NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI

Transcription

1 NetApp Verified Architecture NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI Nabil Fares and David Arnette, NetApp November 2015 NVA-0019-DEPLOY Version 1.0

2 TABLE OF CONTENTS 1 Program Summary Solution Overview Target Audience Solution Technology Solution Use Cases Technology Requirements Hardware Requirements Software Requirements AltaVault Cabling for FlexPod ACI Deployment Procedures Deployment Prerequisites Configuring ACI for AltaVault Configuring AWS for AltaVault Configuring AltaVault Configuring Symantec NetBackup for AltaVault Solution Verification Conclusion References NetApp References Cisco References Symantec References Version History LIST OF TABLES Table 1) Hardware requirements....7 Table 2) Software requirements....8 Table 3) Contracts in the ACI configuration for AltaVault Table 4) Tested use cases LIST OF FIGURES Figure 1) AltaVault with FlexPod connectivity....9 Figure 2) Relationships between the major ACI components Figure 3) External EPG contracts NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

3 Figure 4) NFS EPG contracts Figure 5) Final view of all contracts Figure 6) AltaVault startup configuration NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

4 1 Program Summary The NetApp Verified Architecture (NVA) program offers customers a verified architecture for NetApp solutions. An NVA gives customers a NetApp solution architecture that: Is thoroughly tested Is prescriptive in nature Minimizes customer deployment risks Accelerates customer time to market This NVA deployment guide describes the steps for deploying NetApp AltaVault cloud-integrated storage with the FlexPod Datacenter with NetApp All Flash FAS (AFF), Cisco Application Centric Infrastructure (ACI), and VMware vsphere solution. AltaVault appliances effortlessly integrate with preexisting backup software and support 95% of the cloud storage solutions on the market today, including those of all leading cloud storage providers. 2 Solution Overview A cloud-based backup architecture can significantly reduce costs, increase business agility, and simplify disaster recovery. However, developing a backup strategy for both on-premises and off-premises data centers while incorporating a disaster recovery (DR) strategy often creates a complex infrastructure that is difficult to manage and scale. The NetApp AltaVault and Symantec NetBackup solution with FlexPod Datacenter and ACI is a shared, verified, and proven solution spanning private and public clouds. The solution is built on the previously validated FlexPod Datacenter with AFF and ACI design with the following added components: The AltaVault AVA400 physical appliance and the AltaVault AVA-v8 virtual appliance for a DR case study Amazon S3 cloud storage Symantec NetBackup as the backup program used with AltaVault 2.1 Target Audience The target audience for this deployment guide is customer system administrators, contractors, professional services engineers, and other professionals who install and configure the AltaVault with FlexPod environment. AltaVault is easy to deploy and, when coupled with FlexPod Datacenter with AFF and ACI, provides an architecture that is seamless, industry proven, and validated to industry best practices. 2.2 Solution Technology This section briefly presents the products included in the AltaVault with FlexPod solution. For detailed information about the components, see NVA-0019-DESIGN: NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI. NetApp AltaVault Appliance NetApp AltaVault storage enables customers to securely back up data to the cloud at up to 90% less cost than that of on-premises solutions. AltaVault gives customers the power to tap into cloud economics while preserving their investments in backup infrastructure and meeting backup and recovery SLAs. The AltaVault appliance is a disk-to-disk data storage optimization system that can be integrated with a variety of class-leading cloud storage providers. AltaVault can also be integrated with backup and archive applications to protect critical production data off site without the complexity of tape management 4 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

5 solutions or the cost of in-house DR sites and services. When administrators add an AltaVault appliance as a target for their backup or archive infrastructure, the backup server simply connects to the AltaVault appliance by using the CIFS or the NFS protocol. AltaVault appliances are available in a variety of sizes to scale with business requirements and growth. They are also available in virtual format editions for environments that use hypervisors such as VMware vsphere and Microsoft Hyper-V or the Amazon EC2 Marketplace for cloud-to-cloud backups. This flexibility provides alternative methods for performing data recovery in a disaster when infrastructure and resources might not be available in the same manner as in the lost primary data center. FlexPod Datacenter with NetApp All Flash FAS, Cisco ACI, and VMware vsphere FlexPod is a best practice data center architecture that includes three components: Cisco Unified Computing System (Cisco UCS) Cisco Nexus switches NetApp FAS systems These components are connected and configured according to Cisco and NetApp best practices, and they provide the ideal platform for running a variety of enterprise workloads with confidence. FlexPod can scale up for greater performance and capacity, or it can scale out for environments that require multiple consistent deployments. The reference architecture covered in this document leverages the Cisco Nexus 9000 for the switching element. Cisco Unified Computing System Cisco UCS is a next-generation solution for blade and rack server computing. The system integrates a low-latency, lossless 10GbE unified network fabric with enterprise-class, x86-architecture servers. The system is an integrated, scalable, multichassis platform in which all resources participate in a unified management domain. Cisco UCS accelerates the delivery of new services simply, reliably, and securely through end-to-end provisioning and migration support for virtualized and nonvirtualized environments. FlexPod and Cisco ACI The Cisco Nexus 9000 family of switches supports two modes of operation: the NxOS standalone mode and the ACI fabric mode. In standalone mode, the switch performs as a typical Cisco Nexus switch with increased port density, low latency, and 40Gb connectivity. In fabric mode, the administrator can take advantage of Cisco ACI. The Cisco Nexus 9000 based FlexPod design with Cisco ACI consists of a Cisco Nexus 9500 and 9300 leaf-and-spine switching architecture that is controlled by a cluster of three Application Policy Infrastructure Controllers (APICs). Cisco ACI delivers a resilient fabric to satisfy today s dynamic applications. ACI leverages a network fabric that employs industry-proven protocols coupled with innovative technologies to create a flexible, scalable, and highly available architecture of low-latency, high-bandwidth links. NetApp All Flash FAS and Data ONTAP NetApp solutions offer increased availability while consuming fewer IT resources. A NetApp storage solution includes hardware in the form of FAS controllers and disk storage and the NetApp Data ONTAP operating system that runs on the controllers. Disk storage is offered in two configurations: FAS systems with SAS disks, SATA disks, or solid-state disks (SSDs) and All Flash FAS systems with only SSDs. All Flash FAS NetApp All Flash FAS addresses enterprise storage requirements with high performance, superior flexibility, and best-in-class data management. Built on the clustered Data ONTAP storage operating system, All Flash FAS speeds up businesses without compromising on efficiency, reliability, or the 5 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

