NetBackup and NetBackup Appliances Hardening Guide

To configure data transmission between a production environment and an IRE

1. Open an SSH session to the IRE storage server. Run the following command to determine if the external network is open:

   setting ire-network-control external-network-status

   If it is not, run the following command:

   setting ire-network-control external-network-open

2. Run the following command to add an MSDP reverse connection:

   setting ire-network-control add-reverse-connection remote_storage_server=<production MSDP server> [remote_primary_server=<production primary server>] [local_storage_server=<IRE network interface>]

   Where:

   • <production MSDP server> is the fully qualified domain name (FQDN) of the MSDP server in your production environment.

   • [remote_primary_server=<production primary server>] is an optional parameter for the FQDN of the primary server in your production environment. This parameter is required if the IRE domain uses an alternative name to access the production primary server. This scenario usually occurs if the production primary server runs on multiple networks with multiple hostnames.

   • [local_storage_server=<IRE network interface>] is an optional parameter for the hostname of the network interface to use for image replication on the IRE storage server. This parameter is required if the network interface for replication is different than the IRE storage server name.

3. If necessary, repeat the previous step to add additional MSDP reverse connections.
4. If Auto Image Replication (AIR) is not already configured on the production domain, run the following command to copy the IRE schedule to the production domain as a storage lifecycle policy (SLP) window:

   setting ire-network-control sync-ire-window production_primary_server=<production primary server> production_primary_server_username=<production username> [slp_window_name=<SLP window name>]

   Where:

   • <production primary server> is the FQDN of the primary server in your production environment.

   • <production username> is the username of the NetBackup primary user with permission to list SLPs and SLP windows in the production environment. For Windows users, enter the username in the format <domain name>\<username>. For other users, enter the username only.

   • [slp_window_name=<SLP window name>] is an optional parameter to give a name for the SLP window. If you do not provide this parameter, the name of the SLP window is IRE_DEFAULT_WINDOW.

5. If you do not have them already, create a source SLP on the production primary server and a target import SLP on the IRE primary server.

   Note:

   You cannot add the replication operation from the production NetBackup primary when you create the SLPs as the target storage is air gapped. Continue to the next step to add the replication operation.

6. Run the following command to add the IRE storage server as a replication target of the production Access Appliance domain and to add the replication operation to the SLP:

   setting ire-network-control add-replication-op production_primary_server=<production primary server> production_primary_server_username=<production username> production_storage_server=<production storage server> ire_primary_server_username=<IRE username> source_slp_name=<production SLP name> target_import_slp_name=<IRE SLP name> target_storage_server=<target storage server> target_storage_server_username=<target storage server username> production_storage_unit=<MSDP storage unit> [slp_window_name=<slp window name>]

   Where:

   • <production primary server> is the FQDN of the primary server in your production environment.

   • <production username> is the username of the NetBackup primary user with permission to list SLPs and SLP windows in the production environment. For Windows users, enter the username in the format <domain name>\<username>. For other users, enter the username only.

   • <production storage server> is the FQDN of the production storage server in your production environment.

   • <IRE username> is the username for an administrator on the IRE NetBackup primary server. For Windows users, enter the username in the format <domain name>\<username>. For other users, enter the username only.

   • <source SLP name> is the SLP name from the production primary server to add the replication operation to.

   • <target SLP name> is the import SLP name from the IRE primary server.

   • <target storage server> is the FQDN of the target storage server in your IRE environment.

   • <target storage server username> is the username of the MSDP storage server used while configuring the target storage server .

   • <MSDP storage unit> is the name of the MSDP storage unit that is the replication source in the source SLP.

   • [slp_window_name=<slp window name>] is an optional parameter for the name of the SLP window that is synced with the IRE schedule. This parameter must match the SLP window name from the previous step, if applicable. If you do not provide this parameter, the default name is used.

7. If you opened the external network at the beginning of this procedure, run the following command to close it and resume the air gap schedule:

   setting ire-network-control resume-schedule