Veritas NetBackup™ Security and Encryption Guide

In a Windows clustered environment, after setup master is run, the AUTHENTICATION_DOMAIN entry in the passive nodes can be the same as the active node name. This is not acceptable. After a failover on a passive node, when MFC UI is launched (using <[local machine name] > \[Administrator user]), an authentication-related pop-up error message is displayed. The work-around for this issue is to add the local node name as authentication domain into the AUTHENTICATION_DOMAIN on passive nodes after setup master (before failover). Before updating the value of AUTHENTICATION_DOMAIN, get the current value using the bpgetconfig command. Then add the local node name as authentication domain in the existing domain list using the bpsetconfig command. To exit and save from the bpsetconfig command prompt press Ctrl + Z and then press theEnter key.

Reverting the NBAC mode from REQUIRED to PROHIBITED on the active node of a cluster, can lead the cluster into a faulted state. The workaround for this issue is to do the following. On an active node run the bpclusterutil -disableSvc nbazd command followed by the bpclusterutil -disableSvc nbatd command. Change the bp.conf USE_VXSS=AUTOMATIC or REQUIRED value to PROHIBITED using the bpsetconfig command. Run the bpclusterutil -enableSvc nbazd command followed by the bpclusterutil -enableSvc nbatd command on the active node while turning NBAC to REQUIRED mode to monitor the security services.