6 flexibility of IT operations. As true enterprise-class all-flash arrays, All Flash FAS systems accelerate, manage, and protect business-critical data, now and in the future. For more information about All Flash FAS systems, see NetApp All Flash FAS. Data ONTAP With clustered Data ONTAP, NetApp provides enterprise-ready, unified scale-out storage. Developed from a solid foundation of proven Data ONTAP technology and innovation, clustered Data ONTAP is the basis for large virtualized, shared storage infrastructures that are architected for nondisruptive operations over the system s lifetime. Controller nodes are deployed in HA pairs in a single storage domain or cluster. Data ONTAP scale-out is a way to respond to growth in a storage environment. As the storage environment grows, additional controllers are added seamlessly to the resource pool that resides on the shared storage infrastructure. Host and client connections as well as datastores can move seamlessly and nondisruptively anywhere in the resource pool. Existing workloads can be easily balanced over the available resources, and new workloads can be easily deployed. Technology refreshes (such as replacing disk shelves and adding or replacing storage controllers) are accomplished while the environment remains online and continues to serve data. Data ONTAP is the first product to offer a complete scale-out solution, and it provides an adaptable, always-available storage infrastructure for today s highly virtualized environments. For more information about Data ONTAP, see NetApp Data ONTAP 8.3 Operating System. Note: The design discussed in this document focuses on clustered Data ONTAP and IP-based storage. VMware vsphere VMware vsphere is a virtualization platform for holistically managing large collections of infrastructure resources CPUs, storage, and networking as a seamless, versatile, and dynamic operating environment. Unlike traditional operating systems that manage an individual machine, VMware vsphere aggregates the infrastructure of an entire data center to create a single powerhouse with resources that can be allocated quickly and dynamically to any application. For more information, see the VMware vsphere product page. Symantec NetBackup Symantec NetBackup has a three-tiered architecture. The first tier is a master server that provides functions such as configuration services, policy creation, scheduling, reporting, and logging. The master server is the communications mechanism of the backup application and allocates resources to the media servers. The second tier is the media server, the mainstay of the NetBackup environment. The media server must be a high-rate-of-data I/O importer and exporter. The connections to disk, tape drives, the SAN, and the LAN depend on the backup and storage requirements. The AltaVault appliance is used by the media server to send backups to a public cloud. The final tier is the clients tier. The clients are the systems in which the data resides and that must be protected. However, certain aspects obscure the line between clients and media servers; from the NetBackup standpoint, when a media server sends its own data to a device for backup, it is considered a client. 3 Solution Use Cases The flexibility of AltaVault alone and working with the FlexPod infrastructure allows the NetApp AltaVault and Symantec NetBackup solution with FlexPod Datacenter and ACI to accommodate various business 6 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

7 and technical needs such as the validated use cases that use both AltaVault physical appliances and virtual appliances. Tests for the use cases focused on the functionality and seamless integration between AltaVault and FlexPod Datacenter ACI: Backup of data to both an AVA400 physical appliance and an AVA-v8 virtual appliance by using NetBackup and NDMP Recovery of data from both an AVA400 physical appliance and an AVA-v8 virtual appliance On-premises hardware appliance failure: replacing the appliance, restoring the previous backup configuration, and verifying the data restored from the cloud (Amazon S3) Off-premises disaster recovery: restoring the failed appliance configuration on a remote AVA-v8 virtual appliance with a new IP address and completing the data restore from the cloud The validation tests excluded performance measurements, but the AltaVault deduplication capabilities representing cost savings from backing data to the cloud were still noted in the tests. 4 Technology Requirements NetApp, Cisco, VMware, and Symantec have interoperability matrixes that you must consult to determine support for implementations of the NetApp AltaVault and Symantec NetBackup solution with FlexPod Datacenter and ACI: NetApp Interoperability Matrix Tool Cisco UCS Hardware and Software Interoperability Tool VMware Compatibility Guide Symantec NetBackup Master Compatibility List Although there are no dependencies between FlexPod ACI, AltaVault (physical and virtual), and NetBackup, NetApp recommends consulting the interoperability matrixes as a best practice. 4.1 Hardware Requirements Table 1 lists the hardware components used to validate and implement the solution. The components used in particular implementations might vary based on customer requirements. The FlexPod components in Table 1 correspond to the minimum hardware required to validate the solution in the lab. Note: For a list of minimum requirements for a production environment, see the FlexPod Datacenter with NetApp All Flash FAS, Cisco Application Centric Infrastructure, and VMware vsphere Design Guide. In our validation of AltaVault with FlexPod, we used one APIC server, but in a production environment the requirements vary depending on the deployment strategy. Table 1) Hardware requirements. Layer Hardware Quantity Compute Cisco UCS 6248UP fabric interconnects 2 Cisco UCS B-200 M4 2 Network Cisco APIC 1 Cisco Nexus 9396 (leaf switches) 2 Cisco Nexus 9336 (spine switches) 2 Storage NetApp All Flash FAS (HA pair) NetApp AltaVault AVA NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

