NetBackup™ Deduplication Guide
- Introducing the NetBackup media server deduplication option
- Quick start
- Planning your deployment
- About MSDP storage and connectivity requirements
- About NetBackup media server deduplication
- About NetBackup Client Direct deduplication
- About MSDP remote office client deduplication
- About MSDP performance
- About MSDP stream handlers
- MSDP deployment best practices
- Provisioning the storage
- Licensing deduplication
- Configuring deduplication
- Configuring the Deduplication Multi-Threaded Agent behavior
- Configuring the MSDP fingerprint cache behavior
- Configuring MSDP fingerprint cache seeding on the storage server
- About MSDP Encryption using NetBackup Key Management Server service
- Configuring a storage server for a Media Server Deduplication Pool
- Configuring a disk pool for deduplication
- Configuring a Media Server Deduplication Pool storage unit
- About MSDP optimized duplication within the same domain
- Configuring MSDP optimized duplication within the same NetBackup domain
- Configuring MSDP replication to a different NetBackup domain
- About NetBackup Auto Image Replication
- Configuring a target for MSDP replication to a remote domain
- Creating a storage lifecycle policy
- Resilient network properties
- Editing the MSDP pd.conf file
- About protecting the MSDP catalog
- Configuring an MSDP catalog backup
- About NetBackup WORM storage support for immutable and indelible data
- Running MSDP services with the non-root user
- MSDP cloud support
- About MSDP cloud support
- Cloud space reclamation
- About the disaster recovery for cloud LSU
- About Image Sharing using MSDP cloud
- About MSDP cloud immutable (WORM) storage support
- About immutable object support for AWS S3
- About bucket-level immutable storage support for Google Cloud Storage
- About object-level immutable storage support for Google Cloud Storage
- About AWS IAM Role Anywhere support
- About Azure service principal support
- About NetBackup support for AWS Snowball Edge
- S3 Interface for MSDP
- Configuring S3 interface for MSDP on MSDP build-your-own (BYO) server
- Identity and Access Management (IAM) for S3 interface for MSDP
- S3 APIs for S3 interface for MSDP
- Disaster recovery in S3 interface for MSDP
- Monitoring deduplication activity
- Viewing MSDP job details
- Managing deduplication
- Managing MSDP servers
- Managing NetBackup Deduplication Engine credentials
- Managing Media Server Deduplication Pools
- Changing a Media Server Deduplication Pool properties
- Configuring MSDP data integrity checking behavior
- About MSDP storage rebasing
- Managing MSDP servers
- Recovering MSDP
- Replacing MSDP hosts
- Uninstalling MSDP
- Deduplication architecture
- Configuring and using universal shares
- Configuring universal share user authentication
- Using the ingest mode
- Enabling a universal share with object store
- Configure a universal share accelerator
- About the universal share accelerator quota
- Configuring isolated recovery environment (IRE)
- Configuring an isolated recovery environment using the web UI
- Configuring an isolated recovery environment using the command line
- Using the NetBackup Deduplication Shell
- Managing users from the deduplication shell
- About the external MSDP catalog backup
- Managing certificates from the deduplication shell
- Managing NetBackup services from the deduplication shell
- Monitoring and troubleshooting NetBackup services from the deduplication shell
- Managing S3 service from the deduplication shell
- Troubleshooting
- About unified logging
- About legacy logging
- Troubleshooting MSDP configuration issues
- Troubleshooting MSDP operational issues
- Trouble shooting multi-domain issues
- Appendix A. Migrating to MSDP storage
- Appendix B. Migrating from Cloud Catalyst to MSDP direct cloud tiering
- About direct migration from Cloud Catalyst to MSDP direct cloud tiering
- Appendix C. Encryption Crawler
Configuring an isolated recovery environment on a WORM storage server
You can configure an isolated recovery environment (IRE) on a WORM storage server to create an air gap between your production environment and a copy of the protected data. The air gap restricts network access to the data except during the timeframe when data replication occurs. This feature helps to protect against ransomware and malware.
To configure the IRE, you need a production NetBackup environment and a target WORM storage server on a supported Veritas appliance. Check the appliance documentation for compatibility.
The production environment does not require any additional steps for this feature. Use the following procedure to configure an IRE on the target WORM storage server from the deduplication shell.
