Search <book_title>...

Veritas NetBackup™ Flex Scale Administrator's Guide

Last Published: 2025-02-12

Product(s): Appliances (3.2)

Platform: NetBackup Flex Scale OS

DNS key management

Before changing the replication roles, the DNS server(s) configured with NetBackup Flex Scale may need to be updated to correctly resolve NetBackup primary server FQDN(s). NetBackup Flex Scale gives you the option to update the DNS server(s) automatically when changing the replication role of the cluster.

The DNS key management wizard in the Primary service replication page can be used to configure TSIG (Transaction signature) key for DNS servers configured on the NetBackup Flex Scale cluster. TSIG as specified in RFC 2845 is a shared key message authentication mechanism that is available in BIND DNS. A TSIG key provides the means to authenticate and verify the validity of exchanged DNS data. It uses a shared secret key between a resolver and either one or two servers to provide security. For TSIG authentication to work correctly, the clock has to be in sync between the NetBackup Flex Scale cluster(s) and the DNS server(s).

NetBackup Flex Scale 3.2 supports Bind 9 compatible DNS servers for automatic updates. Windows DNS server is not supported for automatic DNS update. If the primary service replication is configured to use same virtual IP for NetBackup primary service on both clusters, then DNS update is not required before changing the replication role. So the DNS key management wizard and automatic DNS update option are not available in this configuration.

You can manage the DNS keys using the GUI.

To manage DNS secret key using GUI

Log on to NetBackup Flex Scale GUI of the primary or secondary site.
Go to Settings > Primary service replication. Click View details under DNS key management.
The DNS key management screen appears. It lists all the configured DNS server that you can manage.
Note:
DNS key management tab does not appear if NetBackup primary service configuration has been done using a single virtual IP.

You can also upload the secret key using GUI.

To upload secret key using GUI

Ensure that the DNS server secret key file (generated using tsig-keygen on the DNS server) is ready for upload.
Only DNS servers with valid secret keys are allowed to be updated automatically during role change.
Click the Actions menu (vertical ellipsis) from the right side of the row in the GUI to open the additional options for a selected DNS server.
Select Upload secret key option.
Using the File select dialog box, select the secret key file to upload. The secret key file is uploaded and then validated against the DNS server. Once the key is validated, the screen shows the key as valid or invalid.

You can also remove the secret key using GUI.

To remove secret key using GUI

Click the Actions menu (vertical ellipsis) from the right side of the row in the GUI to open the additional options for a selected DNS server.
Select Remove secret key option.

You can also manage the DNS keys using RESTful APIs.

To retrieve the list of DNS servers to configure automatic DNS update.
```
GET api/appliance/v1.0/disaster-recovery/dns
```

To upload a secret key file for a given DNS server.

PUT api/appliance/v1.0/disaster-recovery/dns/{serverIP}

To configure a DNS server for DNS automatic update.

POST /api/appliance/v1.0/disaster-recovery/dns/{serverIP}

To validate a secret key file for a given DNS server.

 POST /api/appliance/v1.0/disaster-recovery/dns/{serverIP}/validate

To unconfigure a DNS server from DNS automatic update.

DELETE /api/appliance/v1.0/disaster-recovery/dns/{serverIP}