NetBackup™ Deduplication Guide

Create an MSDP storage server on media server mediaA of NetBackup domain A.

Open the NetBackup web UI. Click Storage > Disk storage. Click on the Storage servers tab. Click Add and select Media Server Deduplication Pool to local or cloud storage.

Run following command on mediaA to create a new MSDP user testuser1 with password testuser1pass:

spauser -a -u "testuser1" -p "testuser1pass" --role admin

Servers in the domain B can only access IP like 10.XX.40.*, so primaryA2 is used as the primary server host name of domain A.

Run following command on mediaB to get a CA certificate and a host certificate from primaryA:

nbcertcmd -GetCACertificate -server primaryA2

nbcertcmd -GetCertificate -server primaryA2 -token <token_string>

If the nbcertcmd - GetCACertificate displays the error "The server name does not match any of the host names listed in the server's certificate", refer to the following article to add more host name to primary server:

https://www.veritas.com/support/en_US/article.100034092

Create an MSDP OpenStorage server on mediaB of NetBackup domain B.

Open the NetBackup web UI. Click Storage > Disk storage. Click on the Storage server tab. Click Add and select OpenStorage Technology (OST).

The OpenStorage server name mediaA2 is used as the host name that has the IP address 10.XX.40.*.

OpenStorage server type is PureDisk, user name is testuser1, and password is testuser1pass. You must enter the server type as PureDisk.

Read the file /etc/nginx/conf.d/nginx_spws.conf and examine the ssl_certificate field.

Copy ssl_certificate field (for example, /msdp/data/dp1/pdvol/spws/var/keys/cluster_spws_cert.pem) from mediaA2 to primaryB.

Sample file:

engine : cat /etc/nginx/conf.d/nginx_spws.conf
server {
listen 443 default ssl;
listen [::]:443 default ssl;
server_name _;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_certificate /msdp/data/dp1/pdvol/spws/var/keys/cluster_spws_cert.pem;
ssl_certificate_key /msdp/data/dp1/pdvol/spws/var/keys/cluster_spws_key.pem;
ssl_verify_client off;
ssl_protocols TLSv1.2;
ssl_ciphers
ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-G
CM-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES
128-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256;
ssl_prefer_server_ciphers on;
include /etc/nginx/locations/nginx_loc_spws.conf;
}

Run the following command on primaryB to import that certificate to primaryB's trusted keystore.

/usr/openv/java/jre/bin/keytool
-keystore /usr/openv/var/global/wsl/credentials/truststoreMSDP.bcfks
-storetype BCFKS
-providername CCJ
-providerclass com.safelogic.cryptocomply.jcajce.provider.CryptoComplyFipsProvider
-providerpath /usr/openv/wmc/webserver/lib/ccj.jar
-storepass 4d2b912d38dff8d2406b2aba2d023740aafa520a16cd3bb8b1b39b10b58a4ce5
-keypass 4d2b912d38dff8d2406b2aba2d023740aafa520a16cd3bb8b1b39b10b58a4ce5
-alias primaryB -importcert -file cluster_spws_cert.pem

When you run the -list command on primaryB, you should see something similar to the following example:

/usr/openv/java/jre/bin/keytool -list
-keystore /usr/openv/var/global/wsl/credentials/truststoreMSDP.bcfks
-storetype BCFKS
-providername CCJ
-providerclass com.safelogic.cryptocomply.jcajce.provider.CryptoComplyFipsProvider
-providerpath /usr/openv/wmc/webserver/lib/ccj.jar
-storepass 4d2b912d38dff8d2406b2aba2d023740aafa520a16cd3bb8b1b39b10b58a4ce5  
Keystore type: BCFKS 
Keystore provider: BCFIPS 
Your keystore contains 2 entries 
ca1, Jan 11, 2023, trustedCertEntry,  
Certificate fingerprint (SHA-256): 
4A:52:C8:9E:B1:1F:A9:21:99:3B:AA:5A:0C:B5:C3:2F:51:(string continues) 
primaryB, Jan 16, 2023, trustedCertEntry,  
Certificate fingerprint (SHA-256): 
AE:34:D1:63:B1:94:33:8C:07:5D:9A:D6:2B:CF:5B:52:D7:(string continues)

The second certificate that is listed is that of mediaA2.