Q-Cloud Protect for AWS Marketplace

Transcription

1 Launch and Recovery Guide Q-Cloud Protect for AWS Marketplace

2 Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide, May 2016, Product of USA. Quantum Corporation provides this publication as is without warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability or fitness for a particular purpose. Quantum Corporation may revise this publication from time to time without notice. COPYRIGHT STATEMENT 2016 Quantum Corporation. All rights reserved. Your right to copy this manual is limited by copyright law. Making copies or adaptations without prior written authorization of Quantum Corporation is prohibited by law and constitutes a punishable violation of the law. TRADEMARK STATEMENT Artico, Be Certain (and the Q brackets design), DLT, DXi, DXi Accent, DXi V1000, DXi V2000, DXi V4000, GoVault, Lattus, NDX, the Q logo, the Q Quantum logo, Q-Cloud, Quantum (and the Q brackets design), the Quantum logo, Quantum Be Certain (and the Q brackets design), Quantum Vision, Scalar, StorageCare, StorNext, SuperLoader, Symform, the Symform logo (and design), vmpro, and Xcellis are either registered trademarks or trademarks of Quantum Corporation and its affiliates in the United States and/or other countries. All other trademarks are the property of their respective owners. Products mentioned herein are for identification purposes only and may be registered trademarks or trademarks of their respective companies. All other brand names or trademarks are the property of their respective owners. Quantum specifications are subject to change. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide ii

3 Contents Contents Preface vi Chapter 1: Introduction to Q-Cloud Protect 1 Q-Cloud Protect for AWS 1 Pre-Launch Checklists 5 VPC-Hardware VPN Access Connection 6 Terms and Concepts 6 Calculating Storage Needs 10 Chapter 2: VPC-Private Network Connections 15 VPC-Private Network Connections 15 Creating a VPC-Hardware VPN Access Connection 18 Recommended Security Group Rules 23 IAM Roles and Users 24 Creating an IAM Role for Instances 26 Creating IAM Policies for Non-Administrator Users and Groups 30 Chapter 3: Launch 33 Launch 33 Task Overview: Launch Instances from AWS Marketplace 36 Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide iii

4 Contents Steps 1 and 2: Select an AMI and Instance Type 37 Step 3: Configure Instance Details 42 Step 4: Add Storage 45 Step 5: Tag Instance 48 Step 6: Configure Security Group 49 Step 7: Review and Launch 51 Assigning Key Pairs 52 Chapter 4: Deploy 56 Deploy 56 AWS Marketplace Deployment Workflow 57 Step 1: Log In to the Cloud Appliance 58 Step 2: Complete the Getting Started Wizard 60 Step 3: Register the Cloud Appliance 60 Step 4: Generate the System Diagnostics File 65 Step 5: Review Capacity 67 Configuring Access Control 67 Chapter 5: SSH Connection 76 SSH Connect 76 Using PuTTY to Connect to the Cloud Appliance 77 Using an SSH Client to Connect to the Cloud Appliance 81 Chapter 6: S3, EBS Volumes, and Snapshots 83 S3, EBS Volumes, and Snapshots 83 Tagging EBS Volumes 87 Recovering When EBS Volumes Fail 89 Expanding EBS Volumes 92 Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide iv

5 Contents Chapter 7: Expand Licensed Capacity 94 Appendix 8: Troubleshooting Tips and Frequently Asked Questions 95 Troubleshooting Tips and FAQs 95 EC2 Instance Issues and FAQs 97 Virtual Console Issues and FAQs 98 Network Issues and FAQs 99 S3 Issues and FAQs 99 Data Recovery and Space Management Issues and FAQs 102 Alert Issues and FAQs 103 Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide v

6 Preface This guide introduces Q-Cloud Protect for AWS Marketplace and contains the following chapters: Introduction to Q-Cloud Protect on page 1 VPC-Private Network Connections on page 15 Launch on page 33 Deploy on page 56 SSH Connection on page 76 S3, EBS Volumes, and Snapshots on page 83 Troubleshooting Tips and Frequently Asked Questions on page 95 Audience This manual is written for Q-Cloud Protect for AWS Marketplace operators, network administrators, and service engineers. Note: It is useful for the audience to have a basic understanding of UNIX and backup/recovery systems. Notational Conventions This manual uses the following conventions: Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide vi

7 Preface Convention User input is shown in bold monospace font. Computer output and command line examples are shown in monospace font. Example./DARTinstall./DARTinstall User input variables are enclosed in angle brackets. For UNIX and Linux commands, the command prompt is implied../dartinstall is the same as #./DARTinstall File and directory names, menu commands, button names, and window names are shown in bold font. Menu names separated by arrows indicate a sequence of menus to be navigated. /data/upload Utilities > Firmware The following formats indicate important information: Note: Note emphasizes important information related to the main topic. Caution: Caution indicates potential hazards to equipment or data. WARNING: Warning indicates potential hazards to personal safety. Right side of the system - Refers to the right side as you face the component being described. Left side of the system - Refers to the left side as you face the component being described. Data sizes are reported in base 1000 rather than base For example: o o o 1 MB = 1,000,000 bytes 1 GB = 1,000,000,000 bytes 1 TB = 1,000,000,000,000 bytes Product Safety Statements Quantum will not be held liable for damage arising from unauthorized use of the product. The user assumes all risk in this aspect. This unit is engineered and manufactured to meet all safety and regulatory requirements. Be aware that improper use may result in bodily injury, damage to the equipment, or interference with other equipment. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide vii

8 Preface Related Documents The following Quantum documents are also available for Q-Cloud Protect for AWS Marketplace : Document Number Document Title Document Description Q-Cloud Protect Release Notes Describes new information specific to the current release of Q-Cloud Protect. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide viii

9 Preface For the most up to date information on Q-Cloud Protect for AWS Marketplace, see: Contacts For information about contacting Quantum, including Quantum office locations, go to: Comments To provide comments or feedback about this document, or about other Quantum technical publications, send to: Getting More Information or Help StorageCare, Quantum s comprehensive service approach, leverages advanced data access and diagnostics technologies with cross-environment, multi-vendor expertise to resolve backup issues faster and at lower cost. Accelerate service issue resolution with these exclusive Quantum StorageCare services: Service and Support Website - Register products, license software, browse Quantum Learning courses, check backup software and operating system support, and locate manuals, FAQs, firmware downloads, product updates and more in one convenient location. Get started at: esupport - Submit online service requests, update contact information, add attachments, and receive status updates via . Online Service accounts are free from Quantum. That account can also be used to access Quantum s Knowledge Base, a comprehensive repository of product support information. Get started at: For further assistance, or if training is desired, contact the Quantum Customer Support Center: Region North America Support Contact (toll free) Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide ix

10 Preface Region EMEA Support Contact (toll free) Asia Pacific (toll free) For worldwide support: StorageCare Guardian StorageCare Guardian securely links Quantum hardware and the diagnostic data from the surrounding storage ecosystem to Quantum's Global Services Team for faster, more precise root cause diagnosis. StorageCare Guardian is simple to set up through the internet and provides secure, two-way communications with Quantum s Secure Service Center. Learn more at: Worldwide End-User Product Warranty For more information on the Quantum Worldwide End-User Standard Limited Product Warranty: Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide x

11 Chapter 1: Introduction to Q- Cloud Protect This chapter contains the following topics: Q-Cloud Protect for AWS 1 Pre-Launch Checklists 5 Terms and Concepts 6 Calculating Storage Needs 10 Q-Cloud Protect for AWS Q-Cloud Protect for Amazon Web Services (AWS) is Quantum's cloud-based virtual appliance for disaster recovery (DR). Use Q-Cloud Protect to safeguard replicated data from localized disasters. Data can be replicated to Q-Cloud Protect from any of the following sources: Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 1

12 Chapter 1: Introduction to Q-Cloud Protect On-site Quantum DXi Deduplication Backup Appliances On-site DXi Appliances Using Veritas NetBackup and Backup Exec OpenStorage (OST) Optimized Duplication Veritas NetBackup and Backup Exec OST Servers with DXi Accent Enabled Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 2

13 Chapter 1: Introduction to Q-Cloud Protect Additional Benefits Q-Cloud Protect offers the following benefits in addition to safeguarding replicated data. Deduplication Q-Cloud Protect leverages Quantum's variable-length deduplication to minimize WAN traffic and to save you 90% or more on cloud-based storage for DR. Off-site Replication As an Enterprise customer, if you already own or are considering the purchase of a DXi appliance for backup and replication, you can use the Q-Cloud Protect appliance for off-site replication. Replacement for Tape Solutions Q-Cloud Protect can successfully replace tape solutions used for compliance and long term data retention. Q-Cloud Protect eliminates the significant costs and time associated with tape management, allowing for easier and faster access to needed data in case of an audit. The Launch and Recovery Guide This guide presents information for launching and recovering Q-Cloud Protect from the AWS Marketplace. For information about replicating data to the cloud appliance, see the Q-Cloud Protect User's Guide. Prerequisites and Considerations Please review the following information before launching and deploying a Q-Cloud Protect appliance. For a checklist of prerequisite tasks, see Pre-Launch Checklists on page 5. Create an account You must have an AWS account before you can launch a Q-Cloud Protect instance. For more information, see Review AWS terms and concepts Review terms and concepts that are important to understand before launching a Q-Cloud Protect instance. For more information, see Terms and Concepts on page 6. Review FAQs and troubleshooting tips Review frequently asked questions (FAQs) and troubleshooting tips to assist you in launching and managing your cloud appliance. See Troubleshooting Tips and FAQs on page 95. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 3

14 Chapter 1: Introduction to Q-Cloud Protect Configure AWS network connections for Q-Cloud Protect You must configure a secure network connection between Q-Cloud Protect and the on-site DXi appliance or OST server from which you will be sending data. For more information, see VPC-Private Network Connections on page 15. Determine storage needs To avoid running out of storage space too quickly or to avoid unnecessary storage costs, determine your storage needs before selecting a Q-Cloud Protect AMI and configuring the instance's storage capacity. For more information, see Calculating Storage Needs on page 10. Available Q-Cloud Protect Appliances Delivered as an AMI, the cloud appliance is offered with 1-90 TBs of storage capacity. Make sure to purchase the amount of storage capacity that best meets your needs. See Calculating Storage Needs on page 10. Metered AMIs on AWS Marketplace When you purchase a Q-Cloud Protect metered AMI, its maximum storage capacity is predefined. You will be able to use up to the specified amount of storage allocated to the launched instance. Q-Cloud Protect offers two sizes of metered AMIs: 1-20 TB of storage capacity 1-90 TB of storage capacity Depending on the AMI's size, you will need to assign one of the following instance type's to the AMI. AMIs for 1 20 TB of Storage Capacity Instance Type # of vpcus Memory Replication m3.xlarge 4 15 GiB 1:1 source-to-target m4.xlarge 4 16 GiB 1:1 source-to-target AMIs for 1 90 TB of Storage Capacity Instance Type # of vpcus Memory Replication m3.2xlarge 8 30 GiB 1:1 source-to-target m4.2xlarge 8 32 GiB 1:1 source-to-target Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 4

15 Chapter 1: Introduction to Q-Cloud Protect Pre-Launch Checklists Service Plan Important Before receiving support, you must register your product. For more information, see Step 3: Register the Cloud Appliance on page 60. AWS Marketplace Customers Q-Cloud Protect in AWS Marketplace includes 5x9 phone support, with a targeted next business day response time. This plan accompanies all Q-Cloud Protect appliances, free of charge. In addition, Quantum will match any additional support purchased with your on-site DXi appliance. For more information about this service plan, please visit Use this website to submit a ticket, find documentation and training, or access software downloads. AWS Implementation Assistance Quantum offers AWS implementation assistance to all registered customers. This assistance aides in setting up your AWS account, configuring your network, and navigating AWS terminology, acronyms, and payment structure. More information about Quantum's Advanced Services offerings are available at Pre-Launch Checklists Before launching a Q-Cloud Protect instance from the EC2 console, make sure that you complete the tasks listed in the following checklists. ü Task Reference Create an account AWS Marketplace Account: cc Configure a VPC-private network connection VPC-Private Network Connections on page 15 For Create IAM roles and policies IAM Roles and Users on page 24 Determine storage needs Calculating Storage Needs on page 10 Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 5

16 Chapter 1: Introduction to Q-Cloud Protect Terms and Concepts VPC-Hardware VPN Access Connection If you elect to set up a VPC-Hardware VPN Access connection, you will need to make sure to perform each of the following tasks. For more information, see Creating a VPC-Hardware VPN Access Connection on page 18. ü Task Additional Information Needed to Perform Task Create a VPC Configure a subnet for the VPC IP address block to assign to your VPC's subnet Configure a routing table for the VPC's subnet Create a VPN S3 endpoint Security group rule allowing your cloud appliance to communicate with your S3 buckets. See Recommended Security Group Rules on page 23. Create an Internet gateway Create a VPN tunnel Configure a security group An existing customer gateway device or application to connect to the VPN Ports and IP addresses of the applications needing access to and from your Q-Cloud Protect instance. See Recommended Security Group Rules on page 23. Configure a DHCP options set Domain name DNS server IP addresses Terms and Concepts Review the following terms and concepts to understand the language used throughout AWS and this documentation. AWS Terms and Concepts The following AWS terms and concepts are applicable to Q-Cloud Protect. EC2 AWS Elastic Compute Cloud (EC2) is an area within AWS from which you can launch and manage Q- Cloud Protect instances. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 6

