NetApp SteelStore Solution Guide for Veeam Backup & Replication. October 2014

Transcription

1 NetApp SteelStore Solution Guide for Veeam Backup & Replication October 2014

2 2014 NetApp, Inc. All rights reserved. No portions of this document may be reproduced without prior written consent of NetApp, Inc. Specifications are subject to change without notice. NetApp, the NetApp logo, Go Further, Faster, ASUP, AutoSupport, Campaign Express, Cloud ONTAP, Clustered Data ONTAP, Customer Fitness, Data ONTAP, DataMotion, Fitness, Flash Accel, Flash Cache, Flash Pool, FlashRay, FlexArray, FlexCache, FlexClone, FlexPod, FlexScale, FlexShare, FlexVol, FPolicy, GetSuccessful, LockVault, Manage ONTAP, Mars, MetroCluster, MultiStore, NetApp Insight, OnCommand, ONTAP, ONTAPI, RAID-DP, SANtricity, SecureShare, Simplicity, Simulate ONTAP, Snap Creator, SnapCopy, SnapDrive, SnapIntegrator, SnapLock, SnapManager, SnapMirror, SnapMover, SnapProtect, SnapRestore, Snapshot, SnapValidator, SnapVault, StorageGRID, Tech OnTap, Unbound Cloud, WAFL and Whitewater are trademarks or registered trademarks of NetApp, Inc. and its affiliated entities in the United States and/or other countries. SteelStore [and Riverbed] are trademarks of Riverbed Technology used pursuant to license. Any other brands or products are trademarks or registered trademarks of their respective holders and should be treated as such. A current list of certain of NetApp trademarks is available on the Web at

3 TABLE OF CONTENTS Executive Summary... 3 Veeam Backup & Replication Architecture Overview... 3 SteelStore Appliance Overview... 4 SteelStore Appliances with Veeam Backup & Replication... 5 Backup Application, SteelStore Appliance, and Cloud Storage Configuration T opology... 5 Pre-deployment Checklist... 5 Cloud Storage Provider Required T asks... 6 Amazon S3 and Glacier... 6 AT&T Synaptic Storage as a Service... 6 Google Cloud... 6 HP Cloud Services... 6 Microsoft Windows Azure... 7 Rackspace Cloud Files... 7 OpenStack Object Storage (Swift)... 7 Configuring the SteelStore Appliance... 8 Configuring the SteelStore Management Interface... 8 Connecting to the SteelStore Management Console GUI... 9 Configuring SteelStore Appliance Licenses Configuring SteelStore Data Interfaces Configuring Cloud Settings Configuring a CIFS Share Configuring Veeam Backup & Replication Veeam Backup & Replication Management Console Overview Adding a SteelStore Appliance to Veeam Backup & Replication Tasks Create a Backup Repository Create a Veeam Backup & Replication Job Testing Veeam Backup & Replication with a SteelStore Appliance Backup to a SteelStore Appliance Using Veeam Backup & Replication Monitoring a Job Restore from Veeam Backup & Replication Using a SteelStore Appliance Performing a Full VM Restore Restoring an Individual File or Folder Appendix A. SteelStore Appliance Best Practices for Veeam Backup & Replication Appendix B. SteelStore Best Practices for Solaris Operating Systems Appendix C. SteelStore Best Practices for Windows 2008 Operating Systems Appendix D. T roubleshooting... 36

4 Executive Summary This paper outlines the ease of use and deployment of a NetApp SteelStore cloud storage appliance (SteelStore Appliance) with Veeam Backup & Replication. SteelStore appliances provides a simple, efficient way to offsite data to cloud storage providers powered by Amazon S3 and Glacier, AT&T Synaptic Storage as a Service, HP Cloud Services, Google Cloud, Microsoft Windows Azure cloud storage, Rackspace Cloud Files, and general instances of EMC Atmos and OpenStack (Swift) Object Storage. SteelStore appliances simply act as a repository target within a backup infrastructure managed by Veeam Backup & Replication, enabling organizations to eliminate their reliance on tape infrastructure and all of its associated capital and operational costs, while improving backup windows and disaster recovery capabilities. It is simple to set up the SteelStore appliance and start moving data to the cloud in a few hours, compared to setting up tape or other disk replication infrastructures which can take days. Leveraging NetApp s industry leading deduplication, compression and WAN optimization technologies, SteelStore appliances shrink data set sizes by 10 to 30x substantially reducing cloud storage costs, accelerating data transfers and storing more data within the local cache, speeding recovery. Security is provided by encrypting data on-site, in-flight, as well as in the cloud using 256-bit AES encryption and SSL v3. SteelStore appliance provides a dual layer of encryption that ensures that any data moved into the cloud is not compromised, and it creates a complete end-to-end security solution for cloud storage. Since a SteelStore appliance is an asymmetric, stateless appliance, no hardware is needed in the cloud and you can recover the last known good state of a broken or destroyed SteelStore appliance to a new SteelStore appliance. SteelStore appliances provide flexibility to scale cloud storage as the business requirements change. All capital expenditure planning required with tape and disk replication based solutions is avoided, saving organizations 30-50%. Veeam Backup & Replication Architecture Overview Veeam Backup & Replication is an industry-leading data protection and disaster recovery solution for VMware virtual infrastructure that combines backup, replication, and the fastest item -level recovery, in a single product. Enabling these options from one interface, Veeam Backup & Replication serves to solve the most critical problems of VMware virtual infrastructure management by protecting mission-critical virtual machines (VMs) from both hardware and software failure. With Veeam Backup & Replication, VM environments can publish a compressed and deduplicated backup file as a regular VMDK file, run a VM directly from a backup without modifying the backup in any way, and automatically create an isolated environment. You can also run a VM directly from a backup file on regular backup storage, eliminating the need to recover the backup to production storage. Veeam Backup & Replication performs backup and recovery activities via an easy to use wizard, and are managed via the Management Console on Windows. Backup jobs are sent to Windows shares which includes CIFS based targets. See Diagram 1 Typical Veeam Backup & Replication Network View for an image of a typical Backup & Replication deployment, in which Backup & Replication manages VMs that are backed up directly to a repository target.