8 4.2 Software Requirements Table 2 lists the software components required to implement the solution. The components used in particular implementations might vary based on customer requirements. Table 2) Software requirements. Layer Software Version Compute Cisco UCS Manager infrastructure software bundle 2.2(3d) Cisco UCS Manager B-Series software bundle 2.2(3d) Network Cisco APIC software 1.0(4h) Cisco Nexus 9000 inx-os 11.0(4h) Storage, virtualization, and backup NetApp Data ONTAP 8.3 OnCommand Unified Manager for clustered Data ONTAP 6.1 OnCommand Performance Manager for clustered Data ONTAP 1.1 NetApp Virtual Storage Console (VSC) 6.0 NetApp AltaVault AVA400 software NetApp AVA-v Amazon S3 storage Windows Server N/A 2012 R2 VMware vsphere ESXi 5.5u2 VMware vcenter 5.5u2 Symantec NetBackup AltaVault Cabling for FlexPod ACI Figure 1 shows a deployment of the AVA400 appliance with a FlexPod ACI configuration. The connectivity is based on port channels for switch redundancy and added capacity and uses Cisco virtual port channel (vpc) technology. The most common AltaVault cabling layout requires a minimum of two interfaces: the primary (management) interface and the data interface. The data interface can be a single or dual connection with a vpc on FlexPod; a dual connection provides more network redundancy. The configuration tested for the solution validation used the dual connectivity option shown in Figure 1. Section 5.4 ( Configuring AltaVault ) describes the LACP (port channel) configuration required for AltaVault. Section 5.2 ( Configuring ACI for AltaVault ) focuses on the vpc configuration for FlexPod ACI. Note: When the term primary appears in this guide, it refers to the physical Ethernet port that is indicated by a wrench icon on the rear of the chassis. 8 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

9 Figure 1) AltaVault with FlexPod connectivity. 5 Deployment Procedures The procedures in this guide must be completed in a sequential manner to deploy AltaVault and NetBackup with FlexPod Datacenter and ACI. The procedures assume that the FlexPod infrastructure has already been deployed. If this is not the case, see the FlexPod Datacenter with NetApp All Flash FAS, Cisco Application Centric Infrastructure, and VMware vsphere Deployment Guide for instructions on how to deploy FlexPod. To deploy the AltaVault with FlexPod solution, you must complete the following tasks in addition to deploying the FlexPod infrastructure: Note: Verify and configure FlexPod ACI components vpc, EPGs, and contracts for AltaVault Configure Amazon S3 for AltaVault Configure AltaVault (physical appliance and virtual appliance) Configure NetBackup software for AltaVault In the lab environment, we deployed the virtual AltaVault appliance (AVA-v8) on the FlexPod Cisco UCS server for the validation of local recovery and DR cases. In a production environment, the remote DR location should preferably use FlexPod for consistency and rapid recovery of the AltaVault virtual appliance and data. 9 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

10 5.1 Deployment Prerequisites Before you deploy AltaVault to a backup environment, you must have completed the following prerequisites: You have set up at least one server with the functions of a master server and a media server in a single computer system. NetApp recommends that you separate the master and media servers so that the system is not overloaded. These servers, along with clients, require the minimum hardware features identified by the backup application. For more information, visit the Symantec Support site and consult the NetBackup Master Compatibility List. You have obtained server systems and related software media supported by NetBackup and the AltaVault appliance. You have verified that an AltaVault physical appliance or an AltaVault virtual appliance is online and connected to the physical network infrastructure. A minimum of two IP addresses must be available for AltaVault. You have procured and installed all necessary software licenses from each vendor, using vendorspecific guidelines, and obtained cloud storage credentials from your designated cloud storage provider. You have performed the physical stacking and racking of the equipment at each site. All cabling and power supplies must be operational. You have verified that all LAN and WAN connections are functioning to and from the Internet and cloud storage providers. If applicable, you must have available a Windows directory service (Active Directory) or a UNIX Kerberos server. 5.2 Configuring ACI for AltaVault The ACI configuration required for AltaVault is limited to creating endpoint groups (EPGs) and service contracts. Instructions for standing up the ACI infrastructure are beyond the scope of this guide. For detailed information about how to deploy FlexPod Datacenter with ACI, see the FlexPod Datacenter with NetApp All Flash FAS, Cisco Application Centric Infrastructure, and VMware vsphere Deployment Guide. EPGs and Service Contracts An endpoint group (EPG) is a collection of physical and virtual endpoints that require common services and policies. An example of an EPG is a set of servers or storage LIFs on a common VLAN that provide a common application function or service. An EPG can be defined on a per-vlan segment basis such that all servers or VMs on a common segment become part of the same EPG. In the FlexPod design, the following items are placed in separate EPGs: The various application tiers ESXi VMkernel ports for iscsi, NFS, and vmotion connectivity NetApp LIFs for SVM management and NFS and iscsi datastores A service contract can exist between two or more participating peer entities (such as two applications running and talking to each other behind different EPGs) or between providers and consumers (such as a DNS contract between a provider entity and a consumer entity). Contracts use filters to limit traffic between the applications and certain ports and protocols. Figure 2 illustrates the relationship between EPGs and contracts. As shown in the figure, a tenant can contain one or more application profiles, and an application profile can contain one or more EPGs. The devices in the same EPG can talk to each other without any special configuration. Devices in different EPGs can talk to each other by using contracts and associated filters. A tenant can also contain one or more bridge domains, and multiple application profiles and EPGs can use the same bridge domain. 10 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

