Veritas NetBackup™ 53xx Appliance Initial Configuration Guide

To configure an HA setup from the NetBackup Appliance Web Console

1. On the associated primary server, log in to the NetBackup Administration Console and add the new host name for the first configured node to the Host Name Mappings property. You must add both the short name and the fully qualified domain name (FQDN).

   For details, refer to the section Host ID to Host Name Mappings in the NetBackup Security and Encryption Guide.

2. On the first configured node, log on to the NetBackup Appliance Web Console as admin.
3. On the Welcome to Veritas NetBackup Appliance Web Console page, click Manage > High Availability.
4. On the High Availability page, click Setup.
   
5. On the High Availability > Setup page, do the following:

   • Enter a new host name for this node.

   • Enter a new IP address for this node.

   • To have the new host name and IP address added to the /etc/hosts file, click the Make a hosts file entry automatically check box.

   • Click Setup.

   
6. When the Setup window shows that the pre-check is passed, click Continue.
   
7. When the Setup window updates and shows that the node is set up for the HA, click Close.
   
8. After the host name and the IP address have been changed, restart the NetBackup services on this node and on the primary server to ensure that they both recognize the changes and the HA setup.

To set up a NetBackup 53xx HA configuration from the NetBackup Appliance Shell Menu

1. On the associated primary server, log in to the NetBackup Administration Console and add the new host name for the first configured node to the Host Name Mappings property. You must add both the short name and the fully qualified domain name (FQDN).

   For details, refer to the section Host ID to Host Name Mappings in the NetBackup Security and Encryption Guide

2. On the first configured node, log on to the NetBackup Appliance Shell Menu as admin.
3. Go to Main > Manage > HighAvailability.
4. Use the following command to assign the new host name and IP address to the configured node:

   Setup NewHostname NewIPAddress

   Where NewHostname is the new host name of the node, and NewIPAddress is the new IP address of the node.

5. After you change the host name and the IP address on the first node, you must redeploy the required CA certificates.

   The appliance pings the primary server for the Certificate Authority (CA) status and shows the result. Each of the following bullet statements describes the possible status results. Follow the instructions that appear below the applicable status result to complete the certificate configuration.

   • The primary server <primary_server_name> currently uses an External CA-signed certificate. You are required to configure this appliance with a certificate issued by the same external CA. Do you want to import the External CA-signed certificate for this Media server now [yes,no](yes):

     Press Enter to continue. The following message appears:

     To configure the HA setup, the External CA-signed certificate must include the vip hostname and FQDN DNS information in the Subject Alternative Name.

     The following shares have been opened on the appliance for you to upload certificate files:

     NFS share <media_server_name>:/inst/share

     CIFS share \\<media_server_name>\general_share

     Enter the following details for external certificate configuration:

     Enter the certificate file path:

     Enter the trust store file path:

     Enter the private key path:

     Enter the password for the passphrase file path or skip security configuration (default: NONE):

     Enter the following details for CRL usage:

     Should a CRL be honored for the external certificate?

     1) Use the CRL defined in the certificate.

     2) Use the specific CRL directory.

     3) Do not use a CRL.

     q) Skip security configuration.

     CRL option: Enter 1, 2, 3, or q.

     Verify the External CA details that you entered:

     Certificate file name:

     Trust store file name:

     Private key file name:

     CRL check level: (Shows the selected CRL option.)

     Do you want to use the above certificate files? [yes, no](yes):

     After verifying that the entered information is correct, press Enter to continue and answer the following prompt:

     Is this correct? [yes, no](yes):

     If all of the information is correct, press Enter to continue.

     The appliance performs an ECA health check and shows the result of each validation check. When the health check has completed successfully, the following messages appear:

     ECA health check was successful.

     The external certificate has been registered successfully.

   • The primary server <primary_server_name> currently uses an external CA issued certificate and its own internal certificate. Would you like to proceed with the external CA issued certificate? [yes,no](yes):

     If you select no, the following message appears:

     This appliance will use a NetBackup issued certificate for secure communication.

     If you select yes, the following message appears:

     To configure the HA setup, the External CA-signed certificate must include the vip hostname and FQDN DNS information in the Subject Alternative Name.

     The following shares have been opened on the appliance for you to upload certificate files:

     NFS share <media_server_name>:/inst/share

     CIFS share \\<media_server_name>\general_share

     Enter the following details for external certificate configuration:

     Enter the certificate file path:

     Enter the trust store file path:

     Enter the private key path:

     Enter the password for the passphrase file path or skip security configuration (default: NONE):

     Enter the following details for CRL usage:

     Should a CRL be honored for the external certificate?

     1) Use the CRL defined in the certificate.

     2) Use the specific CRL directory.

     3) Do not use a CRL.

     q) Skip security configuration.

     CRL option: Enter 1, 2, 3, or q.

     Verify the External CA details that you entered:

     Certificate file name:

     Trust store file name:

     Private key file name:

     CRL check level: (Shows the selected CRL option.)

     Do you want to use the above certificate files? [yes, no](yes):

     After verifying that the entered information is correct, press Enter to continue and answer the following prompt:

     Is this correct? [yes, no](yes):

     If all of the information is correct, press Enter to continue.

     The appliance performs an ECA health check and shows the result of each validation check. When the health check has completed successfully, the following messages appear:

     ECA health check was successful.

     The external certificate has been registered successfully.

   • This appliance will use a NetBackup issued certificate for secure communication.

     No further certificate configuration is required. Click Next to continue

6. After the host name and the IP address have been changed, restart the NetBackup services on this node and on the primary server to ensure that they both recognize the changes and the HA setup.