5 Diagram 1 Typical Veeam Backup & Replication Network View SteelStore Appliance Overview Figure 1 SteelStore Appliance SteelStore appliances are optimized and purpose built for data protection. SteelStore appliances easily integrate into your existing backup infrastructure and favorite cloud storage provider. Set up and installation are easy because backup applications allow you to add a SteelStore appliance as a common target within its existing infrastructure. The backup server connects to the SteelStore appliance using standard CIFS or NFS protocols. When you backup to a SteelStore device, it performs inline, variable segment length deduplication of the backup data to minimize storage consumption and transmission times. SteelStore appliances also use their local disk cache for fast recovery of recent backups, providing LAN performance for the most likely restores. The SteelStore appliance then writes the deduplicated backup data to cloud storage, and also accelerates restores from the cloud by moving only needed segments of deduplicated data over the WAN. An easy to use graphical management console enables you to manage one or more SteelStore appliances through a web browser interface.

6 SteelStore Appliances with Veeam Backup & Replication Veeam Backup & Replication with SteelStore appliances provides you with a flexible, easy-to-configure and use solution that can be deployed with major cloud storage providers. The sections below provide example configurations and setup steps needed to begin using SteelStore appliances. For further information about performance tuning backup applications with SteelStore appliances, refer to the SteelStore Best Practices Guide for Backup Applications. Backup Application, SteelStore Appliance, and Cloud Storage Configuration Topology Diagram 2 Logical Architecture View Pre-deployment Checklist 1. Users will need a least one server that can act as the Veeam Backup & Replication server. This can be either a physical system, or a virtual guest within a VMware ESX or ESXi environment. This server needs a minimum of a quad core processor and 4GB RAM and 300MB of free hard disk space. Veeam Backup & Replication supports ESX/ESXi server versions 3.5, 4.x and 5.0, as well as vcenter 2.x, 4.x and 5.x. Please check Veeam s support site and related compatibility lists where applicable. & Replication/ 2. Obtain server systems and related software media supported by Windows 2008 R2, Veeam Backup & Replication and SteelStore appliance. 3. A physical SteelStore appliance or SteelStore cloud storage appliance Virtual Edition (Virtual SteelStore) needs to be online and connected to the physical network infrastructure. 4. You must procure and setup all necessary software licenses from each vendor, including NetApp, using vendor-specific guidelines. 5. Physical stacking and racking of equipment at each site. All cabling and power must be operational. Verify that all LAN and WAN connections are functioning to and from Internet and cloud storage provider(s) 6. Set up the Windows server(s) within an existing or new created naming service such as Active Directory.

7 Cloud Storage Provider Required Tasks Amazon S3 and Glacier To sign up for Amazon S3 and Glacier: 1. Go to and click the link Sign Up. 2. Follow the on-screen instructions. 3. AWS will notify you by when your account is active and available for you to use. 4. Login and get authentication information by selecting your account name from the top menu, and selecting the link Security Credentials. 5. Make sure that you record the following information: Access Key - Specify the access key (similar to the user name) for your Amazon S3 (AWS) account. Secret Key - Specify the secret key (password) for your Amazon S3 provider account. AT&T Synaptic Storage as a Service To sign up for AT&T Synaptic Storage as a Service: 1. Go to the following website and click the link Order Now: 2. Follow the on-screen instructions. 3. Receive the confirmation and login to the AT&T Synaptic Storage as a Service website. 4. Record the following information: Tenant ID - Specify the tenant ID that AT&T Synaptic Storage as a Service uses to authenticate each request. UID - Specify the application ID (also known as UID) used to authenticate each request. Shared Secret - Specify the shared secret that AT&T Synaptic Storage as a Service uses to authenticate each request. Google Cloud To sign up for Google Cloud: 1. Go to and click the link Try It Now. 2. Follow the on-screen instructions. 3. Perform account confirmation via phone or text message and login. 4. Create a new Project using the Create Project link. Provide a Project Name and Project ID. 5. Select Cloud Storage, and click the Enable button to activate cloud storage services. 6. Under API Access generate a client ID using the Create a Client ID link. 7. Record the following information from the created project to enter into the SteelStore GUI: Project ID Provide the numeric value of the project created in Google Cloud. Client ID Provide the cloud storage client ID for the user that is associated with the project ID above. Private Key Provide the private key associated with the above client ID. HP Cloud Services To sign up for HP Cloud Services: 1. Go to 2. Follow the on-screen instructions. 3. HP Cloud Services will notify you by when your account is active and available for you to use. 4. Login to HP Cloud Services and activate an availability zone. 5. Create an object container. From the HP Cloud Services console select the Browse Containers button from the Management Console and on the next screen, enter a New Container Name in the field provided and select the Create button. 6. Make sure that you record the following information: Tenant ID Specify the endpoint account to use with HP Cloud Services Access Key - Specify the access key for your HP Cloud Services account. Secret Key - Specify the secret key for your HP Cloud Services account. Container Name Specify the target storage folder name for backup objects

