Implementation Guide: CDOT Cluster Aware NDMP Backup

Catalogic DPX supports NetApp NDMP interfaces to protect data hosted on NetApp Clustered Data ONTAP mode controllers. NetApp clustered controllers support two modes of NDMP backup access configuration: Node-scoped mode (supported in CDOT 8.1 and above) vServer aware mode (supported in CDOT 8.2 and above).

Supported Configurations

Catalogic DPX supports the following modes of NetApp Cluster controllers for the NDMP backup access configuration:

• Node-scoped mode

• vServer aware mode

Configurations for NetApp Storage Controller

The NetApp system must be properly configured for correct NDMP operation with Catalogic DPX. This section outlines all the setup that must be performed. There are specific and different requirements for NetApp Clustered Data ONTAP 8.1, 8.2, and 8.3, which are noted where necessary.

Hardware

The Tape Library and Drives must be connected to one or more physical nodes of the cluster. Depending on the configuration choices supported by the library, the Media Controller (arm) device may be connected to the same or a different cluster node than the Tape Drive devices, which themselves may also be distributed across nodes to achieve better locality of backup. Catalogic DPX supports any and all of these configurations including use of the Media Controller on a standard DPX Device Server node.

Once the hardware is operational, the following NetApp Clustered Data ONTAP shell (CLI) commands may be used to verify and view the setup:

> system node hardware tape library show

> system node hardware tape drive   show

See the following example of the respective output from the above commands:

These commands display all the devices in the cluster and the physical nodes to which they are connected.

The familiar commands used in Data ONTAP 7-mode are also available but must be issued within a “node” context as shown below. These commands only display content for the referenced physical node.

> system node run -node <nodename> sysconfig -m

> system node run -node <nodename> sysconfig -t

> system node run -node <nodename> mt -f <devicename> status

The names shown for the devices are not necessarily the ones which will be used for configurations in Catalogic DPX.

NDMP Operation Mode

In NetApp Clustered Data ONTAP 8.1 and earlier, the cluster supports only one NDMP operation mode which relates to the physical configuration of the cluster resources. Starting with NetApp Clustered Data ONTAP 8.2, the cluster can be configured for NDMP operation in either of the following mutually exclusive modes:

• Node-scoped mode

• vServer aware mode

Use the following commands to toggle and view the NDMP operation mode:

> system services ndmp node-scope-mode [on|off]

> system services ndmp node-scope-mode status

In either mode, the NDMP service must be enabled on all nodes of the cluster. It is enabled by default but can also be configured by using the following commands:

> system services ndmp [on|off] -node <nodename>

> system services ndmp modify   -node <nodename> -enable [true|false]

If the system is configured for vServer aware mode, the NDMP service must be enabled on each vServer which will participate in NDMP operations. Use the following commands to configure and view status of the NDMP service for vServers.

> vserver services ndmp [on|off] -vserver <vservername>

To enable ndmp on all virtual servers the following command can be used:

> vserver services ndmp [on | off] –vserver *

> vserver services ndmp show

Minimally, this should be enabled for the “cluster” vServer, which may be used to perform centralized backup and restore operations for all resources in the cluster. This is mandatory if any library or drive devices are connected to the cluster. For convenience or multi-tenancy needs, selected “data” vServers can be NDMP enabled, thereby allowing protection of their resources to be independently managed.

NDMP User

Access to NDMP services is controlled by authentication using an eligible user ID. User authentication works differently in node-scoped and vServer aware NDMP operation modes.

In node-scoped mode or NetApp Clustered Data ONTAP 8.1 and earlier, NDMP specific credentials must be used to access the storage system. The default NDMP user ID is root. Before using NDMP on a node, the default password must be changed. You can also change the default user ID. Manage user authentication with the following commands:

> system services ndmp modify   -node <nodename> -user-id 

> system services ndmp password -node <nodename>

In vServer aware mode, NDMP user authentication is integrated with the role-based access control (RBAC) mechanism. A user is eligible to use NDMP services if they belong to specific roles. Users associated with the “cluster” vServer must belong to either the admin or backup roles whereas users associated with a “data” vServer must belong to either the vsadmin or vsadmin_backup roles. The user account must also be associated with the SSH application and the authentication method User password. Additionally, a NDMP specific password must be generated for the user. This password is based on the actual login password for the user and must be regenerated if the login password is changed. The following commands can be used to manage user authentication:

> security login create -vserver <vservername> -username <user>
↪ -applicationssh-authmethod password -role [admin|backup|vsadmin|vsadmin_backup]

> vserver services ndmp generate-password -vserver <vservername> -user <user>

The following output comes from the generate-password command. Note that displayed information is used for adding a vServer to the DPX Enterprise. The same command must be repeated for each vServer you plan to add.

Configurations in Catalogic DPX

When the NetApp storage system has been properly configured for NDMP access, the nodes and devices it contains may be added to the DPX Enterprise. The configuration choices differ depending on the NetApp Clustered Data ONTAP version being used. Catalogic DPX includes “cluster awareness” capability and can operate with NetApp Clustered Data ONTAP systems which are configured in node-scoped or vServer aware NDMP modes.

The following section only applies to vServer aware configurations available in NetApp Clustered Data ONTAP 8.2 and later.

In vServer aware clusters, Catalogic DPX can be configured with a “logical” view of the system and provides immunity from resource movement that may occur within the cluster.

Depending on data protection needs, Catalogic DPX nodes may be defined for the “cluster” vServer and the “data” vServers which have been enabled for NDMP service. If a tape library or drive device is connected to the cluster, the “cluster” vServer must be added since that is the only access path for devices. Use the hostname or IP address of the management logical interface (LIF) of the vServer and the credentials of a role-based access control (RBAC) user eligible for NDMP access.

The process for configuring Tape Libraries or Drives is similar to the standard method for NDMP attached devices with the following exceptions:

• All devices must be defined using the “cluster” vServer node as their host.

• The device ID uses an additional prefix, which is typically the cluster physical node to which the device is actually connected. This takes the following form, for example: /f2240clst-02/mc1 or /f2240clst-01/nrst2a.

The correct Device ID to be used can be manually assembled in the form shown above using information displayed from commands described in the NetApp configuration section above. The device configuration wizard in Catalogic DPX may not work for cluster vServer setups; contact Catalogic Software Technical Support if you need assistance discerning the proper configuration data needed for Tape Library setup.

Catalogic DPX cannot provide live browse capability for volumes under a cluster node with NetApp Clustered Data ONTAP 8.2. NetApp did not support the NDMP Snapshot extension necessary to do this. This affects the ability to select a backup source at a sub volume level (File, Directory or Snapshot) using navigation. Instead, one can manually specify the full path to the source object using the mechanism which Catalogic DPX has always provided when live browsing is not supported. Restore destination selection is similarly affected and can also be manually specified in the same manner.

Catalogic DPX supports live browse capability for volumes under a cluster node for NetApp storage systems using NetApp Clustered Data ONTAP 8.3 or later. This capability requires that the NetApp cluster have vServer aware NDMP mode enabled and the following NetApp options also enabled:

> set advanced

> vserver services ndmp extensions modify -is-extension-0x2050-enabled true

If Catalogic DPX is configured to protect the “cluster” vServer, all volumes in the cluster are accessible under this node and may be selected in a backup job. This facilitates centralized data protection operations. When individual “data” vServers have been configured in Catalogic DPX, only the volumes belonging to that vServer are visible and selectable in a backup job. This allows for some level of multi-tenancy data protection operation when used in combination with the administrative delegation capabilities supported by Catalogic DPX. Note, however, that Tape library and drive management is still centralized.