Symantec Backup Exec Blueprints

Transcription

1 Symantec Backup Exec Blueprints Blueprint for Agent for Windows Backup Exec Technical Services Backup & Recovery Technical Education Services Symantec Backup Exec Blueprints - Agent for Windows 1

2 Symantec Backup Exec Blueprints Preface/disclaimer Notice This Backup Exec Blueprint presentation includes example diagrams that contain objects that represent applications and platforms from other companies such as Microsoft and VMware. These diagrams may or may not match or resemble actual implementations found in end user environments. Any likeness or similarity to actual end user environments is completely by coincidence. The goal of the diagrams included in this blueprint presentation is not to recommend specific ways in which to implement applications and platforms from other companies such as Microsoft and VMware, but rather to illustrate Backup Exec best practices only. For guidelines and best practices on installing and configuring applications and platforms from other companies, please refer to best practice documentation and other resources provided by those companies. Symantec Backup Exec Blueprints - Agent for Windows 2

3 Backup Exec Blueprints: How to Use Getting the most out of Backup Exec blueprints These Blueprints are designed to show customer challenges and how Backup Exec solves these challenges. Each Blueprint consists of: Pain Points: what challenges customers face Whiteboard: Shows how Backup Exec solves the customer challenges Recommended Configuration: Shows recommended installation Do s: Gives detailed configurations suggested by Symantec Don'ts: What configurations & pitfalls customers should avoid Advantages: Summarizes the Backup Exec advantages Use these Blueprints to: Understand the customer challenges and how Backup Exec solves them Present the Backup Exec best practice solution Symantec Backup Exec Blueprints - Agent for Windows 3

4 Pain Points Symantec Backup Exec Blueprints - Agent for Windows 4

5 Agentless backups Pain Points: Agentless Backup Methods 1 Network Impact Backup server processes full backup load High network chatter between server, client(s) Potential for high network impact Potential performance inhibitor 2 Recovery Obstacles Difficult to recover granular application or file data Commonly requires multiple manual steps Not optimized for recovery 3 Management Headaches Can increase overall cost of ownership Some solutions use dissolvable agents during recovery Dissolvable agents can impact data integrity Troubleshooting is more complex Symantec Backup Exec Blueprints - Agent for Windows 5

6 Introduction Symantec Backup Exec Blueprints - Agent for Windows 6

7 Introduction Backup Exec Agent for Windows Installs as a separate add-on component Enables simplified backup and restore of remote Windows Servers Optimizes data protection processes in network environments Supports Windows servers and workstations Improves performance, reduces network chatter Agent for Windows Remote Windows Client Symantec Backup Exec Blueprints - Agent for Windows 7

8 Overview Performance Optimization Provides high-performance data protection for remote Windows servers NDMP technology performs source-level compression and distributed processing at the client-level Support for 32-bit and 64-bit Windows servers Open File Protection Open files protected using built-in Advanced Open File capability VSS integration provides Microsoft best-practice alignment Powerful Data Deduplication Client-level data deduplication support built in Reduces amount of data sent to backup server Simplified Disaster Recovery Technology Saves time by automating manual, error-prone recovery processes Symantec Backup Exec Blueprints - Agent for Windows 8

9 Whiteboards and Diagrams Symantec Backup Exec Blueprints - Agent for Windows 9

10 Installation Requirements Network Windows Client Backup Exec Agent for Windows OS Windows 2012/R2 Windows 8/8.1 Windows 2008 SP2/R2 Windows 2008 Core /R2 Windows SBS 2008/2011 Windows EBS 2008 Windows 2003 SP2/R2 Windows Vista Windows 7 Processor Intel Pentium, Xeon, AMD, or compatible RAM 512 MB RAM Hard Disk Space 188 MB Privileges Local administrator rights Application/Platforms Microsoft.NET 2.0 SP2, MSXML 6.0 A list of compatible platforms and applications can be found here: Symantec Backup Exec Blueprints - Agent for Windows 10

11 Operational capabilities Windows Server Backup Exec Agent for Windows Agent for Windows Beremote.exe Media Server Bengine.exe Agent for Windows: Gathers data Compresses the data into Microsoft Tape Format (MTF) Provides software compression Provides software encryption Symantec Backup Exec Blueprints - Agent for Windows 11

12 Media Server Architecture NTFS Tape Format SQL SPS ORACLE DB2 EV Lotus. Catalog s Backup Exec User Interface BE Console BEMCLI Configuration & Control Data Mover Agent Applications Management Service and BESERVER BE Remote BENGINE SQL Exchange SharePoint BEDB Catalog Files Agent for Windows: Provides browse interface for Backup Exec Interface Data source and sink for backup and restore An NDMP Data Server (sort of) NDMP = Network Data Management Protocol The protocol is greatly extended Used on both a media server and application servers Symantec Backup Exec Blueprints - Agent for Windows 12

