Technical Report NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault Christopher Wong, NetApp November 2017 TR-4417 Abstract This solution deployment guide outlines how easy it is to deploy and use a NetApp AltaVault cloud-integrated storage appliance. AltaVault appliances provide a simple, efficient, and secure way to offsite data to either public or private cloud storage providers. Using advanced deduplication, compression, and encryption, AltaVault enables organizations to eliminate reliance on older, less reliable data protection solutions while improving backup windows and disaster recovery capabilities.
TABLE OF CONTENTS 1 AltaVault Overview... 3 1.1 Executive Overview...3 1.2 Dell vranger Architecture Overview...3 1.3 AltaVault Appliance Overview...4 2 Deploy and Configure AltaVault with vranger... 5 2.1 AltaVault Solution Configuration Topography...5 2.2 Hardware and Software Prerequisites...5 3 Configure vranger... 6 3.1 Create a Repository in vranger...6 3.2 Create or Associate a vranger Job with the Newly Created Repository...7 3.3 Perform a Test Backup... 13 3.4 Monitor the Backup... 13 3.5 Restore a Backup... 14 4 Solution Recommendations and Best Practices... 20 4.1 vranger Best Practices... 20 4.2 Windows Best Practices... 20 Version History... 21 LIST OF TABLES Table 1) vranger best practices.... 20 LIST OF FIGURES Figure 1) vranger component view....4 Figure 2) AltaVault appliance....4 Figure 3) AltaVault ecosystem....5 2 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
1 AltaVault Overview This chapter provides an executive overview of the solution components. 1.1 Executive Overview NetApp AltaVault storage enables customers to securely back up data to any cloud at up to 90% lower cost compared with on-premises solutions. AltaVault gives customers the power to tap into cloud economics while preserving investments in existing backup infrastructure and meeting backup and recovery SLAs. AltaVault appliances simply act as a network-attached storage (NAS) target within a backup infrastructure, enabling organizations to eliminate their reliance on tape infrastructure and all its associated capital and operational costs, while improving backup windows and disaster recovery capabilities. It s easy to set up the AltaVault appliance and start moving data to the cloud in as little as 30 minutes, compared to setting up tape or other disk replication infrastructures, which can take days. By applying industry-leading deduplication, compression, and WAN optimization technologies, AltaVault appliances shrink dataset sizes by 10x to 30x, substantially reducing cloud storage costs, accelerating data transfers, and storing more data within the local cache, which speeds recovery. Security is provided by encrypting data on site or in flight, as well as in the cloud, using 256-bit AES encryption and TLS v1.1/1.2. AltaVault appliances provide a dual layer of encryption, which means that any data moved into the cloud is not compromised, and it creates a complete end-to-end security solution for cloud storage. Because an AltaVault appliance is an asymmetric, stateless appliance, no hardware is needed in the cloud, and you can recover the last known good state of a broken or destroyed AltaVault appliance to a new AltaVault appliance. AltaVault appliances offer the flexibility to scale cloud storage as business requirements change. All capital expenditure planning required with tape and disk replication-based solutions is avoided, saving organizations up to 90%. 1.2 Dell vranger Architecture Overview Dell vranger speeds VMware backup and replication while dramatically reducing storage requirements. vranger simplifies disaster recovery for VMware vsphere with one-pass ESX / ESXi backup that includes granular restore capabilities across files, objects, and applications. Native cataloging efficiently indexes file metadata for easy search and one-step recovery. Active Block Mapping (ABM) reads only active blocks from the image, minimizing backup windows and storage needs. In vranger, backups and restore activities are performed as jobs and are submitted using the vranger Backup and Replication Management Console on Windows. Backup jobs are sent to backup targets, which include SMB- and NFS-based targets. 3 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
Figure 1) vranger component view. 1.3 AltaVault Appliance Overview Figure 2 is an illustration of the AltaVault appliance. Figure 2) AltaVault appliance. AltaVault appliances are optimized and purpose built for data protection. They easily integrate into your existing backup infrastructure and favorite cloud storage provider. Setup and installation are easy because backup applications allow you to add an AltaVault appliance as a common target within its existing infrastructure. The backup server connects to the AltaVault appliance using standard SMB or NFS protocol. When you back up to an AltaVault device, it performs inline, variable-segment-length deduplication, compression, and encryption of the backup data to minimize storage consumption and transmission times. AltaVault appliances also use their local disk cache for fast recovery of recent backups, providing LAN performance for the most likely restores. The AltaVault appliance then securely writes the deduplicated backup data to cloud storage and accelerates restores from the cloud by moving only needed segments of deduplicated data over the WAN. An easy-to-use graphical management console enables you to manage one or more AltaVault appliances through a web browser interface. 4 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
