Post-upgrade checklist for NetBackup Appliance 5.1.1

Description

After the upgrade process has completed successfully, perform the following tasks, as required for your environment:

Appliances with NetBackup CLI users

For upgrades to versions 4.1 and later, any existing NetBackup CLI users no longer have any NetBackup RBAC privileges, by default. This also applies to any new NetBackup CLI users that are added after the upgrade. If any of these users require access to the NetBackup Web UI or REST APIs, you must manually grant them the appropriate NetBackup RBAC roles.

For complete details, see the NetBackup Web UI Administrator's Guide.

Appliance license

Starting with version 5.1.1, 5250 and 5350 appliances require appliance license compliance. To obtain a valid appliance license, log in to Veritas Entitlement Management System with your entitlement credentials and retrieve the appropriate license.

After the upgrade has completed, add the license to the appliance with the following command:

' Manage > License > Appliance > Add '.

More detail about Veritas Entitlement Management System, see https://www.veritas.com/support/en_US/article.100048764.

NOTE : This license is different then legacy NB license which we see using #bpminlicense and will be in binary format.

Re-import device certificates

If you exported device certificates before the upgrade, you must re-import them after the upgrade. After completing the upgrade, place the backed-up certificate files from the non-appliance location to an appliance share such as /inst/patch/incoming. Import the files from the share as follows:
    •    Log in to the NetBackup Appliance Shell Menu and navigate to the following view:
         Network > Security > Import
    •    Enter the following import option details:
         Import [EnterPasswd] [PathValue]
         Where [EnterPasswd] is the field used to answer the question, "Do you want to enter a password?". You must enter yes or no.

         and [PathValue] is the location where you want to place the imported certificates.

SDCS mode

If the Symantec Data Center Security (SDCS) feature was set to the unmanaged mode after the upgrade, make sure to change it to the managed mode, and then apply the latest IDS and IPS policies.

Check the Symantec Data Center Security(SDCS) mode with command ' Monitor > SDCS > ServerInfo Show '.

If the above output shows "Current Management Server = 127.0.0.1 " that means the appliance is in "unmanaged mode"  

For complete details, refer to one of the following documents:
NetBackup Appliance Administrator's Guide
NetBackup Appliance Security Guide

SDCS console and server

For appliances that do not currently have an SDCS environment configured, you must obtain the console and the server binaries (SDCS_server_692.zip) from the NetBackup Appliance OS 5.1.1 (veritas.com) before you can set it up.

For appliances with an existing SDCS environment and console set up, you are only required to update the policy files and make sure that the SDCS agent points to the correct SDCS server. You do not need to obtain the binaries.

For complete details, refer to one of the following documents:
NetBackup Appliance Administrator's Guide
NetBackup Appliance Security Guide

STIG feature

If the STIG feature was enabled before upgrade, it must be re-enabled after the upgrade has been completed. For appliances (nodes) in an HA setup, you must re-enable STIG on each node after the upgrades have been completed.

Running the latest version of your SSH client

Make sure you are running the latest version of your SSH client. Upgrading to version 3.2 or later versions changes the key-exchange algorithms used for connecting to the appliance. Make sure that your SSH client supports the following key-exchange algorithms:

diffie-hellman-group-exchange-sha256
diffie-hellman-group18-sha512
diffie-hellman-group16-sha512
diffie-hellman-group14-sha256
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521

If your SSH client does not support any of the above algorithms after the upgrade has completed, the following error appears:

Guest and local user access to Universal shares

If you upgraded appliances with versions 3.3.0.1 or earlier, guest users and existing local users cannot access Universal Shares or CIFS shares after the upgrade has completed.

After the upgrade, you can grant access to these shares as follows:
    •    Guest users: Replace a Guest user by creating a new local user.
    •    Existing local users: Change the passwords for these users.

Update appliance to the latest firmware version

    •    It is strongly recommended that you update your appliances to the latest firmware version. For details, refer to the following:

 https://www.veritas.com/support/en_US/downloads/update.UPD966809.