NetBackup™ Web UI Cloud Administrator's Guide

Last Published:
Product(s): NetBackup & Alta Data Protection (11.0)
  1. Managing and protecting cloud assets
    1.  
      About protecting cloud assets
    2.  
      Limitations and considerations
    3.  
      AWS and Azure government cloud support
    4. Configure Snapshot Manager in NetBackup
      1.  
        Add a Snapshot Manager
      2. Add a cloud provider for a Snapshot Manager
        1.  
          Adding a new region
        2.  
          IAM Role for AWS Configuration
        3.  
          IAM policy for OCI configuration
      3.  
        Associate media servers with a Snapshot Manager
      4.  
        Discover assets on Snapshot Manager
      5.  
        Enable or disable a Snapshot Manager
      6.  
        (Optional) Add the Snapshot Manager extension
    5. Managing intelligent groups for cloud assets
      1.  
        Considerations for cloud intelligent groups
      2.  
        Create an intelligent group for cloud assets
      3.  
        Delete an intelligent group for cloud assets
    6. Protecting cloud assets or intelligent groups for cloud assets
      1.  
        Customize or edit protection for cloud assets or intelligent groups
      2.  
        Remove protection from cloud assets or intelligent groups
    7. About storage lifecycle policies
      1.  
        Adding an SLP
      2.  
        SLP configurations for PaaS and IaaS policies
    8. Managing policies for cloud assets
      1.  
        Limitations and considerations
      2.  
        Planning for policies
      3.  
        Creating policies for cloud assets
      4.  
        Setting up attributes for PaaS assets
      5.  
        Setting up attributes for IaaS assets
      6.  
        Creating schedules
      7.  
        About backup frequency
      8.  
        About assigning retention periods
      9. Configuring the Start window
        1.  
          Example of schedule duration
      10.  
        Configuring the include dates
      11.  
        Configuring the exclude dates
      12.  
        Configuring the cloud assets for PaaS
      13.  
        Configuring the cloud assets for IaaS
      14.  
        Configuring backup options for IaaS
      15. Managing cloud policies
        1.  
          Copy a policy
        2.  
          Deactivating or deleting a policy
        3.  
          Manually backup assets
    9. Scan for malware
      1.  
        Scanning backup images
      2.  
        Assets by workload type
    10. Protecting Microsoft Azure resources using resource groups
      1.  
        Before you begin
      2.  
        Limitations and considerations
      3. About resource group configurations and outcome
        1.  
          Examples of resource group configurations
      4.  
        Troubleshoot resource group permissions
    11. NetBackup Accelerator for cloud workloads
      1.  
        How the NetBackup Accelerator works with virtual machines
      2.  
        Accelerator forced rescan for virtual machines (schedule attribute)
      3.  
        Accelerator backups and the NetBackup catalog
      4.  
        Accelerator messages in the backup job details log
    12.  
      Configuring backup schedules for cloud workloads using protection plan
    13.  
      Backup options for cloud workloads
    14. AWS Snapshot replication
      1.  
        Configure AWS snapshot replication
      2.  
        Using AWS snapshot replication
      3.  
        Support matrix for account replication
    15.  
      Protect applications in-cloud with application-consistent snapshots
    16.  
      Protecting AWS or Azure VMs for recovering to VMware
    17.  
      Cloud asset cleanup
    18.  
      Cloud asset filtering
  2. Protecting PaaS assets
    1.  
      Protecting PaaS assets
    2.  
      Prerequisites for protecting PaaS assets
    3.  
      Enabling binary logging for MySQL and MariaDB databases
    4.  
      Enabling backup and restore in Kubernetes
    5.  
      Prerequisites for protecting Amazon RDS SQL Server database assets
    6. Protecting RDS Custom instances
      1.  
        Protecting RDS Custom for SQL Server assets
      2.  
        Consideration for protecting RDS Custom for SQL Server assets
      3.  
        Protecting RDS Custom for Oracle assets
      4.  
        Consideration for protecting RDS Custom for Oracle assets
    7. Protecting Azure Managed Instance databases
      1.  
        Prerequisites for protecting Azure Managed Instance databases
      2.  
        Permissions required for protecting Azure Managed Instance databases
    8. Limitation and considerations
      1.  
        For all databases
      2.  
        For PostgreSQL
      3.  
        For incremental backups for Azure PostgreSQL
      4.  
        For AWS RDS PostgreSQL and AWS Aurora PostgreSQL
      5.  
        For AWS DynamoDB
      6.  
        For AWS DocumentDB
      7.  
        For AWS Neptune
      8.  
        For AWS RDS SQL