2 Deploy and Configure AltaVault with vranger vranger with AltaVault appliances is a flexible, easy to configure and use solution that can be deployed with major cloud storage providers. See the AltaVault Deployment Guide for the detailed steps to deploy an AltaVault appliance. 2.1 AltaVault Solution Configuration Topography Figure 3 illustrates the AltaVault solution configuration topology. Refer to the NetApp Interoperability Matrix for current versions of the backup application supported with AltaVault. Figure 3) AltaVault ecosystem. 2.2 Hardware and Software Prerequisites To properly install and deploy AltaVault into a backup environment, you must complete the following list of prerequisite requirements prior to installation and deployment. 1. Have at least one server that acts as the vranger backup server. This server, along with clients, needs minimum hardware features as identified by the backup application. Check the vranger support site and related compatibility lists where applicable. 2. Obtain server systems and related software media supported by vranger and the AltaVault appliance. 3. A physical AltaVault appliance or virtual AltaVault appliance must be online and connected to the physical network infrastructure. A minimum of two IP addresses must be available for AltaVault. 4. Procure and set up all necessary software licenses from each vendor, using vendor-specific guidelines, including cloud storage credentials from your designated cloud storage provider. 5. Provide physical stacking and racking of equipment at each site. All cabling and power must be operational. 6. Verify that all LAN and WAN connections are functioning to and from your Internet and cloud storage providers. 7. If applicable, have available a Windows directory service (Active Directory) or UNIX Kerberos server. 5 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
3 Configure vranger 3.1 Create a Repository in vranger A repository is a connection that vranger associates with physical storage. The following describes the steps to create a repository and associate it to the AltaVault appliance. These steps use the best practice configuration for vranger with the AltaVault appliance. 1. From the vranger Management Console, select My Repositories from the left pane. Then select the Add icon and select Windows Share (SMB). 2. In the Add Windows Network Share Repository screen, enter the following information. 6 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
Repository Name The unique name entered here appears in the My Repositories view. Description Enter a description about the connection being created. User Specify the Windows account used if AltaVault is a member of the Windows Active Directory (AD) Domain. This AD account should match the account configured for the SMB share on AltaVault. Otherwise, provide the name of the local user account created on AltaVault for the SMB share. Password Specify the password for the associated user account configured above. Server Identify the SMB share that corresponds to the AltaVault share you created. The format should be in the universal naming (UNC) format. Encrypt All Backups to This Repository Disable this option. AltaVault will encrypt data received from vranger. 3.2 Create or Associate a vranger Job with the Newly Created Repository You can perform vranger backups and restores as scheduled or as manual jobs. Use the vranger My Jobs pane to set up and monitor the activity of running jobs. The following steps show you how to create or associate a vranger job with the AltaVault based repository. 1. Select either Scheduled Jobs or On Demand Jobs to see existing jobs on the right pane. To create a backup job, click on the Add button and select Backup Job. To associate an existing job, select the job name from the right panel, click on the Edit button, and go to step 3. 7 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
2. From the Inventory Node Selection page, select the VM guest you wish to back up. 3. In the Mode Selection screen, select the Advanced radio button and specify a name and description for the new job. Click Next. 8 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
4. In the Virtual Machine Hard Disk Inclusion screen, select the disks to include with the backup job. 5. In the Repository Selection panel, select the AltaVault based SMB share repository created previously. 9 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
6. In the Options Selection panel, configure the following options. Backup Powered on Machines Only Enable this option if vranger should back up only powered-on virtual machines. Check Destination for Free Space Leave this option enabled (default). Compress Backed Up Files Disable this option. AltaVault compresses data during backup. Update Notes with the Latest Backup Results Leave this option enabled (default). Enable Guest Quiescing Enable this option if vranger should back up only Windows-based database servers. Enable Active Block Mapping (ABM) Enable this option to reduce the size of the backup. Use Fiber or SCSI and Perform Network Backup on Fiber or iscsi Failure Leave these options enabled (default). 10 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