8 Microsoft Windows Azure To sign up for Microsoft Windows Azure: 1. Go to and click the link Free Trial. 2. Follow the on-screen instructions. 3. Perform account confirmation via phone or text message. 4. Login to the Azure portal and create a new Storage Account under Hosted Services, Storage Accounts & CDN. 5. Record the following information from the created storage account to enter into the SteelStore GUI: Storage Account Provide the name of the storage account created in Azure. Primary/Secondary Key Provide either the primary or secondary access key from the storage account created. Rackspace Cloud Files To sign up for Rackspace Cloud Files: 1. Go to and sign up for a cloud account. 2. Once account registration is complete, login to the Rackspace portal: US: UK: 3. Access Your Account > API Access, and record the following information to enter into the SteelStore GUI: Access Key Provide the API key used to access the cloud account. Username Provide the user name associated with the account. OpenStack Object Storage (Swift) Please refer to OpenStack documentation ( for information about deploying an OpenStack Object Storage cluster for use with SteelStore appliances. You should have the following information ready to enter into the SteelStore GUI: Host Name Hostname or IP address of the OpenStack Object Storage Proxy server Port Port on which the OpenStack Object Storage Proxy server listens to Username Specify the username that is used to authenticate each request. Password Specify the password that is used to authenticate each request.

9 Configuring the SteelStore Appliance The following procedures are basic configurations. The SteelStore Installation Guide and SteelStore User s Guide provide full details for requirements and installation of the SteelStore appliance. The configuration is broken down into the following activities: Configuring the SteelStore Management Interface Connecting to the SteelStore Management Console Configuring SteelStore appliance Licenses Configuring SteelStore Data Interfaces Configuring Cloud Settings Configuring a CIFS Share Configuring the SteelStore Management Interface After you install and start the SteelStore appliance, connect to the SteelStore CLI to configure the management interface: 1. If you are using a Virtual SteelStore, connect directly to the console session using the VMware vsphere client and skip to step 3. If you are using a physical SteelStore appliance, plug the serial cable into the console port and a terminal. 2. Start your terminal emulation program, such as Tera Term Pro. The terminal device must have the following settings: Baud rate: 9600 bps Data bits: 8 Parity: none Stop bits: 1 vt100 emulation No flow control Note: If you are using SteelStore with a terminal server, the terminal server must use hardware flow control for the port connected to SteelStore. 3. Log in as an administrator user (admin) and enter the default password (password): login as: admin password: password 4. The configuration wizard automatically starts after you have entered the login and default password. Enter yes at the system prompt to begin the configuration wizard. For example: Do you want to use the configuration wizard for initial configuration? yes 5. Complete the configuration wizard steps on the client side and server side: Wizard Prompt Description Example Step 1: Host name? Enter the host name for SteelStore. Step 1: Hostname? Amnesiac Step 2: Use DHCP on the primary interface? You are given the option to enable the DHCP to automatically assign an IP address to the primary interface for SteelStore. NetApp recommends that you do not set DHCP. The default value is no. Step 2: Use DHCP? no Step 3: Primary IP address? Enter the IP address for SteelStore. Step 3: Primary IP address? Step 4: Netmask? Enter the netmask address. Step 4: Netmask? Step 5: Default gateway? Enter the default gateway for SteelStore. Step 5: Default gateway? Step 6: Primary DNS server? Step 7: Domain name? Step 8: Admin password? Enter the primary DNS server IP address. You must specify the primary DNS server for cloud provider name resolution. If you do not specify a valid DNS server, the system will not start. Enter the domain name for the network where SteelStore is to reside. If you set a domain name, you can enter host names in the system without the domain name. NetApp strongly recommends that you change the default administrator password (password) at this time. The new password must be a minimum of 6 characters. 6. To log out of the system, enter the following command at the system prompt: amnesiac> exit Step 6: Primary DNS server? Step 7: Domain name? example.com Step 8: Admin password? xxxyyy

10 Connecting to the SteelStore Management Console GUI After you configure SteelStore, you can verify and modify your configuration settings and view performance reports and system logs in the SteelStore Management Console. You can connect to the SteelStore Management Console through any supported Web browser. To connect to the SteelStore Management Console you must know the host, domain, and administrator password that you assigned in the configuration wizard. Note: Cookies and JavaScript must be enabled in your Web browser. To connect to the SteelStore Management Console: 1. Enter the URL for the SteelStore Management Console in the location box of your web browser: protocol://host.domain protocol is either http or https. https uses the SSL protocol to ensure a secure environment. If you use https to connect, the system prompts you to inspect and verify the SSL key. host is the host name you assigned to SteelStore appliance during initial configuration. If your DNS server maps that IP address to a name, you can specify the DNS name. domain is the full domain name for the SteelStore appliance. Note: You can specify the IP address instead of the host and domain. 2. The SteelStore Management Console appears, displaying the login page as shown in Figure 2. Figure 2 NetApp SteelStore Management Console -In the Username text box, type the user login: admin or monitor. The default login is admin. Users with administrator (admin) privileges can configure and administer SteelStore. Users with monitor (monitor) privileges can view connected SteelStores, reports, and system logs. -In the Password text box, type the password that you assigned in the configuration wizard. By default the password is password. -Click Log In to display the Home page. The Home page summarizes the current status of your system.

