netapp altavault and symantec netbackup solution with ... · the netapp altavault and symantec...

NetApp Verified Architecture

NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI NVA Deployment

Nabil Fares and David Arnette, NetApp

November 2015 | NVA-0019-DEPLOY | Version 1.0

2 NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI: NVA Deployment

© 2015 NetApp, Inc. All rights reserved.

TABLE OF CONTENTS

1 Program Summary................................................................................................................................ 4

2 Solution Overview ................................................................................................................................ 4

2.1 Target Audience ..............................................................................................................................................4

2.2 Solution Technology .......................................................................................................................................4

3 Solution Use Cases .............................................................................................................................. 6

4 Technology Requirements .................................................................................................................. 7

4.1 Hardware Requirements .................................................................................................................................7

4.2 Software Requirements ..................................................................................................................................8

4.3 AltaVault Cabling for FlexPod ACI ..................................................................................................................8

5 Deployment Procedures ...................................................................................................................... 9

5.1 Deployment Prerequisites ............................................................................................................................. 10

5.2 Configuring ACI for AltaVault ........................................................................................................................ 10

5.3 Configuring AWS for AltaVault ...................................................................................................................... 28

5.4 Configuring AltaVault .................................................................................................................................... 29

5.5 Configuring Symantec NetBackup for AltaVault ............................................................................................ 36

6 Solution Verification ........................................................................................................................... 42

7 Conclusion .......................................................................................................................................... 43

References ................................................................................................................................................. 43

NetApp References .............................................................................................................................................. 43

Cisco References ................................................................................................................................................. 44

Symantec References .......................................................................................................................................... 44

Version History ......................................................................................................................................... 44

LIST OF TABLES

Table 1) Hardware requirements. ...................................................................................................................................7

Table 2) Software requirements. ....................................................................................................................................8

Table 3) Contracts in the ACI configuration for AltaVault. ............................................................................................ 24

Table 4) Tested use cases. .......................................................................................................................................... 42

LIST OF FIGURES

Figure 1) AltaVault with FlexPod connectivity. ................................................................................................................9

Figure 2) Relationships between the major ACI components. ...................................................................................... 11

Figure 3) External EPG contracts. ................................................................................................................................ 27



Figure 4) NFS EPG contracts. ...................................................................................................................................... 27

Figure 5) Final view of all contracts. ............................................................................................................................. 28

Figure 6) AltaVault startup configuration. ..................................................................................................................... 30



1 Program Summary

The NetApp® Verified Architecture (NVA) program offers customers a verified architecture for NetApp

solutions. An NVA gives customers a NetApp solution architecture that:

Is thoroughly tested

Is prescriptive in nature

Minimizes customer deployment risks

Accelerates customer time to market

This NVA deployment guide describes the steps for deploying NetApp AltaVault® cloud-integrated storage

with the FlexPod® Datacenter with NetApp All Flash FAS (AFF), Cisco Application Centric Infrastructure

(ACI), and VMware vSphere solution. AltaVault appliances effortlessly integrate with preexisting backup

software and support 95% of the cloud storage solutions on the market today, including those of all

leading cloud storage providers.

2 Solution Overview

A cloud-based backup architecture can significantly reduce costs, increase business agility, and simplify

disaster recovery. However, developing a backup strategy for both on-premises and off-premises data

centers while incorporating a disaster recovery (DR) strategy often creates a complex infrastructure that is

difficult to manage and scale.

The NetApp AltaVault and Symantec NetBackup solution with FlexPod Datacenter and ACI is a shared,

verified, and proven solution spanning private and public clouds. The solution is built on the previously

validated FlexPod Datacenter with AFF and ACI design with the following added components:

The AltaVault AVA400 physical appliance and the AltaVault AVA-v8 virtual appliance for a DR case study

Amazon S3 cloud storage

Symantec NetBackup as the backup program used with AltaVault

2.1 Target Audience

The target audience for this deployment guide is customer system administrators, contractors,

professional services engineers, and other professionals who install and configure the AltaVault with

FlexPod environment.

AltaVault is easy to deploy and, when coupled with FlexPod Datacenter with AFF and ACI, provides an

architecture that is seamless, industry proven, and validated to industry best practices.

2.2 Solution Technology

This section briefly presents the products included in the AltaVault with FlexPod solution. For detailed

information about the components, see NVA-0019-DESIGN: NetApp AltaVault and Symantec NetBackup

Solution with FlexPod Datacenter and ACI.

NetApp AltaVault Appliance

NetApp AltaVault storage enables customers to securely back up data to the cloud at up to 90% less cost

than that of on-premises solutions. AltaVault gives customers the power to tap into cloud economics while

preserving their investments in backup infrastructure and meeting backup and recovery SLAs.

The AltaVault appliance is a disk-to-disk data storage optimization system that can be integrated with a

variety of class-leading cloud storage providers. AltaVault can also be integrated with backup and archive

applications to protect critical production data off site without the complexity of tape management

http://www.netapp.com/us/media/nva-0019-design.pdf




solutions or the cost of in-house DR sites and services. When administrators add an AltaVault appliance

as a target for their backup or archive infrastructure, the backup server simply connects to the AltaVault

appliance by using the CIFS or the NFS protocol.

AltaVault appliances are available in a variety of sizes to scale with business requirements and growth.

They are also available in virtual format editions for environments that use hypervisors such as VMware

vSphere and Microsoft Hyper-V or the Amazon EC2 Marketplace for cloud-to-cloud backups. This

flexibility provides alternative methods for performing data recovery in a disaster when infrastructure and

resources might not be available in the same manner as in the lost primary data center.

FlexPod Datacenter with NetApp All Flash FAS, Cisco ACI, and VMware vSphere

FlexPod is a best practice data center architecture that includes three components:

Cisco Unified Computing System (Cisco UCS)

Cisco Nexus switches

NetApp FAS systems

These components are connected and configured according to Cisco and NetApp best practices, and

they provide the ideal platform for running a variety of enterprise workloads with confidence. FlexPod can

scale up for greater performance and capacity, or it can scale out for environments that require multiple

consistent deployments. The reference architecture covered in this document leverages the Cisco Nexus

9000 for the switching element.

