Configuring an isolated recovery environment on a NetBackup BYO media server
You can configure an isolated recovery environment (IRE) on a NetBackup BYO media server to create an air gap between your production environment and a copy of the protected data. The air gap restricts network access to the IRE environment all the time. This feature helps to protect against ransomware and malware. To configure an IRE, you need a production NetBackup environment and a NetBackup IRE environment with MSDP server configured in a BYO Media server. The production environment does not require any additional steps for this feature.
Use the following procedure to configure an IRE on a BYO media server.
To configure an IRE on a BYO media server
- Note that this procedure applies only to NetBackup 10.1 and later.
Log in to the media server.
- This step is optional. Use this step in any of the following conditions:
You want to enable IRE on an existing system.
AIR SLP is already configured.
You want to configure the IRE schedule in step 4 based on the existing SLP window.
Run the following command to show the SLP windows for replication from the primary server to the MSDP storage on the media server:
/usr/openv/pdde/shell/bin/show_slp_windows --production_primary_server production primary server name --production_primary_server_username production primary server username --ire_primary_server target primary server name --ire_primary_server_username target primary server username [--production_use_apikey] [--ire_use_apikey]
Where:
The production primary server name is the fully qualified domain name (FQDN) of the primary server in your production environment.
The production primary server username is the username of a NetBackup user with permission to list SLPs and SLP windows in the production environment.
The production primary server username must be in domain_name\user_name format on Windows.
The target primary server name is the FQDN of the primary server in the IRE. Use the same hostname that you used to configure the SLPs in the production environment.
The target primary server username is the username of a NetBackup user with permission to list the SLPs and storage units in the IRE environment.
The target primary server username must be in domain_name\user_name format on Windows.
For example:
production_primary_server=examplePrimary.domain.com production_primary_server_username=appadmin ire_primary_server=exampleIREPrimary.domain.com ire_primary_server_username=appadmin
The following is an example output of the command:
EveryDayAtNoon: SLPs: SLP1 Sunday start: 12:00:00 duration: 00:59:59 Monday start: 12:00:00 duration: 00:59:59 Tuesday start: 12:00:00 duration: 00:59:59 Wednesday start: 12:00:00 duration: 00:59:59 Thursday start: 12:00:00 duration: 00:59:59 Friday start: 12:00:00 duration: 00:59:59 Saturday start: 12:00:00 duration: 00:59:59 WeeklyWindow: SLPs: SLP2 Sunday start: 10:00:00 duration: 01:59:59 Monday NONE Tuesday NONE Wednesday NONE Thursday NONE Friday NONE Saturday start: 10:00:00 duration: 01:59:59
This example shows two SLP windows:
A daily window for one hour starting at noon.
A weekly window for 2 hours starting at 10 A.M.
Note:
If an SLP window is greater than 24 hours, the show-slp-windows may display the duration incorrectly.
- Based on the output for your environment, determine a daily schedule that accommodates the SLP windows and take note of it. In the previous example, a daily schedule from 10 A.M. to 12:00 P.M. accommodates both SLP windows.
The start times in the output of this command are in the IRE server's time zone.
Note:
If the time zone of the production primary server is changed, you must restart the NetBackup services.
- Run the following command to configure the subnets and IP addresses that are allowed to access the media server:
/usr/openv/pdde/shell/bin/ire_network_control allow-subnets --subnets CIDR subnets or IP addresses
Where the CIDR subnets or IP addresses field is a comma-separated list of the allowed IP addresses and subnets in CIDR notation.
For example:
/usr/openv/pdde/shell/bin/ire_network_control allow-subnets --subnets 10.10.100.200,10.80.40.0/20
Note:
The IRE primary server, the IRE media servers, and the DNS server for the IRE environment must be included in the allowed list. If all these servers are in the same subnet, only the subnet is required to be in the allowed list.
Note:
If your network environment is dual stack, ensure that both IPv4 and IPv6 subnets and IP addresses of the IRE domain are configured in allowed subnets. For example, if you specify only IPv6 subnets in the allowed subnet, all the IPv4 addresses are not allowed to access the IRE storage server.
- Run the following command to set the daily air gap schedule:
/usr/openv/pdde/shell/bin/ire_network_control set-schedule --start_time time --duration duration [--weekday 0-6]
weekday is optional. It starts from Sunday. You can configure different network and open or close window for a specific weekday. If it is not specified, the IRE schedule is the same on each day.
For example:
/usr/openv/pdde/shell/bin/ire_network_control set-schedule --start_time 10:00:00 --duration 03:00:00
Note:
The SLP replication window on the production domain must be configured to be open at the same time as the IRE schedule. The IRE schedule window can be different for weekdays. You can configure a window for a specific weekday.
For example:
/usr/openv/pdde/shell/bin/ire_network_control set-schedule --start_time 11:00:00 --duration 10:00:00 --weekday 0
Note:
If the production and the IRE environments are in different time zones, the schedule must begin only once per day in both time zones.
For example, if one environment is in the Asia/Kolkata time zone and the other is in the America/New_York time zone, the following schedule in Kolkata is not supported: Tuesday start time 22:00:00 and Wednesday start time 03:00:00. When these start times are converted to the New York time zone, they become Tuesday start time 12:30:00 and Tuesday start time 17:30:00, which is not supported.
Note:
If you want to open air gap network for 24 hours on all days, you do not need to configure IRE schedule. However, the IRE media server restricts the network access from the hosts that are not configured in the subnets that the air gap allows.