NDMP Backup NetAPP

[dietmar]

Hi,

We need to protect the NetApp against Randsomware attack . ( airgap to Tape )

As we could not do any snapdiff anymore ( v3 is not supported by ISP )

The Netapp has no FC Adapter , just a Filer . I think the NDMP Dump to Tape is only possible if they have + share the SAN , correct ?

We looked into it a bit what i have seen i could use a dedicated stg container with type NetAppdump . ( with dedup ,compression )

What are the possiblities to get this on Tape ?

stg Protect type local ?
STG Rule to dehydrate the dumps to tape ( possible ? )

I mean it could be very ugly if we need to repair the Container first to be able to restore the NDMP data ?

If we use the TOC Feature from NDMP Backup's , will those toc scanning faster than the baclient incremential file scan ?

No idea how this works, but if those are just big files , those should be a good point to restore from Tape directly ?

Any do not do this , or best practices would be very welcomed ...

thx, Dietmar

 

[marclant]

stg Protect type local ?
STG Rule to dehydrate the dumps to tape ( possible ? )

I mean it could be very ugly if we need to repair the Container first to be able to restore the NDMP data ?

Just some information here regarding the repair.

• Protect stg type=local can be used to repair the container pool, but clients cannot restore from those tapes, the pool needs to be repaired first.
• The stgrule copy to tape cannot be used to repair the container pool, but clients can restore from those tapes, the same way as they are able to restore from copy pool tapes with a traditional storage pool.

Ideally, you would want both the protect and the copy to tape. The protect to tape is limited to small environment due to the time required to repair the storage pool. Check this to see if protect to local is right for you: https://www.ibm.com/docs/en/spectru...tainer-copy-storage-pools-disaster-protection

 

[dietmar]

Hi Marc,

thx for your answer .

So the general solution atm for DR is then .

* Use small STGPools Containers on different Replication Target servers ( with stgrule ) where a dehydrate to Tape does not work or makes no sense ( many (MIO) small files , or VMWARE TDP ) and use protect local . ( sadly it is not possible to synthetic dehydrate a full disk/vmware disk as image to Tape ) This would get the Tape to stream.... ( image backup of windows servers restores fine from tape , but not a PIT restore from incrementials - unusable )
* Use stg rules to dehydrate "big" files as much as possible . ( DB Dumps, NDMP hopefully )

We have an expected volume of 150 TB on the NetApp. We will do 2 datamover's for the different volumes ?

I guess we will need a weekly FULL ( 2 days ) and then DIFF during weekdays . I hope we will manage that amount of data ... *hm* ( backup , stgrule + maybe optional protect local to tape if we left out our primary backup Server where no Tape is connected )

I have also read that there are limitation about containers saving NDMP Data . Our current solution is :

* Backup client to primary backup server , protect to target server, replicate to target server , protect local to tape + stgrule to tape as testing for some special backups .

could we use this also for dedicated NDMP Container pools ? Does NDMP needs/supports replication , or is this protect to target server needed only ? I have read that replicate is not supported by NDMP pools ? Or did i miss read something ? The reason would be to repair the containers from Disk Data , and only copy dehydrated NDMP Volumes to Tape for DR (once weekly after full is finished ) . I think ~ 150 TB would be to much on one Server . ( protect local + dehydrate ) .

We will do some testing next week. Will post the results .

Any more Info on that matter ( Netapp NDMP and or DR to Tape considerations )

The hole File Versioning/Backup is done on the NetApp. The Backup is needed "only" for DR . ( randsomware ... )

br, Dietmar

 

[fredric]

If you backup the Netapp data to a backup client(node), then you could copy the data to tape via a Retention Set, the data will be hydrated. I'm doing this for our VMware environment and it work fine, separate the ctl files(metadata for VMware) to a separate stg pool(with a copypool) to speed ut the restores from tape.

If you are going to store the Netapp data for long time, it could require a lot of licenses, you can use the archive license option if you use Retention set.
Remember to also backup the Spectrum Protect internal databas to tape after copying the Netapp data to tape.
Another solution for protect your Netapp data is to use Netapp Snaplock (need a license) on your Snapvault, it makes the snapshots read only and can't be removed until the retention expire.

Remember to test, test and test.... there will be new things you didn't thought about the first time and it the restore will probably take longer time than you want.

Let us know how it goes, I also have some Netapp systems.

//Fredric

 

[dietmar]

HI Fredric,

(off-topic)
I have a Case open about retrule of vmware Data to Tape + CTL Files to Tape CopyPools . My first restore Test where very very slow and are extrem depended on when the last full took place. But even if i tried a full restore without Inc it was not able to stream . Currently we are trying to use Image Backup C + Criestie . The image restore is 1 file dehydrated and restores with 200MB/s from Tape. The VM Blocks are small and i think not written in sequence on Tape. But thats a different story which i need to follow after getting the netapp working .

We only will do a Backup of the Netapp for disaster recovery . The Versioning is done on the NetApp .

What would be interesting if you use VIRTUALFSmapping ?
Backup from the Server or Client ?
Multible Clients ?

Of course we will test Backup and Restore + retule to Tape Restores .

Currently we have some setup issues , the def datamover returns errors ( rc=4) where we look into today ...

Thx for your reply, Dietmar

 

[fredric]

HI Fredric,

(off-topic)
I have a Case open about retrule of vmware Data to Tape + CTL Files to Tape CopyPools . My first restore Test where very very slow and are extrem depended on when the last full took place. But even if i tried a full restore without Inc it was not able to stream . Currently we are trying to use Image Backup C + Criestie . The image restore is 1 file dehydrated and restores with 200MB/s from Tape. The VM Blocks are small and i think not written in sequence on Tape. But thats a different story which i need to follow after getting the netapp working .

We only will do a Backup of the Netapp for disaster recovery . The Versioning is done on the NetApp .

What would be interesting if you use VIRTUALFSmapping ?
Backup from the Server or Client ?
Multible Clients ?

Of course we will test Backup and Restore + retule to Tape Restores .

Currently we have some setup issues , the def datamover returns errors ( rc=4) where we look into today ...

Thx for your reply, Dietmar

Hi Dietmar ,
I have only performed some tests to restore a VM from a Retrule archive on tape. After spliting the ctl files to a separate diskpool (protected by copypool) it worked much better. If the diskpool is unavailable, you must first restore the ctl files before you restore the VM's.

I have not backup our Netapp filers to the backup server in many years. I think I used Snapdiff, but it not available any more.

Will it not be very much data to backup the entiry Netapp? How will you license it?

Good luck!

//Fredric