17 Chapter 1: Introduction to Q-Cloud Protect Terms and Concepts For more information, see VPC A Virtual Private Cloud (VPC) is an isolated section within the AWS cloud where Q-Cloud Protect instances reside. You can configure your own VPC and its virtual network, including the configuration of the network connection between your Q-Cloud Protect instances and your on-site DXi appliances. For more information regarding Amazon's VPC, see For information about configuring a VPC, see VPC-Private Network Connections on page 15. Security Groups Security groups are virtual firewalls that you can create to control traffic to and from your instances. Configure security groups for your VPC network. For more information, see Creating a VPC-Hardware VPN Access Connection on page 18 For more information regarding AWS security groups, see S3 Simple Storage Service (S3) is Amazon's cloud storage service. Q-Cloud Protect uses S3 to store the data being replicated to Q-Cloud Protect. It places this data into S3 buckets, which are identified by the serial number assigned to your Q-Cloud Protect appliance. In addition, snapshots of EBS volumes are also stored in S3, further protecting your data from corruption. For more information about S3, see For more information about using S3 with Q-Cloud Protect, see S3, EBS Volumes, and Snapshots on page 83. IAM AWS Identity and Access Management (IAM) provides access control for your AWS resources. Q-Cloud Protect uses IAM as follows: IAM roles to grant the EC2 instance permission to manage S3 objects and EBS snapshots For AWS Marketplace and GovCloud only: IAM users/groups to grant non-administrator users/groups permission to launch a Q-Cloud Protect EC2 instance For more information about IAM, see For more information about creating IAM roles and IAM users/groups, see IAM Roles and Users on page 24. AMI An Amazon Machine Image (AMI) is a snapshot of a system that users can deploy as a new EC2 instance. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 7

18 Chapter 1: Introduction to Q-Cloud Protect Terms and Concepts Quantum offers different Q-Cloud Protect AMIs from which to select, varying in storage capacity. To select the best Q-Cloud Protect AMI for your situation, make sure you know your storage needs ahead of time. For more information about Q-Cloud Protect AMIs, see Launch on page 33 For more information, see Instance An instance is a unique virtual machine image of an AMI that operates in EC2. Q-Cloud Protect runs as an EC2 instance after being launched from the AMI. For more information about launching a Q-Cloud Protect instance, see Launch on page 33 For more information, see VPC Endpoints A VPC S3 endpoint enables instances within your VPC to communicate with their S3 buckets over a private connection that does not require an Internet gateway or a VPN connection. All data transferred between your instances and their S3 buckets stays securely within the Amazon network. For more information regarding VPC endpoints, see For more information about configuring a VPC endpoint for your VPC, see VPC-Private Network Connections on page 15. EBS Volumes Elastic Block Storage (EBS) volumes are persistent block-level storage attached to instances. These volumes remain without an instance so that stored data is not lost. The Q-Cloud Protect instance uses two main types of EBS volumes: Root volumes store OS and initial configuration data for the Q-Cloud Protect instance. Data volumes store metadata about the data replicated to Q-Cloud Protect. By using both types of EBS volumes along with S3, all data associated with the Q-Cloud Protect instance and appliance is being protected. To further protect data stored in these volumes, Q-Cloud Protect takes snapshots of each volume, which are also stored in S3. For more information about EBS volumes, see For more information about managing your EBS volumes, see S3, EBS Volumes, and Snapshots on page 83. EBS Snapshots EBS snapshots are images of the metadata stored on EBS volumes. Snapshots are safeguarded in S3, Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 8

19 Chapter 1: Introduction to Q-Cloud Protect Terms and Concepts increasing the durability of the stored metadata. Q-Cloud Protect takes advantage of this durability by capturing routine EBS snapshots of your instance's EBS volumes. If you need to restore data on an EBS volume or entire instance in cases where the data on the volume is corrupted or fails you can use the EBS snapshots along with the data stored in S3. For more information about snapshots, see For information about managing snapshots for your Q-Cloud Protect instance, see S3, EBS Volumes, and Snapshots on page 83. Regions Regions are geographically independent areas around the world in which EC2 data centers are located. When launching your Q-Cloud Protect instance, you must select a region in which to store data backed-up to Q-Cloud Protect. We recommend selecting a region that is geographically close in proximity to your source DXi or OST server to reduce network latency. For more information, see Availability Zones Availability zones are isolated, but interconnected sections within a region. You can select availability zones in which to store data backed-up to your Q-Cloud Protect, or you can have AWS assign an availability zone. For more information, see Q-Cloud Protect Documentation Terminology The following terms are used throughout Q-Cloud Protect documentation to discuss the various components of the cloud appliance. Q-Cloud Protect Quantum's virtual deduplication appliance that runs in the AWS cloud infrastructure. Q-Cloud Protect AMI The Amazon Machine Image (AMI) offered by Quantum. Q-Cloud Protect Instance The virtual machine image of the Q-Cloud Protect AMI. Q-Cloud Protect / Cloud Appliance Virtual Console The web-based graphic user interface (GUI) from which you can manage data transfers between Q-Cloud Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 9

20 Chapter 1: Introduction to Q-Cloud Protect Calculating Storage Needs Protect and the on-site DXi or OST server with Accent enabled. Calculating Storage Needs To avoid running out of storage space too quickly or to avoid unnecessary storage costs, determine your storage needs before selecting a Q-Cloud Protect AMI and configuring the instance's EBS volume storage capacity. Review the following sections for recommendations in calculating your storage requirements. Calculate Storage Needs for DXi Replication and OST Optimized Duplication When performing direct replication or OST optimized duplication from an on-site DXi appliance to the cloud appliance, we recommend calculating your cloud appliance's storage needs as follows. Scenario 1 You want to replicate all data from your on-site DXi appliance to the cloud appliance. The total storage required on the cloud appliance will mirror the amount of deduplicated data on the source DXi appliance. You can view this amount on the source DXi appliance's Advanced Reporting Overview Report > Data Volume Overview graph After Reduction value. Note: We recommend rounding up all values to ensure you have enough capacity allocated to your cloud appliance. For example If you will be replicating all deduplicated data from your on-site 5 TB DXi4700 to the cloud appliance, select a smaller AMI with up-to 20TB of storage capacity. If you will be replicating all deduplicated data from your on-site 21 TB DXi4700, select a larger AMI with up-to 90 TB of storage capacity. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 10

21 Chapter 1: Introduction to Q-Cloud Protect Calculating Storage Needs Scenario 2 You want to replicate only some of your data from an on-site DXi appliance to the cloud appliance. Determine the amount of data in each share or partition to be replicated using one of the following methods. Note: We recommend rounding up all values to ensure you have enough capacity allocated to your cloud appliance. Method 1 1. From the source DXi appliance's console, navigate to Advanced Reporting. 2. From the Ingest (Chargeback) Report > Capacity graph, record the User Data Size values for each share or partition on the DXi appliance that you intend to replicate to the cloud appliance. Figure 1: Partition <name> Capacity Graph 3. Add the shares or partitions User Data Size values together. 4. From the Overview Report > Data Volume Overview graph, record the After Reduction last value, which is the total amount of deduplicated data on the DXi appliance. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 11

22 Chapter 1: Introduction to Q-Cloud Protect Calculating Storage Needs Figure 2: Data Volume Overview Graph 5. Divide the sum of the User Data Size value from step 3 by the After Reduction last value from step 4 to reach an estimate of the amount of deduplicated data contained in the selected shares or partitions. Sum of User Data Size After Reduction last value = deduplicated data in shares/partitions to replicate 6. Calculate 10% of the estimated value from step 5, plus any anticipated data growth in the shares or partitions, to reach your estimated storage capacity requirement. (Sum of User Data Size After Reduction last value) x (10% + anticipated data growth) = required amount of storage 7. Choose the AMI that best fits your estimated storage needs. Method 2 1. From the source DXi appliance's console, navigate to Advanced Reporting. 2. From the Ingest (Chargeback) Report > Per <Share or Partition Ingest> menu, select Export <share or partition> Chargeback to download the Chargeback Ingest file. 3. Open the file and locate the OnDisk field. 4. Add the OnDisk values together to estimate the total amount of data on disk for the share or partition. 5. Calculate 10% of the sum from step 4, plus any anticipated data growth in the share or partition, to reach your estimated storage capacity requirement. (Sum of OnDisk values) x (10% + anticipated data growth) = required amount of storage 6. Choose the AMI that best fits your estimated storage needs. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 12

23 Chapter 1: Introduction to Q-Cloud Protect Calculating Storage Needs Calculate Storage Capacity for OST Direct Replication with DXi Accent We recommend working with your Quantum DXi Account team to determine storage capacity needs for OST direct replication with DXi Accent to the cloud appliance. Calculate EBS Volume Requirements In addition to selecting the correct size of AMI, you will configure EBS volume storage attached to the Q- Cloud Protect instance. See Step 4: Add Storage on page 45. The EBS volume stores metadata about the data replicated to the cloud appliance. The EBS data volume is pre-configured with 256 GiB of General Purpose (SSD) for its base configuration. You need to configure enough additional metadata storage to accommodate data being replicated to the cloud appliance in the short term plus an additional 50% of storage capacity for future growth. Use the following task to determine additional storage needs. Note: We recommend rounding up all values to ensure you have enough capacity allocated to your EBS volume. GB versus GiB Although the Q-Cloud Protect appliance reports measurements in units of MB, GB, and TB, AWS reports measurements in units of MiB, GiB, and TiB. When calculating the EBS volume's storage capacity, you will need to convert measurements between the cloud appliance and AWS interfaces, as appropriate. To convert GB to GiB, multiply by.93. GB x.93 = GiB Calculation Steps 1. Calculate the total deduplicated amount of data to be replicated to the cloud appliance as follows: a. From the source DXi appliance's console, navigate to Advanced Reporting. b. From the Overview Report > Data Volume Overview graph, record the After Reduction value. This value is representative of the total amount of deduplicated data that will be replicated from the source DXi to the cloud appliance. If you will be replicating only some of your data from an on-site DXi appliance to the cloud appliance, refer to Scenario 2 on page 11 to reach an estimate of the amount of deduplicated data that will be replicated. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 13

24 Chapter 1: Introduction to Q-Cloud Protect Calculating Storage Needs Figure 3: Data Volume Overview Graph 2. Convert the total deduplicated data to be replicated from GB to GiB. Use the following equation: GB x.93 = GiB 3. Calculate 10% of the total deduplicated data size to determine the storage needed for metadata. (Deduplicated data to be replicated in GiB) x (0.10) = Required EBS volume storage capacity in GiB Additional Information If you foresee future growth in the amount of data to be replicated, we recommend calculating an additional percentage of the metadata storage to determine the required amount of EBS volume storage. For example If you current DXi appliance uses 10 TiB to store data and you foresee stored data growing by 10% to 11 TiB, calculate the following: (10 TiB) x (0.11 growth) = Required EBS volume storage capacity in GiB If you foresee your growth rate being closer to 50% to 15 TiB, calculate the following: (10 TiB) x (0.15 growth) = Required EBS volume storage capacity in GiB If your EBS volume reaches 85% of allotted storage capacity, you will receive an alert notifying you to increase your EBS volume storage. See Expanding EBS Volumes on page 92. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 14

25 Chapter 2: VPC-Private Network Connections This chapter contains the following topics: VPC-Private Network Connections 15 Creating a VPC-Hardware VPN Access Connection 18 Recommended Security Group Rules 23 IAM Roles and Users 24 VPC-Private Network Connections Important For both durability and security, we recommend using a VPC-private network connection either VPC- Hardware VPN Access or VPC-DirectConnect for your Q-Cloud Protect. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 15

26 Chapter 2: VPC-Private Network Connections VPC-Related Concepts Review the following concepts to gain a better understanding of VPC connections. What is a VPC? A Virtual Private Cloud (VPC) is an isolated section within the AWS cloud where Q-Cloud Protect instances reside. You can configure your own VPC and its virtual network, including the configuration of the network connection between your Q-Cloud Protect instances and your on-site DXi appliances. For more information regarding Amazon's VPC, see What is a VPC S3 Endpoint? A VPC S3 endpoint enables instances within your VPC to communicate with their S3 buckets over a private connection that does not require an Internet gateway or a VPN connection. All data transferred between your instances and their S3 buckets stays securely within the Amazon network. For more information regarding VPC endpoints, see VPC-Hardware VPN Access Connection The VPC-Hardware VPN Access connection uses a VPN tunnel to securely connect your on-site DXi with your Q-Cloud Protect instance in the VPC. Review the following information about the components that complete this type of connection. For information about creating a VPC-Hardware VPN Access connection, see Creating a VPC-Hardware VPN Access Connection on page 18. Connection Components To create this connection, you will need to create the following components. VPC in which your instances will reside. VPC endpoint policy to enable a private connection a secure connection that does not require an Internet gateway or a VPN connection between instances within the VPC and S3 buckets within the same region. For metered AMIs in AWS Marketplace, an Internet gateway within the VPC that allows your instances to communicate with the Internet, and AWS API services. Internet Protocol Security (IPsec) VPN tunnel to secure all communication between your on-site DXi appliances and Q-Cloud Protect instances. This VPN connection consists of the following: o Virtual private gateway allowing communication to and from the Q-Cloud Protect instances within the VPC. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 16

27 Chapter 2: VPC-Private Network Connections o o Customer gateway allowing communication to and from the on-site DXi appliances. VPN connection between the virtual private gateway and the customer gateway. Figure 4: VPC-Private Network Connection Diagram Additional Configuration In addition, you will need to configure the following: Public subnet to define the range of private IP addresses that can be assigned to your instances. Your instances will also be assigned public IP addresses to be used with the Internet gateway. Routing table to direct traffic for the subnet associated with your VPC. Security groups to define the traffic allowed to and from your instances in the VPC. Dynamic Host Configuration Protocol (DHCP) options set provide instances access to domain name servers (DNS) while communicating with your on-site DXi appliances. VPC-DirectConnect Network Connection With a VPC-DirectConnect network connection, DirectConnect replaces the user-configured VPC- Hardware VPN Access connection. For more information about using AWS DirectConnect, see Note: Additional charges apply when you use AWS DirectConnect. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 17