13 Data Browse and Job Definition NTFS SQL SPS ORACLE DB2 EV Lotus. NTFS Tape Format SQL SPS ORACLE DB2 EV Lotus. Catalog s Windows Server Backup Exec Agent BE Remote User Interface BE Console 1 2 Applications Exchange User Interface connects to Management Service Management Service connects to Agent on the Media Server 3 Configuration & Control Data Mover Agent 2 4 Management Service and BESERVER BE Remote 1 BENGINE 5 BEDB Catalog Files 3 Agent on the Media Server connects to the Agent on the Remote Server to browse backup 4 5 User Interface saves job definition to BESERVER BESERVER saves configuration to BEDB Applications SQL Exchange SharePoint Symantec Backup Exec Blueprints - Agent for Windows 13

14 Backup to Disk NTFS SQL SPS ORACLE DB2 EV Lotus Exchange Tape Format NTFS SQL SPS ORACLE DB2 EV Lotus. Catalog s Windows Server Backup Exec Agent BE Remote User Interface BE Console 1 Applications 5 Configuration & Control Exchange 6 Management Service and BESERVER BEDB Data Mover Job to backup remote sever is set up on the Media Server BE SERVER sends job to BENGINE BENGINE connects to Media Server Agent Agent BENGINE 4 3 BE Remote Catalog Files 4 5 Media Server Agent sends data to BENGINE BENGINE connects to Remote Server Agent PDI Files 6 Remote Server Agent sends data to Machine A BE Remote (for GRT) Applications SQL Exchange SharePoint Symantec Backup Exec Blueprints - Agent for Windows 14

15 Restore Workflow NTFS SQL SPS ORACLE DB2 EV Lotus. Tape Format NTFS SQL SPS ORACLE DB2 EV Lotus. Catalog s Windows Server Backup Exec Agent BE Remote User Interface BE Console Applications Exchange User Interface connects to catalogs via Management Service Catalogs connects to Agent on the Media Server Agent opens PDI files for browse User Interface saves job definition to BESERVER BESERVER saves configuration to BEDB BE SERVER sends job to BENGINE BENGINE connects to Agent on the Media Server BENGINE connects to Agent on the Remote Server Agent on the Media Server sends data to the Agent on the Remote Server (for GRT restore) Configuration & Control 8 Data Mover Agent 9 Applications PDI Files Management Service and BESERVER 3 4 BENGINE 7 BE Remote SQL Exchange SharePoint BEDB Catalog Files Symantec Backup Exec Blueprints - Agent for Windows 15

16 Pre-Backup Exec 2010 R3 Connections Windows Server Backup Exec Remote Server AWS Beremote.exe Original Data Connection Media Server Job Engine Bengine.exe MITM Connection Attacker MITM = Man in the Middle Symantec Backup Exec Blueprints - Agent for Windows 16

17 Secured Connections with SSL encryption in BE 2010 R3 and onwards Windows Server Backup Exec Remote Server AWS Beremote.exe Control Connection Data Connection Media Server Job Engine Bengine.exe The control connection between the Media Server and remote agent is encrypted Supplements existing data encryption, does not replace it Does not encrypt the data connection If data connection encryption is desired, select software based encryption in the job options Each Backup Exec media server is its own Certificate Authority (CA) A CA has the power to sign certificates, thereby establishing identity and trust for media servers and remote agents. Symantec Backup Exec Blueprints - Agent for Windows 17

18 Secured Connections with SSL encryption: TLS trust establishment Windows Server Backup Exec 3 TLS Connection Certificate Authority [CA] When a Media Server is installed, it will automatically generate a public/private key pair then create and sign a root certificate for itself. It will then generate another public/private key pair to use for secure connections. Using this, it will ask its own CA to sign a new certificate made from this public key. This is called the TLS certificate. The first time a Media Server talks to a remote agent, a TLS connection is attempted and fails because the remote agent doesn t have a TLS certificate that is signed by the media server s CA. The user is asked to physically validate that the remote agent is in fact the computer he wishes to contact. Once affirmed, the remote agent will generate a public/private key pair, followed by a Certificate Signing Request (CSR) that contains the remote agent s identification info and public key. The Media Server will sign this and return the result as a TLS certificate for the agent. When a remote agent is push-installed from a media server, the installer generates the agent certificates, gets them signed by the media server s CA, and installs them into the certificate store of the agent. Symantec Backup Exec Blueprints - Agent for Windows 18

19 VSS Requestor Production Network (10 Gigabit) Backup Exec Windows Server Backup Network (10 Gigabit) Writers Volume Shadow Copy Service Requestor Exchange Provider SQL Active Directory SharePoint.. Operating System, Storage Array or System Provider Symantec Backup Exec Blueprints - Agent for Windows 19

20 Port and firewalls Windows Server Firewall Backup Exec When a Backup Exec server connects to a remote system, the connection is initiated on port o By default, AWS listens for connections on this port. AWS initiates control connections and data connections. o This can be adjusted to use a specific range of ports to isolate traffic. Symantec Backup Exec Blueprints - Agent for Windows 20

