Veritas NetBackup™ Flex Scale Administrator's Guide
- Product overview
- Viewing information about the NetBackup Flex Scale cluster environment
- NetBackup Flex Scale infrastructure management
- User management
- Considerations for managing NetBackup Flex Scale users
- Adding users
- Changing user password
- Removing users
- Modifying user roles
- Considerations for configuring AD/LDAP
- Configuring AD server for Universal shares and Instant Access
- Configuring AD/LDAP servers for NetBackup services
- Configuring additional AD/LDAP servers for managing NetBackup services/Universal Shares/Instant Access
- Configuring AD/LDAP servers on clusters deployed with only media servers
- Directory services and certificate management
- Region settings management
- About NetBackup Flex Scale storage
- About Universal Shares
- Cloud bucket support for NetBackup Flex Scale
- Node and disk management
- NetBackup Flex Scale network cabling
- Adding a node to the cluster using the NetBackup Flex Scale web interface
- Adding a node using the REST APIs
- Replacing a node in a cluster
- Starting and stopping nodes
- Rebooting a node
- Adding an excluded node to the cluster
- Replacing a disk
- Adding an excluded disk to the cluster
- Viewing the disk sync status
- Viewing disk details
- Viewing node details
- Switching management console to another cluster node
- License management
- Stopping NetBackup service containers
- Starting NetBackup service containers
- Managing hardware vendor packages
- User management
- NetBackup Flex Scale network management
- About network management
- Modifying DNS settings
- About bonding Ethernet interfaces
- Bonding operations
- Configuring NetBackup Flex Scale in a non-DNS environment
- Data network configurations
- Choosing the correct input method for data network configuration
- Network configuration on plain device (eth5)
- Network configuration on VLAN (eth5)
- Network configuration on bonded interfaces (bond0 on eth5 and eth7)
- VLAN on bond of eth5 and eth7 (bond0)
- Network configuration on management interface (eth1)
- Network configurations for adding a partial data network
- Support for multiple VLAN when disaster recovery is configured
- Configuring static routes on a NetBackup Flex Scale cluster
- NetBackup Flex Scale infrastructure monitoring
- Resiliency in NetBackup Flex Scale
- EMS server configuration
- Site-based disaster recovery in NetBackup Flex Scale
- About site-based disaster recovery in NetBackup Flex Scale
- Configuring disaster recovery using GUI
- Clearing the host cache
- Automated NetBackup SLP management
- DNS key management
- Managing disaster recovery using GUI
- Performing disaster recovery using RESTful APIs
- Active-Active disaster recovery configuration
- NetBackup optimized duplication using Storage Lifecycle Policies
- NetBackup Flex Scale security
- STIG overview for NetBackup Flex Scale
- FIPS overview for NetBackup Flex Scale
- Managing the login banner
- Changing the password policy
- Support for immutability in NetBackup Flex Scale
- Authenticating users using digital certificates or smart cards
- About system certificates on NetBackup Flex Scale
- Deploying external certificates on NetBackup Flex Scale
- Troubleshooting
- Services management
- Audit logs
- Collecting logs for cluster nodes
- Troubleshooting NetBackup Flex Scale issues
- If cluster configuration fails (for example because an IP address that was already in use is specified) and you try to reconfigure the cluster, the UI displays an error but the configuration process continues to run
- Validation error while adding VMware credentials to NetBackup
- NetBackup Web UI incorrectly displays some NetBackup Flex Scale processes as failed
- Unable to create BMR Shared Resource Tree (SRT) on NetBackup Flex Scale Appliance
- NetBackup configuration files are not persistent across operations that require restarting the system
- Appendix A. Maintenance procedures for HPE servers
- Replacement procedure for a chassis fan
- Replacement procedure for power supply
- Replacement procedure for a single OS disk
- Replacement procedure for both OS disks on the management console node
- Replacement procedure for both OS disks on a non- management console node
- Replacement procedure for NVMe disks (SSDs)
- Replacement procedure for RAID controller
- Replacement procedure for an Integrated Lights-Out (iLO) port
- Replacement procedure for quad-port NIC
- Procedure for memory expansion (DIMMs)
- Replacement procedure for memory (DIMMs)
- Replacement procedure for Mellanox port
- Appendix B. Configuring NetBackup optimized duplication
- Appendix C. Disaster recovery terminologies
- Appendix D. Configuring Auto Image Replication
Establishing trust and setting up authentication
In NetBackup Flex Scale Appliance, the Appliance web server creates a self-signed CA certificate and an Appliance web server certificate (signed by that CA) for every cluster. As the CA certificates are different, you have to ensure that both the clusters trust the CA of the other. This is done by adding one cluster's gateway CA certificate to the trusted certificate store of the other. Each cluster should be able to trust the secondary site and perform the required operations to configure and manage disaster recovery. Appliance web server certificates are exchanged between both the clusters to enable authentication.
You can use the following RESTful APIs to setup trust and authentication. The secondary site can be added as a disaster recovery cluster to the primary site anytime after the primary site is up and running. The secondary site has to be a freshly installed and configured NetBackup Flex Scale cluster.
The RESTful API calls must be made in the following order on the management server of the clusters. The API calls do not use SSH between the clusters.
You can get the list of available certificates on the cluster using the API:
GET /api/appliance/v1.0/certificates
This API returns the URI of certificateName as Appliance web services certificate, Appliance web services CA certificate and the root certificate. The certificateName should be passed as input to the GET specific certificate API. The certificate is in base64 encoded format.
To set up trust between both the clusters
- Get the appliance web services certificate on the primary site by providing the certificate name (appliance-webservice) as input in the GET specific certificate API.
GET /api/appliance/v1.0/certificates/{certificateName} - Get the appliance web services CA certificate on the primary site by providing the certificate name (appliance-webservice-ca) as input in the GET specific certificate API.
GET /api/appliance/v1.0/certificates/{certificateName} - Establish trust by passing the certificates obtained from the primary site to the secondary site. Execute the following API on the secondary site:
POST /api/appliance/v1.0/certificates
The API imports the certificates of one cluster and exports the certificates on the other cluster to establish trust and enable certificate authentication.
Set type as appliance-webservice and purpose as remote-cluster-trust-auth. Use the management server FQDN of the remote cluster for gateway.
- Get the appliance web services certificate on the secondary site by providing the certificate name (appliance-webservice) as input in the GET specific certificate API.
GET /api/appliance/v1.0/certificates{certificateName} - Get the appliance web services CA certificate on the secondary site.
GET /api/appliance/v1.0/certificates/appliance-webservice-ca
- Establish trust by passing the certificates obtained from the secondary site to the primary site. Execute the following API on the primary site:
POST /api/appliance/v1.0/certificates
The API imports the certificates of one cluster and exports the certificates on the other cluster to establish trust and enable certificate authentication.
Set type as appliance-webservice and purpose as remote-cluster-trust-auth. Use the management server FQDN of the remote cluster for gateway.
For more information, see the Veritas NetBackup Flex Scale APIs on SORT.