11 Figure 2) Relationships between the major ACI components. Prerequisites for the ACI Configuration The ACI configuration steps required for adding the AltaVault appliance to the FlexPod infrastructure assume that the following items have been created or configured: The vpc configuration EPGs for the following items: Note: Note: AFF LIFs. This EPG allows access to the NFS, CIFS, and iscsi protocols. You can use individual EPGs for each protocol if the protocols are separated by VLAN boundaries. External access. This EPG typically allows traffic in and out of the ACI fabric and identifies layer 2 or layer 3 connectivity between the ACI fabric and external routing devices. For an example of this EPG, see Creating an Application Profile, EPGs, and Contracts. Servers and data. You can create one or multiple EPGs, depending on your application profiles and on the data center design. For this validation, we created an EPG, a VLAN, and a subnet dedicated to AltaVault and the NetBackup servers and clients to isolate the traffic. For an example of this EPG, see Creating an Application Profile, EPGs, and Contracts. ACI application profiles The ACI fabric tenant. For this validation, we used a dedicated tenant for convenience. This choice has no implication on the validation outcome. Internet routing. This configuration is required for AltaVault to reach the public cloud (in this case, AWS storage). Network services. NTP, DNS, and firewall filters must be in place if outbound SSL traffic is restricted. A subnet for the AltaVault appliances and the NetBackup servers and clients. For this validation, we configured all devices by using the same IP subnet, but you can place the devices on their own subnets if your design calls for it. If you separate the subnets, you must create additional contracts to allow traffic between EPGs and application profiles. 11 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

12 The ACI configuration steps take into consideration that servers and AltaVault appliances might be on different subnets. However, the ACI policy should be the same as long as the contracts stitch together the correct EPGs. For this validation, we placed the AltaVault appliances, the NetBackup servers, and the AFF LIFs on different VLANs within the same subnet. We created a contract to allow the NetBackup servers to access the AltaVault physical and virtual appliances, AFF LIFs, and resources outside the fabric. Because the validation was completed in a restricted lab environment, we segmented Internet routing on a separate physical network. As shown in Figure 2, the primary is connected to a separate network for Internet traffic. Note: We mapped each EPG within the ACI environment to a unique VLAN. Although the VM ports on the ESXi host, the AltaVault appliance, and the NFS LIF on the NetApp SVM are part of the same layer 2 domain, we configured two VLANs (3180 and 3178) for these EPGs. Using contracts, the ACI fabric allows the necessary connectivity between the ESXi hosts, AltaVault, and the NetApp nodes; different VLAN IDs within the ACI fabric do not matter. A similar configuration with two VLANs can also be used for iscsi connectivity. Verifying the vpc Configuration To verify that vpcs are correctly configured, complete the following steps: Log in to the ACI fabric. From the menu bar, select Fabric > Access Policies. In the navigation bar, expand Switch Policies > Policies and select the default policy, which is labeled Virtual Port Channel Default. Verify that vpc is configured for the default policy. 12 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

13 4. In the Properties pane, double-click the vpc policy to display additional information about the leaf switches, their node IDs, and the peering relationship. 5. Click Close. Creating the AltaVault VLAN To create a VLAN for AltaVault, complete the following steps: Note: In the configuration validated in the lab, we used VLAN 3180 for the AltaVault appliance and NetBackup servers. Log in to the ACI fabric. From the menu bar, select Fabric > Access Policies. In the navigation bar, expand Pools. 13 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

14 4. Right-click VLAN and select Create VLAN Pool. 5. In the Create VLAN Pool dialog box, type a name for the AltaVault VLAN and click the plus sign to specify the encapsulation block range. 14 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

15 6. Type the VLAN ID in the Range boxes and click OK. 7. Click Submit to create the VLAN. Creating a Physical Domain Policy To create a physical domain policy, complete the following steps: 1. Log in to the ACI fabric. 2. From the menu bar, select Fabric > Access Policies. 3. In the navigation bar, expand Physical and External Domains. 15 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

16 4. Right-click Physical Domains and select Create Physical Domain. 5. Type a name for the policy and select the AltaVault VLAN from the VLAN Pool list. 16 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

17 6. Associate the new physical domain policy with an attachable entity profile. If no profile exists, select Create Attachable Entity Profile from the drop-down list. 7. Type a name for the profile and click Next. 17 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

18 8. Click the plus sign to create an interface policy group. 9. From the Switches list, select the leaf switches for the switch profile. 18 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

19 10. Assign a name to the switch profile. 11. Click the Port Configuration icon to configure the switch interfaces for vpc and LACP. 12. Make the following selections: a. Select the VPC option. b. Type or select the interfaces to add to the profile. c. Select an interface selector. d. Select Create VPC Interface Policy Group from the VPC Policy Group list. 19 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