28 Chapter 2: VPC-Private Network Connections Creating a VPC-Hardware VPN Access Connection Creating a VPC-Hardware VPN Access Connection Use the following steps to create a VPC-Hardware VPN Access connection. Prerequisites Before creating a VPC-Hardware VPN Access connection, make sure that you have the following. For a checklist of tasks to complete in setting up your connection, see Pre-Launch Checklists on page 5. Subnet CIDR Block Know the IP address block to assign to your VPC's subnet. See Step 2: Configure a Subnet for the VPC on the next page. Customer Gateway As part of your VPN tunnel, you will need to have an existing customer gateway device or application to connect to the VPN. See Step 6: Create a VPN Tunnel on page 20. Security Group Ports and IP Addresses To configure a security group for your VPC, make sure you know the ports and IP addresses of the applications needing access to and from your Q-Cloud Protect instance. See Recommended Security Group Rules on page 23. DHCP Options Set For your Q-Cloud Protect instance to access domain name servers (DNS) while communicating with your on-site DXi appliances, you will need to provide the following: Domain name DNS server IP addresses See Step 8: Configure a DHCP Options Set on page 22. Need More Information? For detailed information about Amazon VPC connections, see Step 1: Create a VPC A Virtual Private Cloud (VPC) is an isolated section within the AWS cloud where instances reside. As the Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 18

29 Chapter 2: VPC-Private Network Connections Creating a VPC-Hardware VPN Access Connection first step in creating your VPC-Hardware VPN Access connection, you need to create the VPC in which your Q-Cloud Protect instances will reside. Need detailed instructions? See Step 2: Configure a Subnet for the VPC Configure a public subnet to define the range of private IP addresses that can be assigned to your instances within the VPC. During launch, you will assign this public subnet to the instance, which in turn assigns the instance the following: Private IP address within the subnet range Public IP address allowing Internet access to the instance Need detailed instructions? See Step 3: Configure a Routing Table for the VPC's Subnet Configure a route table to define the routes that can be used by traffic leaving the subnet. Configuration Tasks a. Create a custom route table. b. Associate the route table with the subnet. Need detailed instructions? See Step 4: Create a VPN S3 Endpoint A VPC S3 endpoint enables a private connection a secure connection that does not require an Internet gateway or a VPN connection between your Q-Cloud Protect instance and its S3 buckets. Configuration Tasks Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 19

30 Chapter 2: VPC-Private Network Connections Creating a VPC-Hardware VPN Access Connection a. Select a VPC. b. Create a VPC S3 endpoint policy. c. Create an outbound security group rule to allow access from your cloud appliance to its S3 buckets. See Recommended Security Group Rules on page 23. d. Associate a route table and subnet with the S3 endpoint policy. Need detailed instructions? See Step 5: Create an Internet Gateway An Internet gateway provides a secure target for the route table to use in directing your instances access to the Internet. It also provides network address translation (NAT) for your instances' public IP addresses. Your Q-Cloud Protect instance requires an Internet gateway to securely access the following: Quantum's licensing verification server (applicable only to GovCloud accounts) API services to create and maintain snapshots Need detailed instructions? See Step 6: Create a VPN Tunnel Create an Internet Protocol Security (IPsec) VPN tunnel to secure all communication between your on-site DXi appliances and Q-Cloud Protect instances. This VPN tunnel consists of the following: Virtual private gateway Allows communication to and from the Q-Cloud Protect instances within the VPC. Configuration Tasks a. Create a virtual private gateway. b. Attach the virtual private gateway to the VPC. Need detailed instructions? Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 20

31 Chapter 2: VPC-Private Network Connections Creating a VPC-Hardware VPN Access Connection See Customer gateway Allows communication to and from the on-site DXi appliances. Configuration Tasks a. Select a device or application to use as your customer gateway. For a list of AWS tested devices and appliances, see b. Create the customer gateway by entering the device's information in AWS. See c. Associate this gateway with the VPN Connection. See Need more information? See VPN connection Create a VPN connection between the virtual private gateway and the customer gateway. Need detailed instructions? See Step 7: Configure a Security Group A security group is a virtual firewall that you can create to control traffic to and from your instance within the VPC. Configure a security group to meet your company's security requirements. Configuration Tasks a. Create a VPC security group. b. Configure access rules. For a list of recommended security group rules, see Recommended Security Group Rules on page 23. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 21

32 Chapter 2: VPC-Private Network Connections Creating a VPC-Hardware VPN Access Connection Need detailed instruction? See Step 8: Configure a DHCP Options Set Configure a Dynamic Host Configuration Protocol (DHCP) options set to attach to your VPC. DHCP options provide configuration parameters, such as domain name and domain name servers (DNS), to your Q-Cloud Protect instance. Your instance requires these parameters to access DNS while communicating with your on-site DXi appliances. Configuration Tasks a. Create a DHCP options set with a specified domain name and DNS server. b. Associate the DCHP options with your VPC to provide the options to your instance. Need detailed instructions? See Step 9: Create IAM Policies and Roles Note: Although AWS Identity and Access Management (IAM) policies and roles are not part of the VPC-Hardware VPN Access connection, we recommend that you configure these policies and roles at the same time that you set up your VPC network infrastructure. AWS Identity and Access Management (IAM) roles and policies grant permissions to different users or applications within AWS. You will need to create the following IAM role and policy to use with Q-Cloud Protect. Configuration Tasks Create an IAM role to grant the instance permission to manage S3 objects and EBS snapshots. For AWS Marketplace and GovCloud only, create an IAM policy to grant non-administrator users permission to launch an EC2 instance. Need detailed instructions See Creating an IAM Role for Instances on page 26 and Creating IAM Policies for Non-Administrator Users and Groups on page 30. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 22

33 Chapter 2: VPC-Private Network Connections Recommended Security Group Rules Recommended Security Group Rules When creating your Virtual Private Cloud (VPC), you will need to configure a security group for it. Include the following rules in the VPC's security group. Inbound SSH Access Create a rule to allow SecureShell (SSH) access to the instance from your IP address. Populate the table as follows: Type Protocol Port Range Source IP Address SSH tcp 22 Custom IP Enter the IP address or IP CIDR range from which to allow SSH access. Inbound HTTP Access Create a rule to allow HTTP connections to the instance. Populate the table as follows: Type Protocol Port Range Source IP Address HTTP tcp 80 Custom IP Enter the IP address of the website from which to allow HTTP access. Inbound HTTPS Access Create a rule to allow HTTPS connections to the instance. Populate the table as follows: Type Protocol Port Range Source IP Address HTTPS tcp 443 Custom IP Enter the IP address of the website from which to allow HTTPS access. Inbound Replication Access Create a rule to allow access to the instance from the on-site DXi. Populate the table as follows: Type Protocol Port Range Source IP Address Custom TCP Rule tcp 1062 Custom IP Enter the IP address of the on-site DXi. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 23

34 Chapter 2: VPC-Private Network Connections IAM Roles and Users Inbound OST Access Create a rule to allow access to the instance from the OpenStorage Technology (OST) server. Populate the table as follows: Type Protocol Port Range Source IP Address Custom TCP Rule tcp 3095 and Custom IP Enter the IP address of the OST server. Outbound S3 Access If your security group restricts outbound traffic, create a rule to allow the instance to communicate with your S3 buckets. Populate the table as follows: Type Protocol Port Range Destination HTTPS tcp 443 Enter the prefix list ID for the S3 endpoint service: com.amazon.<aws_region>.s3 Outbound SMTP Access If your security group restricts outbound traffic, create a rule to allow the instance to communicate with your SMTP server in order to send alerts. Populate the table as follows: Type Protocol Port Range Destination Custom TCP Rule tcp 25 Custom IP: IP address of the SMTP server. IAM Roles and Users AWS Identity and Access Management (IAM) provides access control for your AWS resources. Q-Cloud Protect uses IAM as follows: IAM roles to grant the EC2 instance permission to manage S3 objects and EBS snapshots For AWS Marketplace and GovCloud only: IAM users/groups to grant non-administrator users/groups permission to launch a Q-Cloud Protect EC2 instance For more information about IAM, see Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 24

35 Chapter 2: VPC-Private Network Connections IAM Roles and Users Steps To define access control for a IAM role or an IAM user/group, you need to take the following steps: a. Create IAM policies that define what the entity is allowed to do with your AWS resources. b. Assign the policies to the role or user/group. ARNs When creating an IAM policy, you can assign it an Amazon Resource Name (ARN). ARNs specify the resource for the policy, such as the instances to which to grant S3 management permissions or IAM role permissions to pass to users. ARNs consist of the following fields: Field Partition Description The partition, such as AWS Marketplace, Gov Cloud, or C2S, in which the resource is located. Service The service being called by the policy, such as IAM or S3. Region Account Resource The region in which the resource resides, such as US West. The ID of the account to which the resource belongs. The resource being specified for the policy. This field varies in format and content depending on the purpose of the policy. ARN Example arn:aws:s3:::qcp-*, arn:aws:s3:::qcp-*/* partition The resource is located in AWS. service The policy is calling the S3 service. region A region is not defined for the resource. account An account is not defined for the resource. resource The resources being specified - and given permissions to manage buckets within S3 are Q-Cloud Protect instances. The content of an ARN varies depending on the purpose of the policy. The only required information is an asterisk (*), which provides open access to the policy. In the following topics, we provide suggestions for policy ARNs. We recommend that you create an ARN that fits your unique requirements. For detailed information about ARNs, see Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 25

36 Chapter 2: VPC-Private Network Connections IAM Roles and Users Topics For detailed instructions on creating the necessary IAM role and policies, see the following topics: Creating an IAM Role for Instances below Creating IAM Policies for Non-Administrator Users and Groups on page 30 Creating an IAM Role for Instances Create an IAM role to grant your Q-Cloud Protect EC2 instance permission to manage S3 objects and EBS snapshots. Steps to Create IAM Role To create an IAM role, do the following: a. Create an IAM policy with statements for both your EC2 and S3 environments. b. Create the IAM role to which to assign the IAM policy. Note: You can create IAM roles either before launching an instance or during the launch process. Create an IAM policy 1. From the IAM Management Console, select Policies to display the IAM Policy Dashboard. 2. Click Create Policy to display Step 1: Create Policy. 3. Click Select next to the Policy Generator option to display Step 2: Set Permissions. 4. Create the EC2 statement to add to the policy. EC2 statement a. In the Effect field, select Allow to enable permissions in the policy. b. From the AWS Service drop-down list, select Amazon EC2. c. From the Actions drop-down list, select the 12 actions required for the statement. AttachVolume CreateTags DeleteSnapshot CreateSnapshot CreateVolume DeleteVolume Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 26

37 Chapter 2: VPC-Private Network Connections IAM Roles and Users DescribeInstanceAttribute DescribeSnapshots DescribeVolumes DescribeSnapshotAttribute DescribeVolumeStatus DetachVolume d. In the Amazon Resource Name (ARN) field, enter an asterisk (*) to have AWS assign the ARN. For more information about ARNs, see IAM Roles and Users on page 24. e. Click Add Statement to add the EC2 statement to the policy. 5. Create the S3 statement to add to the policy. S3 statement a. In the Effect field, select Allow to enable permissions in the policy. b. From the AWS Service drop-down list, select Amazon S3. c. From the Actions drop-down list, select the 7 actions required for the statement. CreateBucket GetBucketTagging ListBucket DeleteObject GetObject PutBucketTagging PutObject d. In the Amazon Resource Name (ARN) field, enter one of the following: An asterisk (*) to have AWS assign the ARN An ARN that fits your unique requirements Note: For more information about ARNs, see IAM Roles and Users on page 24. e. Click Add Statement to add the S3 statement to the policy. 6. Click Next Step to display Step 3: Review Policy. 7. Populate the Policy Name and Description fields for the policy. 8. Review the Policy Document to make sure that the correct permissions are set. Example AWS Marketplace Policy Document "Version": " ", "Statement": [ { "Sid": "Stmtxxxxxxxxxxxxx", Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 27

38 Chapter 2: VPC-Private Network Connections IAM Roles and Users }, { ] } } "Effect": "Allow", "Action": [ "ec2:attachvolume", "ec2:createsnapshot", "ec2:createtags", "ec2:createvolume", "ec2:deletesnapshot", "ec2:deletevolume", "ec2:describeinstanceattribute", "ec2:describesnapshotattribute", "ec2:describesnapshots", "ec2:describevolumestatus", "ec2:describevolumes", "ec2:detachvolume" ], "Resource": [ "*" ] "Sid": "Stmtxxxxxxxxxxxx", "Effect": "Allow", "Action": [ "s3:createbucket", "s3:deleteobject", "s3:getbuckettagging", "s3:getobject", "s3:listbucket", "s3:putbuckettagging", "s3:putobject" ], "Resource": [ "arn:aws:s3:::qcp-*", "arn:aws:s3:::qcp-*/*" ] 9. Click Create Policy to add the new policy to the IAM Policy Dashboard. Create an IAM role 1. From the IAM Management Console, select Roles to display the IAM Roles dashboard. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 28