To configure an IRE
- If A.I.R. is not configured on the production domain, continue to the next step.
If A.I.R. is already configured on the production domain, log in to the deduplication shell as the msdpadm user. Run the following command to show the SLP windows for replication from the primary server to the WORM server.
setting ire-network-control show-slp-windows production_primary_server=<production domain> production_primary_server_username=<production username> ire_primary_server=<IRE domain> ire_primary_server_username=<IRE username>
Where:
<production domain> is the fully qualified domain name (FQDN) of the primary server in your production environment.
<production username> is the username of a NetBackup user with permission to list SLPs and SLP windows in the production environment. For Windows users, enter the username in the format <domain name>\<username>. For other users, enter the username only.
<IRE domain> is the FQDN of the primary server in the IRE. Use the same hostname that you used for the target primary server when you configured the SLPs in the production environment.
<IRE username> is the username of a NetBackup user with permission to list SLPs and storage units in the IRE. For Windows users, enter the username in the format <domain name>\<username>. For other users, enter the username only.
For example:
production_primary_server=examplePrimary.domain.com production_primary_server_username=appadmin ire_primary_server=exampleIREPrimary.domain.com ire_primary_server_username=appadmin
The following is an example output of the command:
EveryDayAtNoon: SLPs: SLP1 Sunday start: 12:00:00 duration: 00:59:59 Monday start: 12:00:00 duration: 00:59:59 Tuesday start: 12:00:00 duration: 00:59:59 Wednesday start: 12:00:00 duration: 00:59:59 Thursday start: 12:00:00 duration: 00:59:59 Friday start: 12:00:00 duration: 00:59:59 Saturday start: 12:00:00 duration: 00:59:59 WeeklyWindow: SLPs: SLP2 Sunday start: 10:00:00 duration: 01:59:59 Monday NONE Tuesday NONE Wednesday NONE Thursday NONE Friday NONE Saturday start: 10:00:00 duration: 01:59:59
This example shows two SLP windows:
A daily window for one hour starting at noon.
A weekly window for two hours starting at 10:00 A.M.
- Based on the requirements for your environment, determine a schedule and take note of it. For an existing A.I.R. environment, the schedule must accommodate the SLP windows that you viewed in the previous step.
You can set a daily schedule that is open at the same time each day, or you can set a different schedule for each day of the week.
In the previous example, you can accommodate both SLP windows with either of the following:
A daily schedule from 10:00 A.M. to 1:00 P.M.
A schedule from 12:00 P.M. to 1:00 P.M. on Monday through Friday and a schedule from 10:00 A.M. to 1:00 P.M. on Saturday and Sunday
Note:
If the production environment and the IRE are in different time zones, the schedule must begin only once per day in both time zones. For example, if one environment is in the Asia/Kolkata time zone and the other is in the America/New_York time zone, the following schedule in Kolkata is not supported: Tuesday start time 22:00:00 and Wednesday start time 03:00:00. When these start times get converted to the New York time zone, they become Tuesday start time 12:30:00 and Tuesday start time 17:30:00, which is not supported.
- Run the following command to configure which subnets and IP addresses are allowed to access the WORM storage server:
setting ire-network-control allow-subnets subnets=<CIDR subnets or IP addresses>
Where <CIDR subnets or IP addresses> is a comma-separated list of the allowed IP addresses and subnets, in CIDR notation.
For example:
setting ire-network-control allow-subnets subnets=10.80.120.208,10.84.48.0/20
Note:
The IRE primary server, the IRE media servers, and the DNS server for the IRE must be included in the allowed list. If all of these servers are in the same subnet, only the subnet is required to be in the allowed list. If you have a dual stack IPv4-IPv6 network, make sure that you add both the IPv4 and the IPv6 addresses to the allowed list.
- Run the following command to set the daily air gap schedule:
setting ire-network-control set-schedule start_time=<time> duration=<duration> [weekday=<0-6>]
Where [weekday=<0-6>] is an optional parameter to indicate the day if you need to set different schedules for different days. 0 is Sunday, 1 is Monday, etc.
For example:
setting ire-network-control set-schedule start_time=10:00:00 duration=03:00:00 weekday=0
- Before you can send data between the production domain and the IRE storage server, you must add MSDP reverse connections and add the replication operation.
See Configuring data transmission between a production environment and an IRE WORM storage server.