Enable Cataloging Enable this option only if vranger cataloging is enabled. 7. In the Retention Policy Selection panel, set the number of snapshots that vranger should manage and whether the backup will be a full, incremental, or differential backup. 11 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
8. In the Recurrence Schedule Selection panel, identify whether this job recurs on a regular schedule or if it runs only manually on demand. 9. In the Email Notification Selection panel, select the users to be notified when the job completes. 12 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
3.3 Perform a Test Backup To test vranger with the AltaVault appliance you can run a manual backup. To run a manual backup, right-click the job name you want to execute and select Run. 3.4 Monitor the Backup Use the Current Jobs view within the My Jobs tab of the left panel in the vranger Management Console to monitor and control vranger jobs. The currently running backup jobs are displayed under the right panel of the window. 13 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
3.5 Restore a Backup You can use vranger to recover an entire VM, multiple VMs, or individual files. Similar to backups, you configure restores of VMs through jobs; however, you can perform file-level restores directly from a backup image. Performing a Full VM Restore 1. To set up a restore of a VM, go to the My Jobs pane on the left pane of the Management Console. Click on Add and select Restore Job. 2. In the Mode Selection panel, select Advanced and choose one of the following options. Restore from SavePoint Use this option if the vranger database is intact and you want to restore a VM guest from backup. Restore from SavePoint Manifest File Use this option if the vranger database is unavailable and you want to restore a VM guest from backup. This option is typically used in environments such as disaster recovery in which the original vranger database is destroyed. Job Name Provide a name for the job being created. Job Description Provide a description of the restore activity to be performed. 14 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
3. If performing a VM restore from vranger SavePoint, simply select the VM backup you wish to recover. Select the VM backup you wish to restore. If you have access to the vranger database, then SavePoint or SavePoint manifest files appear. If you do not have access to the vranger database and you are restoring from a SavePoint manifest file, the system prompts you to point to the repository location where the VM backups and manifest files reside. User Name Specify the AltaVault account name that has access to the SMB share in which the manifest file resides. 15 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
Password Specify the password for the user name that has access to the AltaVault SMB share in which the manifest file resides. Manifest Path Specify the manifest path name by browsing to the AltaVault SMB share and the VM backup folder and then selecting the manifest file. Click to highlight the manifest file and click OK. Then click Add to add the manifest file to the Selected SavePoints pane on the lower half of the manifest selection window, above. 4. Identify the host and datastore in which the system writes the VM. 16 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
Step 1. For each VM: In the Restore To Host column, select the host to which the VM should be restored, or select the host to which all VMs should be restored from the Master Host drop-down. Click Assign. Step 2. For each VM: In the Primary Datastore field, select a value, or, select the datastore to be used for all VMs from the Master Datastore field. Step 3. For each VMDK: Select the datastore to which each VMDK should be restored. 5. Configure the virtual network to which each vnic is connected upon restore, or configure a Master Network that uses the selected network for all vnics. 6. Configure the options for the restore. By default all the options are selected. 17 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
7. Identify if the job is scheduled to repeat or if it is an on-demand job started manually. By default, the checkbox is selected for an on-demand job configuration. 8. Optionally, select the names of contacts who will be notified when the restore is complete. 18 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
9. Confirm the operation and options selected. Optionally select the checkbox to run the restore immediately after this wizard completes. Performing an Individual File or Folder Restore 1. Open the My Repositories tab on the left panel of the management console and select the AltaVault based SMB repository. On the right pane, select the VM and backup version from which you wish to restore a file. Right-click and select File Level Restore. 2. Browse through the VM directory structure and select the object(s) that you wish to restore in the lower left pane. Select the target you want to restore the files to on the right pane and click Restore to begin the File Level Restore operation. 19 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