39 Chapter 2: VPC-Private Network Connections IAM Roles and Users You can also access this page from Step 3: Configure Instance Details of the Launch Instance Wizard. Figure 5: Step 3: Configure Instance Details 2. Click Create New Role to access the Create Role Wizard. 3. In Step 1: Set Role Name, assign a name to the new IAM role, and click Next Step. You will use this IAM role name if you need to create an IAM policy for non-administrator users. See Creating IAM Policies for Non-Administrator Users and Groups on the next page. 4. In Step 2: Select Role Type, click Select next to the Amazon EC2 option and to display the Step 4: Attach Policy page. 5. From the Filter > Policy Type drop-down, select Customer Managed Polices to limit the display to policies you have created. 6. Select the IAM policy created in the previous task, and click Next to display the Step 5: Review page. 7. Click Create Role to create the IAM role to attach to your instance. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 29

40 Chapter 2: VPC-Private Network Connections IAM Roles and Users Creating IAM Policies for Non-Administrator Users and Groups For AWS Marketplace and GovCloud only, you will need to create an IAM policy to grant authorization to launch a Q-Cloud Protect EC2 instance for non-administrator users or groups. This authorization, which is assigned through the PassRole permission, allows the user or group to assign the required IAM role to the instance during launch, even if the role has more permissions than the user or group. Additional Resources For more information about the instance's required IAM role, see Creating an IAM Role for Instances on page 26. For more information about the PassRole permission, see EC2-Instances-with-IAM-Roles-PassRole-Permission. For more information about creating IAM users or groups, see Steps to Assign PassRole Permissions To assign the PassRole permission to users or groups, do the following: a. Create an IAM role to grant the EC2 instance permission to manage S3 objects and EBS snapshots. See Creating an IAM Role for Instances on page 26. b. Create an IAM policy with the PassRole permission. c. Assign the IAM policy to the appropriate user or group. Create an IAM policy 1. From the IAM Management Console, select Policies to display the IAM Policy Dashboard. 2. Click Create Policy to display Step 1: Create Policy. 3. Click Select next to the Policy Generator option to display Step 2: Set Permissions. 4. In the Effect field, select Allow to enable permissions in the policy. 5. From the AWS Service drop-down list, select AWS Identity and Access Management. 6. From the Actions drop-down list, select PassRole. 7. In the Amazon Resource Name (ARN) field, enter one of the following: AWS Marketplace arn:aws:iam::<account_number>:role/<ec2_instance_iam_role_name> Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 30

41 Chapter 2: VPC-Private Network Connections IAM Roles and Users For information about ARNs, see IAM Roles and Users on page Click Add Statement to add the EC2 statement to the policy. 9. Click Next Step to display Step 3: Review Policy. 10. Populate the Policy Name and Description fields for the policy. 11. Review the Policy Document to make sure that the correct permissions are set. Example AWS Marketplace Policy Document "Version": " ", "Statement": [ { "Sid": "Stmtxxxxxxxxxxxxx", "Effect": "Allow", "Action": [ "iam:passrole", ], "Resource": [ "arn:aws:iam::<account_number>:role/<ec2_instance_iam_role_name>", ] } ] } 12. Click Create Policy to add the new policy to the IAM Policy Dashboard. Assign the IAM Policy to a User 1. From the IAM Management Console, select Policies to display the IAM Policy Dashboard. 2. From the menu, select Users to display the Users console. 3. Click on the user name to display Summary page for that user. 4. Click the Permissions tab, and then click Attach Policy to display the Attach Policy page. 5. From the Filter > Policy Type drop-down, select Customer Managed Polices to limit the display to policies you have created. 6. Select the policy that you created in the previous task, and click Attach Policy to assign the PassRole permission to the user. Assign the IAM Policy to a Group 1. From the IAM Management Console, select Policies to display the IAM Policy Dashboard. 2. From the menu, select Groups to display the Groups console. 3. Click on the group name to display the Summary page for that group. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 31

42 Chapter 2: VPC-Private Network Connections IAM Roles and Users 4. Click the Permissions tab, and then click Attach Policy to display the Attach Policy page. 5. From the Filter > Policy Type drop-down, select Customer Managed Polices to limit the display to policies you have created. 6. Select the policy that you created in the previous task, and click Attach Policy to assign the PassRole permission to the group. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 32

43 Chapter 3: Launch This chapter contains the following topics: Launch 33 Task Overview: Launch Instances from AWS Marketplace 36 Step 3: Configure Instance Details 42 Step 4: Add Storage 45 Step 5: Tag Instance 48 Step 6: Configure Security Group 49 Step 7: Review and Launch 51 Launch An Amazon Machine Image (AMI) is a snapshot of a system that users can deploy as a new EC2 instance. Quantum offers different Q-Cloud Protect AMIs from which to select, varying in storage capacity. To select the best Q-Cloud Protect AMI for your situation, make sure you know your storage needs ahead of time. After selecting a Q-Cloud Protect AMI, you can launch the EC2 instance the unique virtual machine image of the AMI from which to deploy the Q-Cloud Protect appliance. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 33

44 Chapter 3: Launch During launch, you will need to manually configure settings for the instance, such as selecting an instance type, assigning network and security settings, and configuring storage. Review the following sections to gain a better understanding of these settings. Prerequisites Before launching your Q-Cloud Protect instance, you must perform the following prerequisite tasks. For a checklist of prerequisite tasks, see Pre-Launch Checklists on page 5. Create a VPC-private network connection to provide durability and security to your instance. See Creating a VPC-Hardware VPN Access Connection on page 18. Configure a security group to control traffic to and from your instance within the VPC. See Recommended Security Group Rules on page 23. Create an IAM role to grant your instance permission to manage S3 objects and EBS snapshots. See Creating an IAM Role for Instances on page 26. Determine storage requirements to correctly size your AMI and EBS volume. See Calculating Storage Needs on page 10. From AWS Marketplace Important Although AWS Marketplace provides a 1-Click Launch option, you must use the Manual Launch process to correctly configure all settings for Q-Cloud Protect. When you purchase a Q-Cloud Protect metered AMI, its maximum storage capacity is predefined. You will be able to use up to the specified amount of storage allocated to the launched instance. Q-Cloud Protect offers two sizes of metered AMIs: 1-20 TB of storage capacity 1-90 TB of storage capacity How You Are Charged You pay for the following with a metered AMI: The AWS resources consumed by the instance, such as EBS storage, S3 storage, and EC2 usage. The hourly usage of the launched instances To keep costs down, we recommend configuring your instances with the minimum required amount of storage capacity for near-term replication and mid-term growth. For more information about launching and configuring EC2 instances from metered AMIs, see Task Overview: Launch Instances from AWS Marketplace on page 36. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 34

45 Chapter 3: Launch Generating a Serial Number When you deploy Q-Cloud Protect from a metered AMI, the Q-Cloud Protect appliance generates a unique serial number, which is displayed on the System Overview page of the cloud appliance's web console. The serial number is used to identify your Q-Cloud Protect appliance, such as when you register the appliance with Quantum Service and Support. See Step 3: Register the Cloud Appliance on page 60. In addition, the serial number is used to name the S3 bucket in which the cloud appliance's data is protected. See S3, EBS Volumes, and Snapshots on page 83. Instance Types When you launch your Q-Cloud Protect instance, you need to select the appropriate instance type based on your selected AMI. The following instance types are available for Q-Cloud Protect. m3.xlarge or m4.xlarge Select one of these instance types for Q-Cloud ProtectAMIs with 1 TB to 20 TB of storage capacity. Instance Type # of vcpus Memory Available Instance Storage Volumes Network Performance m3.xlarge 4 15 GiB 2 x 40 (SSD) High with EBS optimization m4.xlarge 4 16 GiB EBS only High with EBS optimization m3.2xlarge or m4.2xlarge Select one of these instance types for Q-Cloud ProtectAMIs with 1 TB to 90 TB of storage capacity. Instance Type # of vcpus Memory Available Instance Storage Volumes Network Performance m3.2xlarge 8 30 GiB 2 x 40 (SSD) High with EBS optimization m4.2xlarge 8 32 GiB EBS only High with EBS optimization Additional Information For an outline of the instance launch process, see the following: Task Overview: Launch Instances from AWS Marketplace on the next page Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 35

46 Chapter 3: Launch Task Overview: Launch Instances from AWS Marketplace For more information about AMIs and EC2 instances, see the following: Task Overview: Launch Instances from AWS Marketplace The following task provides an overview of the steps you will take to launch your Q-Cloud Protect instance. For detailed instructions, click on the step's corresponding link. Task Outline: Launch an Instance 1. From the AWS Marketplace, search for Q-Cloud Protect, select the Q-Cloud Protect AMI based on your storage needs, and manually launch the AMI. See Steps 1 and 2: Select an AMI and Instance Type on the next page. Important Although AWS Marketplace provides a 1-Click Launch option, you must use the Manual Launch process to correctly configure all settings for Q-Cloud Protect. 2. On the Step 2: Choose an Instance Type page, select the appropriate instance type based on your selected AMI and storage capacity needs. See Steps 1 and 2: Select an AMI and Instance Type on the next page. 3. Click Next: Configure Instance Details to assign a network configuration to the instance. See Step 3: Configure Instance Details on page Click the Next: Add Storage button to configure storage for your instance. See Step 4: Add Storage on page Click the Next: Tag Instance button to create tags for your instance. See Step 5: Tag Instance on page Click Next: Configure Security Group to assign a security group to your instance. See Step 6: Configure Security Group on page Click Review and Launch to review configuration settings. See Step 7: Review and Launch on page 51. As part of the launch process, you will need to assign a key pair to the instance. See Assigning Key Pairs on page Click Launch Instances to launch your instance. See Step 7: Review and Launch on page 51. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 36

47 Chapter 3: Launch Task Overview: Launch Instances from AWS Marketplace Steps 1 and 2: Select an AMI and Instance Type To begin the instance launch process, you must select a Q-Cloud Protect Amazon Machine Image (AMI) on the AWS Marketplace. Quantum offers two sizes of the Q-Cloud Protect AMI. Select the size that best meets your minimum storage requirements. AMI Type Q-Cloud Protect 1 TB to 20 TB of storage capacity Q-Cloud Protect 1 TB to 90 TB of storage capacity Instance Type m3.xlarge or m4.xlarge m3.2xlarge or m4.2xlarge Initiate Software Launch After selecting the AMI, you will need to do the following to initiate the Launch process: a. Select a subscription type. b. Accept product terms. c. Manually launch the AMI. d. Select the appropriate instance type based on your selected AMI. Steps 1 and 2: Select an AMI and Instance Type 1. From the AWS Marketplace, select the appropriate Q-Cloud Protect AMI to display the Q-Cloud Protect product page. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 37

48 Chapter 3: Launch Task Overview: Launch Instances from AWS Marketplace Figure 6: Q-Cloud Protect Product Page 2. After reviewing the information regarding the AMI's specifications, click Continue to display the Launch on EC2 page. 3. Select the Manual Launch tab. Important Although AWS Marketplace provides a 1-Click Launch option, you must use the Manual Launch process to correctly configure all settings for Q-Cloud Protect. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 38

49 Chapter 3: Launch Task Overview: Launch Instances from AWS Marketplace Figure 7: Manual Launch Tab Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 39

50 Chapter 3: Launch Task Overview: Launch Instances from AWS Marketplace 4. In the Software Pricing section, select the desired Subscription Term, either Hourly or Annual. Figure 8: Software Pricing Section 5. In the Price for your selections section, review the End User License Agreement and AWS Customer Agreement, and then click Accept Terms. Figure 9: Price for your selections Section The AWS Marketplace Team sends you an confirming your subscription to Q-Cloud Protect, which you will need before launching the product. 6. From the AWS Marketplace Team , click the details needed to launch Q-Cloud Protect link to display the Your Software Subscriptions page. Figure 10: Your Software Subscriptions Page 7. Click Launch More Software to display the Q-Cloud Protect product page. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 40

51 Chapter 3: Launch Task Overview: Launch Instances from AWS Marketplace 8. Select the Manual Launch tab, and click Launch with EC2 Console for the appropriate region. Figure 11: Launch with EC2 Console The Step 2: Choose an Instance Type page displays. 9. Select the appropriate instance type based on your selected AMI and storage capacity needs. Figure 12: Step 2: Choose an Instance Type Page 10. Click Next: Configure Instance Details to assign a network to the instance. See Step 3: Configure Instance Details on the next page. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 41

52 Chapter 3: Launch Step 3: Configure Instance Details Step 3: Configure Instance Details On Step 3: Configure Instance Details of the Launch Instance Wizard, assign your Q-Cloud Protect instance the network configuration settings identified in the task below. You can configure additional permissions and purchasing options for the instance at your discretion. Important You must assign the following network settings for your instance: For security purposes, you must use a VPC-Private network configuration. For more information, see VPC-Private Network Connections on page 15. To grant S3 and EC2 permissions to your instance, you must assign an IAM role. For more information, see Creating an IAM Role for Instances on page 26. Step 3: Configure Instance Details 1. From the Launch Instance Wizard, display Step 3: Configure Instance Details. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 42

53 Chapter 3: Launch Step 3: Configure Instance Details Figure 13: Step 3: Configure Instance Details Page 2. In the Number of Instances field, enter In the Purchasing Option field, make sure the Request Spot Instances check box is not selected. Important Q-Cloud Protect requires a persistent instance, and spot instances could be interrupted while running. 4. In the Network field, select the appropriate pre-configured VPC-Private network set up for your AWS account. If you are unsure about which network to select, ask the network administrator who configured your VPC-private network connection. If you need to create a VPC-Private network, click Create new VPC. See Creating a VPC- Hardware VPN Access Connection on page 18. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 43