11 Configuring SteelStore Appliance Licenses You can add or remove a license in the Configure > Maintenance > Licenses page. You install a license on a SteelStore appliance after receiving it from Technical Support or Sales. To add or remove a license: 1. Choose Configure > Maintenance > Licenses to display the Licenses page, as shown in Figure 3. Figure 3 SteelStore Appliance Licenses Page 2. Complete the configuration as described in the following table. Control Add a New License Remove Selected Licenses Text Box Add Description Displays the controls (licenses text box) to add a new license. Displays the controls to remove a license. Select the license you wish to delete and click Remove Selected to delete it. Copy and paste the license key provided by Technical Support or Sales into the text box. Tip: Separate multiple license keys with a space, Tab, or Enter. Adds the license. 3. Click Save to save your settings permanently. Configuring SteelStore Data Interfaces You can view and modify settings for the data interfaces in the Configure > Networking > Data Interfaces page. To display and modify the configuration for data interfaces: 1. Choose Configure > Networking > Data Interfaces to display the Data Interfaces page, as shown in Figure 4. Figure 4 SteelStore Data Interface Page

12 2. Under Data Network Interfaces, complete the configuration as described in the following table. Control Network Interface IP Configuration Enable Data Interface Description Displays the controls to add a network interface. Click the magnifying glass icon next to an interface to display the controls to configure the interface. NetApp recommends that you use the network interfaces for backup and LAN traffic. Displays the IP address of the network interface. Check this check box to enable the data interface and specify the following settings: IPv4 Address - Specify an IP address. IPv4 Subnet Mask - Specify a subnet mask. Data Gateway IP - Specify the data gateway IP address. The data gateway must be in the same network as the data interface. MTU - Specify the MTU value. The MTU is the largest physical packet size, measured in bytes, that a network can send. The default value is Under Routing Table for <network interface> (for example, Routing Table for eth0_0), configure static routing in the routi ng table if your device management network requires static routes. You can add or remove routes as described in following table. Click Apply to apply your changes to the running configuration, and click Save to save your changes permanently. Control Add a New Route Destination Subnet Mask Gateway Add Remove Selected Description Displays the controls for adding a new route. Specify the destination IP address for the gateway. Specify the subnet mask. Specify the IP address for the gateway. The gateway must be in the same network as the network interface you are configuring. Adds the route to the table list. Check the check box next to the name and click Remove Selected. Configuring Cloud Settings You can specify cloud settings, replication scheduling, and bandwidth limit settings in the Configure > Storage > Cloud Setti ngs page. Replication is the process that transfers deduplicated data from SteelStore to the cloud asynchronously. A storage replication service provides an extra measure of redundancy that can be invaluable if the main storage backup system fails. Immediate access to the replicated data minimizes downtime and its associated costs. Replication streamlines disaster recover y processes by generating duplicate copies of all backed-up files on a continuous basis. It can also simplify recovery from all types of disasters including fire, flood, hurricane, virus, or worm. Note: Before you configure cloud settings, configure DNS settings to access the cloud service provider host machine. To configure cloud settings: 1. Choose Configure > Storage > Cloud Settings to display the Cloud Settings page, as shown in Figure 5. Figure 5 Cloud Settings Page

13 2. Under Cloud Settings, complete the configuration as described in the following table. Control Protocol Type Description Select the cloud service provider from the drop-down menu. If you select Amazon S3, you must also specify the following: Region - Select an Amazon region from the drop-down list. You can choose a Region to optimize for latency, minimize costs, or address regulatory requirements. You can select one of the following regions: Asia Pacific (Singapore) Asia Pacific (Sydney) Asia Pacific (Tokyo) EU (Ireland) South America US Standard US-West (N. California) US-West (Oregon) Access Key - Specify the access key (similar to the user name) for your Amazon S3 (AWS) account. Secret Key - Specify the secret key (password) for your cloud service provider account. If you select AT&T Synaptic Storage, specify the following: Storage Policy - Select one of the following storage policies from the drop down list: Local Replication - Stores data stored in one location and protects it using erasure coding (which is a software-based data protection scheme that allows for data recovery in the event of hardware failures). Remote Replication - Stores data in two locations maintains a copy in one data center and replicates it to a geographically remote data center. Sub Tenant ID - Specify the sub tenant ID that AT&T Synaptic Storage uses to authenticate each request. UID - Specify the user ID that AT&T Synaptic Storage uses to authenticate each request. Shared Secret - Specify the shared secret thatat&t Synaptic Storage uses to authenticate each request. When the client application builds a Web service request, AT&T Synaptic Storage uses the shared secret to create a signature entry as a part of the request. The shared secret must be associated with the tenant ID and application ID created by AT&T Synaptic Storage. If you select EMC Atmos, specify the following: Sub Tenant ID - Specify the subtenant ID that EMC Atmos uses to authenticate each request. UID - Specify the user ID that EMC Atmos uses to authenticate each request. Shared Secret - Specify the shared secret that EMC Atmos uses to authenticate each request. When the client application builds a Web service request, EMC Atmos uses the shared secret to create a signature entry as a part of the request. The shared secret must be associated with the subtenant ID and application ID created by the EMC Atmos-based storage provider. If you select Glacier Service, you must also specify the following: Region - Select an Amazon Glacier region from the drop-down list. You can choose to store your data in the Amazon Glacier Region that meets your regulatory, throughput, and geographic redundancy criteria. You can select one of the following regions: Asia Pacific (Tokyo) EU (Ireland) US Standard US-West (N. California) US-West (Oregon) Access Key - Specify the access key (similar to the user name) for your Glacier account. Secret Key - Specify the secret key (password) for your cloud service provider account. Dedupe against cloud - Select this checkbox to specify that the SteelStore appliance must check the incoming data for deduplication against the entire data set, both in the Glacier cloud and in the local disk cache. This is the same procedure that the SteelStore appliance uses for other (non- Glacier) cloud providers. The pros of this approach are that the deduplication factor (ratio of expanded data and deduplicated data) is high. If the incoming data is not found on the SteelStore appliance cache and is found only in the Glacier cloud, then the SteelStore appliance must first restore the data from Glacier in order to perform deduplication on the incoming data stream. This impacts costs and performance. \ Note: If you enable the Dedupe against Cloud option, inline deduplication is performed for data written to the SteelStore appliance without data being restored from Glacier. However, when you verify the backup, it requires data to be restored from Glacier and can result in very slow verification and possible time-outs. This option is not selected by default. Leave this checkbox unchecked to specify that the SteelStore appliance must check the incoming data for deduplication only against the local disk cache of the SteelStore appliance. It does not match the incoming data with the data in the Glacier cloud. The pros of this approach are that it minimizes impacts to cost and performance of reading data to find duplicate matches, since the SteelStore appliance only references the local SteelStore appliance disk cache. The cons of this approach are that the deduplication factor is low because the SteelStore appliance does not consider the entire data set. If you select Google Cloud Storage, specify the following: Location - Select your location from the drop-down list. The choices are: EU: Specifies Europe as the location. US: Specifies the United States of America as the location. Project ID - Specify the project ID associated with the bucket. The project ID tells Google Cloud Storage which project you want to create a bucket in or which project to list buckets for. Each project is identified by its unique project ID. Since it is possible to have multiple projects, this ensures that the request is properly completed in the right project. Client ID - Specify the client ID used to access the bucket. Private Key - Specify the private key (password) for your cloud service provider account. If you select HP Cloud Object Storage, specify the following: Region - Select one of the following regions from the drop-down list: US West US East Authentication - Specify one of the following methods that the cloud provider uses to authenticate each request. Access Key ID/Secret Key: Select this option and specify the access key ID and secret key to authenticate your account. Username/Password: Select this option and specify the user name and password to authenticate your account. Tenant ID - Specify the tenant ID for your HP Cloud Object Storage account.