21 Agentless or Agent-based protection You Decide Windows Server Use an Agent Go Agentless For all Physical Windows Server On any virtual machines on which you want to use GRT Unless true agent-based backup method is being used, Simplified Disaster Recovery and related features do not apply to virtual backups Little or no I/O impact Optimize for recoverability Restore an entire guest Restore granular data Restore granular application data Optimized for virtual performance Restore an entire virtual guest Integrated Management View with vstorage API Virtual Machines Usually Protected Through Image-based Backups (Agentless) Symantec Backup Exec Blueprints - Agent for Windows 21

22 Agent installation on VM s - Simplified New mechanism that allows users to enumerate available virtual machines on an ESX or Hyper V host and install AWS on them in bulk Note: VMWare Tools should be installed before you install the Agent for Windows on a guest virtual machine if you intend to use the Backup Exec VSS provider Symantec Backup Exec Blueprints - Agent for Windows 22

23 Do Symantec Backup Exec Blueprints - Agent for Windows 23

24 Best Practices: Agent for Windows Do the following Use the Update feature on the Backup and Restore tab to update the Agent for Windows on remote computers with the same patches that were installed on the Backup Exec server Option to Run immediately or with a schedule LiveUpdate does not update the Agent for Windows on remote computers. Symantec Backup Exec Blueprints - Agent for Windows 24

25 Best Practices: Agent for Windows Do the following Purchase the Agent for Windows separately, and it must be running on the remote computer to perform disaster recovery of the remote computer Install the Backup Exec Agent for Windows on any virtual machines on which you want to use Backup Exec's Granular Recovery Technology (GRT) Install the VMware Tools before you install the Agent for Windows on the guest virtual machine to use GRT Promote remote systems with larger data footprints to Media Servers that: Use locally attached storage devices Keep data loads off the network Symantec Backup Exec Blueprints - Agent for Windows 25

26 Best Practices: Agent for Windows Do the following Subdivide the remote computers that are enabled for direct access sharing among the servers that host the deduplication disk storage folders to best optimize several managed Backup Exec servers at a single site For example, a large site with two managed Backup Exec servers and 10 remote computers should split the remote computers evenly between the managed Backup Exec servers Limit the sharing of remote computers that are enabled for direct access sharing with other Backup Exec servers that use deduplication disk storage This prevents duplicate data from being hosted on multiple backup servers Update the Backup Exec Agent Utility whenever Oracle database instance information changes If credential information is not updated, you may receive an Unable to attach to a resource... error during backup Symantec Backup Exec Blueprints - Agent for Windows 26

27 Best Practices: Agent for Windows Do the following Windows Resource Protection (WRP) prevents backup and restore jobs from functioning normally on computers that run Windows Vista/Server 2008/8/8.1/2012/2012 R2 Although Backup Exec can complete backup and restore jobs, performance may suffer. Refer to the following Microsoft article for more information and to obtain a hot fix that resolves this issue: Because WRP affects the Windows Installer, you should install the hot fix before you install Backup Exec agents or options on a computer that runs Windows Vista. Symantec Backup Exec Blueprints - Agent for Windows 27

28 Do not Symantec Backup Exec Blueprints - Agent for Windows 28

29 Best Practices: Agent for Windows Do not do the following Do Not install the Agent for Windows on a volume that has been enabled for deduplication in Windows Microsoft does not support this configuration. However, if you install the Agent for Windows on a volume and then enable it for deduplication in Windows, Backup Exec functions normally. Do Not install the Agent for Windows on a ReFS volume Microsoft does not support this configuration. However, if you install the Agent for Windows on a volume and then convert it to ReFS, Backup Exec functions normally. Don t push-install the Agent for Windows when the remote computer is in the ForceGuest configuration Symantec recommends that you do not install a Backup Exec server or the Agent for Windows on a Cluster Shared Volume These configurations are not support Push-installation by mapped drives is not supported; install using a UNC path Symantec Backup Exec Blueprints - Agent for Windows 29

30 Backup Exec Blueprints: Final Thoughts Four powerful technologies wrapped into one agent Production Network (10 Gigabit) Windows Server Backup Exec Agent for Windows Backup Network (10 Gigabit) Provides high-performance data protection for remote Windows servers and includes Open File protection and Simplified Disaster Recovery Optimizes data transfers for 32-bit and 64-bit remote Windows servers with exclusive NDMP technology that provides source-level compression and distributed processing at the client Open files are protected with the Advanced Open File capability built into the Agent for Windows Integrates with VSS to protect open files in multiple volumes and ensures files on local or remote servers are protected while in use Provides Simplified Disaster Recovery feature which saves time by automating the traditional manual, errorprone process of system recovery With four powerful technologies wrapped into one agent, users truly have complete data and system protection for every remote Windows server Symantec Backup Exec Blueprints - Agent for Windows 30

31 Thank You! Backup Exec Product Management Symantec Backup Exec Blueprints - Agent for Windows 31