54 Chapter 3: Launch Step 3: Configure Instance Details 5. In the Subnet field, verify that the subnet configured for the VPC is selected. If you are unsure about which subnet to select, ask the network administrator who configured your VPC-private network connection. If you need to create a subnet for the VPC, click Create new subnet. See Creating a VPC- Hardware VPN Access Connection on page In the Auto-assign Public IP field, select Use subnet setting (Enable) to assign public IP addresses, which have been defined for the subnet, to the instance. You must enable this setting for your instance to communicate with S3. 7. In the IAM role field, select the appropriate IAM role to grant snapshot and S3 permissions to your instance. If you do not know whether an IAM role has been created, ask the network administrator who configured your VPC-private network connection. If you need to create an IAM role to grant your Q-Cloud Protect instance correct permissions, click Create new IAM role. See IAM Roles and Users on page In the Shutdown behavior field, select Stop to turn your instance off when it is shut down. Important Do not select Terminate. The Terminate option deletes the instance when it is shut down, although all Elastic Block Storage (EBS) volumes attached to the instance continue to persist. 9. In the Enable termination protection field, select the Protect against accidental termination check box to protect against inadvertently terminating the instance. 10. Configure other network settings, as desired. Keep in mind that you will be charged additionally for the Monitoring and Tenancy settings. Warning Message If you receive the Changed Network Settings warning, verify that your settings are correct and then select Yes, I want to continue with this change. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 44

55 Chapter 3: Launch Step 4: Add Storage Figure 14: Changed Network Settings Warning 11. Click Next: Add Storage to proceed to the next step. See Step 4: Add Storage below Step 4: Add Storage Q-Cloud Protect AMIs include pre-configured storage to meet minimum operation requirements. You can configure additional storage for an instance on Step 4: Add Storage of the Launch Instance Wizard by increasing the amount of storage allocated to the EBS volume. From this page, you can also review the instance's current storage configuration. Figure 15: Step 4: Add Storage Page Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 45

56 Chapter 3: Launch Step 4: Add Storage * Although the Step 4: Add Storage page states that you can attach additional EBS volumes to your instance and edit the root volume, we strongly recommend against doing so. See Storage Recommendations below for more information. Storage Recommendations The following information provides our recommendations for configuring additional storage for your Q- Cloud Protect instance. GB versus GiB Although the Q-Cloud Protect appliance reports measurements in units of MB, GB, and TB, AWS reports measurements in units of MiB, GiB, and TiB. When calculating the EBS volume's storage capacity, you will need to convert measurements between the cloud appliance and AWS interfaces, as appropriate. To convert GB to GiB, multiply by.93. GB x.93 = GiB All Volumes Do not select the Delete on Termination option. By making sure not to select this option, the volumes will persist if the instance is inadvertently terminated. You can then use the persisting volumes to relaunch the instance. Root Volume The static root volume is pre-configured with 320 GiB of Magnetic storage, which contains OS and initial configuration data for the instance. This data does not affect the deduplication storage pool. We recommend against changing the size or type of the root volume. The root volume does not require any additional storage beyond the amount that has been pre-configured for it. Data (EBS) Volumes The data volume is pre-configured with 256 GiBof General Purpose (SSD) for its base configuration. We recommend configuring enough additional storage to accommodate data being replicated to the cloud appliance in the short term plus additional storage capacity for future growth. See Calculate EBS Volume Requirements on page 13. When you configure additional storage, do not add a new EBS volume. Instead, add the storage to the existing EBS volume. In addition, we recommend against changing the type of EBS volume. Step 4: Add Storage Depending on your storage needs, perform one or both of the following tasks. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 46

57 Chapter 3: Launch Step 4: Add Storage Add storage 1. From the Launch Instance Wizard, display Step 4: Add Storage. 2. In the Size (GiB) field for the existing EBS volume, increase the amount of storage, as appropriate. See Calculating Storage Needs on page Click Next: Tag Instance to proceed to the next step. See Step 5: Tag Instance on the next page. Review configured storage 1. From the Launch Instance Wizard, display Step 4: Add Storage. 2. Review the following information about the currently configured storage: Column Type Device Description The type of volume, either Root or EBS. The device name assigned to the volume. Root volume device name: /dev/sda1 EBS volume device name: /dev/sdb Snapshot Size (GiB) Volume Type The ID of the EBS snapshot of the volume. See S3, EBS Volumes, and Snapshots on page 83. The currently configured storage size of the volume. The pre-assigned volume type: Magnetic type for the Root volume General Purpose (SSD) type for the EBS volume We do not recommend changing the volume type. IOPS Delete on Termination Encrypted The requested number of I/O operations per second that the volume can support. Do not select this option. By making sure not to select this option, the volumes will persist if the instance is inadvertently terminated. You can then use the persisting volumes to relaunch the instance. The encryption setting for the volume. 3. Click Next: Tag Instance to proceed to the next step. See Step 5: Tag Instance on the next page. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 47

58 Chapter 3: Launch Step 5: Tag Instance Step 5: Tag Instance You can create tags to help identify an instance, such as providing the instance with an easily identifiable name. Use Step 5: Tag Instance of the Launch Instance Wizard to create instance tags. Figure 16: Step 5: Tag Instance Page Step 5: Tag Instance 1. From the Launch Instance Wizard, display Step 5: Tag Instance. 2. Click Create Tag to add a row to the Instance Tags table. 3. For each tag, enter the following: Key Use the key to identify the type of tag, such as Name. Value Enter a value to assign to each key, such as Q-Cloud Protect- 1 for the Name key. 4. Click Next: Configure Security Group to proceed to the next step. See Step 6: Configure Security Group on the next page. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 48

59 Chapter 3: Launch Step 6: Configure Security Group Step 6: Configure Security Group A security group is analogous to a virtual firewall that you can use to control traffic to and from your instances. You need to assign a security group to allow the replication sources access to the Q-Cloud Protect instance in your VPC. Use Step 6: Configure Security Group from the Launch Instance Wizard to assign a security group to the instance being launched. If you need to configure a new security group to assign to the instance, you can do so from this page, as well. For information about security group recommendations, see Recommended Security Group Rules on page 23. Important We recommend using the security group configured for your VPC-private network connection. If you do not know which security group to select, ask your network administrator who configured the network connection. Figure 17: Step 6: Configure Security Group Page Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 49

60 Chapter 3: Launch Step 6: Configure Security Group Step 6: Configure Security Group Depending on whether a security group has been configured, perform one of the following tasks. Boot from General Purpose (SSD) Dialog Box Before proceeding to Step 7: Review Instance Launch, the Launch Instance Wizard will display the following dialog box: Figure 18: Boot from General Purpose (SSD) Dialog Box We recommend selecting Continue with Magnetic as the boot volume for this instance to avoid unnecessary costs. For more information about volume type, see Step 4: Add Storage on page 45 Assign a security group 1. From the Launch Instance Wizard, display Step 6: Configure Security Group. 2. In the Assign a security group field, select the Select an existing security group option to display available security groups. 3. Select the security group configured for your VPC-private network connection. 4. Click the Review and Launch button to proceed in launching the instance. See Step 7: Review and Launch on the next page. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 50

61 Chapter 3: Launch Step 7: Review and Launch Configure a security group 1. From the Launch Instance Wizard, display Step 6: Configure Security Group. 2. In the Assign a security group field, select the Create a new security group option. 3. In the Security group name field, enter a name for the new security group. 4. In the Description field, enter a description to help identify the security group. 5. For each new rule to add to the security group, click the Add Rule button. A new row is added to the Security Group table. Figure 19: Security Group Table 6. Create the necessary rules for the security group. 7. Click the Review and Launch button to proceed in launching the instance. See Step 7: Review and Launch below. Step 7: Review and Launch After assigning a security group to instance, you can review all configuration settings and launch the instance. As part of this last step, you will need to assign a key pair to the instance. For detailed instructions, see Assigning Key Pairs on the next page. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 51

62 Chapter 3: Launch Step 7: Review and Launch Step 7: Review and launch your instance 1. From the Launch Instance Wizard, display Step 7: Review Instance Launch. Figure 20: Step 7: Review Instance Launch Page 2. Review the settings defined for the new instance, and make any necessary adjustments by using the Previous button (optional). 3. When you are ready to launch the instance, click the Launch button to display the Key Pair dialog box. 4. Assign a key pair to your instance. See Assigning Key Pairs below. 5. Click Launch Instances to launch your instance and display the Launch Status page. 6. In the Your instances are now launching section, make note of the assigned instance ID, which you can use to locate your instance on the Instances Dashboard. 7. Click View Instances to display the Instances Dashboard. When the instance is in a running state, you can deploy your Q-Cloud Protect appliance. See Deploy on page 56. Assigning Key Pairs Before launching an instance, you need to assign a key pair to it. You will use the key pair to securely access your instance through SecureShell (SSH) using the ServiceLogin account. The public key is stored on AWS, and the private key is downloaded to your system as a.pem file. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 52

63 Chapter 3: Launch Step 7: Review and Launch You can select to have AWS automatically generate a key pair during instance launch or you can import a key pair generated on your terminal. Use the following tasks to assign key pairs to your instances. Generate key pairs during instance launch 1. From the Launch Instance Wizard, display the Key Pair dialog box. Figure 21: Key Pair Dialog Box Create a New Key Pair 2. From the first drop-down list, select Create a new key pair. 3. In the Key pair name field, enter a name to use in identifying the key pair. 4. Click the Download Key Pair button. AWS downloads the private key to your system and saves the public key in its system. Important Make sure you save the private key file for future reference. You will not be able to download it at a later time, and you must enter the private key to securely access your instance through SSH. 5. Click the Launch Instances button to launch the instance. See Step 7: Review and Launch on page 51. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 53

64 Chapter 3: Launch Step 7: Review and Launch Import a key pair from your terminal 1. From the Key Pairs dashboard, select Import Key Pair to display the Import Key Pair dialog box. Figure 22: Import Key Pair Dialog Box 2. Click Choose File and navigate to the location in which the generated key pair resides. 3. Select the key pair to populate the dialog box with the public key contents. 4. In the Key pair name field, assign a name to the key pair. 5. Click Import to import the key pair to your AWS account. Important Make sure you save the key pair for future reference. You will not be able to download it at a later time, and you must enter the private key to securely access your instance through SSH. Assign an existing key pair 1. From the Launch Instance Wizard, display the Key Pair dialog box. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 54

65 Chapter 3: Launch Step 7: Review and Launch Figure 23: Key Pair Dialog Box Assign Existing Key Pair 2. From the first drop-down list, select Choose an existing key pair. 3. From the Select a key pair drop-down list, select the key pair to assign to the instance. 4. Click the I acknowledge that I have access to the selected private key file check box. Important Make sure you save the private key file for future reference. You must enter the private key to securely access your instance through SSH. 5. Click the Launch Instances button to launch the instance. See Step 7: Review and Launch on page 51. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 55

66 Chapter 4: Deploy This chapter contains the following topics: Deploy 56 AWS Marketplace Deployment Workflow 57 Configuring Access Control 67 Deploy After launching your instance, you can deploy the Q-Cloud Protect appliance from a supported browser. Important When your Q-Cloud Protect appliance has been deployed and is running at a steady state, do not stop its EC2 instance. You must keep the instance running at all times for storage space to be properly reclaimed on the cloud appliance. Note: This guide provides instructions for completing the Q-Cloud Protect Getting Started Wizard, Support Wizard, and Access Control Settings. For help with other configuration tasks, such as configuring notifications, please see the Q-Cloud Protect User's Guide. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 56

67 Chapter 4: Deploy AWS Marketplace Deployment Workflow AWS Marketplace Deployment Workflow When you deploy your cloud appliance, you will need to take the following steps to activate and register the product. Step 1: Log In As the first step in deploying the cloud appliance, you must log in to its virtual console using the Administrator user account, which is enabled by default upon deployment. Use the instance's ID as the initial Administrator user's password. Access the Q-Cloud Protect virtual console using a Web browser on a workstation that exists within the VPC-network configured for your Q-Cloud Protect appliance. For detailed instructions, see Step 1: Log In to the Cloud Appliance on the next page. Step 2: Get Started After logging in to the cloud appliance, you will need to complete the Getting Started Wizard. Through this process, you will review and accept the product's license agreement, as well as set the new Administrator user's password. For detailed instructions, see Step 2: Complete the Getting Started Wizard on page 60. Step 3: Register the Appliance for Service and Support To receive service and support from Quantum, you will need to register your cloud appliance. For detailed instructions, see Step 3: Register the Cloud Appliance on page 60. Step 4: Generate the System Diagnostics File Generate a system diagnostics file, which contains the diagnostic logs for all cloud appliance components. You can use this file as a future comparison to troubleshoot issues that may occur with your cloud appliance. For detailed instructions, see Step 4: Generate the System Diagnostics File on page 65. Step 6: Review Storage Capacity On the Home page, you can review the amount of capacity allocated to your appliance. For detailed instructions, see Step 6: Review Capacity. What's Next? Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 57

68 Chapter 4: Deploy AWS Marketplace Deployment Workflow After completing the deployment process, you can begin configuring and using your cloud appliance as a replication target for source DXi appliances and OST servers. Before configuring any other settings in your cloud appliance, we recommend that you configure the following three settings first. Configure Access Control Settings Configure access control settings to define the accounts that can access the cloud appliance through its virtual console (GUI) or SecureShell (SSH). For detailed instructions, see Configuring Access Control on page 67. Note: The Administrator GUI account and ServiceLogin SSH account are enabled by default upon deployment. Set the Cloud Appliance's Date and Time You can specify a Network Time Protocol (NTP) server with which to synchronize the system time, or you can manually enter the date and time. For detailed instructions, see the Q-Cloud Protect User's Guide. Change the Cloud Appliance's Host Name The cloud appliance's host name defaults to the instance ID. For ease of use, you can change this setting. For detailed instructions, see the Q-Cloud Protect User's Guide. For detailed information and instructions about configuring and using all features of the cloud appliance, see the Q-Cloud Protect User's Guide. Step 1: Log In to the Cloud Appliance As the first step in deploying the cloud appliance, you must log in to its virtual console using the Administrator user account, which is enabled by default upon deployment. Use the instance's ID as the initial Administrator user's password. Access the Q-Cloud Protect virtual console using a Web browser on a workstation that exists within the VPC-network configured for your Q-Cloud Protect appliance. Supported Browsers The Q-Cloud Protect virtual console supports the following Web browsers: Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 58