Cisco Unified Computing System

Cisco UCS is a next-generation solution for blade and rack server computing. The system integrates a

low-latency, lossless 10GbE unified network fabric with enterprise-class, x86-architecture servers. The

system is an integrated, scalable, multichassis platform in which all resources participate in a unified

management domain. Cisco UCS accelerates the delivery of new services simply, reliably, and securely

through end-to-end provisioning and migration support for virtualized and nonvirtualized environments.

FlexPod and Cisco ACI

The Cisco Nexus 9000 family of switches supports two modes of operation: the NxOS standalone mode

and the ACI fabric mode. In standalone mode, the switch performs as a typical Cisco Nexus switch with

increased port density, low latency, and 40Gb connectivity. In fabric mode, the administrator can take

advantage of Cisco ACI. The Cisco Nexus 9000–based FlexPod design with Cisco ACI consists of a

Cisco Nexus 9500 and 9300 leaf-and-spine switching architecture that is controlled by a cluster of three

Application Policy Infrastructure Controllers (APICs).

Cisco ACI delivers a resilient fabric to satisfy today’s dynamic applications. ACI leverages a network

fabric that employs industry-proven protocols coupled with innovative technologies to create a flexible,

scalable, and highly available architecture of low-latency, high-bandwidth links.

NetApp All Flash FAS and Data ONTAP

NetApp solutions offer increased availability while consuming fewer IT resources. A NetApp storage

solution includes hardware in the form of FAS controllers and disk storage and the NetApp Data ONTAP®

operating system that runs on the controllers. Disk storage is offered in two configurations: FAS systems

with SAS disks, SATA disks, or solid-state disks (SSDs) and All Flash FAS systems with only SSDs.

All Flash FAS

NetApp All Flash FAS addresses enterprise storage requirements with high performance, superior

flexibility, and best-in-class data management. Built on the clustered Data ONTAP storage operating

system, All Flash FAS speeds up businesses without compromising on efficiency, reliability, or the



flexibility of IT operations. As true enterprise-class all-flash arrays, All Flash FAS systems accelerate,

manage, and protect business-critical data, now and in the future.

For more information about All Flash FAS systems, see NetApp All Flash FAS.

Data ONTAP

With clustered Data ONTAP, NetApp provides enterprise-ready, unified scale-out storage. Developed

from a solid foundation of proven Data ONTAP technology and innovation, clustered Data ONTAP is the

basis for large virtualized, shared storage infrastructures that are architected for nondisruptive operations

over the system’s lifetime. Controller nodes are deployed in HA pairs in a single storage domain or

cluster.

Data ONTAP scale-out is a way to respond to growth in a storage environment. As the storage

environment grows, additional controllers are added seamlessly to the resource pool that resides on the

shared storage infrastructure. Host and client connections as well as datastores can move seamlessly

and nondisruptively anywhere in the resource pool. Existing workloads can be easily balanced over the

available resources, and new workloads can be easily deployed. Technology refreshes (such as replacing

disk shelves and adding or replacing storage controllers) are accomplished while the environment

remains online and continues to serve data. Data ONTAP is the first product to offer a complete scale-out

solution, and it provides an adaptable, always-available storage infrastructure for today’s highly virtualized

environments.

For more information about Data ONTAP, see NetApp Data ONTAP 8.3 Operating System.

Note: The design discussed in this document focuses on clustered Data ONTAP and IP-based storage.

VMware vSphere

VMware vSphere is a virtualization platform for holistically managing large collections of infrastructure

resources—CPUs, storage, and networking—as a seamless, versatile, and dynamic operating

environment. Unlike traditional operating systems that manage an individual machine, VMware vSphere

aggregates the infrastructure of an entire data center to create a single powerhouse with resources that

can be allocated quickly and dynamically to any application.

For more information, see the VMware vSphere product page.

Symantec NetBackup

Symantec NetBackup has a three-tiered architecture. The first tier is a master server that provides

functions such as configuration services, policy creation, scheduling, reporting, and logging. The master

server is the communications mechanism of the backup application and allocates resources to the media

servers.

The second tier is the media server, the mainstay of the NetBackup environment. The media server must

be a high-rate-of-data I/O importer and exporter. The connections to disk, tape drives, the SAN, and the

LAN depend on the backup and storage requirements. The AltaVault appliance is used by the media

server to send backups to a public cloud.

The final tier is the clients tier. The clients are the systems in which the data resides and that must be

protected. However, certain aspects obscure the line between clients and media servers; from the

NetBackup standpoint, when a media server sends its own data to a device for backup, it is considered a

client.

3 Solution Use Cases

The flexibility of AltaVault alone and working with the FlexPod infrastructure allows the NetApp AltaVault

and Symantec NetBackup solution with FlexPod Datacenter and ACI to accommodate various business

http://www.netapp.com/us/products/storage-systems/all-flash-fas/

http://www.netapp.com/us/products/platform-os/data-ontap-8/index.aspx

http://www.vmware.com/products/vsphere



and technical needs such as the validated use cases that use both AltaVault physical appliances and

virtual appliances. Tests for the use cases focused on the functionality and seamless integration between

AltaVault and FlexPod Datacenter ACI:

Backup of data to both an AVA400 physical appliance and an AVA-v8 virtual appliance by using NetBackup and NDMP

Recovery of data from both an AVA400 physical appliance and an AVA-v8 virtual appliance

On-premises hardware appliance failure: replacing the appliance, restoring the previous backup configuration, and verifying the data restored from the cloud (Amazon S3)

Off-premises disaster recovery: restoring the failed appliance configuration on a remote AVA-v8 virtual appliance with a new IP address and completing the data restore from the cloud

The validation tests excluded performance measurements, but the AltaVault deduplication capabilities

representing cost savings from backing data to the cloud were still noted in the tests.

4 Technology Requirements

NetApp, Cisco, VMware, and Symantec have interoperability matrixes that you must consult to determine

support for implementations of the NetApp AltaVault and Symantec NetBackup solution with FlexPod

Datacenter and ACI:

NetApp Interoperability Matrix Tool

Cisco UCS Hardware and Software Interoperability Tool

VMware Compatibility Guide

Symantec NetBackup Master Compatibility List

Although there are no dependencies between FlexPod ACI, AltaVault (physical and virtual), and

NetBackup, NetApp recommends consulting the interoperability matrixes as a best practice.