14 Hostname Port Bucket Name If you select Microsoft Windows Azure Storage, specify the following: Storage Account - Specify the Windows Azure storage account name. Primary or Secondary Access Key - Specify the primary or secondary Windows Azure storage access key that you generated when you created your Windows Azure storage account. The secondary key provides the same access as the primary key and is used for backup purposes. You can regenerate each key in case either one is compromised. If you select OpenStack Object Storage (Swift), specify the following: Authentication - Specify one of the following methods that OpenStack Object Storage (Swift) uses to authenticate each request. Access Key ID/Secret Key Username/Password Username/API access key API Access Key - Specify the API access key for your OpenStack Object Storage (Swift) account. Tenant ID - Specify the tenant ID that OpenStack Object Storage (Swift) uses to authenticate each request. Authentication URL - Specify the cloud server API URL for OpenStack Object Storage (Swift) to authenticate the request. Web Protocol - Specify whether to use the HTTP or HTTPS protocol. HTTPS is the secure version of the HTTP protocol, where packets are encrypted before they are transmitted. It uses the SSL protocol to ensure a secure environment. If you select Rackspace Cloud Files, specify the following: Region - Select the region from the drop-down list. The choices are US Based or UK Based. Username - Specify the user name that Rackspace uses to authenticate each request. API Access Key - Specify the API access key for your Rackspace account. Specify the hostname of the cloud provider on which SteelStore stores the replicated data. For example, s3.amazonaws.com or storage.synaptic.att.com. Specify the port through which replication occurs. Amazon uses port 80, which is an unsecured port, or port 443, which is a secure port. AT&T Synaptic Storage, EMC Atmos, Microsoft Windows Azure Storage, and OpenStack Object Storage (Swift) use port 443. HP uses port The default value is 443, which works for all of the other cloud providers. Specify the bucket name associated with your cloud service provider account. Buckets are containers (similar to folders) that store deduplicated data sent from the SteelStore appliance. If the bucket name does not exist, the bucket is created during initial SteelStore appliance replication. For Azure, the bucket name must be a valid DNS name, conforming to the following naming rules: Bucket names must start with a letter or number, and can contain only letters, numbers, and the - (dash) character. Every - (dash) character must be immediately preceded and followed by a letter or number; consecutive dashes are not permitted. All letters in a bucket name must be lowercase. Bucket names must be from 3 through 63 characters long. For Amazon (in the US Standard region only) and AT&T Synaptic Storage, the bucket name must conform to the following rules: Bucket names can only contain numbers, and the following characters:.(period), - (dash), and _ (underscore). Bucket names must start with a number or letter. Bucket names must be from 3 through 255 characters long. For Amazon, if the region is not US Standard, the bucket names cannot contain _ (undersores) and they must be 3 through 63 characters long. For all other cloud providers, you can use bucket names that are alphanumeric and contain the following characters:. (period), - (dash), _ (underscore), and ~ (tilde). Configuring a CIFS Share You can configure Common Internet File System (CIFS) access to the SteelStore appliance in the Configure > Storage > CIFS page. CIFS is a protocol that allows programs to make requests for files and services on remote computers on the Internet. To configure CIFS: 1. Choose Configure > Storage > CIFS to display the CIFS page, as shown in Figure 6.

15 Figure 6 Adding a CIFS Share 2. If your network has an Active Directory (AD) domain, you can add the SteelStore appliance to the domain and enable domain users to access SteelStore appliance CIFS shares. You can add the SteelStore appliance to only one domain. You cannot add it to multiple domains. Ensure that you have permissions to join appliances to the domain and add users who can access the domain. To join the SteelStore appliance to an AD domain, complete the configuration as described in the following table.

