NetBackup™ Web UI Cloud Object Store Administrator's Guide

Last Published:
Product(s): NetBackup (10.1)
  1. Introduction
    1.  
      Overview of NetBackup protection for Cloud object store
    2.  
      Features of NetBackup Cloud object store workload support
  2. Managing Cloud object store assets
    1.  
      Prerequisites for adding Cloud object store accounts
    2.  
      Permissions required for Amazon S3 cloud provider user
    3. Adding Cloud object store accounts
      1.  
        Creating cross account access in AWS
      2.  
        Check certificate for revocation
      3.  
        Managing Certification Authorities (CA) for NetBackup Cloud
      4.  
        Adding a new region
    4.  
      Manage Cloud object store accounts
  3. Protecting Cloud object store assets
    1. About accelerator support
      1.  
        How NetBackup accelerator works with Cloud object store
      2.  
        Accelerator notes and requirements
      3.  
        Accelerator force rescan for Cloud object store (schedule attribute)
      4.  
        Accelerator backup and NetBackup catalog
    2.  
      About incremental backup
    3.  
      About policies for Cloud object store assets
    4.  
      Planning for policies
    5.  
      Prerequisites for Cloud object store policies
    6.  
      Creating a backup policy
    7.  
      Setting up attributes
    8.  
      Creating schedule attributes for policies
    9.  
      Configuring the Start window
    10.  
      Configuring exclude dates
    11.  
      Configuring include dates
    12.  
      Configuring the Cloud objects tab
    13.  
      Adding conditions
    14.  
      Adding tag conditions
    15.  
      Example of conditions and tag conditions
    16. Managing Cloud object store policies
      1.  
        Copy a policy
      2.  
        Deactivating or deleting a policy
      3.  
        Manually backup assets
  4. Recovering Cloud object store assets
    1.  
      Prerequisites for recovering Cloud object store objects
    2.  
      Recovering Cloud object store assets
  5. Troubleshooting
    1.  
      Recovery for Cloud object store using web UI for original bucket recovery option starts but job fails with error 3601
    2.  
      Recovery Job does not start
    3.  
      Restore fails: "Error bpbrm (PID=3899) client restore EXIT STATUS 40: network connection broken"
    4.  
      Access tier property not restored after overwrite existing to original location
    5.  
      Reduced accelerator optimization in Azure for OR query with multiple tags
    6.  
      Backup is failed and shows a certificate error with Amazon S3 bucket names containing dots (.)
    7.  
      Azure backup job fails when space is provided in tag query for either tag key name or value.
    8.  
      The Cloud object store account has encountered an error
    9.  
      Bucket list empty when selecting it in policy selection
    10.  
      Creating second account on Cloudian fails by selecting existing region
    11.  
      Restore failed with 2825 incomplete restore operation
    12.  
      Bucket listing of cloud provider fails when adding bucket in Cloud objects tab

Check certificate for revocation

For all the cloud providers, NetBackup provides a capability to verify the revocation status of SSL certificates using Online Certificate Status Protocol (OCSP). If SSL and the Check certificate revocation option, both are enabled, NetBackup verifies each SSL certificate. To verify, NetBackup makes an OCSP request to the CA to check revocation status of certificate presented during SSL handshake. NetBackup does not connect to the cloud provider, if the status is returned as revoked, or it failed to connect to the OCSP endpoint present in the SSL certificate.

To enable validation, update the USE_CRL property from the Cloud object store account dialog.

Requirements for enabling 'Check certificate revocation' option

  • OCSP endpoints are HTTP thus, turn off any firewall rule that block HTTP (port 80) connection to external network. For example, http://ocsp.sca1b.amazontrust.com

  • OCSP URL is dynamically retrieved from the certificate thus, disable any firewall rule that blocks unknown URLs.

  • Typically, OCSP URLs endpoint support IPV4. For IPV6 environments disable the 'Check certificate revocation' option.

  • Private Clouds typically have a self-signed certificate. Thus, for private clouds, Check certificate revocation is not required. Disable this check while configuring the account, otherwise, account creation fails.

  • OSCP URL of CA should be present in certificate's 'Authority Information Access' extension.