20 13. Type a name for the vpc interface policy group and select LACP_Active from the LACP Policy list. 14. Select the new vpc group from the list and click the Modify icon. 20 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

21 15. Select the attachable entity profile policy to apply it to the new vpc group. 16. Click Save and then click Submit to complete the configuration. Creating an Application Profile, EPGs, and Contracts You must create an external application profile for vpc, three EPGs, and service contracts for the ACI configuration for AltaVault. The storage EPG and the VM EPGs are part of the existing fabric, and they are referenced in the contracts. The EPGs and contracts allow the AltaVault appliance to communicate with the external networks and the NetApp storage on the same ACI fabric. They also allow NetBackup to communicate with the AltaVault appliance. Creating the External Application Profile To create the external application profile, complete the following steps: Log in to the ACI fabric. In the navigation bar, expand your tenant. Right-click Application Profiles and select Create Application Profiles. In the Create Application Profile dialog box, type External as the profile name. From the Monitoring Policy list, select Default. 21 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

22 6. Click the plus sign next to EPG to add an EPG In the Create Application EPG dialog box, type AVA-DATA as the EPG name. From the Bridge Domain list, select bd-external. From the Monitoring Policy list, select Default. Click Finish. Repeat step 1 to step 10 to create two additional EPGs: External and VM-External. For these EPGs, select bd-ava-400 as the bridge domain. Applying EPGs to the External Application Profile To apply the EPGs to the external application profile that you created, complete the following steps: 1. In the navigation bar, expand Application Profiles > External > Application EPGs > EPG AVA-DATA and select Static Bindings (Paths). 22 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

23 2. Click Action and select Deploy Static EPG on PC, VPC, or Interface In the dialog box, select Virtual Port Channel as the path type. From the Path list, select pg-ava NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

24 5. 6. Type vlan-3180 in the Encap box. Change the Deployment Immediacy setting to Immediate Click Submit. Repeat step 1 to step 7 to apply the other two EPGs (External and VM-External) to your external application profile. Note: VM-External must be assigned to the icef1-vc VMM physical domain. This step automates port-group provisioning on the VMware vds and allows dynamic VLAN provisioning. Creating Contracts Contracts allow traffic to flow between the AltaVault appliance, NetApp controllers, and external networks. EPGs require multiple contracts. Table 3 exemplifies the contracts that are provided or consumed by the AVA-DATA EPG. The other contracts listed in the table allow traffic between all EPGs. All filters are set to Allow-All. Table 3) Contracts in the ACI configuration for AltaVault. Application Profile EPG Tenant Name Contract Name Provided or Consumed? External AVA-DATA AVA-400 Allow-All Provided External AVA-DATA AVA-400 Allow-External Consumed External External AVA-400 Allow-External Provided External VM-External AVA-400 Allow-All Consumed External VM-External AVA-400 Allow-External Consumed NFS LIF-NFS AVA-400 Allow-NFS Provided NFS VMK-NFS AVA-400 Allow-NFS Consumed 24 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

25 To create ACI contracts for AltaVault, complete the following steps: 1. In the navigation bar, expand Application Profiles > External > Application EPGs > EPG AVA-Data and select Contracts Click Action and select Add Provided Contract. In the Add Provided Contract dialog box, from the Contract list, select Create Contract In the Create Contract dialog box, type Allow-External as the name of the contract. Change the scope to Tenant. Click the plus sign next to Subjects to add a filter as a contract subject. In the Create Contract Subject dialog box, type Allow-All as the name of the contract subject. 25 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

26 8. Click the plus sign under Filter Chain to add the new filter. 9. In the Name drop-down list under Filters, select the Allow-All filter under tenant AVA Click Update to add the Allow-All filter to the filter chain. 11. Click OK to finish creating the contract subject. 12. Click Submit. 13. Click Submit again to finish adding the contract to ACI. 26 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

27 14. Repeat steps 1 to 13 to create the other contracts listed in Table 3. After you create those contracts, the relationships between application profiles, EPGs, and contracts in your ACI configuration for AltaVault should look like the diagrams in Figure 3 to Figure 5. Figure 3) External EPG contracts. Figure 4) NFS EPG contracts. 27 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

28 Figure 5) Final view of all contracts. 5.3 Configuring AWS for AltaVault AltaVault requires access to the AWS S3 service before the storage service is enabled. This failsafe feature allows data to be archived at all times. To configure AWS for AltaVault, you must create an AWS account and an access key for the S3 service and attach policy permission for access to S3 only. The policy can be granular to a specific S3 bucket. In our validation, the account had full access to S3. Creating a Dedicated S3 Account for AltaVault To create a dedicated Amazon S3 account for AltaVault, complete the following steps: Access the AWS IAM console. In the navigation pane, click Users. Click Create New Users. Type a user name (for example, AltaVault) and keep the Generate an Access Key for Each User checkbox selected. Click Create. Click Show User Security Credentials or click Download Credentials to obtain the access key ID and the secret access key for your user. The key pair should look similar to the following examples: Access key ID: AKIAIOSFODNN7EXAMPLE Secret access key: wjalrxutnfemi/k7mdeng/bpxrficyexamplekey Attaching an S3 Policy to the AltaVault User After you create the user, you must assign a policy that allows access to a particular AWS service (in this case, the S3 service). To attach an S3 policy to the AltaVault user, complete the following steps: Return to the IAM console and click Users. Double-click the user that you created for AltaVault. 28 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