4.1 Hardware Requirements

Table 1 lists the hardware components used to validate and implement the solution. The components

used in particular implementations might vary based on customer requirements. The FlexPod

components in Table 1 correspond to the minimum hardware required to validate the solution in the lab.

Note: For a list of minimum requirements for a production environment, see the FlexPod Datacenter with NetApp All Flash FAS, Cisco Application Centric Infrastructure, and VMware vSphere Design Guide. In our validation of AltaVault with FlexPod, we used one APIC server, but in a production environment the requirements vary depending on the deployment strategy.

Table 1) Hardware requirements.

Layer Hardware Quantity

Compute Cisco UCS 6248UP fabric interconnects 2

Cisco UCS B-200 M4 2

Network Cisco APIC 1

Cisco Nexus 9396 (leaf switches) 2

Cisco Nexus 9336 (spine switches) 2

Storage NetApp All Flash FAS8040 1 (HA pair)

NetApp AltaVault AVA400 1

http://support.netapp.com/matrix/

http://www.cisco.com/web/techdoc/ucs/interoperability/matrix/matrix.html

http://www.vmware.com/resources/compatibility/search.php

https://support.symantec.com/en_US/article.tech59978.html

http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/UCS_CVDs/flexpod_esxi55u2_n9k_aci_aff8040_design.html#_Toc425435684





4.2 Software Requirements

Table 2 lists the software components required to implement the solution. The components used in

particular implementations might vary based on customer requirements.

Table 2) Software requirements.

4.3 AltaVault Cabling for FlexPod ACI

Figure 1 shows a deployment of the AVA400 appliance with a FlexPod ACI configuration. The

connectivity is based on port channels for switch redundancy and added capacity and uses Cisco virtual

port channel (vPC) technology.

The most common AltaVault cabling layout requires a minimum of two interfaces: the primary

(management) interface and the data interface. The data interface can be a single or dual connection with

a vPC on FlexPod; a dual connection provides more network redundancy.

The configuration tested for the solution validation used the dual connectivity option shown in Figure 1.

Section 5.4 (“Configuring AltaVault”) describes the LACP (port channel) configuration required for

AltaVault. Section 5.2 (“Configuring ACI for AltaVault”) focuses on the vPC configuration for FlexPod ACI.

Note: When the term primary appears in this guide, it refers to the physical Ethernet port that is indicated by a wrench icon on the rear of the chassis.

Layer Software Version

Compute Cisco UCS Manager infrastructure software bundle 2.2(3d)

Cisco UCS Manager B-Series software bundle 2.2(3d)

Network Cisco APIC software 1.0(4h)

Cisco Nexus 9000 iNX-OS 11.0(4h)

Storage, virtualization, and backup

NetApp Data ONTAP 8.3

OnCommand® Unified Manager for clustered Data ONTAP 6.1

OnCommand Performance Manager for clustered Data ONTAP 1.1

NetApp Virtual Storage Console (VSC) 6.0

NetApp AltaVault AVA400 software 4.0.0.1

NetApp AVA-v8 4.0.0.1

Amazon S3 storage N/A

Windows Server 2012 R2

VMware vSphere ESXi 5.5u2

VMware vCenter 5.5u2

Symantec NetBackup 7.6



Figure 1) AltaVault with FlexPod connectivity.

5 Deployment Procedures

The procedures in this guide must be completed in a sequential manner to deploy AltaVault and

NetBackup with FlexPod Datacenter and ACI. The procedures assume that the FlexPod infrastructure

has already been deployed. If this is not the case, see the FlexPod Datacenter with NetApp All Flash

FAS, Cisco Application Centric Infrastructure, and VMware vSphere Deployment Guide for instructions on

how to deploy FlexPod.

To deploy the AltaVault with FlexPod solution, you must complete the following tasks in addition to

deploying the FlexPod infrastructure:

Verify and configure FlexPod ACI components—vPC, EPGs, and contracts—for AltaVault

Configure Amazon S3 for AltaVault

Configure AltaVault (physical appliance and virtual appliance)

Configure NetBackup software for AltaVault

Note: In the lab environment, we deployed the virtual AltaVault appliance (AVA-v8) on the FlexPod Cisco UCS server for the validation of local recovery and DR cases. In a production environment, the remote DR location should preferably use FlexPod for consistency and rapid recovery of the AltaVault virtual appliance and data.

http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/UCS_CVDs/flexpod_esxi55u2_n9k_aci_aff8040.html




5.1 Deployment Prerequisites

Before you deploy AltaVault to a backup environment, you must have completed the following

prerequisites:

You have set up at least one server with the functions of a master server and a media server in a single computer system. NetApp recommends that you separate the master and media servers so that the system is not overloaded. These servers, along with clients, require the minimum hardware features identified by the backup application. For more information, visit the Symantec Support site and consult the NetBackup Master Compatibility List.

You have obtained server systems and related software media supported by NetBackup and the AltaVault appliance.

You have verified that an AltaVault physical appliance or an AltaVault virtual appliance is online and connected to the physical network infrastructure. A minimum of two IP addresses must be available for AltaVault.

You have procured and installed all necessary software licenses from each vendor, using vendor-specific guidelines, and obtained cloud storage credentials from your designated cloud storage provider.

You have performed the physical stacking and racking of the equipment at each site. All cabling and power supplies must be operational.

You have verified that all LAN and WAN connections are functioning to and from the Internet and cloud storage providers.

If applicable, you must have available a Windows directory service (Active Directory) or a UNIX Kerberos server.

5.2 Configuring ACI for AltaVault

The ACI configuration required for AltaVault is limited to creating endpoint groups (EPGs) and service

contracts. Instructions for standing up the ACI infrastructure are beyond the scope of this guide. For

detailed information about how to deploy FlexPod Datacenter with ACI, see the FlexPod Datacenter with

NetApp All Flash FAS, Cisco Application Centric Infrastructure, and VMware vSphere Deployment Guide.

