About MSDP encryption using NetBackup KMS service
Access Appliance incorporates Key Management Server (KMS) with Media Server Deduplication Pool. MSDP encryption carries out segment-level encryption and assigns a unique encryption key for every data segment. A customer key is retrieved from NetBackup KMS to encrypt the segment key. Key creation and activation actions must be done manually (or using scripts) by the user.
The version of the NetBackup primary server which is to be used as the KMS server should be 10.1.1 for KMS encryption.
Pre-requisite:
Set up secure communication between Access Appliance and the primary server in its domain.
You can use the kms enable command to enable encryption in the deduplication server using KMS. The key group specified should have an active key for encryption to work. Ensure that secure communication has been set up between the deduplication server and the NetBackup primary server before enabling KMS. The deduplication server is restarted as a part of the kms enable command.
dedupe> kms enable primary_server keygroup config_name
primary_server | FQDN of the NetBackup primary server which is also the KMS server. |
keygroup | Name of the key group whose active key is used to encrypt data. |
config_name | Name for the deduplication service in which KMS is to be enabled. Note: This is an optional parameter when only one deduplication server is present in the cluster. It is mandatory if more than one deduplication servers are present. |
The kms enable command can be used to enable external KMS in Access Appliance MSDP. Ensure that the NetBackup primary server is already configured to work with the external KMS.
The encryption and KMS status of the deduplication servers can be verified with the dedupe show command. After you enable the KMS server, the existing unencrypted data can be encrypted with KMS encryption by running the encryption crawler.
If the MSDP storage server is being used in multiple NetBackup domains, backup and restores from other domains fail if secure communication has been set up with the NetBackup primary server or the NetBackup KMS server. To avoid the backup and restore failure from other domains, you must set up trust between the NetBackup primary server with which secure communication has been set up, and the rest of the NetBackup primary servers. You can set up trust using the same steps that you use to set up AIR between two appliances.
For detailed steps, refer to the NetBackup™ Deduplication Guide on SORT.