29 { Click Permissions to expand the Permissions section. Click Attach Policy. Select AmazonS3FullAccess and click Attach Policy. The following example shows a policy applied to a user: "Version": " ", "Statement": [ { "Effect": "Allow", "Action": "s3:*", "Resource": "*" } ] Creating an Amazon S3 Bucket You can create an S3 bucket for AltaVault from the S3 console or from the AltaVault appliance. In our validation, AltaVault created the bucket during the initial configuration. 5.4 Configuring AltaVault AltaVault physical appliances and virtual appliances are configured the same way. For our validation, we completed the configuration steps on the physical appliance. Note: For detailed instructions on how to deploy the AltaVault virtual appliance on VMware vsphere, see the NetApp AltaVault Cloud Integrated Storage Installation and Service Guide for Virtual Appliances. AltaVault requires a minimum of two interfaces: primary and data. The primary interface is used for management, Internet traffic, and cloud archiving. The data interface is used for local backup and restore. You can, however, direct Internet-bound traffic to the data interface if the network segment for the data interface has Internet reachability. Performing the AltaVault Basic Configuration The first time you access an AltaVault appliance, it runs a setup program that prompts you to change the password and supply the basic networking information required for the appliance to communicate over the primary interface. You must enter the following information to be able to configure and manage the appliance: The appliance host name No DHCP use on the primary interface The primary IP address The network mask The default gateway The IP address of the primary DNS server The domain name Figure 6 shows a sample startup configuration for an AltaVault appliance. After the initial configuration is completed, the remaining steps can be finalized from the web interface. The default password for AltaVault appliances is password. 29 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

30 Figure 6) AltaVault startup configuration. Configuring the AltaVault Cloud Settings Before you configure any storage features on an AltaVault appliance, you must set the cloud configuration and the data encryption key. As noted earlier, cloud configuration is mandatory for the storage service to run. To configure the AltaVault cloud settings, complete the following steps: From the AltaVault main webpage, select Storage and click Cloud Settings. In the Cloud tab, select Amazon S3 as the cloud provider. Select a region. Type the access key ID and the secret access key that you previously obtained from the Amazon IAM console. Type the host name. Type the bucket name. If the bucket already exists on the AWS S3 console, ensure that the name you enter matches the existing bucket name. Otherwise, AltaVault creates another bucket on S3 automatically. 30 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

31 7. Click Apply to commit the configuration. 8. Note: The items flagged with arrows in the screenshot are mandatory for the AWS S3 cloud configuration. For a list of all supported cloud vendors and the minimum information required to complete the cloud settings for each cloud provider, see the NetApp AltaVault Cloud Integrated Storage Deployment Guide. Click the Encryption tab. 31 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

32 9. Type and confirm a new passphrase and click Apply. Note: This passphrase is used to encrypt the datastore encryption key and must be provided whenever you import that datastore encryption key (for example, as part of disaster recovery). The passphrase is not stored in a configuration file and must be kept in a secure location Click Save at the top right corner of the page. Restart the optimization service by selecting Settings > Service and clicking Restart. Configuring the AltaVault Data Interface Settings The AltaVault appliance supports LACP on the data interfaces for added network redundancy and additional capacity. You must create a virtual interface (VIF) and assign an IP address to the new VIF. Note: To add the VIF, you must reboot the appliance. Confirm that the VIF configuration is saved before rebooting. 32 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

33 Creating a VIF To create a VIF, complete the following steps: 1. From the AltaVault main webpage, select Settings and click VIFs. 2. Click Add a Virtual Interface. 3. Select the Enable VIF checkbox. 4. Type a name for the VIF. 5. Add the member interfaces separated by a comma. Verify that these interfaces are connected to the network. 6. Select 802.3ad from the Mode drop-down list. 7. Click Add. 8. Click Save. The new virtual interface is added to the VIFs list. 9. Select Settings > Reboot/Shutdown and click Reboot. Assigning an IP Address to the New VIF After the appliance reboots, assign an IP address to the new VIF, save the configuration, and restart the service. To assign an IP address to the VIF, complete the following steps: 33 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

34 From the AltaVault main webpage, select Settings and click Data Interfaces. Expand the new VIF by clicking the arrow next to it. Assign an IP address and a subnet mask. The subnet mask is the data subnet reachable by clients. Keep the MTU size at the default 1500 value. Note: You can change the MTU size if your network switches support a different size. Click Apply. 6. Click Save and then click Restart at the top right corner of the page. Configuring CIFS for AltaVault Depending on your requirements, both CIFS and NFS are available for data archiving on AltaVault. This guide focuses on CIFS with NetBackup. Note: For more information about the NFS configuration, see the NetApp AltaVault Cloud Integrated Storage User s Guide. The CIFS configuration on AltaVault is completed in a few steps. The appliance provisions a CIFS share when you perform the appliance s initial network and cloud configuration. This procedure explains the basic CIFS configuration; further configuration might be required to accommodate your environment requirements. Note: If the cloud services are not configured, you will not be able to provision CIFS or NFS shares. The appliance must be running the optimization service for CIFS and NFS to run. To configure CIFS for AltaVault, complete the following steps: From the AltaVault main webpage, select Storage and click CIFS. Click Add CIFS Share. Type a share name. 34 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