69 Chapter 4: Deploy AWS Marketplace Deployment Workflow Mozilla Firefox 17 or later Google Chrome 21 or later Microsoft Internet Explorer 9, 10, or 11 Log In to the Q-Cloud Protect Virtual Console 1. From the Instances Dashboard, select the Q-Cloud Protect instance to deploy and locate its private IP address listed on the Description tab. Figure 24: Instances Dashboard Private IP Address Location 2. In a supported browser, enter to access the Q-Cloud ProtectLogin page. 3. Log in to the appliance. a. In the Login Type field, select Administrator. b. In the Password field, enter the instance's ID, which you can find on the Instances Dashboard. 4. Click the Login button to display Getting Started Wizard. See Step 2: Complete the Getting Started Wizard on the next page. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 59

70 Chapter 4: Deploy AWS Marketplace Deployment Workflow If the Login window does not display Verify that your Q-Cloud Protect instance is running in the EC2 console. Verify that the IP address is correct and that the network path to the cloud appliance is valid. Verify that you are using a supported Web browser. If the appliance is first booting up or rebooting, wait 15 minutes before trying to access the Login window. If you are still unable to access the Login window, contact your administrator. Step 2: Complete the Getting Started Wizard The first time that you log in to the cloud appliance, you will need to walk through the Getting Started Wizard. Through this process, you will review and accept the appliance's license agreement, as well as set the Administrator user's password. Complete the Getting Started Wizard 1. Log in to the cloud appliance to display Getting Started Wizard. See Step 1: Log In to the Cloud Appliance on page Click the Next button to display the Wizard's License Agreement page. 3. Select the I have read and accept this License Agreement check box, and click Next to display the Wizard's Access Control page. 4. Set the new Administrator user's password required for accessing the cloud appliance's virtual console. a. In the Old Password field, enter the Instance ID. b. In the New Password field, enter a new password for the Administrator user. c. In the Confirm New Password field, re-enter the new password. 5. Click Next to display the Wizard's Confirm Settings page. 6. Click Show Password to confirm that the new password is correct. 7. Click Finish to save your settings and display the Wizard's Confirm page. 8. Click Ok to display the Configuration Wizard Home page. 9. Register your cloud appliance. See Step 3: Register the Cloud Appliance below. Step 3: Register the Cloud Appliance After completing the Getting Started Wizard, we recommend registering your Q-Cloud Protect appliance. You will not receive service and support from Quantum until you do so. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 60

71 Chapter 4: Deploy AWS Marketplace Deployment Workflow Prerequisite To register your cloud appliance, you will need its serial number, which you can find on the Q-Cloud Protect appliance's Registration page (see Registration Page on the next page) or Home page. Figure 25: Q-Cloud Protect Appliance Home Page Serial Number Register the cloud appliance 1. Depending on whether you can access the Internet from your cloud appliance's virtual console, do one of the following: The cloud appliance's virtual console can access the Internet a. From the Configuration Wizard Home page, click Support to display the About System Support page. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 61

72 Chapter 4: Deploy AWS Marketplace Deployment Workflow b. Click Next to display the Registration page Figure 26: Registration Page c. Click the Quantum's Product Registration link to display the Quantum Start Up Web page. The cloud appliance's virtual console cannot access the Internet From a workstation that has Internet access, open a Web browser and navigate to The Quantum Start Up Web page displays. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 62

73 Chapter 4: Deploy AWS Marketplace Deployment Workflow Figure 27: Quantum Start Up Web Page Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 63

74 Chapter 4: Deploy AWS Marketplace Deployment Workflow 2. Click Product Registration to display the Quantum Product Registration Web page. Figure 28: Quantum Product Registration Web Page 3. Enter the cloud appliance's serial number in the New Customer or Existing Customer section, as appropriate. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 64

75 Chapter 4: Deploy AWS Marketplace Deployment Workflow 4. Click Submit to display the Online Product Registration form. Figure 29: Online Product Registration Form 5. Complete the form and click Submit to register your appliance. 6. Return to the cloud appliance's virtual console, and generate a system diagnostics file to continue with the deployment process. See Step 4: Generate the System Diagnostics File below. Step 4: Generate the System Diagnostics File After registering your cloud appliance, generate a system diagnostics file. This file contains the diagnostic logs for all cloud appliance components, which you can use as a future comparison to troubleshoot issues that may occur with your cloud appliance. Generate the system diagnostics file 1. From the Configuration Wizard Home page, click Support to display the About System Support page. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 65

76 Chapter 4: Deploy AWS Marketplace Deployment Workflow 2. Click Next until the System Log page displays. Figure 30: System Log Page 3. Click Generate New to generate a new system diagnostics file. 4. After the file has been generated, click the displayed Enable Downloading link to activate the Download Current button. Figure 31: Enable Downloading Link 5. Click Download Current to download the system diagnostics file. 6. Save the file for future reference. 7. To continue the deployment process, review the cloud appliance's storage capacity. See Step 5: Review Capacity on the next page. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 66

77 Chapter 4: Deploy Configuring Access Control Step 5: Review Capacity After generating the system diagnostics file, you can review the amount of storage capacity allocated to your Q-Cloud Protect appliance. Review storage capacity 1. Display the appliance's Home page. 2. In the Licensed Usage area, review the following information to verify the appliance's storage capacity. Figure 32: License Usage Area Field Licensed Capacity Available Space Free Space Reclaimable Space Used Space Deduplicated Data Description The total amount of storage capacity allocated to your cloud appliance. The amount of storage capacity that is available for storing new data. The amount of storage capacity that is available for storing new deduplicated data. The amount of storage space that is occupied by outdated deduplicated data, and which will be automatically reused if additional space for new deduplicated data is needed. The amount of storage capacity being used to store deduplicated data. The amount of deduplicated data being stored in the cloud appliance. Configuring Access Control The Access Control Settings page allows you to define the accounts that can access the cloud appliance through its virtual console or a SecureShell (SSH) client. Keep in mind that only Administrator users can Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 67

78 Chapter 4: Deploy Configuring Access Control enable, edit, or delete access control settings. Note: The Administrator GUI account and ServiceLogin SSH account are enabled by default upon deployment of the cloud appliance. Enable GUI Account Access 1. From the Configuration menu, select Security > Access Control to display the Access Control Settings page. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 68

79 Chapter 4: Deploy Configuring Access Control Figure 33: Access Control Settings Page 2. Select the Enable account check box for the appropriate account. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 69

80 Chapter 4: Deploy Configuring Access Control 3. Enter the following information: Item New Password Confirm New Password Description Enter the new password to authenticate the account. Re-enter the password to confirm it. Additional Information When defining the account password, you can enter up to 32 characters, and use both alphanumeric and special characters. 4. Click Apply to enable to account. Enable SSH Access After deploying your Q-Cloud Protect appliance, you can immediately connect to it through a SecureShell (SSH) client using the ServiceLogin account. This account is authenticated using the key pair assigned to the instance during launch. To access your Q-Cloud Protect appliance through SecureShell (SSH) using the cliadmin or cliviewer accounts, you must enable them from the appliance's Access Control Settings page. As part of this process, you will need to access the public key from the key pair assigned to the instance during launch. Using a key pair generator, such as PuTTY Key Generator, you can load the key pair, and copy and paste the public key into the cloud appliance's GUI. Note: Only Administrator users can enable, edit, or delete access control settings. Access a key pair This task depicts key pair generation using PuTTY Key Generator, but you may use other key pair generators at your discretion. 1. From the PuTTY Key Generator window, click Load to browse to the key pair downloaded from AWS. 2. Locate and select the private key (.pem file). You may need to select All Files (*.*) from the File name drop-down list to locate the.pem file. Figure 34: File Name Drop-Down List Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 70

81 Chapter 4: Deploy Configuring Access Control 3. After the key pair is loaded, protect it by populating the Key passphrase and Confirm passphrase fields. 4. Click Save private key to save the passphrase for the key pair. You will need to enter this passphrase to access your cloud appliance through SSH. Figure 35: PuTTY Key Generator Window 5. Use the displayed public key to enable SSH accounts. Enable the cliadmin and cliviewer SSH accounts 1. From the cloud appliance's Home page, select Configuration > System > Security to display the Access Control Settings page. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 71

82 Chapter 4: Deploy Configuring Access Control Figure 36: Access Control Settings Page 2. Select the Enable account check box for either the cliadmin or cliviewer SSH account. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 72

83 Chapter 4: Deploy Configuring Access Control 3. Click Add to display the Add Public Key page. Figure 37: Add Public Key Page 4. In the Alias field, assign an alias to the SSH account. Additional Information An alias can be up to 20 characters. An alias must be an alphanumeric string (no spaces or special characters). It is OK to have the same alias for different accounts (such as QCPEast for both the cliadmin and cliviewer accounts). 5. In the Public Key field, copy and paqcpeastste the public key of the AWS key pair. Important A public key should be in the following form: <key-type> <base64 encoded string>. Enter the public key's text up to the key comment, but do not include the key comment, as shown in the following figure. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 73

84 Chapter 4: Deploy Configuring Access Control Figure 38: Key Comment A public key length can be up to 16 kilobits. 6. Click Apply to display the Successfully performed Security action message. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 74

85 Chapter 4: Deploy Configuring Access Control 7. Click Ok to add the new key to the SSH account. Figure 39: New SSH Public Key Sample 8. Select Enable account again and click Apply to enable to account. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 75

86 Chapter 5: SSH Connection This chapter contains the following topics: SSH Connect 76 Using PuTTY to Connect to the Cloud Appliance 77 Using an SSH Client to Connect to the Cloud Appliance 81 SSH Connect At times, you may need to connect to your Q-Cloud Protect appliance through a SecureShell (SSH) client, such as a scenario in which you need to install an emergency security patch to the operating system (OS) to protect against a vulnerability. After deploying your cloud appliance, you can immediately connect to it through SSH using the ServiceLogin account, which is enabled by default upon deployment. This account is authenticated using the key pair assigned to the instance during launch. To connect to the cloud appliance through SSH using the cliadmin or cliviewer accounts, you must first enable them from the appliance's virtual console. See Configuring Access Control on page 67. Note: For more information about SSH commands to use with your cloud appliance, see the DXi- Series Command Line Interface Guide. Keep in mind that not all DXi commands will apply to Q-Cloud Protect. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 76

87 Chapter 5: SSH Connection Using PuTTY to Connect to the Cloud Appliance Connection Tasks Before connecting to your cloud appliance through SSH, you must configure the SSH client. See the following topics for configuration instructions. Using PuTTY to Connect to the Cloud Appliance below Using an SSH Client to Connect to the Cloud Appliance on page 81 Using PuTTY to Connect to the Cloud Appliance You can use the PuTTY SecureShell (SSH) client to connect to your Q-Cloud Protect appliance either as an Administrator (cliadmin), Monitor (clieviewer), or Service (ServiceLogin) user. Before doing so, you must configure a PuTTY session. Prerequisites You will need the following to connect to your Q-Cloud Protect appliance using PuTTY. Key Pair When you launch a Q-Cloud Protect instance, you assign it a key pair, which is then downloaded to your system as a.pem file. You will use the public key to enable the SSH account in the appliance and the private key to authenticate the account from PuTTY. You will need to provide the fully-qualified path of the.pem file in the PuTTY Configuration window to authenticate the SSH account for the instance. For more information about accessing key pairs, see Configuring Access Control on page 67. Enable cliadmin and cliviewer SSH Accounts To access your Q-Cloud Protect appliance through PuTTY using the cliadmin or cliviewer accounts, you must enable these accounts from the appliance's Access Control Settings page. See Configuring Access Control on page 67. Note: The ServiceLogin account is automatically enabled upon the deployment of your cloud appliance. Public DNS Name or IP Address You will need either the public DNS name or IP address for your Q-Cloud Protect appliance to connect Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 77

88 Chapter 5: SSH Connection Using PuTTY to Connect to the Cloud Appliance to it from PuTTY. You can find both the public DNSname and IP address on the Instances Dashboard. Security Group Configure your Q-Cloud Protect instance's security group to allow incoming SSH traffic from the terminal on which PuTTY resides. See Step 6: Configure Security Group on page 49. PuTTY Suite Make sure that you have the entire PuTTY suite downloaded. Download the suite from Configure a session in PuTTY 1. Open your PuTTY Configuration window. 2. In the Category pane, select the Connection > Data menu to display the Data to send to the server pane. Figure 40: Data to send to the server Pane 3. In the Auto-login username field, enter the name of the SSH account for which you are configuring the session, such as ServiceLogin. 4. In the Category pane, select the Connection > SSH > Auth menu to display the Options controlling SSH authentication pane. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 78

89 Chapter 5: SSH Connection Using PuTTY to Connect to the Cloud Appliance Figure 41: Options controlling SSH authentication Pane 5. Click the Browse button and locate the private key file that you downloaded during instance launch. You may need to select All Files (*.*) from the File name drop-down list to locate the.pem file. Figure 42: File Name Drop-Down List 6. In the Category pane, select the Session menu to display the Basic options for your PuTTY session pane. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 79