EPGs and Service Contracts

An endpoint group (EPG) is a collection of physical and virtual endpoints that require common services

and policies. An example of an EPG is a set of servers or storage LIFs on a common VLAN that provide a

common application function or service. An EPG can be defined on a per-VLAN segment basis such that

all servers or VMs on a common segment become part of the same EPG.

In the FlexPod design, the following items are placed in separate EPGs:

The various application tiers

ESXi VMkernel ports for iSCSI, NFS, and vMotion connectivity

NetApp LIFs for SVM management and NFS and iSCSI datastores

A service contract can exist between two or more participating peer entities (such as two applications

running and talking to each other behind different EPGs) or between providers and consumers (such as a

DNS contract between a provider entity and a consumer entity). Contracts use filters to limit traffic

between the applications and certain ports and protocols.

Figure 2 illustrates the relationship between EPGs and contracts. As shown in the figure, a tenant can

contain one or more application profiles, and an application profile can contain one or more EPGs. The

devices in the same EPG can talk to each other without any special configuration. Devices in different

EPGs can talk to each other by using contracts and associated filters. A tenant can also contain one or

more bridge domains, and multiple application profiles and EPGs can use the same bridge domain.

https://www.veritas.com/support/en_US/article.TECH59978





Figure 2) Relationships between the major ACI components.

Prerequisites for the ACI Configuration

The ACI configuration steps required for adding the AltaVault appliance to the FlexPod infrastructure

assume that the following items have been created or configured:

The vPC configuration

EPGs for the following items:

AFF LIFs. This EPG allows access to the NFS, CIFS, and iSCSI protocols. You can use individual EPGs for each protocol if the protocols are separated by VLAN boundaries.

External access. This EPG typically allows traffic in and out of the ACI fabric and identifies layer 2 or layer 3 connectivity between the ACI fabric and external routing devices.

Note: For an example of this EPG, see “Creating an Application Profile, EPGs, and Contracts.”

Servers and data. You can create one or multiple EPGs, depending on your application profiles and on the data center design. For this validation, we created an EPG, a VLAN, and a subnet dedicated to AltaVault and the NetBackup servers and clients to isolate the traffic.

Note: For an example of this EPG, see “Creating an Application Profile, EPGs, and Contracts.”

ACI application profiles

The ACI fabric tenant. For this validation, we used a dedicated tenant for convenience. This choice has no implication on the validation outcome.

Internet routing. This configuration is required for AltaVault to reach the public cloud (in this case, AWS storage).

Network services. NTP, DNS, and firewall filters must be in place if outbound SSL traffic is restricted.

A subnet for the AltaVault appliances and the NetBackup servers and clients. For this validation, we configured all devices by using the same IP subnet, but you can place the devices on their own subnets if your design calls for it. If you separate the subnets, you must create additional contracts to allow traffic between EPGs and application profiles.



The ACI configuration steps take into consideration that servers and AltaVault appliances might be on

different subnets. However, the ACI policy should be the same as long as the contracts stitch together the

correct EPGs. For this validation, we placed the AltaVault appliances, the NetBackup servers, and the

AFF LIFs on different VLANs within the same subnet. We created a contract to allow the NetBackup

servers to access the AltaVault physical and virtual appliances, AFF LIFs, and resources outside the

fabric.

Because the validation was completed in a restricted lab environment, we segmented Internet routing on

a separate physical network. As shown in Figure 2, the primary is connected to a separate network for

Internet traffic.

Note: We mapped each EPG within the ACI environment to a unique VLAN. Although the VM ports on the ESXi host, the AltaVault appliance, and the NFS LIF on the NetApp SVM are part of the same layer 2 domain, we configured two VLANs (3180 and 3178) for these EPGs. Using contracts, the ACI fabric allows the necessary connectivity between the ESXi hosts, AltaVault, and the NetApp nodes; different VLAN IDs within the ACI fabric do not matter. A similar configuration with two VLANs can also be used for iSCSI connectivity.

Verifying the vPC Configuration

To verify that vPCs are correctly configured, complete the following steps:

Log in to the ACI fabric. 1.

From the menu bar, select Fabric > Access Policies. 2.

In the navigation bar, expand Switch Policies > Policies and select the default policy, which is labeled 3.Virtual Port Channel Default. Verify that vPC is configured for the default policy.



In the Properties pane, double-click the vPC policy to display additional information about the leaf 4.switches, their node IDs, and the peering relationship.

Click Close. 5.

Creating the AltaVault VLAN

To create a VLAN for AltaVault, complete the following steps:

Note: In the configuration validated in the lab, we used VLAN 3180 for the AltaVault appliance and NetBackup servers.



In the navigation bar, expand Pools. 3.



Right-click VLAN and select Create VLAN Pool. 4.

In the Create VLAN Pool dialog box, type a name for the AltaVault VLAN and click the plus sign to 5.specify the encapsulation block range.



Type the VLAN ID in the Range boxes and click OK. 6.

Click Submit to create the VLAN. 7.

Creating a Physical Domain Policy

To create a physical domain policy, complete the following steps:



In the navigation bar, expand Physical and External Domains. 3.



Right-click Physical Domains and select Create Physical Domain. 4.

Type a name for the policy and select the AltaVault VLAN from the VLAN Pool list. 5.



Associate the new physical domain policy with an attachable entity profile. If no profile exists, select 6.Create Attachable Entity Profile from the drop-down list.

Type a name for the profile and click Next. 7.



Click the plus sign to create an interface policy group. 8.

From the Switches list, select the leaf switches for the switch profile. 9.



Assign a name to the switch profile. 10.

Click the Port Configuration icon to configure the switch interfaces for vPC and LACP. 11.

Make the following selections: 12.

a. Select the VPC option.

b. Type or select the interfaces to add to the profile.

c. Select an interface selector.

d. Select Create VPC Interface Policy Group from the VPC Policy Group list.



Type a name for the vPC interface policy group and select LACP_Active from the LACP Policy list. 13.

Select the new vPC group from the list and click the Modify icon. 14.