35 Type a path (for example, /appliance_name/share_name). Keep the default selections for the other options and click Add Share. Click Add CIFS User to add a service account or an administrator account. Click Add. 8. The AltaVault appliance can join a Windows domain for granular security and centralized policy management. In the Domain pane, enter the domain name and the domain administrator user name and password. Click Join Domain. 35 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

36 5.5 Configuring Symantec NetBackup for AltaVault Before you can use NetBackup with AltaVault, you must associate a NetBackup policy with a storage unit that is based on the AltaVault appliance. After you configure the policy, you can create a test backup and restore your data from the backup to verify that NetBackup works with AltaVault. Note: Important Instructions for deploying NetBackup and configuring scalability options are beyond the scope of this guide. Because deployment details are specific to each environment, NetApp recommends that you refer to Symantec s best practices to complete NetBackup deployment tasks. The SMB 3.0 implementation causes a user authentication issue in Windows Server 2012 environments. User authentication fails and results in the failure of catalog backup jobs with DR file functionality. The following Windows registry key must be configured on media servers running Windows Server 2012 for NetBackup service accounts to be properly authenticated: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Param eters\requiresecurenegotiate DWORD value = 0 Configuring a Storage Unit A storage unit is a label that NetBackup associates with physical storage. The label can identify a robot, a path to a volume, or a disk pool. This procedure presents the best practice configuration for NetBackup with AltaVault appliances. To create a storage unit and associate it with the AltaVault appliance, complete the following steps: 1. Open the NetBackup Management Console and point to the master server. 36 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

37 2. Expand NetBackup Management > Storage, right-click Storage Units, and select New Storage Unit. 3. Create the storage unit with the following settings: a. Type a name for the storage unit. b. Select a media server. c. Specify the absolute path name to the directory. d. Select the Reduce Fragment Size To checkbox and set the value to 20480MB (20GB). Note: For the lab validation, we kept the remaining settings at their default values. 37 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

38 Note: To back up data with NetBackup to an AltaVault CIFS share in a Windows environment, you must first configure NetBackup Remote Manager, the monitor service, and the NetBackup client service. Failure to perform these configurations can result in the NetBackup status code 800, resource request failed. For more information, see the Symantec NetBackup Administrator s Guide. Modifying a Backup Policy NetBackup policies determine when backups occur, to which backup targets the data is written, and how long backup versions are maintained. Policies include automatic calendar-based schedules for performing unattended backups of clients. You can also run policies manually as needed. You must associate a policy with a storage unit or a storage unit group to write the backup jobs. To associate a NetBackup policy with a storage unit or storage unit group that is based on an AltaVault appliance, complete the following steps: 1. Under NetBackup Management > Policies, right-click an existing policy and select Change. 38 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

39 2. Modify the existing policy properties to point backups to an AltaVault appliance based storage unit and click OK. Creating a Test Backup To test NetBackup with an AltaVault appliance, you can run a manual backup with the policy that you modified in the previous procedure. To run a manual backup, complete the following steps: 1. Under NetBackup Management > Policies, right-click the modified policy and select Manual Backup. 39 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

40 2. Select the schedule and clients to back up and click OK. You will be prompted to view the backup progress in Activity Monitor. Within a given policy, you can select one or more clients for manual backup. In most cases, all clients are run from policies defined for a set schedule. You manually run policies for clients after jobs fail and need to be rerun. Viewing the Manual Backup Status To view details of a specific backup job, complete the following steps: 40 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

41 1. 2. In the navigation bar, click Activity Monitor to display the list of backup jobs. Double-click your backup job in the jobs list. 3. In the Job Details dialog box, review the job details on two tabs: the Job Overview tab and the Detailed Status tab. Information about the elapsed time, transfer rate (in KBps), and current object being processed is also available. Restoring a Backup When the backup is complete, perform a restore operation to verify that the AltaVault appliance can restore the backed-up data. To run a restore, complete the following steps: 1. From the client system, navigate to Windows Start > All Programs > Symantec NetBackup and click the Backup, Archive, and Restore icon. The following window is displayed: 41 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

42 Click Select for Restore. In the dialog box, select the checkboxes for the files that you want to restore. From the left toolbar, click Restore to start the restore. 6 Solution Verification We tested the use cases listed in Table 4 after FlexPod Datacenter with AFF and ACI was deployed, the AltaVault physical and logical appliances were configured and brought online, and all software was provisioned on the VMware infrastructure, including Windows Server and NetBackup software. Table 4) Tested use cases. Test Case Data backup to both the AVA400 appliance and the AVA-v8 appliance Data recovery from both the AVA400 appliance and the AVA-v8 appliance On-premises AVA400 failure and recovery Off-premises disaster recovery Details The verification consisted of the following tasks: Selecting a directory to back up Verifying that the backup completed successfully to both the AVA400 appliance and the AVA-v8 appliance Verifying the copied data on both AltaVault appliances by reviewing reports and network utilization logs Verifying deduplication reports and the cloud operation status Verifying Amazon S3 buckets and confirming that data slabs were populated The verification consisted of the following tasks: Deleting data from the servers Using the NetBackup restore utility to restore data from both the AVA400 appliance and the AVA-v8 appliance After the restore operation finished, verifying data integrity Note: This test restored data from the AltaVault local cache rather than from S3 buckets. AltaVault keeps up to 90% of the appliance s storage capacity hot before a rotational schedule kicks in. The verification consisted of the following tasks: Backing up the AVA400 configuration to a safe location Simulating hardware failure by destroying the configuration, the data stored on the appliance, and any encryption keys Deleting data from clients to verify restore from S3 storage Reapplying the previously saved configuration to the AVA400 appliance Restoring the archived data from S3 storage by executing the Prepopulation task from the AltaVault Storage menu Performing a restore from the NetBackup client and verifying data integrity The verification consisted of the following tasks: Backing up the AVA400 configuration to a safe location Shutting down the AVA400 appliance to simulate site failure Configuring an AVA-v8 appliance with an IP address different from the IP address of the failed AVA400 appliance to simulate a remote DR location Importing shared data only and not the full configuration; for this step, the encryption key passphrase was required 42 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