90 Chapter 5: SSH Connection Using PuTTY to Connect to the Cloud Appliance Figure 43: Basic options for your PuTTY session Pane 7. In the Saved Sessions field, assign a name to the session. 8. Click Save to save the newly configured session. Access the SSH account 1. Open your PuTTY Configuration window to the Basic options for your PuTTY session pane. 2. In the Host Name (or IP address) field, enter the public DNS name or IP address for your Q-Cloud Protect instance. 3. In the Saved Sessions field, select the appropriate session and click Load to apply the session settings. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 80

91 Chapter 5: SSH Connection Using an SSH Client to Connect to the Cloud Appliance 4. Click the Open button to display the PuTTY shell connecting you to your Q-Cloud Protect instance. Figure 44: PuTTY Shell Using an SSH Client to Connect to the Cloud Appliance You can use SecureShell (SSH) clients, such as Linux or OSX, to connect to your Q-Cloud Protect appliance either as an Administrator (cliadmin), Monitor (clieviewer), or Service (ServiceLogin) user. Prerequisites You will need the following to connect to your Q-Cloud Protect appliance using an SSH client. Key Pair When you launch a Q-Cloud Protect instance, you assign it a key pair, which is then downloaded to your system as a.pem file. You will use the public key to enable the SSH account in the appliance and the private key to authenticate the account from the SSH client. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 81

92 Chapter 5: SSH Connection Using an SSH Client to Connect to the Cloud Appliance You will need to provide the fully-qualified path of the.pem file in the SSH client to authenticate the SSH account for the instance. For more information about accessing key pairs, see Configuring Access Control on page 67. Enable cliadmin and cliviewer SSH Accounts To access your Q-Cloud Protect appliance through SSH using the cliadmin or cliviewer accounts, you must enable these accounts from the appliance's Access Control Settings page. See Configuring Access Control on page 67. Note: The ServiceLogin account is automatically enabled upon the deployment of your cloud appliance. Public DNS Name or IP Address You will need the public DNS name or IP address for your Q-Cloud Protect appliance to connect to it from the SSH client. You can find both the public DNS name and IP address on the Instances Dashboard. Security Group Configure your Q-Cloud Protect instance's security group to allow incoming SSH traffic from the terminal on which your SSH client resides. See Step 6: Configure Security Group on page 49. SSH Client Make sure that you have an SSH client installed on your terminal. For more information, see Connect to the cloud appliance from an SSH client 1. Open the SSH Client. 2. At the command line, enter the command to navigate to the directory in which the private key (.pem file) is located. 3. At the command line, enter chmod 400 <key_pair.pem> to ensure that the private key cannot be viewed publicly. 4. At the command line, enter ssh -i <key_pair.pem> or appliance_ ip_address> to connect to the Q-Cloud Protect appliance. 5. At the command line, enter yes to add the Q-Cloud Protect appliance's host name to the list of known hosts. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 82

93 Chapter 6: S3, EBS Volumes, and Snapshots This chapter contains the following topics: S3, EBS Volumes, and Snapshots 83 Tagging EBS Volumes 87 Recovering When EBS Volumes Fail 89 Expanding EBS Volumes 92 S3, EBS Volumes, and Snapshots After you have launched, deployed, and configured Q-Cloud Protect, you can begin replicating data to it. Q- Cloud Protect secures all replicated data by using the following components of AWS. S3 below EBS Volumes on page 85 EBS Snapshots on page 86 S3 Simple Storage Service (S3) is Amazon's cloud storage service. Q-Cloud Protect uses S3 to store the data being replicated to Q-Cloud Protect. It places this data into S3 buckets, which are identified by the serial Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 83

94 Chapter 6: S3, EBS Volumes, and Snapshots number assigned to your Q-Cloud Protect appliance. In addition, snapshots of EBS volumes are also stored in S3, further protecting your data from corruption. For more information about S3, see Access S3 Buckets When you first deploy Q-Cloud Protect, it automatically creates an S3 bucket in which to store replicated data. Q-Cloud Protect names the S3 bucket with the Q-Cloud Protect appliance's serial number, such as qcp-xxxxxxxxxxxxxx. Locate your serial number and S3 bucket 1. From the Q-Cloud Protect web console, navigate to the System Overview page. 2. Locate your cloud appliance's serial number as shown in the following image. Figure 45: System Overview Page Serial Number Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 84

95 Chapter 6: S3, EBS Volumes, and Snapshots 3. From the S3 Console, locate the bucket with the corresponding serial number. Figure 46: S3 Console S3 Bucket Important Because the data stored in S3 buckets is used to configure a recovered instance or to failback data to a source appliance, you should not delete S3 buckets associated with your Q-Cloud Protect appliance unless you are completely certain that you no longer need the stored data. IAM Roles and Policies AWS Identity and Access Management (IAM) provides access control for your AWS resources. Q-Cloud Protect uses IAM as follows: IAM roles to grant the EC2 instance permission to manage S3 objects and EBS snapshots For AWS Marketplace and GovCloud only: IAM users/groups to grant non-administrator users/groups permission to launch a Q-Cloud Protect EC2 instance For more information about IAM, see For information about creating IAM roles and policies, see IAM Roles and Users on page 24. EBS Volumes Elastic Block Storage (EBS) volumes are persistent block-level storage attached to instances. These volumes remain without an instance so that stored data is not lost. The Q-Cloud Protect instance uses two main types of EBS volumes: Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 85

96 Chapter 6: S3, EBS Volumes, and Snapshots Root volumes store OS and initial configuration data for the Q-Cloud Protect instance. Data volumes store metadata about the data replicated to Q-Cloud Protect. By using both types of EBS volumes along with S3, all data associated with the Q-Cloud Protect instance and appliance is being protected. To further protect data stored in these volumes, Q-Cloud Protect takes snapshots of each volume, which are also stored in S3. For more information about EBS volumes, see Working with EBS Volumes The Q-Cloud Protect AMI is pre-configured with the appropriate EBS volumes. When you first launch your Q-Cloud Protect instance, you can access its volumes from the EBS Volumes dashboard. From this dashboard, you can tag the volumes with unique names for easy identification. In addition, you can delete old or corrupted volumes after recovering the volumes from their associated snapshots. For information on performing these tasks, see Tagging EBS Volumes on the next page and Recovering When EBS Volumes Fail on page 89 If you determine that you need additional storage for your Q-Cloud Protect appliance, you can expand the EBS volume attached to its instance. For more information, see Expanding EBS Volumes on page 92. EBS Snapshots EBS snapshots are images of the metadata stored on EBS volumes. Snapshots are safeguarded in S3, increasing the durability of the stored metadata. Q-Cloud Protect takes advantage of this durability by capturing routine EBS snapshots of your instance's EBS volumes. If you need to restore data on an EBS volume or entire instance in cases where the data on the volume is corrupted or fails you can use the EBS snapshots along with the data stored in S3. For more information about snapshots, see Understanding Snapshot Generations Q-Cloud Protect automatically takes daily routine snapshots of the root and data volumes attached to your instances. These snapshots are grouped into a single generation consisting of both the root and data volume at a single point in time as follows: a. The first snapshot generation captures and stores full images of the EBS root and data volumes. b. Each subsequent snapshot captures only data that is new or changed from the preceding snapshot generation. c. The new data is added to the data in the previous generation to create a new snapshot generation. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 86

97 Chapter 6: S3, EBS Volumes, and Snapshots Tagging EBS Volumes This incremental snapshot process captures a complete image of the volumes attached to an instance, without using unnecessary storage space. Manage snapshot generations View snapshot generations on the EBS Snapshots dashboard, which are identified in the Description column as shown in the following image. Figure 47: EBS Snapshots Dashboard Snapshot Generations Example If an EBS volume becomes corrupt or fails, use a snapshot generation to recover the instance to which the failed volume is attached. See Recovering When EBS Volumes Fail on page 89. Tagging EBS Volumes From the EBS Volumes dashboard, you can tag your instance's EBS root and data volumes with unique names for easy identification. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 87

98 Chapter 6: S3, EBS Volumes, and Snapshots Tagging EBS Volumes Figure 48: Volumes Dashboard Add tags to better identify volumes 1. In the Volumes dashboard, select the volume to which to add a tag. 2. Click the Actions button, and select Add/Edit Tags to display the Add/Edit Tags dialog box. Figure 49: Add/Edit Tags Dialog Box 3. Click the Create Tag button to display a new tag row. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 88

99 Chapter 6: S3, EBS Volumes, and Snapshots Recovering When EBS Volumes Fail 4. In the Key field, enter the type of tag that you are creating, such as Name. 5. In the Value field, enter a value to assign to the key, such as Data_Volume. 6. Click the Save button to update the tags for the volume. Recovering When EBS Volumes Fail If an EBS volume attached to an instance becomes corrupted or fails, the Q-Cloud Protect appliance enters diagnostics mode and sends an alert to warn you of the issue. You can recover the data in the failed EBS volume by using the volume's EBS snapshots. Recovery Steps a. Shut down the Q-Cloud Protect appliance. b. Recover the Q-Cloud Protect instance's failed root (/dev/sda1/) and data volumes (dev/sdf/) by using their associated EBS snapshots to create a new AMI. See Recover failed volumes from EBS snapshots below. c. Terminate the original Q-Cloud Protect appliance to release its private IP address. You will reassign the private IP address to the new Q-Cloud Protect instance. See EC2 Instance Issues and FAQs on page 97. d. Launch a new Q-Cloud Protect instance from the AMI containing the recovered data. See Launch the recovery instance on page 91 e. Deploy Q-Cloud Protect from the new instance. See Step 2: Complete the Getting Started Wizard on page 60 This newly deployed cloud appliance will use data from the recovered EBS root and data volumes to access the replicated data stored in S3. It will function just as the original Q-Cloud Protect appliance did before entering diagnostics mode. Therefore, you will not need to reconfigure the appliance. Important Because the data stored in S3 buckets is used to configure a recovered instance or to failback data to a source appliance, you should not delete S3 buckets associated with your Q-Cloud Protect appliance unless you are completely certain that you no longer need the stored data. f. Delete the corrupted EBS volume. See Delete a corrupted volume on page 92. Recover failed volumes from EBS snapshots 1. On the EC2 console, select the Elastic Block Store > Snapshots menu to display the Snapshots Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 89

100 Chapter 6: S3, EBS Volumes, and Snapshots Recovering When EBS Volumes Fail dashboard. 2. Locate the appropriate snapshot generation from which to recover the failed EBS root and data volumes. 3. Select the snapshot of the root volume, and select Actions > Create Image to display the Create Image from EBS Snapshot dialog box. Figure 50: Create Image from EBS Snapshot Dialog Box 4. Populate the Name and Description fields to identify the new AMI that will be created from the snapshots. 5. From the Architecture drop-down list, select x86_ In the Root device name field, enter /dev/sda1/. When you launch the new instance, you will give it the same name as the original instance, which then automatically attaches the root volume to the new instance. 7. Leave the RAM disk ID field set to Use default. 8. From the Virtualization type drop-down list, select Hardware-assisted virtualization. 9. Leave the Kernel ID field set to Use default. 10. Populate the Root row of the Block Device Mappings table with the same settings that were used for the original root volume, making sure the Delete on Termination is NOT selected. 11. For each EBS data volume to recover, click Add New Volume to display a new Block Device Mappings row. 12. In the new Block Device Mappings row, populate the following fields to configure the data volume for the instance: Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 90

101 Chapter 6: S3, EBS Volumes, and Snapshots Recovering When EBS Volumes Fail Field Type Device Snapshot Size (GiB) Volume Type Delete on Termination Encrypted Description Select EBS. Select /dev/sdf/. Enter the ID of the snapshot from which you are recovering the data volume. Enter the same size as was assigned to the original data volume. Select General Purpose (SSD). Deselect this option. Select to encrypt the data volume. 13. Click Create to create the AMI. Launch the recovery instance 1. On the EC2 console, select the Images > AMIs menu to display the AMIs dashboard. 2. Select the AMI created from the EBS snapshots, and click Launch to display the Launch Instance Wizard. 3. Step through the wizard, making sure to apply ALL settings that were used for the original instance. See Launch on page 33. Important To continue replication jobs to the new Q-Cloud Protect instance, you must assign it the original instance's IP address: a. When you reach Step 3: Configure Instance Details, navigate to the Nework Interfaces section. b. Populate the Primary IP field for eth0 with the private IP address assigned to the original Q- Cloud Protect instance. Figure 51: Network Interfaces Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 91

102 Chapter 6: S3, EBS Volumes, and Snapshots Expanding EBS Volumes 4. After launching the new instance, deploy Q-Cloud Protect. See Deploy on page 56. Delete a corrupted volume 1. In the EC2 console's Volumes dashboard, select the volume to delete. 2. Click the Actions button, and select Delete Volume. 3. At the prompt, confirm the deletion. Expanding EBS Volumes If you determine that you require more storage capacity than what is currently configured for your Q-Cloud Protect instance, you can run a command in a SecureShell (SSH) client to automatically expand the EBS volume's storage capacity for your instance. Considerations Before expanding an EBS volume's storage capacity, review the following considerations. Because expanding an EBS volume also increases storage costs, we recommend that you expand a volume's storage capacity only to the required amount and not beyond that amount. You cannot undo an EBS volume expansion. You cannot expand your volume's storage capacity beyond the maximum capacity allowed by AWS. You will enter the size by which to increase volume storage capacity not the total size of the volume's storage capacity in GiB. During volume expansion, your cloud appliance's file system is dismounted. To avoid loss of data, make sure that your are not currently replicating data to the cloud appliance. GB versus GiB Although the Q-Cloud Protect appliance reports measurements in units of MB, GB, and TB, AWS reports measurements in units of MiB, GiB, and TiB. When calculating the EBS volume's storage capacity, you will need to convert measurements between the cloud appliance and AWS interfaces, as appropriate. To convert GB to GiB, multiply by.93. GB x.93 = GiB Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 92

