
• Monitor several transmissions to see the speed at which your ISP has connected you. Bandwidth is not usually guaranteed and will vary with the amount of traffic at any given time. Try to backup when conditions are favorable.
• Reduce the size of your backup sessions — at least until you complete an initial backup of everything that you want. It may be that your ISP's available capacity is being taxed by sheer volume or that your own network is.