Select the attachable entity profile policy to apply it to the new vPC group. 15.

Click Save and then click Submit to complete the configuration. 16.

Creating an Application Profile, EPGs, and Contracts

You must create an external application profile for vPC, three EPGs, and service contracts for the ACI

configuration for AltaVault. The storage EPG and the VM EPGs are part of the existing fabric, and they

are referenced in the contracts. The EPGs and contracts allow the AltaVault appliance to communicate

with the external networks and the NetApp storage on the same ACI fabric. They also allow NetBackup to

communicate with the AltaVault appliance.

Creating the External Application Profile

To create the external application profile, complete the following steps:


In the navigation bar, expand your tenant. 2.

Right-click Application Profiles and select Create Application Profiles. 3.

In the Create Application Profile dialog box, type External as the profile name. 4.

From the Monitoring Policy list, select Default. 5.



Click the plus sign next to EPG to add an EPG. 6.

In the Create Application EPG dialog box, type AVA-DATA as the EPG name. 7.

From the Bridge Domain list, select bd-EXTERNAL. 8.

From the Monitoring Policy list, select Default. 9.

Click Finish. 10.

Repeat step 1 to step 10 to create two additional EPGs: External and VM-External. For these EPGs, 11.select bd-AVA-400 as the bridge domain.

Applying EPGs to the External Application Profile

To apply the EPGs to the external application profile that you created, complete the following steps:

In the navigation bar, expand Application Profiles > External > Application EPGs > EPG AVA-DATA 1.and select Static Bindings (Paths).



Click Action and select Deploy Static EPG on PC, VPC, or Interface. 2.

In the dialog box, select Virtual Port Channel as the path type. 3.

From the Path list, select pg-AVA-400. 4.



Type vlan-3180 in the Encap box. 5.

Change the Deployment Immediacy setting to Immediate. 6.

Click Submit. 7.

Repeat step 1 to step 7 to apply the other two EPGs (External and VM-External) to your external 8.application profile.

Note: VM-External must be assigned to the icef1-vc VMM physical domain. This step automates port-group provisioning on the VMware vDS and allows dynamic VLAN provisioning.

Creating Contracts

Contracts allow traffic to flow between the AltaVault appliance, NetApp controllers, and external networks.

EPGs require multiple contracts. Table 3 exemplifies the contracts that are provided or consumed by the

AVA-DATA EPG. The other contracts listed in the table allow traffic between all EPGs. All filters are set to

Allow-All.

Table 3) Contracts in the ACI configuration for AltaVault.

Application Profile EPG Tenant Name Contract Name Provided or Consumed?

External AVA-DATA AVA-400 Allow-All Provided

External AVA-DATA AVA-400 Allow-External Consumed

External External AVA-400 Allow-External Provided

External VM-External AVA-400 Allow-All Consumed

External VM-External AVA-400 Allow-External Consumed

NFS LIF-NFS AVA-400 Allow-NFS Provided

NFS VMK-NFS AVA-400 Allow-NFS Consumed



To create ACI contracts for AltaVault, complete the following steps:

In the navigation bar, expand Application Profiles > External > Application EPGs > EPG AVA-Data 1.and select Contracts.

Click Action and select Add Provided Contract. 2.

In the Add Provided Contract dialog box, from the Contract list, select Create Contract. 3.

In the Create Contract dialog box, type Allow-External as the name of the contract. 4.

Change the scope to Tenant. 5.

Click the plus sign next to Subjects to add a filter as a contract subject. 6.

In the Create Contract Subject dialog box, type Allow-All as the name of the contract subject. 7.



Click the plus sign under Filter Chain to add the new filter. 8.

In the Name drop-down list under Filters, select the Allow-All filter under tenant AVA-400. 9.

Click Update to add the Allow-All filter to the filter chain. 10.

Click OK to finish creating the contract subject. 11.

Click Submit. 12.

Click Submit again to finish adding the contract to ACI. 13.



Repeat steps 1 to 13 to create the other contracts listed in Table 3. After you create those contracts, 14.the relationships between application profiles, EPGs, and contracts in your ACI configuration for AltaVault should look like the diagrams in Figure 3 to Figure 5.

Figure 3) External EPG contracts.

Figure 4) NFS EPG contracts.



Figure 5) Final view of all contracts.

5.3 Configuring AWS for AltaVault

AltaVault requires access to the AWS S3 service before the storage service is enabled. This failsafe

feature allows data to be archived at all times.

To configure AWS for AltaVault, you must create an AWS account and an access key for the S3 service

and attach policy permission for access to S3 only. The policy can be granular to a specific S3 bucket. In

our validation, the account had full access to S3.

Creating a Dedicated S3 Account for AltaVault

To create a dedicated Amazon S3 account for AltaVault, complete the following steps:

Access the AWS IAM console. 1.

In the navigation pane, click Users. 2.

Click Create New Users. 3.

Type a user name (for example, AltaVault) and keep the Generate an Access Key for Each User 4.

checkbox selected. Click Create.

Click Show User Security Credentials or click Download Credentials to obtain the access key ID and 5.the secret access key for your user.

The key pair should look similar to the following examples:

Access key ID: AKIAIOSFODNN7EXAMPLE

Secret access key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

Attaching an S3 Policy to the AltaVault User

After you create the user, you must assign a policy that allows access to a particular AWS service (in this

case, the S3 service). To attach an S3 policy to the AltaVault user, complete the following steps:

Return to the IAM console and click Users. 1.

Double-click the user that you created for AltaVault. 2.



Click Permissions to expand the Permissions section. 3.

Click Attach Policy. 4.

Select AmazonS3FullAccess and click Attach Policy. 5.

The following example shows a policy applied to a user:

{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Action": "s3:*",

"Resource": "*"

}

]

Creating an Amazon S3 Bucket

You can create an S3 bucket for AltaVault from the S3 console or from the AltaVault appliance. In our

validation, AltaVault created the bucket during the initial configuration.

5.4 Configuring AltaVault

AltaVault physical appliances and virtual appliances are configured the same way. For our validation, we

completed the configuration steps on the physical appliance.