16 Control Join Domain Domain Name User Name Password Description Displays the controls to add the SteelStore appliance to your AD domain. Specify the fully qualified domain name of the AD that the SteelStore appliance must join. If your system has an AD domain, then you can add the SteelStore appliance to your AD domain and create share permissions for AD users and groups. Specify the user name of a user to access the AD domain. The user name must be a part of the AD and the user must have permissions to add computers to the domain. Specify the domain password to authenticate the user. Click Advanced Settings to display Advanced Settings to (optionally) configure the domain. Complete the configuration as displayed in the following table. Control Organizational Unit Hostname Host DNS Domain Description SteelStore appliance must join. Organizational units are Active Directory containers into which you can place users, groups, computers, and other organizational units. An organizational unit cannot contain objects from other domains. For an overview of organizational units, go to: Optionally, specify the hostname that the SteelStore appliance must use to join the domain. SteelStore appliance then appears as the specified hostname in the AD. Optionally, specify the host DNS name that is used to join the SteelStore appliance to the domain. The default domain name is the AD domain name. 3. After you join an AD domain, you can add you can add domain users and groups who can access the SteelStore appliance CIFS shares. To add a CIFS share, complete the configuration as described in the following table. Control Add CIFS Share Share Name Description Displays the controls to add a new CIFS share. Specify the name of the share to be added. Path Specify the pathname to the share to be added. It starts with a forward slash (/). Comment Read Only Allow Everyone Access Remove Selected Add Share Specify a comment about the share. You can only use alphanumeric, underscore (_), hyphen (-) characters and space in this field. Check this check box if you want the share to be a read-only share. Check this check box to enable all clients connected to the SteelStore system to access the CIFS share. Deletes the selected CIFS share. Adds the CIFS share to the SteelStore CIFS server. The share you add appears in the list of shares on the page. 4. When you add a CIFS share to the SteelStore appliance, you can enable authentication or leave it disabled (allowing all users to access the CIFS share). If you enable authentication, you must add CIFS users who can access the share. To enable authentication, ensure that you delete the user Everyone from the access control list of the share. 5. If you did not join the SteelStore appliance to an AD domain, you must add a CIFS user. To add a CIFS user, complete the configuration as described in the following table. Control Add CIFS User User Name Password Account Password Confirm Remove Selected Add Description Displays the controls to add a user to the SteelStore CIFS server. Specify the user name of a user to access the CIFS shares. Specify the password to authenticate the user. Select one of the following options from the drop-down list: Enabled - Enables the CIFS user to access the SteelStore appliance CIFS share. Disabled - Disables the CIFS user from accessing the SteelStore appliance CIFS share. Specify the password again to confirm authentication. Deletes the selected user name from the CIFS server. Adds the user name and password to the SteelStore CIFS server. 6. Under Global CIFS Settings, specify the values for Server Message Block (SMB) Signing and Guest Account. This setting overrides the setting under Add CIFS User. Select one of the following values for SMB Signing: Disabled - The CIFS server does not offer SMB signing. This is the default value.

17 Auto - Enables SMB signing automatically. The CIFS server offers SMB signing, but does not enforce it. You can choose to enable or disable it. Mandatory - The CIFS server enforces SMB signing. You must use SMB signing if you select this option. Select one of the following values for Guest Account: Enabled - Activates the guest account. A user may authenticate as a guest user and access a CIFS share (which allows guest users) using any user name and password. If you want to enable any user to access the share, you can use this feature. Disabled - De-activates the guest account. Note: Windows provides the ability to sign CIFS messages to prevent man-in-the-middle attacks when sharing files. Each CIFS message has a unique signature, which prevents the message from being tampered with. Note: Enabling SMB signing degrades SteelStore performance. Configuring Veeam Backup & Replication The following sections describe how to configure and use Backup & Replication with the SteelStore appliance - please refer to Veeam documentation for complete details: Veeam Backup & Replication Management Console Overview Adding the SteelStore appliance to Veeam Backup & Replication Tasks o Create a Backup Repository o Create a Veeam Backup & Replication Job Testing Backup & Replication with the SteelStore appliance Monitoring a Job Testing a VM Restore Veeam Backup & Replication Management Console Overview The Veeam Backup & Replication Management Console is the interface that is used to configure all settings in a Veeam Backup & Replication environment. In order for the Management Console to make changes in a Veeam Backup & Replication environment the Management Console must point to the desired VMware vcenter server, or individual VMware ESX or ESXi servers. This is performed at setup time, or can be added by clicking on Add Server within the management console (Figure 7). Figure 7 Veeam Backup & Replication Management Console

18 Adding a SteelStore Appliance to Veeam Backup & Replication Tasks When adding a SteelStore appliance to a Veeam Backup & Replication environment there are two primary tasks required. The first is to create a repository for backups, and map it to a CIFS share created on the SteelStore appliance. The second is to create a backup job. During this wizard-driven process, the backup target will be specified to a SteelStore CIFS share. Create a Backup Repository A repository is used by Veeam Backup & Replication as a target location for backups. The following describes the steps to create a backup repository and associate it to the SteelStore appliance. 1. Select Backup Infrastructure from the bottom left list, and in the upper left pane, r ight click on Backup Repositories and click on Add Backup Repository (Figure 8). Figure 8 Create Backup Repository 2. Provide a name for the new repository and click Next (Figure 9). Figure 9 Backup Repository Wizard

19 3. Select Shared Folder and click Next (Figure 10). Figure 10 Backup Repository Type 4. Provide the CIFS shared folder path name, and if applicable, provide the SteelStore user credentials required to access the share (Figure 11). Click Next. Figure 11 Backup Repository Shared Folder Specification

20 5. Select the Limit maximum concurrent tasks to: checkbox and enter a value representing the number of allowed tasks to access the SteelStore appliance (Figure 12). Veeam recommends that you configure the number of jobs based on the amount of RAM and the num ber of core CPUs available on the Veeam VMware Proxy server. Refer to Veeam for further details on proper settings for this field, and Appendix A. SteelStore Appliance Best Practices for Veeam Backup & Replication for details on configuring the VMware Proxy server. Figure 12 Backup Repository Load Control 6. Click on the Advanced button and make sure to uncheck the checkbox for both options Align backup file data blocks and Decompress backup data blocks before storing (Figure 13). Figure 13 Deduplication Storage Advanced Options

