Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. NetBackup™ Security and Encryption Guide
  3. Security deployment models
  4. Multi-datacenter with standard NetBackup
NetBackup™ Security and Encryption Guide

Multi-datacenter with standard NetBackup

A multi-datacenter with standard NetBackup is defined as a medium to large group of hosts (greater than 50). These hosts can span two or more geographic regions and can be connected by a Wide Area Network (WAN). In this example one datacenter is located in London and the other datacenter is located in Tokyo. Both datacenters are connected through a dedicated WAN connection.

A multi-datacenter includes the hosts that are both internal only and those that expand through the DMZ to the Internet. This configuration typically has centralized naming service for hosts (such as DNS or WINS). It also has a centralized naming service for users (such as NIS or Active Directory).

The multi-datacenter with standard NetBackup includes the following highlights:

  • NetBackup spans two or more geographic regions through a WAN

  • Centralized naming services typically exist

  • Greater than 50 hosts in size

  • Simplest to configure; requires only general NetBackup knowledge

  • Assumes no fear of passive data interception on the wire as the backup runs

The following table describes the NetBackup parts that are used with a multi-datacenter that has implemented standard NetBackup.

Table: NetBackup parts for a multi-datacenter with standard NetBackup implemented

Part

Description

London datacenter

Contains the primary server, media server 1, client 4 standard NetBackup, and the unencrypted data tape for client 4. The London datacenter connects to the Tokyo datacenter through a dedicated WAN connection.

Tokyo datacenter

Contains the media server 2, client 10 standard NetBackup, and the unencrypted data tape for client 10. The Tokyo datacenter connects to the London datacenter through a dedicated WAN connection.

Wide Area Network (WAN)

Specifies the dedicated WAN link that connects the London datacenter to the Tokyo datacenter. The WAN provides connectivity between the primary server and media server 2 and client 10.

Primary server

Specifies that it is located in London and communicates with media server 1 in London. The primary server also communicates over the WAN with the media server 2 in Tokyo. The primary server communicates with standard NetBackup client 4 in London and client 10 over the WAN in Tokyo.

Media servers

Specifies that the multi-datacenter can have two media servers. One media server is in London and the other is in Tokyo. The media server 1 in London communicates with the primary server and standard NetBackup client 4 also in London. Media server 1 manages the writing of unencrypted data to tape for client 4 in London.

The media server 2 in Tokyo communicates with the primary server in London and standard NetBackup client 10 in Tokyo. Media server 2 manages the writing of unencrypted data to tape for client 10 in Tokyo.

Tapes

Specifies that tapes are produced in both the London and Tokyo datacenters. The London tape contains unencrypted backup data that is written for client 4. The Tokyo tape contains unencrypted backup data that is written for client 10.

Clients

Specifies that the clients are located in both the London and Tokyo datacenters. Clients 4 and 10 are standard NetBackup types. Both clients can be managed by the primary server that is located in London. Their unencrypted data is backed up to tape by the media server. Unencrypted data is written to both client 4 tape in London and client 10 tape in Tokyo. Note that all NetBackup traffic for client 10 lookup is sent unencrypted over the wire (WAN) from Tokyo to London.

Internal firewalls

Specifies that internal firewalls are not used at the London or Tokyo datacenter with standard NetBackup.

Demilitarized Zones (DMZs)

Specifies that DMZs are not used at the London or Tokyo datacenter with standard NetBackup.

External firewalls

Specifies that external firewalls are not used at the London or Tokyo datacenter with standard NetBackup.

Internet

Specifies that the Internet is not used at the London or Tokyo datacenter with standard NetBackup.

Feedback

Was this page helpful?
Previous

Single datacenter with NBAC complete

Next

Multi-datacenter with client side encryption

Feedback

Was this page helpful?