Veritas NetBackup™ Flex Scale Administrator's Guide
- Product overview
- Viewing information about the NetBackup Flex Scale cluster environment
- NetBackup Flex Scale infrastructure management
- User management
- Directory services and certificate management
- Region settings management
- About NetBackup Flex Scale storage
- Node and disk management
- License management
- NetBackup Flex Scale network management
- About network management
- Modifying DNS settings
- About bonding Ethernet interfaces
- Bonding operations
- Data network configurations
- NetBackup Flex Scale infrastructure monitoring
- Resiliency in NetBackup Flex Scale
- Site-based disaster recovery in NetBackup Flex Scale
- NetBackup Flex Scale security
- Troubleshooting
- Appendix A. Configuring NetBackup optimized duplication
- Appendix B. Disaster recovery terminologies
Establishing trust and setting up authentication
In NetBackup Flex Scale Appliance, the Appliance web server creates a self-signed CA certificate and an Appliance web server certificate (signed by that CA) for every cluster. As the CA certificates are different, you have to ensure that both the clusters trust the CA of the other. This is done by adding one cluster's gateway CA certificate to the trusted certificate store of the other. Each cluster should be able to trust the secondary cluster and perform the required operations to configure and manage disaster recovery. Appliance web server certificates are exchanged between both the clusters to enable authentication.
You can use the following REST APIs to setup trust and authentication. The secondary cluster can be added as a disaster recovery cluster to the primary cluster anytime after the primary cluster is up and running. The secondary cluster has to be a freshly installed and configured NetBackup Flex Scale cluster.
The REST API calls must be made in the following order on the API gateway of the clusters. The API calls do not use SSH between the clusters.
You can get the list of available certificates on the cluster using the API:
GET /api/appliance/v1.0/certificates
This API returns the URI of certificateName as Appliance web services certificate, Appliance web services CA certificate and the root certificate. The certificateName should be passed as input to the GET specific certificate API. The certificate is in base64 encoded format.
To set up trust between both the clusters
- Get the appliance web services certificate on the primary cluster by providing the certificate name (appliance-webservice) as input in the GET specific certificate API.
GET /api/appliance/v1.0/certificates/{certificateName} - Get the appliance web services CA certificate on the primary cluster by providing the certificate name (appliance-webservice-ca) as input in the GET specific certificate API. .
GET /api/appliance/v1.0/certificates/{certificateName} - Establish trust by passing the certificates obtained from the primary cluster to the secondary cluster. Execute the following API on the secondary cluster:
POST /api/appliance/v1.0/certificates
The API imports the certificates of one cluster and exports the certificates on the other cluster to establish trust and enable certificate authentication.
Set type as appliance-webservice and purpose as remote-cluster-trust-auth. Use the API gateway FQDN of the remote cluster for gateway.
- Get the appliance web services certificate on the secondary cluster by providing the certificate name (appliance-webservice) as input in the GET specific certificate API.
GET /api/appliance/v1.0/certificates//{certificateName} - Get the appliance web services CA certificate on the secondary cluster.
GET /api/appliance/v1.0/certificates/appliance-webservice-ca
- Establish trust by passing the certificates obtained from the secondary cluster to the primary cluster. Execute the following API on the primary cluster:
POST /api/appliance/v1.0/certificates
The API imports the certificates of one cluster and exports the certificates on the other cluster to establish trust and enable certificate authentication.
Set type as appliance-webservice and purpose as remote-cluster-trust-auth. Use the API gateway FQDN of the remote cluster for gateway.
For more information, see the Veritas NetBackup Flex Scale APIs on SORT.