21 7. Set up the vpower NFS server and specify a local path for writes (Figure 14). Note: It is recommended to use physical SteelStore appliances if performing vpower operations. Figure 14 vpower Configuration 8. Review settings to confirm the configuration, then click Next (Figure 15). Figure 15 Backup Repository Settings Review

22 9. Complete the wizard by clicking on Finish (Figure 16). Figure 16 Backup Repository Wizard Completion Create a Veeam Backup & Replication Job To perform backup of a VM, create a backup job through the Backup wizard. This section will guide you through all steps of the wizard and provide explanation on offered options. 1. Select the Backup & Replication button from the main window, and at the first step of the wizard enter a name and description of the created job as shown in Figure 17. Figure 17 Create a Backup Job

23 2. Select the VMs to backup. Click on the Add button to search for the VMs, and browse through the inventory and select the VMs to back up (Figure 18). Click on the Add button to add them to the Virtual Machines selection panel (Figure 19). Click Next. Figure 18 Adding VMs for Backup Figure 19 Mode Selection Panel

24 3. At the Storage panel of the wizard, provide the SteelStore CIFS share where backups will be sent (Figure 20). Figure 20 Backup Destination Selection 4. Backup job options are accessed by clicking on the Advanced button within the Storage panel of the wizard above. In the Advanced window that appears there are multiple tabs, of which Backup is the first tab ( Figure 21). Backup Mode Select Incremental as the backup mode. Enable Synthetic Fulls Do not enable synthetic fulls with incremental backups. Instead, use the Active Full Backup option. Perform Active Full Backups Periodically Enable this option if Veeam will perform full backups of the VM on a periodic basis. It is recommended to enable this option to improve recoverability points for VMs. Figure 21 Backup Options

25 5. The storage related backup options can be accessed via the second tab ( Figure 22). Enable inline data deduplication Disable this option, since SteelStore will perform block level deduplication of Veeam backups. Compression Do not perform any compression. Optimize For: Select Local target optimization for storage, since backups will be written via LAN to the SteelStore CIFS share. Figure 22 Storage Options 6. The notifications tab can provide automatic notifications as appropriate (Figure 23). Send Notifications to the Following Recipients Enable this check box if you want to receive notifications by e mail in case of job failure or success. In the field below, specify a recipient s address.

26 Figure 23 Notifications Tab 7. Changed block options are available in the vsphere tab (Figure 24). Use Changed Block Tracking Data It is recommended to use this option to enable changed block tracking. By default, this option is selected. Enable CBT for All Protected VMs Automatically Check this option if you want to force using changed block tracking for VMs for which changed block tracking is disabled on the ESX server. This applies to VMs using virtual hardware version 7 or later. Figure 24 vsphere Options 8. If desired select Enable Automatic Backup Integrity Checks (Figure 25).

27 Figure 25 Advanced Options 9. By default Use Storage Snapshots is enabled (Figure 26). Click OK and Next to continue. Figure 26 Storage Integration

28 10. If applicable, select Enable application-aware image processing for the guest VM and supply the required guest VM login credentials (Figure 27). Click Next. Figure 27 Guest Processing Options Enable Application-Aware Image Processing Enable this option to create a transactionally consistent backup, ensuring successful recovery of VM applications without any data loss. Enable Guest File System Indexing Enable this option to index guest files in a VM being backed up. This will perform file indexing and enable you to p erform fast and accurate search for VM guest OS files. Guest OS Credentials To coordinate proper indexing and VSS activities, Veeam Backup & Replication deploys a small agent inside a VM. The agent is installed only during VSS quiescence and indexing procedure and removed immediately after the processing is finished (depending on the selected option, during the backup job or after it is finished), thus producing low impact on VM performance and stability. If either the VSS or Indexing options are enabled, then provide the system credentials for a target VM to deploy the agent. Please note that the user name must be supplied in the DOMAIN\USERNAME format. 11. Use this panel of the wizard to schedule backups of the VMs on a regular basis (Figure 28). Click Create to complete the wizard.

29 Figure 28 Job Scheduling Panel Run the Job Automatically To specify the job schedule, select this option and identify which schedule to perform the backups of the VM. Automatic Retry In the Automatic retry section, select to repeat an attempt to run a backup job in case it fails for some reason. A repeatedly run job will include failed VMs only. Enter the number of attempts to run the job and define time spans between them. If you select continuous backup, Veeam Backup & Replication will retry the job for the defined number of times without any time intervals between the job runs.

30 Testing Veeam Backup & Replication with a SteelStore Appliance Backup to a SteelStore Appliance Using Veeam Backup & Replication To test Veeam Backup & Replication with the SteelStore appliance you can run a manual backup of the job setup in the previous step. To run a manual backup right-click on the job name you want to execute and select Start Job to begin the next backup job in the series (if doing incremental backups), or Active Full to perform a manual full backup out of sequence (Figure 29). Figure 29 Initiating a Manual Backup Monitoring a Job Use the History view within the left tree of the Management Console GUI to monitor and control backup jobs. The current running backup jobs are reported under the right panel of the window (Figure 30), and a detailed view can be accessed by right clicking on the job name and selecting Statistics. Figure 30 Job Sessions and Results