      9.  
        For Azure, AWS RDS, and Aurora MySQL
      10.  
        For incremental backups using Azure MySQL server
      11.  
        For incremental backups using the GCP SQL Server
      12.  
        For Azure SQL and SQL Managed Instance
      13.  
        For Azure SQL and SQL Managed Instance (without temp. database)
      14.  
        For Azure SQL Server and SQL Managed Instance incremental backup
      15.  
        For Azure Cosmos DB for MongoDB
      16.  
        For Azure Cosmos DB for NoSQL
      17.  
        For Amazon RDS for Oracle
      18.  
        For Amazon Redshift databases
      19.  
        For Amazon Redshift clusters
      20.  
        For GCP SQL Server
      21.  
        For GCP BigQuery
    9. Installing the native client utilities
      1.  
        Installing the MySQL client utility
      2.  
        Installing the sqlpackage client utility
      3.  
        Installing PostgreSQL client utility
      4.  
        Installing MongoDB client utility
    10. Configuring storage for different deployments
      1.  
        For MSDP cloud deployments
      2.  
        For Kubernetes deployments
      3.  
        For VM-based BYO deployments
    11.  
      Configuring the storage server for instant access
    12.  
      About incremental backup for PaaS workloads
    13.  
      Configuring incremental backups for Azure MySQL server
    14.  
      About archive redo log backup for PaaS workloads
    15.  
      About Auto Image Replication for PaaS workloads
    16.  
      Discovering PaaS assets
    17.  
      Viewing PaaS assets
    18. Managing PaaS credentials
      1.  
        View the credential name that is applied to a database
      2.  
        Add credentials to a database
      3.  
        Creating an IAM database username
      4.  
        Creating a system or user-managed identity username
      5.  
        Configuring permissions for the database user
    19. Add protection to PaaS assets
      1.  
        Perform backup now
  3. Recovering cloud assets
    1. Recovering cloud assets
      1.  
        About the pre-recovery check for VMs
      2.  
        Supported parameters for restoring cloud assets
      3.  
        Recovering virtual machines
      4.  
        Recovering applications and volumes to their original location
      5.  
        Recovering applications and volumes to an alternate location
      6.  
        Recovery scenarios for GCP VMs with read-only volumes
      7.  
        (GCP only) Restoring virtual machines and volumes using the autoDelete disk support
    2.  
      Perform rollback recovery of cloud assets
    3. Recovering AWS or Azure VMs to VMware
      1.  
        Post-recovery considerations for cloud VMs recovered to VMware
      2. Steps to recover images from cloud VMs to VMware
        1.  
          Recovering images from AWS to VMware
        2.  
          Recovering images from Azure to VMware
    4. Recovering PaaS assets
      1.  
        Recovering non-RDS PaaS assets
      2.  
        Recovering Redshift clusters
      3.  
        Recovering AWS DocumentDB and Neptune assets
      4.  
        Recovering RDS-based PaaS asset
      5.  
        Recovering Azure-protected assets
      6.  
        Recovering duplicate images from AdvancedDisk
  4. Performing granular restore
    1.  
      About granular restore
    2.  
      Supported environment list
    3.  
      List of supported file systems
    4.  
      Before you begin
    5.  
      Limitations and considerations
    6.  
      Restoring files and folders from cloud virtual machines
    7.  
      Restoring volumes on cloud virtual machines
    8.  
      Performing steps after volume restore containing LVM
    9.  
      Troubleshooting
  5. Troubleshooting protection and recovery of cloud assets
    1.  
      Troubleshoot cloud workload protection issues
    2.  
      Error Code 9855: Error occurred while exporting snapshot for the asset: <asset_name>
    3.  
      VMs and other OCI assets with CMK-encrypted disks are marked as deleted in NetBackup UI.
    4.  
      Backup from snapshot jobs take longer time than expected
    5.  
      Backup from snapshot job fails due to connectivity issues when Snapshot Manager is deployed on an Ubuntu host
    6.  
      Error disambiguation in NetBackup UI
    7.  
      Status Code 150: Termination requested by administrator
    8. Troubleshoot PaaS workload protection and recovery issues
      1.  
        Troubleshooting Amazon Redshift issues
      2.  
        Troubleshooting Azure Postgres issues
      3.  
        Troubleshooting Amazon RDS Custom for SQL issues

Configure AWS snapshot replication

Requirements for replicating snapshots
  • Replicating unencrypted snapshots

    Ensure that the source and target accounts/regions are configured using the AWS cloud provider from NetBackup Snapshot Manager. There are no additional requirements for replicating unencrypted snapshots.