Note: For detailed instructions on how to deploy the AltaVault virtual appliance on VMware vSphere, see the NetApp AltaVault Cloud Integrated Storage Installation and Service Guide for Virtual Appliances.

AltaVault requires a minimum of two interfaces: primary and data. The primary interface is used for

management, Internet traffic, and cloud archiving. The data interface is used for local backup and restore.

You can, however, direct Internet-bound traffic to the data interface if the network segment for the data

interface has Internet reachability.

Performing the AltaVault Basic Configuration

The first time you access an AltaVault appliance, it runs a setup program that prompts you to change the

password and supply the basic networking information required for the appliance to communicate over

the primary interface. You must enter the following information to be able to configure and manage the

appliance:

The appliance host name

No DHCP use on the primary interface

The primary IP address

The network mask

The default gateway

The IP address of the primary DNS server

The domain name

Figure 6 shows a sample startup configuration for an AltaVault appliance. After the initial configuration is

completed, the remaining steps can be finalized from the web interface. The default password for

AltaVault appliances is password.

https://library.netapp.com/ecm/ecm_download_file/ECMP12455064




Figure 6) AltaVault startup configuration.

Configuring the AltaVault Cloud Settings

Before you configure any storage features on an AltaVault appliance, you must set the cloud

configuration and the data encryption key. As noted earlier, cloud configuration is mandatory for the

storage service to run.

To configure the AltaVault cloud settings, complete the following steps:

From the AltaVault main webpage, select Storage and click Cloud Settings. 1.

In the Cloud tab, select Amazon S3 as the cloud provider. 2.

Select a region. 3.

Type the access key ID and the secret access key that you previously obtained from the Amazon IAM 4.console.

Type the host name. 5.

Type the bucket name. If the bucket already exists on the AWS S3 console, ensure that the name 6.you enter matches the existing bucket name. Otherwise, AltaVault creates another bucket on S3 automatically.



Click Apply to commit the configuration. 7.

Note: The items flagged with arrows in the screenshot are mandatory for the AWS S3 cloud configuration. For a list of all supported cloud vendors and the minimum information required to complete the cloud settings for each cloud provider, see the NetApp AltaVault Cloud Integrated Storage Deployment Guide.

Click the Encryption tab. 8.





Type and confirm a new passphrase and click Apply. 9.

Note: This passphrase is used to encrypt the datastore encryption key and must be provided whenever you import that datastore encryption key (for example, as part of disaster recovery). The passphrase is not stored in a configuration file and must be kept in a secure location.

Click Save at the top right corner of the page. 10.

Restart the optimization service by selecting Settings > Service and clicking Restart. 11.

Configuring the AltaVault Data Interface Settings

The AltaVault appliance supports LACP on the data interfaces for added network redundancy and

additional capacity. You must create a virtual interface (VIF) and assign an IP address to the new VIF.

Note: To add the VIF, you must reboot the appliance. Confirm that the VIF configuration is saved before rebooting.



Creating a VIF

To create a VIF, complete the following steps:

From the AltaVault main webpage, select Settings and click VIFs. 1.

Click Add a Virtual Interface. 2.

Select the Enable VIF checkbox. 3.

Type a name for the VIF. 4.

Add the member interfaces separated by a comma. Verify that these interfaces are connected to the 5.network.

Select 802.3ad from the Mode drop-down list. 6.

Click Add. 7.

Click Save. The new virtual interface is added to the VIFs list. 8.

Select Settings > Reboot/Shutdown and click Reboot. 9.

Assigning an IP Address to the New VIF

After the appliance reboots, assign an IP address to the new VIF, save the configuration, and restart the

service.

To assign an IP address to the VIF, complete the following steps:



From the AltaVault main webpage, select Settings and click Data Interfaces. 1.

Expand the new VIF by clicking the arrow next to it. 2.

Assign an IP address and a subnet mask. The subnet mask is the data subnet reachable by clients. 3.

Keep the MTU size at the default 1500 value. 4.

Note: You can change the MTU size if your network switches support a different size.

Click Apply. 5.

Click Save and then click Restart at the top right corner of the page. 6.

Configuring CIFS for AltaVault

Depending on your requirements, both CIFS and NFS are available for data archiving on AltaVault. This

guide focuses on CIFS with NetBackup.

Note: For more information about the NFS configuration, see the NetApp AltaVault Cloud Integrated Storage User’s Guide.

The CIFS configuration on AltaVault is completed in a few steps. The appliance provisions a CIFS share

when you perform the appliance’s initial network and cloud configuration. This procedure explains the

basic CIFS configuration; further configuration might be required to accommodate your environment

requirements.

Note: If the cloud services are not configured, you will not be able to provision CIFS or NFS shares. The appliance must be running the optimization service for CIFS and NFS to run.

To configure CIFS for AltaVault, complete the following steps:

From the AltaVault main webpage, select Storage and click CIFS. 1.

Click Add CIFS Share. 2.

Type a share name. 3.





Type a path (for example, /appliance_name/share_name). 4.

Keep the default selections for the other options and click Add Share. 5.

Click Add CIFS User to add a service account or an administrator account. 6.

Click Add. 7.

The AltaVault appliance can join a Windows domain for granular security and centralized policy 8.management. In the Domain pane, enter the domain name and the domain administrator user name and password. Click Join Domain.



5.5 Configuring Symantec NetBackup for AltaVault

Before you can use NetBackup with AltaVault, you must associate a NetBackup policy with a storage unit

that is based on the AltaVault appliance. After you configure the policy, you can create a test backup and

restore your data from the backup to verify that NetBackup works with AltaVault.

Note: Instructions for deploying NetBackup and configuring scalability options are beyond the scope of this guide. Because deployment details are specific to each environment, NetApp recommends that you refer to Symantec’s best practices to complete NetBackup deployment tasks.

Important

The SMB 3.0 implementation causes a user authentication issue in Windows Server 2012 environments.

User authentication fails and results in the failure of catalog backup jobs with DR file functionality. The

following Windows registry key must be configured on media servers running Windows Server 2012 for

NetBackup service accounts to be properly authenticated:

HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Param

eters\RequireSecureNegotiate

DWORD value = 0

Configuring a Storage Unit

A storage unit is a label that NetBackup associates with physical storage. The label can identify a robot, a

path to a volume, or a disk pool. This procedure presents the best practice configuration for NetBackup

with AltaVault appliances.