31 Restore from Veeam Backup & Replication Using a SteelStore Appliance Veeam Backup & Replication can be used to recover an entire VM, multiple VMs, or individual files. All activities for Restore are accessed via the Restore wizard. Performing a Full VM Restore 1. To setup a restore of a VM, click on the Restore button to begin the Restore Wizard, as shown in Figure 31. Select Entire VM. Figure 31 Restore Job Initialization 2. Click on the Add VM button when you arrive at the Full VM Restore Wizard (Figure 32), and select the VM or VMs to restore from the list of backup jobs (Figure 33). Click OK. Figure 32 VM Selection

32 Figure 33 Select VM screen 3. If the VM to be restored has multiple restore points available, you can select the one to use by clicking the Point button (Figure 34). Select the particular version of the VM to be restored, and click OK (Figure 35). Figure 34 Accessing Point In Time Versions of Backup

33 Figure 35 Restore Points Selection 4. Select the restore location, as shown in Figure 36, and click Next twice and Finish to complete the wizard and begin the restore operation. Similar to backup, restore progress will appear within the Sessions area of the management interface. Figure 36 Restore Point Panel

34 Restoring an Individual File or Folder 1. To setup a restore of individual objects from a VM, click on the Restore button to begin the Restore Wizard, as shown in Figure 37. Select Guest Files to perform item level recovery of folders or files from a VM image. Figure 37 File Level Restore Initialization 2. Select the VM to restore files from, as shown in Figure 38. Figure 38 VM Selection

35 3. The Backup Browser window appears, allowing you to choose which files or folders to restore. Select the items to restore, right click on the items, and click Copy To (Figure 39). Identify the location to restore the file (Figure 40). Click OK to begin the file level restore operation. Figure 39 Item Selection Screen Figure 40 Item Restore Target

36 Appendix A. SteelStore Appliance Best Practices for Veeam Backup & Replication Veeam Backup & Replication uses backup repositories to send data to SteelStore, starting with Veeam 6. In addition to configuring the backup repository for a SteelStore appliance, Veeam provides several advanced configuration options for backup jobs. Figure 41 Advanced Job Settings Storage Tab Via the Advanced job settings button, configure the Storage options to disable deduplication and compression. Configure the storage optimization for the local target. Figure 42 Advanced Job Settings vsphere Tab Via the Advanced job settings button, configure the vsphere options to enable Change Block Tracking to improve incremental backup performance to SteelStore

37 When using Veeam for vpower recovery operations (such as Instant VM Recovery or SureBackup), it is recommended to o nly use a physical SteelStore appliance. Because virtual SteelStore depends heavily on the performance of user supplied hardware, this can cause significant performance problems with vpower based operations. Appendix B. SteelStore Best Practices for Solaris Operating Systems NFS networking parameters on Solaris operating systems should be configured to optimally send data to SteelStore through configured NFS mounts. In addition to tuning the rsize and wsize mount options appropriately, nfs3_max_transfer_size and nfs3_bsize should also be tuned. nfs3_max_transfer_size and nfs3_bsize should be greater than or equal to minimum of rsize and wsize. To set the values, edit the /etc/system file and change/add the following lines to the file: nfs:nfs3_max_transfer_size=<value> nfs:nfs3_bsize=<value> A reboot of the system is required in order for the configuration changes to take effect. Appendix C. SteelStore Best Practices for Windows 2008 Operating Systems Windows networking parameters for CIFS can be modified to improve overall backup application performance. To make these changes, go to Start Menu and enter regedit to start the Windows registry editor. Provide administrative permissions if prompted. Note that changes made within Windows registry editor are permanent upon entry so use extreme caution when making the changes/additions. A reboot is required. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parame ters] "SESSTIMEOUT"=dword:00000e10 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters] "DefaultSendWindow"=dword: "DefaultReceiveWindow"=dword: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters] "GlobalMaxTcpWindowSize"=dword: "TcpWindowSize"=dword: "Tcp1323Opts"=dword:

38 Appendix D. Troubleshooting Issue: Veeam vpower functions of Veeam Backup & Replication might cause slow performance reading from SteelStore appliances. Possible solutions: Because these operations cause random reads and writes to occur, NetApp recommends that you perform vpower tasks serially, on physical SteelStore appliance hardware instead of Virtual SteelStore and individual user supplied disk. Issue: Low performance during full or incremental backups. Possible solutions: Ensure SteelStore logging is set to INFO rather than NOTICE. Double-check the job settings. Ensure no other jobs are writing to SteelStore at the same time and that no more than one Veeam job is writing to SteelStore at a time. Due to inherent limitations of the CIFS protocol, 30-50MB/s data throughput is not uncommon for a single backup stream. Check Veeam job logs to verify that Veeam is using the Virtual Appliance transport mode for the VMware Proxy server rather than falling back to Network mode, which is much slower (Figure 43). Note: The Virtual Appliance transport mode is only recommended if the Veeam backup proxy is being run within a VM. Figure 43 Virtual Appliance Transport Mode Sanity test ESX infrastructure for bottlenecks by temporarily changing the problematic backup job's repository to local disk storage, or creating a separate job in Veeam with the same VMs configured to write local disk storage. If the observed throughput is not substantially higher, the bottleneck is elsewhere. In case of slow incremental backups, verify that the last full backup is no more than a week old, and that there are no more than six increments taken since then. If a job is only run manually, Veeam does not run a full backup unless it is either required or the user specifically requests it. Because Veeam scans the last full backup and all subsequent increments during backups, having too many increments slows the process. If slow performance persists, upgrade to the latest SteelStore software and re-run full backup before running any incrementals. Issue: Poor vpower performance and time-outs during VM power-on in SureBackup jobs. Possible solutions: Ensure that SteelStore logging is set to INFO rather than NOTICE. Due to SteelStore architecture and optimizations, vpower features do not run as fast as they would run on the primary storage. This is a common issue with inline deduplication storage.