Search <book_title>...

Veritas NetBackup™ Deduplication Guide

Last Published: 2021-01-06

Product(s): NetBackup (9.0.0.1, 9.0)

About MSDP multi-domain support

An MSDP storage server is configured in a NetBackup media server. The NetBackup media servers and clients in the NetBackup domain can use this storage server. By default, the NetBackup media servers and clients cannot directly use an MSDP storage server from another NetBackup domain. For example, NetBackup media servers or clients cannot backup data to an MSDP storage server from another NetBackup domain.

To use an MSDP storage server from another NetBackup domain, the MSDP storage server must have multiple MSDP users. Then NetBackup media servers or clients can use the MSDP storage server from another NetBackup domain by using a different MSDP user. Multiple NetBackup domains can use the same MSDP storage server, but each NetBackup domain must use a different MSDP user to access that MSDP storage server.

To add an MSDP user on an MSDP storage server, run the following command:

Windows
<install_path>\pdde\spauser -a -u <username> -p <password>
UNIX
/usr/openv/pdde/pdcr/bin/spauser -a -u <username> -p <password>

To list all the MSDP users, run the following command on the MSDP storage server:

Windows
<install_path>\pdde\spauser -l
UNIX
/usr/openv/pdde/pdcr/bin/spauser -l

To use an MSDP storage server from another NetBackup domain, you must obtain a NetBackup certificate from another NetBackup domain.

Run the following commands on every NetBackup media server or client that wants to use an MSDP storage server from another domain:

Windows
install_path\NetBackup\bin\nbcertcmd -getCACertificate - server another_master_server
install_path\NetBackup\bin\nbcertcmd -getCertificate - server another_master_server -token token_string
UNIX
/usr/openv/netbackup/bin/nbcertcmd -getCACertificate - server another_master_server
/usr/openv/netbackup/bin/nbcertcmd -getCertificate - server another_master_server -token token_string

Use either of these two methods to obtain the authorization tokens:

NetBackup Administration Console
- Log on the target NetBackup master server and open Security Management > Certificate Management > Token Management.
- Click Create Token or right-click in the blank area of the Token records list view and select New Token to create a token.
NetBackup Commands
- Use the bpnbat command to log on the target NetBackup master server.
- Use the nbcertcmd command to get the authorization tokens.
  For more information on the commands, refer to the NetBackup Commands Reference Guide.

An example for using an MSDP storage server from another NetBackup domain

The following table describes the hierarchy that is used in the example:

NetBackup domain A	NetBackup domain B
`masterA` `mediaA1` `mediaA2` `clientA`	`masterB` `mediaB`

NetBackup domain A

NetBackup domain B

masterA

mediaA1

mediaA2

clientA

masterB

mediaB

MasterA is the host name of the master server of NetBackup domain A and the domain contains two media servers (mediaA1, mediaA2), and one client (clientA). MasterB is the host name of the master server of NetBackup domain B and the domain contains one media server (mediaB).

Using the following sample steps, create an MSDP storage server in domain B and let domain A use the MSDP storage server:

Create an MSDP storage server on media server mediaB of NetBackup domain B. (NetBackup Administration Console > Media and Device Management > Configure Disk storage servers > Media Server Deduplication Pool)
Run the following command on mediaB to create a new MSDP user testuser1 with password as testuser1pass.
spauser -a -u "testuser1" -p "testuser1pass"
Run the following command on mediaA1 to get a CA certificate and a host certificate from masterB.
nbcertcmd -GetCACertificate -server masterB
nbcertcmd -GetCertificate -server masterB -token <token_string>
Create an MSDP OpenStorage server on mediaA1 of NetBackup domain A. (NetBackup Administration Console > Media and Device Management > Configure Disk storage servers > OpenStorage).
OpenStorage server type is PureDisk, Storage server name is mediaB, user name is testuser1, and password is testuser1pass.
You must enter the server type as PureDisk.
Now mediaA1 of NetBackup domain can use the MSDP storage server mediaB. To use mediaA2 as a load balance server of the MSDP storage server, you can run the following certificate command on mediaA2:
- nbcertcmd -GetCACertificate -server masterB
- nbcertcmd -GetCertificate -server masterB -token <token_string>
To run client-direct backup from clientA to MSDP storage server mediaB, run the following certificate command on clientA:
- nbcertcmd -GetCACertificate -server masterB
- nbcertcmd -GetCertificate -server masterB -token <token_string>
After creating the MSDP OpenStorage server, create a related NetBackup disk pool and storage unit. Use the storage unit to run all the related NetBackup jobs.

When optimized duplication and multi-domain are used together, there is communication between the MSDP storage servers from two different NetBackup domains. The MSDP storage server from the other domain must have a certificate generated by master server of the local NetBackup domain. Run the nbcertcmd commands on source side MSDP storage server to request a certificate from the NetBackup master server of target MSDP storage server.

When backup and restore jobs on the client and multi-domain are used together, there is communication between the NetBackup client and MSDP storage server from two different NetBackup domains. Run the nbcertcmd commands on the NetBackup client to request a certificate from the NetBackup master server of MSDP storage server.

When one NetBackup domain uses the MSDP storage server of another NetBackup domain, the MSDP storage server cannot be the A.I.R target of that NetBackup domain.

If an external CA is used in the NetBackup setup, you do not need to run the nbcertcmd - GetCACertificate and the nbcertcmd - GetCertificate commands. If NetBackup domains A and B do not use the same external CA, synchronize the external root CA between the two NetBackup domains for MSDP communication.

For more information of the external CA, refer to NetBackup Security and Encryption Guide.

When one NetBackup domain uses an MSDP storage server that has multiple network interfaces and related host names, another NetBackup domain can use any one host name to configure the OpenStorage server. If the MSDP storage server that has multiple host names uses an external CA, the Subject Alternative Name field of the external certificate must contain all the host names that are used to configure the OpenStorage server.