To create a storage unit and associate it with the AltaVault appliance, complete the following steps:

Open the NetBackup Management Console and point to the master server. 1.



Expand NetBackup Management > Storage, right-click Storage Units, and select New Storage Unit. 2.

Create the storage unit with the following settings: 3.

a. Type a name for the storage unit.

b. Select a media server.

c. Specify the absolute path name to the directory.

d. Select the Reduce Fragment Size To checkbox and set the value to 20480MB (20GB).

Note: For the lab validation, we kept the remaining settings at their default values.



Note: To back up data with NetBackup to an AltaVault CIFS share in a Windows environment, you must first configure NetBackup Remote Manager, the monitor service, and the NetBackup client service. Failure to perform these configurations can result in the NetBackup status code 800, resource request failed. For more information, see the Symantec NetBackup Administrator’s Guide.

Modifying a Backup Policy

NetBackup policies determine when backups occur, to which backup targets the data is written, and how

long backup versions are maintained. Policies include automatic calendar-based schedules for

performing unattended backups of clients. You can also run policies manually as needed. You must

associate a policy with a storage unit or a storage unit group to write the backup jobs.

To associate a NetBackup policy with a storage unit or storage unit group that is based on an AltaVault

appliance, complete the following steps:

Under NetBackup Management > Policies, right-click an existing policy and select Change. 1.

https://support.symantec.com/en_US/article.DOC6452.html




Modify the existing policy properties to point backups to an AltaVault appliance–based storage unit 2.and click OK.

Creating a Test Backup

To test NetBackup with an AltaVault appliance, you can run a manual backup with the policy that you

modified in the previous procedure. To run a manual backup, complete the following steps:

Under NetBackup Management > Policies, right-click the modified policy and select Manual Backup. 1.



Select the schedule and clients to back up and click OK. 2.

You will be prompted to view the backup progress in Activity Monitor. Within a given policy, you can select one or more clients for manual backup. In most cases, all clients are run from policies defined for a set schedule. You manually run policies for clients after jobs fail and need to be rerun.

Viewing the Manual Backup Status

To view details of a specific backup job, complete the following steps:



In the navigation bar, click Activity Monitor to display the list of backup jobs. 1.

Double-click your backup job in the jobs list. 2.

In the Job Details dialog box, review the job details on two tabs: the Job Overview tab and the 3.Detailed Status tab. Information about the elapsed time, transfer rate (in KBps), and current object being processed is also available.

Restoring a Backup

When the backup is complete, perform a restore operation to verify that the AltaVault appliance can

restore the backed-up data. To run a restore, complete the following steps:

From the client system, navigate to Windows Start > All Programs > Symantec NetBackup and click 1.the Backup, Archive, and Restore icon. The following window is displayed:



Click Select for Restore. 2.

In the dialog box, select the checkboxes for the files that you want to restore. 3.

From the left toolbar, click Restore to start the restore. 4.

6 Solution Verification

We tested the use cases listed in Table 4 after FlexPod Datacenter with AFF and ACI was deployed, the

AltaVault physical and logical appliances were configured and brought online, and all software was

provisioned on the VMware infrastructure, including Windows Server and NetBackup software.

Table 4) Tested use cases.

Test Case Details

Data backup to both the AVA400 appliance and the AVA-v8 appliance

The verification consisted of the following tasks:

Selecting a directory to back up

Verifying that the backup completed successfully to both the AVA400 appliance and the AVA-v8 appliance

Verifying the copied data on both AltaVault appliances by reviewing reports and network utilization logs

Verifying deduplication reports and the cloud operation status

Verifying Amazon S3 buckets and confirming that data slabs were populated

Data recovery from both the AVA400 appliance and the AVA-v8 appliance


Deleting data from the servers

Using the NetBackup restore utility to restore data from both the AVA400 appliance and the AVA-v8 appliance

After the restore operation finished, verifying data integrity

Note: This test restored data from the AltaVault local cache rather than from S3 buckets. AltaVault keeps up to 90% of the appliance’s storage capacity hot before a rotational schedule kicks in.

On-premises AVA400 failure and recovery


Backing up the AVA400 configuration to a safe location

Simulating hardware failure by destroying the configuration, the data stored on the appliance, and any encryption keys

Deleting data from clients to verify restore from S3 storage

Reapplying the previously saved configuration to the AVA400 appliance

Restoring the archived data from S3 storage by executing the Prepopulation task from the AltaVault Storage menu

Performing a restore from the NetBackup client and verifying data integrity

Off-premises disaster recovery The verification consisted of the following tasks:

Backing up the AVA400 configuration to a safe location

Shutting down the AVA400 appliance to simulate site failure

Configuring an AVA-v8 appliance with an IP address different from the IP address of the failed AVA400 appliance to simulate a remote DR location

Importing shared data only and not the full configuration; for this step, the encryption key passphrase was required



Test Case Details

Restoring the archived data from S3 storage by executing the Prepopulation task from the AltaVault Storage menu

Performing a restore from the NetBackup client and verifying data integrity

7 Conclusion

AltaVault coupled with FlexPod Datacenter with NetApp All Flash FAS and Cisco ACI is an optimal

shared infrastructure that scales beyond the boundaries of the private cloud into the public cloud with

ease of use and a low cost of ownership not typically seen with traditional tape backup methods. With

AltaVault, DR strategies are no longer limited to specific locations, and DR solutions can be obtained

without excessive costs and the ongoing maintenance and limited capacity of tape libraries.

This infrastructure, which has a proven and validated design, can support multiple use cases and

applications. The flexibility afforded by customers’ ability to use multiple cloud service providers translates

to total data sovereignty and control. The efficiency of AltaVault deduplication accelerates data archiving

and lowers the cost of remote storage.

