NetBackup™ 10.1.1 Application Guide
- Product overview
- Release notes
- Geting started
- Creating NetBackup application instances
- Managing NetBackup application instances
- Managing application instances from Flex Appliance and NetBackup
- Accessing NetBackup primary and media server instances for management tasks
- Managing users on a primary or a media server instance
- Running NetBackup commands on a primary or a media server application instance
- Monitoring NetBackup services on a NetBackup primary server instance
- Mounting an NFS share on a NetBackup primary server instance
- Setting environment variables on primary and media server instances
- Storing custom data on a primary or a media server instance
- Modifying or disabling the nbdeployutil utility on a primary server instance
- Disabling SMB server signing on a media server instance
- Enabling extra OS STIG hardening on a primary or a media server instance
- Using a login banner on a primary or a media server instance
- Using a primary server instance for disaster recovery
- Accessing NetBackup WORM storage server instances for management tasks
- Managing users from the deduplication shell
- Adding and removing local users from the deduplication shell
- Adding MSDP users from the deduplication shell
- Connecting an Active Directory domain to a WORM storage server for Universal Shares and Instant Access
- Disconnecting an Active Directory domain from the deduplication shell
- Changing a user password from the deduplication shell
- Managing VLAN interfaces from the deduplication shell
- Viewing the lockdown mode on a WORM storage server
- Managing the retention policy on a WORM storage server
- Managing images with a retention lock on a WORM storage server
- Auditing WORM retention changes
- Managing certificates from the deduplication shell
- Managing FIPS mode from the deduplication shell
- Encrypting backups from the deduplication shell
- Configuring an isolated recovery environment on a WORM storage server
- Managing an isolated recovery environment on a WORM storage server
- Tuning the MSDP configuration from the deduplication shell
- Setting the MSDP log level from the deduplication shell
- Managing NetBackup services from the deduplication shell
- Managing the cyclic redundancy checking (CRC) service
- Managing the content router queue processing (CRQP) service
- Managing the online checking service
- Managing the compaction service
- Managing the deduplication (MSDP) services
- Managing the Storage Platform Web Service (SPWS)
- Managing the Veritas provisioning file system (VPFS) mounts
- Managing the NGINX service
- Managing the SMB service
- Monitoring and troubleshooting NetBackup services from the deduplication shell
- Managing users from the deduplication shell
Managing an isolated recovery environment on a WORM storage server
Once you have configured an isolated recovery environment (IRE) on a WORM storage server, you can manage it from the deduplication shell as the msdpadm user. Use the following commands.
To view the SLP windows from the primary server to the WORM server:
setting ire-network-control show-slp-windows production_primary_server=<production domain> production_primary_server_username=<production username> ire_primary_server=<IRE domain> ire_primary_server_username=<IRE username>
Where:
<production domain> is the fully qualified domain name (FQDN) of the primary server in your production environment.
<production username> is the username of a NetBackup user with permission to list SLPs and SLP windows in the production environment. For Windows users, enter the username in the format <domain name>\<username>. For other users, enter the username only.
<IRE domain> is the FQDN of the primary server in the IRE. Use the same hostname that you used for the target primary server when you configured the SLPs in the production environment.
<IRE username> is the username of a NetBackup user with permission to list SLPs and storage units in the IRE. For Windows users, enter the username in the format <domain name>\<username>. For other users, enter the username only.
For example:
production_primary_server=examplePrimary.domain.com production_primary_server_username=appadmin ire_primary_server=exampleIREPrimary.domain.com ire_primary_server_username=appadmin
Note:
The SLP replication window on the production domain must be configured to be open at the same time as the IRE schedule.
To list the MSDP reverse connections:
setting ire-network-control list-reverse-connection
To add an MSDP reverse connection:
setting ire-network-control add-reverse-connection remote_storage_server=<production MSDP server> [remote_primary_server=<production primary server>] [local_storage_server=<IRE network interface>]
Where:
<production MSDP server> is the FQDN of the MSDP server in your production environment.
[remote_primary_server=<production primary server>] is an optional parameter for the FQDN of the primary server in your production environment. This parameter is required if the IRE domain uses an alternative name to access the production primary server. This scenario usually occurs if the production primary server runs on multiple networks with multiple hostnames.
[local_storage_server=<IRE network interface>] is an optional parameter for the hostname of the network interface to use for image replication on the IRE storage server. This parameter is required if the network interface for replication is different than the IRE storage server name.
To verify that a reverse connection works:
setting ire-network-control validate-reverse-connection remote_storage_server=<production MSDP server> [remote_primary_server=<production primary server>] [local_storage_server=<IRE network interface>]
To remove an MSDP reverse connection:
setting ire-network-control remove-reverse-connection remote_storage_server=<production MSDP server>
To view the allowed IP addresses and subnets:
setting ire-network-control show-allows
To add IP addresses and subnets to the allowed list:
setting ire-network-control allow-subnets subnets=<CIDR subnets or IP addresses>
Where <CIDR subnets or IP addresses> is a comma-separated list of the allowed IP addresses and subnets, in CIDR notation.
For example:
setting ire-network-control allow-subnets subnets=10.80.120.208,10.84.48.0/20
Note:
The IRE primary server, the IRE media servers, and the DNS server for the IRE must be included in the allowed list. If all of these servers are in the same subnet, only the subnet is required to be in the allowed list. If you have a dual stack IPv4-IPv6 network, make sure that you add both the IPv4 and the IPv6 addresses to the allowed list.
To remove the IP addresses and subnets from the allowed list:
setting ire-network-control allow-subnets subnets=,
To view the daily air gap schedule:
setting ire-network-control show-schedule
To change the air gap schedule:
setting ire-network-control set-schedule start_time=<time> duration=<duration>
For example:
setting ire-network-control set-schedule start_time=10:00:00 duration=03:00:00
Note:
If the production environment and the IRE are in different time zones, the schedule must begin only once per day in both time zones. For example, if one environment is in the Asia/Kolkata time zone and the other is in the America/New_York time zone, the following schedule in Kolkata is not supported: Tuesday start time 22:00:00 and Wednesday start time 03:00:00. When these start times get converted to the New York time zone, they become Tuesday start time 12:30:00 and Tuesday start time 17:30:00, which is not supported.
To stop the air gap schedule:
setting ire-network-control delete-schedule
To view the current network status and check whether the external network is open or closed:
setting ire-network-control external-network-status
To manually open the external network:
setting ire-network-control external-network-open
To manually close the external network and resume the air gap schedule:
setting ire-network-control resume-schedule