NetBackup™ Deduplication Guide
- Introducing the NetBackup media server deduplication option
- Quick start
- Planning your deployment
- About MSDP storage and connectivity requirements
- About NetBackup media server deduplication
- About NetBackup Client Direct deduplication
- About MSDP remote office client deduplication
- About MSDP performance
- About MSDP stream handlers
- MSDP deployment best practices
- Provisioning the storage
- Licensing deduplication
- Configuring deduplication
- About the MSDP Deduplication Multi-Threaded Agent
- About MSDP fingerprinting
- Enabling 400 TB support for MSDP
- About MSDP Encryption using NetBackup Key Management Server service
- Configuring a storage server for a Media Server Deduplication Pool
- About disk pools for NetBackup deduplication
- Configuring a Media Server Deduplication Pool storage unit
- Configuring client attributes for MSDP client-side deduplication
- About MSDP encryption
- About a separate network path for MSDP duplication and replication
- About MSDP optimized duplication within the same domain
- Configuring MSDP replication to a different NetBackup domain
- About NetBackup Auto Image Replication
- Configuring a target for MSDP replication to a remote domain
- About storage lifecycle policies
- Resilient network properties
- About variable-length deduplication on NetBackup clients
- About the MSDP pd.conf configuration file
- About saving the MSDP storage server configuration
- About protecting the MSDP catalog
- About NetBackup WORM storage support for immutable and indelible data
- Running MSDP services with the non-root user
- MSDP volume group (MVG)
- About the MSDP volume group
- Configuring the MSDP volume group
- MSDP cloud support
- About MSDP cloud support
- Cloud space reclamation
- About the disaster recovery for cloud LSU
- About Image Sharing using MSDP cloud
- About MSDP cloud immutable (WORM) storage support
- About immutable object support for AWS S3
- About bucket-level immutable storage support for Google Cloud Storage
- About object-level immutable storage support for Google Cloud Storage
- About AWS IAM Role Anywhere support
- About Azure service principal support
- About NetBackup support for AWS Snowball Edge
- About the cloud direct
- S3 Interface for MSDP
- Configuring S3 interface for MSDP on MSDP build-your-own (BYO) server
- Identity and Access Management (IAM) for S3 interface for MSDP
- S3 APIs for S3 interface for MSDP
- Disaster recovery in S3 interface for MSDP
- Monitoring deduplication activity
- Viewing MSDP job details
- Managing deduplication
- Managing MSDP servers
- Managing NetBackup Deduplication Engine credentials
- Managing Media Server Deduplication Pools
- Changing a Media Server Deduplication Pool properties
- Configuring MSDP data integrity checking behavior
- About MSDP storage rebasing
- Managing MSDP servers
- Recovering MSDP
- Replacing MSDP hosts
- Uninstalling MSDP
- Deduplication architecture
- Configuring and managing universal shares
- Introduction to universal shares
- Prerequisites to configure universal shares
- Managing universal shares
- Restoring data using universal shares
- Advanced features of universal shares
- Direct universal share data to object store
- Universal share accelerator for data deduplication
- Configure a universal share accelerator
- About the universal share accelerator quota
- Load backup data to a universal share with the ingest mode
- Managing universal share services
- Troubleshooting issues related to universal shares
- Configuring isolated recovery environment (IRE)
- Configuring an isolated recovery environment using the web UI
- Configuring an isolated recovery environment using the command line
- Using the NetBackup Deduplication Shell
- Managing users from the deduplication shell
- About the external MSDP catalog backup
- Managing certificates from the deduplication shell
- Managing NetBackup services from the deduplication shell
- Monitoring and troubleshooting NetBackup services from the deduplication shell
- Managing S3 service from the deduplication shell
- Troubleshooting
- About unified logging
- About legacy logging
- Troubleshooting MSDP configuration issues
- Troubleshooting MSDP operational issues
- Trouble shooting multi-domain issues
- Appendix A. Migrating to MSDP storage
- Appendix B. Migrating from Cloud Catalyst to MSDP direct cloud tiering
- About direct migration from Cloud Catalyst to MSDP direct cloud tiering
- Appendix C. Encryption Crawler
About MSDP Encryption using NetBackup Key Management Server service
NetBackup incorporates the Key Management Server (KMS) with Media Server Deduplication Pool.
Starting NetBackup 10.1.1 and Flex WORM Storage Server 17.1, MSDP uses envelope encryption with multiple layers of keys to encrypt the data. Each new MSDP data segment is encrypted with a unique data encryption key (DEK) that is generated by an MSDP. Each DEK is encrypted or wrapped by a key encryption key (KEK) that is generated by an MSDP. Multiple DEKs can use the same KEK for encryption until a new active KEK is generated. The KEKs are encrypted using the active root keys that reside in NetBackup KMS or an external KMS. The root keys are not sent to the MSDP. Instead, an MSDP sends the KEK to the NetBackup primary server, which interfaces with the NetBackup KMS or an external KMS to encrypt or decrypt the KEK. The encrypted DEKs and encrypted KEKs are stored within MSDP.
For information on how to convert the legacy KMS encryption to the KEK-based KMS encryption for the previous backup data, See Converting the legacy KMS to KEK-based KMS.
User manages KMS service to create and activate a key. In KMS service, one active key must exist.
You can configure the KMS service from the NetBackup web UI or the NetBackup command line during storage server configuration.
Note:
You cannot disable the MSDP KMS service after you enable it.
If the KMS service is not available for MSDP or the key in the KMS service that MSDP uses is not available, then MSDP waits in an infinite loop and the backup job may fail. When MSDP goes in an infinite loop, some commands that you run might not respond.
After you configure KMS encryption or once the MSDP processes restart, check the KMS encryption status after the first backup finishes.
The keys in the key dictionary must not be deleted, deprecated, or terminated. All keys that are associated with the MSDP disk pool must be in an active or an inactive state.
You can use the following commands to get the status of the KMS mode:
For UNIX:
/usr/openv/pdde/pdcr/bin/crcontrol --getmode
For MSDP cloud, run the following keydictutil command to check if the Logical Storage Unit (LSU) is in KMS mode:
/usr/openv/pdde/pdcr/bin/keydictutil --list
For Windows:
<install_path>\Veritas\pdde\crcontrol.exe --getmode
Note:
If you use the nbdevconfig command to add a new encrypted cloud LSU and an encrypted LSU exists in this MSDP, the keygroupname must be the same as the keygroupname in the previous encrypted LSU.
For enabling KMS, refer to the following topics: