Veritas NetBackup™ Security and Encryption Guide

In a Windows clustered environment, after setup master is run, the AUTHENTICATION_DOMAIN entry in the passive nodes can be the same as the active node name. This is not acceptable. After a failover on a passive node, when MFC UI is launched (using <[local machine name] > \[Administrator user]), an authentication-related pop-up error message is displayed. The work-around for this issue is to add the local node name as authentication domain into the AUTHENTICATION_DOMAIN on passive nodes after setup master (before failover). Before updating the value of AUTHENTICATION_DOMAIN, get the current value using the C:\Program Files\Veritas\NetBackup\bin\admincmd\bpgetconfig command. Then add the local node name as authentication domain in the existing domain list using the C:\Program Files\Veritas\NetBackup\bin\admincmd\bpsetconfig command. To exit and save from the bpsetconfig command prompt press Ctrl + Z and then press theEnter key.

Reverting the NBAC mode from REQUIRED to PROHIBITED on the active node of a cluster, can lead the cluster into a faulted state. The workaround for this issue is to do the following. On an active node run the bpclusterutil -disableSvc nbazd command followed by the bpclusterutil -disableSvc nbatd command. Change the bp.conf USE_VXSS=AUTOMATIC or REQUIRED value to PROHIBITED using the bpsetconfig command. Run the bpclusterutil -enableSvc nbazd command followed by the bpclusterutil -enableSvc nbatd command on the active node while turning NBAC to REQUIRED mode to monitor the security services.