Search <book_title>...

NetBackup and Veritas Appliances Hardening Guide

Last Published: 2023-06-08

Product(s): Appliances (10.2, 5.1.1, 3.0), NetBackup (10.2, 5.1.1, 3.0)

Platform: NetBackup Appliance OS,Flex Appliance OS,Linux,UNIX,Windows

Configuring AIR for replicating backup images from production environment to IRE BYO environment

Once IRE configuration is completed, the production NetBackup hosts are no longer able to access the IRE MSDP storage server. You need to enable MSDP reverse connection to allow the data transmission between the production MSDP server and the IRE MSDP server.

Note:

AIR configuration operations can be performed when the external network is open by IRE air gap. All the given operations are performed on the IRE MSDP server.

Prerequisites

Before you configure AIR for replicating backup images from production environment to IRE BYO environment, ensure the following:

In case of NetBackup certificate authority (CA), get the CA certificate and host certificate for the IRE MSDP storage server from the production primary server.
Create a token on the production primary server.

To configure AIR for replicating backup images from production environment to IRE BYO environment

Run the following commands:
- NetBackup certificate:
  /usr/openv/netbackup/bin/nbcertcmd -getCACertificate -server <production primary server>
  /usr/openv/netbackup/bin/nbcertcmd -getCertificate -server <production primary server> -token <token>
- External certificate:
  /usr/openv/netbackup/bin/nbcertcmd -enrollCertificate -server <production primary server>
Run the following command to enable MSDP reverse connection.
/usr/openv/pdde/shell/bin/ire_network_control reverse_connection --add production msdp server
This step is not required if you have not configured any IRE schedule. That is because if the IRE schedule is not configured, MSDP reverse connection is enabled for 24 hours on all days. The production primary server can configure the SLP replication operation with any SLP window.
Once the MSDP reverse connection is configured, copy the IRE schedule to the NetBackup production domain as an SLP window. Use the following command:
/usr/openv/pdde/shell/bin/sync_ire_window --production_primary_server production primary server name --production_primary_server_username production primary server username [--slp_window_name slp_window_name ]
Where:
The production primary server name is the fully qualified domain name (FQDN) of the primary server in your production environment.
The production primary server username is the username of a NetBackup user with permission to list SLPs and SLP windows in the production environment.
The production primary server username must be in domain_name\user_name format on Windows.
The slp_window_name is the name of the SLP window to be synced with the IRE window. It is an optional parameter. If the SLP window is not specified, an SLP window with the name IRE_DEFAULT_WINDOW is created on the production primary server.
You can then add the IRE WORM storage server as a replication target of the production NetBackup domain. Then add the replication operation to an existing SLP to replicate from production NetBackup domain to IRE WORM storage server using the following command:
/usr/openv/pdde/shell/bin/add_replication_op --production_primary_server production primary server name --production_primary_server_username production primary server username --source_slp_name source slp name --target_import_slp_name target import slp name --production_storage_server production storage server name --ire_primary_server_username ire primary server username --target_storage_server target storage server name --target_storage_server_username target storage server username --production_storage_unit msdp storage unit name used in source SLP [--slp_window_name slp window name]
Where:
The production primary server name is the fully qualified domain name (FQDN) of the primary server in your production environment.
The production primary server username is the username of a NetBackup user with permission to list SLPs and SLP windows in the production environment.
The production primary server username must be in domain_name\user_name format on Windows.
The production storage server name is the fully qualified domain name (FQDN) of the production storage server in your production environment.
The ire primary server username is the username for administrator user of IRE primary server.
The ire primary server username must be in domain_name\user_name format on Windows.
The source slp name is the SLP name on the production primary server against which a replication operation is added.
The target import slp name is the import SLP name from IRE primary server.
The target storage server name is the fully qualified domain name (FQDN) of the target WORM storage server.
The target storage server username is the username of the target WORM storage server.
The slp_window_name is the name of the SLP window that is synced with the IRE window. Alternatively, it is created on the production primary server before the operation. It is an optional parameter. If the SLP window is not specified, an SLP window with the name IRE_DEFAULT_WINDOW is used that must be created using the sync_ire_window command before the operation.
The production_storage_unit is the storage unit name of type PureDisk used in source SLP.
Note:
The source SLP and target import SLP need to be created before the operation.