103 Chapter 6: S3, EBS Volumes, and Snapshots Expanding EBS Volumes Expand an EBS volume's storage capacity 1. Stop any replication that may be running on your cloud appliance. 2. Using an SSH client, log into the cloud appliance using the ServiceLogin account. For information regarding SSH access, see SSH Connect on page At the command line, enter the following commands: $ sudo bash # /opt/dxi/util/awssnap/awsdisk.py --expand-ebs <additional_volume_size_gib> 4. The EBS volume expansion process will run. 5. After the process is complete, reboot your appliance for it to register the expanded storage capacity. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 93

104 Chapter 7: Expand Licensed Capacity This chapter contains the following topics: Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 94

105 Appendix 8: Troubleshooting Tips and Frequently Asked Questions This appendix contains the following topics: Troubleshooting Tips and FAQs 95 EC2 Instance Issues and FAQs 97 Virtual Console Issues and FAQs 98 Network Issues and FAQs 99 S3 Issues and FAQs 99 Data Recovery and Space Management Issues and FAQs 102 Alert Issues and FAQs 103 Troubleshooting Tips and FAQs The topics in this section present tips for troubleshooting issues that may arise with your Q-Cloud Protect appliance, along with frequently asked questions (FAQs). For a current status of all AWS services, view the AWS Service Health Dashboard ( You can use this dashboard to identify any AWS issues that might be interfering with your Q-Cloud Protect appliance. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 95

106 Appendix 8: Troubleshooting Tips and Frequently Asked Questions Figure 52: AWS Service Health Dashboard Topics EC2 Instance Issues and FAQs on the next page Virtual Console Issues and FAQs on page 98 Network Issues and FAQs on page 99 S3 Issues and FAQs on page 99 Data Recovery and Space Management Issues and FAQs on page 102 Alert Issues and FAQs on page 103 Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 96

107 Appendix 8: Troubleshooting Tips and Frequently Asked Questions EC2 Instance Issues and FAQs EC2 Instance Issues and FAQs Why can't I launch my Q-Cloud Protect instance from the EC2 console? If you don't have the correct instance type selected, the instance will not launch and the following Launch Failed warning is displayed: Figure 53: Launch Failed Warning Determine whether the instance type is incorrect 1. From the Launch Status page, click Back to Review Screen to display the Step 7: Review Instance Launch page. See Step 7: Review and Launch on page In the Instance Type area, make sure that the correct instance type for the AMI is selected. Resolve the Issue 1. From the Launch Instance Wizard, click Cancel. 2. Re-launch the instance, making sure to select the correct instance type for the AMI. See Launch on page 33. Can I stop my Q-Cloud Protect instance when I am not actively replicating data? When your Q-Cloud Protect appliance has been deployed and is running at a steady state, you should not stop the EC2 instance. You must keep the instance running at all times for storage space to be properly reclaimed on the cloud appliance. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 97

108 Appendix 8: Troubleshooting Tips and Frequently Asked Questions Virtual Console Issues and FAQs If I terminate my Q-Cloud Protect instance, are there any additional actions I need to take? When you terminate a Q-Cloud Protect instance and no longer need its associated data, we recommend that you remove the instance's remaining artifacts to avoid unnecessary costs. For more information, see S3, EBS Volumes, and Snapshots on page 83. Remove the following artifacts S3 buckets storing the instance's data Root and EBS volumes attached to the instance EBS snapshots of the instance's EBS volumes Virtual Console Issues and FAQs Why can't I access my cloud appliance's virtual console from a supported browser? When you launch your Q-Cloud Protect instance, there are specific settings that you must configure to deploy your cloud appliance. If the following settings are not configured correctly, you may be unable to access the cloud appliance's virtual console from a supported browser. For a list of supported browsers, see Accessing the Virtual Console. VPC-Private Network Connection In order to access your cloud appliance's virtual console, you must have its VPC-private network connection configured correctly. For more information, see VPC-Private Network Connections on page 15. Instance Type When you launch your Q-Cloud Protect instance, you must assign it the correct instance type depending on the selected AMI. See Launch on page 33. If the correct instance type is not assigned to your instance, one of the following occurs: Your instance fails to launch. See EC2 Instance Issues and FAQs on the previous page. You cannot access your cloud appliance's virtual console Your receive an Administration Alert of AWSConfiguration on the virtual console's Alerts page. See Virtual Console Issues and FAQs above. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 98

109 Appendix 8: Troubleshooting Tips and Frequently Asked Questions Network Issues and FAQs Figure 54: AWSConfiguration Alert Determine whether the instance type is incorrect 1. From the EC2 Dashboard, select Instances to display the Instances console. 2. Select the EC2 instance from which you deploy your cloud appliance. 3. On the Description tab, locate the Instance Type field. 4. In the Instance Type field, make sure that the correct instance type for the AMI is selected. Resolve the Issue 1. Terminate the existing Q-Cloud Protect instance. 2. Re-launch the instance, making sure to select the correct instance type for the AMI. See Launch on page 33. Network Issues and FAQs Why isn't my Q-Cloud Protect instance able to access DNS? You must configure a Dynamic Host Configuration Protocol (DHCP) options set and attach it to your VPC. EC2 instances require the parameters provided by the DHCP options set to access DNS while communicating with your on-site DXi appliances. For more information, see Creating a VPC-Hardware VPN Access Connection on page 18. S3 Issues and FAQs Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 99

110 Appendix 8: Troubleshooting Tips and Frequently Asked Questions S3 Issues and FAQs Why don't I see an S3 bucket being created for my Q-Cloud Protect instance? If your instance does not have access to S3, then it cannot create an S3 bucket in which to store data. If your instance does not have S3 access, you will receive an Administration Alert of AWSConfiguration on the virtual console's Alerts page. Figure 55: AWSConfiguration Alert Determine whether your instance can access S3 1. From the Q-Cloud Protect virtual console's Home page, note the appliance's serial number. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 100

111 Appendix 8: Troubleshooting Tips and Frequently Asked Questions S3 Issues and FAQs Figure 56: Serial Number 2. On the AWS S3 Management Console, look for a bucket with the name of qcp-<serialnumber>. 3. If you cannot locate such a bucket, open a SecureShell (SSH) client and log in to the cloud appliance using the ServiceLogin credentials. See SSH Connect on page At the command line, enter the following command: create_bucket 5. At the command line, enter the following command: less /hurricane/tsunami.log 6. In the returned response, look for the following to confirm that the instance does not have access to S3: S3ResponseError: 403 Forbidden with Access Denied Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 101

112 Appendix 8: Troubleshooting Tips and Frequently Asked Questions Data Recovery and Space Management Issues and FAQs Resolve the issue 1. Do one of the following: Make sure an IAM role has been assigned to your instance. An IAM role grants permission to your instance to access S3. See S3 Issues and FAQs on page 99. Make sure than a VPC Endpoint has been defined for your VPC-private network connection. See Step 4: Create a VPN S3 Endpoint on page Terminate the existing Q-Cloud Protect instance. 3. Launch a new Q-Cloud Protect instance, making sure that your instance can access S3. Note: You must launch a new instance to resolve the issue. Data Recovery and Space Management Issues and FAQs What do I do if my EBS volume fails? If an EBS volume attached to an instance becomes corrupted or fails, the Q-Cloud Protect appliance enters diagnostics mode and sends an alert to warn you of the issue. You can recover the data in the failed EBS volume by using the volume's EBS snapshots to create a new AMI. For detailed instructions, see Recovering When EBS Volumes Fail on page 89 What do I do if I can't access my NAS share or VTL partition on the source system? If a NAS share or VTL partition is lost or damaged on the source system, you can failback the share or partition to the source system from a received snapshot on the target system. When you failback a share or partition, it is restored on the source system just as it was at the point in time when the snapshot was saved. For detailed instructions, see Perform a Share or Partition Failback. What do I do if my storage capacity begins to reach low levels? Q-Cloud Protect uses the AWS cloud storage service, S3, to store all deduplicated data that is replicated to the appliance. It stores metadata separately in the EBS volumes attached to your Q-Cloud Protect instances. When either storage area becomes low, the cloud appliance sends an alert. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 102

113 Appendix 8: Troubleshooting Tips and Frequently Asked Questions Alert Issues and FAQs Additional Information When you purchase a Q-Cloud Protect metered AMI, its maximum storage capacity is predefined. You will be able to use up to the specified amount of storage allocated to the launched instance. Q-Cloud Protect offers two sizes of metered AMIs: 1-20 TB of storage capacity 1-90 TB of storage capacity For more information about space management, see the Q-Cloud Protect User's Guide. Storage Capacity for Replicated Data If your storage capacity for replicated data reaches low levels, you will need to do one of the following: For metered instances in AWS Marketplace, purchase a larger Q-Cloud Protect AMI, launch the AMI as a new Q-Cloud Protect instance, and begin replicating data to the new, larger appliance. See Task Overview: Launch Instances from AWS Marketplace on page 36. Remove replicated data stored in S3. For additional information, see the Q-Cloud Protect User's Guide. EBS Volume Storage Capacity If your EBS volume storage capacity reaches low levels, you need to expand the size of the EBS volume attached to the appliance. For detailed instructions, see the Q-Cloud Protect Launch and Recovery Guide Alert Issues and FAQs Why am I receiving the AWSConfiguration Administration Alerts? In order for your instance to access S3, an IAM role must be configured and assigned to an instance. See IAM Roles and Users on page 24. If an IAM role is not configured, you will receive an Administration Alert of AWSConfiguration on the virtual console's Alerts page. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 103

114 Appendix 8: Troubleshooting Tips and Frequently Asked Questions Alert Issues and FAQs Figure 57: AWSConfiguration Alert Determine whether an IAM role has been configured and assigned to your instance 1. From the EC2 Dashboard, select Instances to display the Instances console. 2. Select the EC2 instance from which you deployed your cloud appliance. 3. On the Description tab, locate the IAM role field. 4. If the IAM role field displays a dash (-), then an IAM role is not configured or assigned to your instance. Figure 58: IAM Role Field Resolve the issue 1. Terminate the existing Q-Cloud Protect instance. 2. Launch a new Q-Cloud Protect instance, making sure to assign an IAM role to the instance. See Launch on page 33 and Creating an IAM Role for Instances on page 26.. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 104

115 Appendix 8: Troubleshooting Tips and Frequently Asked Questions Alert Issues and FAQs Important You must launch a new Q-Cloud Protect instance to resolve the issue. Why am I receiving the EBSVolumeSnapshot Administration Alerts In order for you instance to access S3 and manage EBS snapshots, your Q-Cloud Protect instance must be assigned a public IP address. See Step 3: Configure Instance Details on page 42. If your instance does not have access to the Internet, one of the following occurs: You receive an Administration Alert of EBSVolumeSnapshot on the virtual console's Alerts page. Figure 59: EBSVolumeSnapshot Alert After 24 hours, EBS snapshots of the Q-Cloud Protect instance's root or EBS volumes do not exist. See S3, EBS Volumes, and Snapshots on page 83. Determine whether the instance has Internet access 1. From the EC2 Dashboard, select Instances to display the Instances console. 2. Select the EC2 instance from which you deploy your cloud appliance. 3. On the Description tab, locate the Public IP field. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 105

116 Appendix 8: Troubleshooting Tips and Frequently Asked Questions Alert Issues and FAQs 4. If the Public IP field displays a dash (-), then your instance does not have access to the Internet. Figure 60: Public IP Field Resolve the issue 1. Do one of the following: Assign a public IP address to the instance a. Terminate the existing Q-Cloud Protect instance. b. Launch a new Q-Cloud Protect instance, making sure that the Auto-assign Public IP field is set to Use subnet setting (Enable). This setting assigns public IP addresses, which have been defined for the subnet, to the instance. See Step 3: Configure Instance Details on page 42. Associate an elastic IP with the instance a. From the Instances console, stop the Q-Cloud Protect instance. b. From the Elastic IPs console, allocate new elastic IP address and associate this address with the Q-Cloud Protect instance. c. From the Instances Console, start the Q-Cloud Protect instance. Why am I receiving the OSTServer Administration Alert? If a BFST operation is taking longer than 5 minutes to complete, an alert is raised notifying you of the slow performance. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 106

117 Appendix 8: Troubleshooting Tips and Frequently Asked Questions Alert Issues and FAQs Figure 61: OSTServer Alert Why isn't my Q-Cloud Protect appliance sending alerts? You must enable communication between the instance and your SMTP server by doing the following: Ensure that your SMTP server does not require login credentials. Your cloud appliance cannot provide these credentials when communicating with the SMTP server. Configure a rule in the appicable security group that enables communication between the cloud appliance and SMTP server. Configure security group rule 1. From the EC2 Dashboard, select Instances to display the Instances console. 2. Select the EC2 instance from which you deploy your cloud appliance. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 107

118 Appendix 8: Troubleshooting Tips and Frequently Asked Questions Alert Issues and FAQs 3. On the Description tab, locate the Security groups field. Figure 62: Security Group Field 4. Click on the security group to display the Security Groups console. 5. Edit the security group rules to allow communication between the instance and SMTP server. see Recommended Security Group Rules on page 23. Why does my Q-Cloud Protect appliance report an unclean shutdown? If you stop your instance from the EC2 console before shutting down the cloud appliance's virtual console, EC2 will power off the cloud appliance and cause an unclean shutdown. If you stop the instance prior to shutting down the cloud appliance, restarting the appliance will take longer than normal as it progresses through its self check. Resolve the issue 1. Shut down your cloud appliance from its virtual console. 2. Stop the instance in the EC2 console. Q-Cloud Protect for AWS Marketplace Launch and Recovery Guide 108