  • Replicating encrypted snapshots using AWS KMS

    Ensure that the source and target accounts/regions are configured using the AWS cloud provider from NetBackup Snapshot Manager.

    Additionally, to replicate encrypted snapshots to a cross-account, the encryption CMK key from the original location needs to be shared with the target account. (This shared KMS key is implicitly used while copying the snapshot in the target account, and the copied snapshot can be replicated by a different key).

    Both the source and target locations should have encryption key (KMS key) with the same name; that is, they should have the same key alias (in terms of AWS).

    If encryption key with the same name is not present at the target, then the replicated snapshot is encrypted using the default KMS key in the target location.

  • Permissions for cross-account replication

    In case of replication to a different region in a different AWS account, the source region (where the VM to be protected exists) must be enabled in the target AWS accounts.

    For cross-account replication, the AWS IAM user or role associated with the snapshot source region's AWS account (source AWS account) must have the following permissions:

    • ModifySnapshotAttribute and CopySnapshot on the EC2 instance.

    • DescribeKey and ReEncrypt on the KMS key that is used to encrypt the original snapshot.

    For cross-account replication, the AWS IAM user or role associated with the snapshot replication target region's AWS account (target AWS account) must have the following permissions:

    • CreateGrant, DescribeKey, and Decrypt on the KMS key that is used to encrypt the original snapshot.

    • CreateGrant, Encrypt, Decrypt, DescribeKey, and GenerateDataKeyWithoutPlainText on the KMS encryption key used while performing the CopySnapshot operation on the original snapshot.

You can choose to replicate snapshots for AWS cloud assets from the primary location to a remote or a secondary location. The Snapshot Manager's support cross-region and cross account replication. With snapshot replication you can achieve the following:

  • Maintain a copy of cloud assets at a different destination for long-term retention and auditing requirements.

  • Recover cloud assets from the replicated copies from another region in case there is a region outage.

  • Recover cloud assets from the replicated copies from another account in case the user account is compromised.

Configuration

Review the following information to configure snapshot replication:

  • You can configure snapshot replication when you create a protection plan. See the NetBackup™ Web UI Administrator's Guide.

  • For cross-account replication, you need to establish a trust relationship between the source and the target account. For more details, refer to the Across AWS Accounts Using IAM Roles related information in the Amazon Web Services documentation.

Considerations

Consider the following when you configure cloud snapshot replication:

  • Even if multiple schedules are configured, the replication destination region that is configured is applied to all the schedules.

  • Cloud snapshot replication is supported only for Amazon cloud providers.

Asset protection criteria

Consider the following before adding cloud assets to a protection plan that is configured for cloud snapshot replication:

  • Assets must be added to a protection plan that replicates snapshots to a different region.

    For example, assets residing in region 'aws_account_1-us-east-1' cannot be subscribed to a protection plan replicating to the same region 'aws_account_1-us-east-1'.

  • Assets can be replicated to a different account in the same region.

    For example, assets residing in region 'aws_account_1-us-east-1' can be subscribed to a protection plan replicating inside the same region, but a different account 'aws_account_2-us-east-1'.

  • Assets that are discovered by a Snapshot Manager must be replicated to the region that is discovered by the same Snapshot Manager.

    For example, assets that are discovered by Snapshot Manager 'CP1' cannot be subscribed to a protection plan replicating to a region that is discovered by Snapshot Manager 'CP2'.

  • Only Amazon assets can be subscribed to a protection plan that is configured for cloud snapshot replication.

Manage concurrent snapshots replications

For better performance, you can tune the number of concurrent snapshot replications. Amazon has different limits for each asset type to do concurrent snapshot replications to a single destination region. For example, RDS has a limit of 5, EBS has a limit of 5, and EC2 has a limit of 50. For more details refer to Copy Snapshot related information in the Amazon Web Services documentation.

In NetBackup this limit is defined using the following parameter in the bp.conf file:

MAX_CLOUD_SNAPSHOT_REPLICATION_JOBS_PER_DESTINATION

The default value is 5.