About MSDP multi-domain support
An MSDP storage server is configured in a NetBackup media server. The NetBackup media servers and clients in the NetBackup domain can use this storage server. By default, the NetBackup media servers and clients cannot directly use an MSDP storage server from another NetBackup domain. For example, NetBackup media servers or clients cannot backup data to an MSDP storage server from another NetBackup domain.
To use an MSDP storage server from another NetBackup domain, the MSDP storage server must have multiple MSDP users. Then NetBackup media servers or clients can use the MSDP storage server from another NetBackup domain by using a different MSDP user. Multiple NetBackup domains can use the same MSDP storage server, but each NetBackup domain must use a different MSDP user to access that MSDP storage server.
To add an MSDP user on an MSDP storage server, run the following command:
Windows
<install_path>\pdde\spauser -a -u <username> -p <password> --role admin
UNIX
/usr/openv/pdde/pdcr/bin/spauser -a -u <username> -p <password> --role admin
If the storage server is NetBackup WORM Storage Server or NetBackup Flex Scale storage server, run following NetBackup Deduplication Shell command:
setting MSDP-user add-MSDP-user username=<username> [role=<role-name>]
Where, role is optional, which can be admin or app. If the role is not specified, the default role admin is used.
To list all the MSDP users, run the following command on the MSDP storage server:
Windows
<install_path>\pdde\spauser -l
UNIX
/usr/openv/pdde/pdcr/bin/spauser -l
If the storage server is NetBackup WORM Storage Server or NetBackup Flex Scale storage server, run following NetBackup Deduplication Shell command:
setting MSDP-user list
Note:
We recommend that the total number of MSDP users that you create to support the multi-domain should not exceed 128 users.
To use an MSDP storage server from another NetBackup domain, you must obtain a NetBackup certificate from another NetBackup domain.
Run the following commands on every NetBackup media server or client that wants to use an MSDP storage server from another domain:
Windows
install_path\NetBackup\bin\nbcertcmd -getCACertificate - server another_primary_server
install_path\NetBackup\bin\nbcertcmd -getCertificate - server another_primary_server -token token_string
UNIX
/usr/openv/netbackup/bin/nbcertcmd -getCACertificate - server another_primary_server
/usr/openv/netbackup/bin/nbcertcmd -getCertificate - server another_primary_server -token token_string
If the storage server is NetBackup WORM Storage Server or NetBackup Flex Scale storage server, run the following NetBackup Deduplication Shell command:
setting certificate get-CA-certificate primary_server=another_primary_server
setting certificate get-certificate primary_server=another_primary_server token=token_string
Use either of these two methods to obtain the authorization tokens:
NetBackup web UI
On the left, click .
Click to create a token.
NetBackup commands
Use the bpnbat command to log on the target NetBackup primary server.
Use the nbcertcmd command to get the authorization tokens.
For more information on the commands, refer to the NetBackup Commands Reference Guide.
The following table describes the hierarchy that is used in the example:
NetBackup domain A | NetBackup domain B |
|---|---|
|
|
|
PrimaryA is the host name of the primary server of NetBackup domain A and the domain contains two media servers (mediaA1, mediaA2), and one client (clientA). PrimaryB is the host name of the primary server of NetBackup domain B and the domain contains one media server (mediaB).
Using the following sample steps, create an MSDP storage server in domain B and let domain A use the MSDP storage server:
Create an MSDP storage server on the media server
mediaBof NetBackup domain B.Open the web UI.
On the left, click .
On the Storage servers tab, click and select .
Run the following command on
mediaBto create a new MSDP usertestuser1with password astestuser1pass.spauser -a -u "testuser1" -p "testuser1pass" --role admin
Run the following command on
mediaA1to get a CA certificate and a host certificate fromprimaryB.nbcertcmd -GetCACertificate -server primaryB
nbcertcmd -GetCertificate -server primaryB -token <token_string>
Create an MSDP OpenStorage server on
mediaA1of NetBackup domain A.Open the web UI.
On the left, click .
On the Storage servers tab, click and select .
Then the OpenStorage server type is PureDisk, the Storage server name is
mediaB, the username istestuser1, and the password istestuser1pass.You must enter the server type as PureDisk.
Now
mediaA1of the NetBackup domain can use the MSDP storage servermediaB. To usemediaA2as a load balance server of the MSDP storage server, you can run the following certificate command onmediaA2:nbcertcmd -GetCACertificate -server primaryBnbcertcmd -GetCertificate -server primaryB -token <token_string>
To run client-direct backup from
clientAto MSDP storage servermediaB, run the following certificate command onclientA:nbcertcmd -GetCACertificate -server primaryB
nbcertcmd -GetCertificate -server primaryB -token <token_string>
After creating the MSDP OpenStorage server, create a related NetBackup disk pool and storage unit. Use the storage unit to run all the related NetBackup jobs.
When multi-domain is used with optimized duplication or A.I.R., there is communication between the MSDP storage servers from two different NetBackup domains. The MSDP storage server from the other domain must have a certificate generated by primary server of the local NetBackup domain. Run the nbcertcmd commands on the source side MSDP storage server to request a certificate from the NetBackup primary server of the target MSDP storage server.
When backup and restore jobs on the client and multi-domain are used together, there is communication between the NetBackup client and MSDP storage server from two different NetBackup domains. Run the nbcertcmd commands on the NetBackup client to request a certificate from the NetBackup primary server of MSDP storage server.
When one NetBackup domain uses the MSDP storage server of another NetBackup domain, the MSDP storage server cannot be the A.I.R target of that NetBackup domain.
If an external CA is used in the NetBackup setup, you do not need to run the nbcertcmd - GetCACertificate and the nbcertcmd - GetCertificate commands. If NetBackup domains A and B do not use the same external CA, synchronize the external root CA between the two NetBackup domains for MSDP communication.
For more information of the external CA, refer to NetBackup Security and Encryption Guide.
When one NetBackup domain uses an MSDP storage server that has multiple network interfaces and related host names, another NetBackup domain can use any one host name to configure the OpenStorage server. If the MSDP storage server that has multiple host names uses an external CA, the field of the external certificate must contain all the host names that are used to configure the OpenStorage server.
Only local storage of one MSDP storage can be used by other NetBackup domains. Cloud LSU in one MSDP storage server cannot be used by other NetBackup domains. Different NetBackup domains should not use the same MSDP user to access the MSDP storage server or it will cause the storage server to shut down after several minutes. To solve this issue, See Trouble shooting multi-domain issues.
If there is a data corruption in the MSDP storage server, only the first domain of the MSDP storage server receives the data corruption notification. With multi-domain, one storage server is used by multiple NetBackup domains, and each domain can check space usage of this storage server. The used space of the storage server is the sum of data from all domains.
Note:
The universal share backup to the target domain is not supported in the multi-domain setup.