References

NetApp References

NetApp All Flash FAS http://www.netapp.com/us/products/storage-systems/all-flash-fas/

NetApp AltaVault Cloud Integrated Storage Deployment Guide https://library.netapp.com/ecm/ecm_download_file/ECMP12434738

NetApp AltaVault Cloud Integrated Storage Installation and Service Guide for Virtual Appliances https://library.netapp.com/ecm/ecm_download_file/ECMP12455064

NetApp AltaVault Cloud Integrated Storage User’s Guide https://library.netapp.com/ecm/ecm_download_file/ECMP12510035

NetApp Data ONTAP 8.3 Operating System http://www.netapp.com/us/products/platform-os/data-ontap-8/index.aspx

NVA-0019-DESIGN: NetApp AltaVault and Symantec NetBackup Solution with FlexPod Datacenter and ACI http://www.netapp.com/us/media/nva-0019-design.pdf

TR-4405: NetApp AltaVault Cloud-Integrated Storage Appliance: Security Overview http://www.netapp.com/us/media/tr-4405.pdf

TR-4414: NetApp AltaVault Cloud-Integrated Storage Appliance: Best Practices Guide for Backup Applications http://www.netapp.com/us/media/tr-4414.pdf

TR-4420: NetApp AltaVault Cloud-Integrated Storage Appliance: Best Practices for Disaster Recovery http://www.netapp.com/us/media/tr-4420.pdf

TR-4427: NetApp AltaVault Cloud-Integrated Storage Appliance: Technology Overview http://www.netapp.com/us/media/tr-4427.pdf

For more information about NetApp technologies, consult the NetApp public document library at

http://www.netapp.com/us/library/.

http://www.netapp.com/us/products/storage-systems/all-flash-fas/




http://www.netapp.com/us/products/platform-os/data-ontap-8/index.aspx


http://www.netapp.com/us/media/tr-4405.pdf




http://www.netapp.com/us/library/



Cisco References

FlexPod Datacenter with NetApp All Flash FAS, Cisco Application Centric Infrastructure, and VMware vSphere Design Guide http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/UCS_CVDs/flexpod_esxi55u2_n9k_aci_aff8040_design.html#_Toc425435684

FlexPod Datacenter with NetApp All Flash FAS, Cisco Application Centric Infrastructure, and VMware vSphere Deployment Guide http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/UCS_CVDs/flexpod_esxi55u2_n9k_aci_aff8040.html

Symantec References

Symantec NetBackup http://www.symantec.com/products-solutions/families/?fid=netbackup-platform

Symantec NetBackup Administrator’s Guide https://support.symantec.com/en_US/article.DOC6452.html

Version History

Version Date Document Version History

Version 1.0 November 2015 Initial release

http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/UCS_CVDs/flexpod_esxi55u2_n9k_aci_aff8040_design.html%23_Toc425435684

http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/UCS_CVDs/flexpod_esxi55u2_n9k_aci_aff8040_design.html%23_Toc425435684



http://www.symantec.com/products-solutions/families/?fid=netbackup-platform




Refer to the Interoperability Matrix Tool (IMT) on the NetApp Support site to validate that the exact

product and feature versions described in this document are supported for your specific environment.

The NetApp IMT defines the product components and versions that can be used to construct

configurations that are supported by NetApp. Specific results depend on each customer's installation in

accordance with published specifications.

Trademark Information

NetApp, the NetApp logo, Go Further, Faster, AltaVault, ASUP, AutoSupport, Campaign Express, Cloud

ONTAP, Clustered Data ONTAP, Customer Fitness, Data ONTAP, DataMotion, Fitness, Flash Accel,

Flash Cache, Flash Pool, FlashRay, FlexArray, FlexCache, FlexClone, FlexPod, FlexScale, FlexShare,

FlexVol, FPolicy, GetSuccessful, LockVault, Manage ONTAP, Mars, MetroCluster, MultiStore, NetApp

Insight, OnCommand, ONTAP, ONTAPI, RAID DP, RAID-TEC, SANtricity, SecureShare, Simplicity,

Simulate ONTAP, SnapCenter, Snap Creator, SnapCopy, SnapDrive, SnapIntegrator, SnapLock,

SnapManager, SnapMirror, SnapMover, SnapProtect, SnapRestore, Snapshot, SnapValidator,

SnapVault, StorageGRID, Tech OnTap, Unbound Cloud, WAFL, and other names are trademarks or

registered trademarks of NetApp Inc., in the United States and/or other countries. All other brands or

products are trademarks or registered trademarks of their respective holders and should be treated as

such. A current list of NetApp trademarks is available on the web at

http://www.netapp.com/us/legal/netapptmlist.aspx. NVA-0019-DEPLOY-1115

Copyright Information

Copyright © 1994–2015 NetApp, Inc. All rights reserved. Printed in the U.S. No part of this document

covered by copyright may be reproduced in any form or by any means—graphic, electronic, or

mechanical, including photocopying, recording, taping, or storage in an electronic retrieval system—

without prior written permission of the copyright owner.

Software derived from copyrighted NetApp material is subject to the following license and disclaimer:

THIS SOFTWARE IS PROVIDED BY NETAPP "AS IS" AND WITHOUT ANY EXPRESS OR IMPLIED

WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF

MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WHICH ARE HEREBY

DISCLAIMED. IN NO EVENT SHALL NETAPP BE LIABLE FOR ANY DIRECT, INDIRECT,

INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF

LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR

OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

OF THE POSSIBILITY OF SUCH DAMAGE.

NetApp reserves the right to change any products described herein at any time, and without notice.

NetApp assumes no responsibility or liability arising from the use of products described herein, except as

expressly agreed to in writing by NetApp. The use or purchase of this product does not convey a license

under any patent rights, trademark rights, or any other intellectual property rights of NetApp.

The product described in this manual may be protected by one or more U.S. patents, foreign patents, or

pending applications.

RESTRICTED RIGHTS LEGEND: Use, duplication, or disclosure by the government is subject to

restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software

clause at DFARS 252.277-7103 (October 1988) and FAR 52-227-19 (June 1987).

http://support.netapp.com/matrix/mtx/login.do

http://www.netapp.com/us/legal/netapptmlist.aspx

netapp altavault and symantec netbackup solution with ... · the netapp altavault and symantec...

Documents