Note: File-level restores recover to the system where the vranger Management Console resides and not to the originating VM guest. 4 Solution Recommendations and Best Practices This chapter lists recommendations and best practices for deploying AltaVault in vranger environments. The best practices are not requirements, but NetApp recommends that you follow these suggestions for the best solution experience. 4.1 vranger Best Practices Table 1 describes the recommended best practices for for using vranger with AltaVault. Table 1) vranger best practices. Item Repository credentials Disable backup job compression Disable encryption Enable Active Block Mapping Description Provide Windows AD user credentials for connecting to the AltaVault SMB share. If using a local Windows user account, create that user account on the AltaVault appliance prior to configuring the repository. Disable the compression option during backup job configuration to allow AltaVault to compress data prior to sending it to cloud storage. Disable the repository encryption to allow AltaVault to secure data prior to sending it to cloud storage. This option can be left checked to reduce the size of backups sent to AltaVault. 4.2 Windows Best Practices You can modify Windows networking parameters for SMB to improve overall backup application performance. To make these changes, go to the Start menu and enter regedit to start the Windows registry editor. Enter administrative permissions if prompted. Changes made in the Windows registry 20 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
editor are permanent upon entry, so use extreme caution when making the changes or additions. A reboot is required. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters] "SESSTIMEOUT"=DWORD:00000e10 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters] "DefaultSendWindow"=DWORD:00040000 "DefaultReceiveWindow"=dword:00040000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters] "GlobalMaxTcpWindowSize"=dword:00040000 "TcpWindowSize"=dword:00040000 "Tcp1323Opts"=dword:00000003 If Windows 2012 or Windows 8 or later is used with AltaVault versions earlier than 4.2, the Secure Negotiate feature in those products requires SMB signing negotiation messages to be signed themselves; otherwise, the connection fails. AltaVault versions earlier than 4.2 do not sign negotiation messages, and this can cause the SMB connections to AltaVault to fail repeatedly. To work around this limitation, if you cannot upgrade AltaVault to version 4.2 or later, disable the Secure Negotiate feature on the Windows server by using the following command from Windows PowerShell. Refer to Microsoft Knowledge Base article 2686098 for details. Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" RequireSecureNegotiate -Value 0 -Force Version History Version Date Document Version History Version 1.0 May 2015 Initial version Version 1.1 November 2015 Updated for 4.1 release Version 1.2 April 2016 Updated for 4.2 release Version 1.3 August 2016 Updated for 4.2.1 release Version 1.4 January 2017 Updated for 4.3 release Version 1.5 April 2017 Updated for 4.3.1 release Version 1.6 November 2017 Updated for 4.4 release 21 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault
Refer to the Interoperability Matrix Tool (IMT) on the NetApp Support site to validate that the exact product and feature versions described in this document are supported for your specific environment. The NetApp IMT defines the product components and versions that can be used to construct configurations that are supported by NetApp. Specific results depend on each customer's installation in accordance with published specifications. Copyright Information Copyright 1994 2017 NetApp, Inc. All Rights Reserved. NETAPP, the NETAPP logo, and the marks listed at http://www.netapp.com/tm are trademarks of NetApp, Inc. Other company and product names may be trademarks of their respective owners. Printed in the U.S. No part of this document covered by copyright may be reproduced in any form or by any means graphic, electronic, or mechanical, including photocopying, recording, taping, or storage in an electronic retrieval system without prior written permission of the copyright owner. Software derived from copyrighted NetApp material is subject to the following license and disclaimer: THIS SOFTWARE IS PROVIDED BY NETAPP "AS IS" AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL NETAPP BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. NetApp reserves the right to change any products described herein at any time, and without notice. NetApp assumes no responsibility or liability arising from the use of products described herein, except as expressly agreed to in writing by NetApp. The use or purchase of this product does not convey a license under any patent rights, trademark rights, or any other intellectual property rights of NetApp. The product described in this manual may be protected by one or more U.S. patents, foreign patents, or pending applications. RESTRICTED RIGHTS LEGEND: Use, duplication, or disclosure by the government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.277-7103 (October 1988) and FAR 52-227-19 (June 1987). TR-4417-1117 22 NetApp AltaVault Cloud-Integrated Storage Appliances Solution Deployment: AltaVault