NetBackup and Veritas Appliances Hardening Guide

To configure data transmission between a production environment and an IRE

1. Open an SSH session to the IRE WORM storage server. Run the following command to determine if the external network is open:

   setting ire-network-control external-network-status

   If it is not, run the following command:

   setting ire-network-control external-network-open

2. Depending on the type of certificate authority that you use for host communication, do one of the following:

   • If you use a NetBackup Certificate Authority, run the following commands to request the certificates from the production domain:

     setting certificate get-CA-certificate primary_server=<production primary server>

     setting certificate get-certificate primary_server=<production primary server> token=<token>

   • If you use an external certificate authority, run the following commands to enroll the certificates with the production domain:

     setting certificate enroll-external-certificates server=<production primary server>

3. Run the following command to add an MSDP reverse connection:

   setting ire-network-control add-reverse-connection remote_storage_server=<production MSDP server> [remote_primary_server=<production primary server>] [local_storage_server=<IRE network interface>]

   Where:

   • <production MSDP server> is the fully qualified domain name (FQDN) of the MSDP server in your production environment.

   • [remote_primary_server=<production primary server>] is an optional parameter for the FQDN of the primary server in your production environment. This parameter is required if the IRE domain uses an alternative name to access the production primary server. This scenario usually occurs if the production primary server runs on multiple networks with multiple hostnames.

   • [local_storage_server=<IRE network interface>] is an optional parameter for the hostname of the network interface to use for image replication on the IRE storage server. This parameter is required if the network interface for replication is different than the IRE storage server name.

4. If necessary, repeat the previous step to add additional MSDP reverse connections.
5. If Auto Image Replication (AIR) is not already configured on the production domain, run the following command to copy the IRE schedule to the production domain as a storage lifecycle policy (SLP) window:

   setting ire-network-control sync-ire-window production_primary_server=<production primary server> production_primary_server_username=<production username> [slp_window_name=<SLP window name>]

   Where:

   • <production primary server> is the FQDN of the primary server in your production environment.

   • <production username> is the username of a NetBackup user with permission to list SLPs and SLP windows in the production environment. For Windows users, enter the username in the format <domain name>\<username>. For other users, enter the username only.

   • [slp_window_name=<SLP window name>] is an optional parameter to give a name for the SLP window. If you do not provide this parameter, the name of the SLP window is IRE_DEFAULT_WINDOW.

6. If you do not have them already, create a source SLP on the production primary server and a target import SLP on the IRE primary server. See the section "Creating a storage lifecycle policy" in the NetBackup Deduplication Guide for details.

   Note:

   You cannot add the replication operation from NetBackup when you create the SLPs. Continue to the next step to add the replication operation.

7. Run the following command to add the IRE WORM storage server as a replication target of the production NetBackup domain and to add the replication operation to the SLP:

   setting ire-network-control add-replication-op production_primary_server=<production primary server> production_primary_server_username=<production username> production_storage_server=<production storage server> ire_primary_server_username=<IRE username> source_slp_name=<production SLP name> target_import_slp_name=<IRE SLP name> target_storage_server=<target storage server> target_storage_server_username=<target storage server username> production_storage_unit=<MSDP storage unit> [slp_window_name=<slp window name>]

   Where:

   • <production primary server> is the FQDN of the primary server in your production environment.

   • <production username> is the username of a NetBackup user with permission to list SLPs and SLP windows in the production environment. For Windows users, enter the username in the format <domain name>\<username>. For other users, enter the username only.

   • <production storage server> is the FQDN of the production storage server in your production environment.

   • <IRE username> is the username for an administrator on the IRE primary server. For Windows users, enter the username in the format <domain name>\<username>. For other users, enter the username only.

   • <source SLP name> is the SLP name from the production primary server to add the replication operation to.

   • <target SLP name> is the import SLP name from the IRE primary server.

   • <target storage server> is the FQDN of the target WORM storage server in your IRE environment.

   • <target storage server username> is the username for an administrator on the target WORM storage server.

   • <MSDP storage unit> is the name of the MSDP storage unit that is the replication source in the source SLP.

   • [slp_window_name=<slp window name>] is an optional parameter for the name of the SLP window that is synced with the IRE schedule. This parameter must match the SLP window name from the previous step, if applicable. If you do not provide this parameter, the default name is used.

8. If you opened the external network at the beginning of this procedure, run the following command to close it and resume the air gap schedule:

   setting ire-network-control resume-schedule