43 Test Case Details Restoring the archived data from S3 storage by executing the Prepopulation task from the AltaVault Storage menu Performing a restore from the NetBackup client and verifying data integrity 7 Conclusion AltaVault coupled with FlexPod Datacenter with NetApp All Flash FAS and Cisco ACI is an optimal shared infrastructure that scales beyond the boundaries of the private cloud into the public cloud with ease of use and a low cost of ownership not typically seen with traditional tape backup methods. With AltaVault, DR strategies are no longer limited to specific locations, and DR solutions can be obtained without excessive costs and the ongoing maintenance and limited capacity of tape libraries. This infrastructure, which has a proven and validated design, can support multiple use cases and applications. The flexibility afforded by customers ability to use multiple cloud service providers translates to total data sovereignty and control. The efficiency of AltaVault deduplication accelerates data archiving and lowers the cost of remote storage. References NetApp References NetApp All Flash FAS NetApp AltaVault Cloud Integrated Storage Deployment Guide NetApp AltaVault Cloud Integrated Storage Installation and Service Guide for Virtual Appliances NetApp AltaVault Cloud Integrated Storage User s Guide NetApp Data ONTAP 8.3 Operating System NVA-0019-DESIGN: NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI TR-4405: NetApp AltaVault Cloud-Integrated Storage Appliance: Security Overview TR-4414: NetApp AltaVault Cloud-Integrated Storage Appliance: Best Practices Guide for Backup Applications TR-4420: NetApp AltaVault Cloud-Integrated Storage Appliance: Best Practices for Disaster Recovery TR-4427: NetApp AltaVault Cloud-Integrated Storage Appliance: Technology Overview For more information about NetApp technologies, consult the NetApp public document library at 43 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

44 Cisco References FlexPod Datacenter with NetApp All Flash FAS, Cisco Application Centric Infrastructure, and VMware vsphere Design Guide aff8040_design.html#_toc FlexPod Datacenter with NetApp All Flash FAS, Cisco Application Centric Infrastructure, and VMware vsphere Deployment Guide aff8040.html Symantec References Symantec NetBackup Symantec NetBackup Administrator s Guide Version History Version Date Document Version History Version 1.0 November 2015 Initial release 44 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI:

45 Refer to the Interoperability Matrix Tool (IMT) on the NetApp Support site to validate that the exact product and feature versions described in this document are supported for your specific environment. The NetApp IMT defines the product components and versions that can be used to construct configurations that are supported by NetApp. Specific results depend on each customer's installation in accordance with published specifications. Copyright Information Copyright NetApp, Inc. All rights reserved. Printed in the U.S. No part of this document covered by copyright may be reproduced in any form or by any means graphic, electronic, or mechanical, including photocopying, recording, taping, or storage in an electronic retrieval system without prior written permission of the copyright owner. Software derived from copyrighted NetApp material is subject to the following license and disclaimer: THIS SOFTWARE IS PROVIDED BY NETAPP "AS IS" AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL NETAPP BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. NetApp reserves the right to change any products described herein at any time, and without notice. NetApp assumes no responsibility or liability arising from the use of products described herein, except as expressly agreed to in writing by NetApp. The use or purchase of this product does not convey a license under any patent rights, trademark rights, or any other intellectual property rights of NetApp. The product described in this manual may be protected by one or more U.S. patents, foreign patents, or pending applications. RESTRICTED RIGHTS LEGEND: Use, duplication, or disclosure by the government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS (October 1988) and FAR (June 1987). Trademark Information NetApp, the NetApp logo, Go Further, Faster, AltaVault, ASUP, AutoSupport, Campaign Express, Cloud ONTAP, Clustered Data ONTAP, Customer Fitness, Data ONTAP, DataMotion, Fitness, Flash Accel, Flash Cache, Flash Pool, FlashRay, FlexArray, FlexCache, FlexClone, FlexPod, FlexScale, FlexShare, FlexVol, FPolicy, GetSuccessful, LockVault, Manage ONTAP, Mars, MetroCluster, MultiStore, NetApp Insight, OnCommand, ONTAP, ONTAPI, RAID DP, RAID-TEC, SANtricity, SecureShare, Simplicity, Simulate ONTAP, SnapCenter, Snap Creator, SnapCopy, SnapDrive, SnapIntegrator, SnapLock, SnapManager, SnapMirror, SnapMover, SnapProtect, SnapRestore, Snapshot, SnapValidator, SnapVault, StorageGRID, Tech OnTap, Unbound Cloud, WAFL, and other names are trademarks or registered trademarks of NetApp Inc., in the United States and/or other countries. All other brands or products are trademarks or registered trademarks of their respective holders and should be treated as such. A current list of NetApp trademarks is available on the web at NVA-0019-DEPLOY NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI: