Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. NetBackup™ Security and Encryption Guide
  3. Section II. Encryption of data-in-transit
  4. Configuring data-in-transit encryption (DTE)
  5. How DTE configuration settings work in various NetBackup operations
  6. Restore
NetBackup™ Security and Encryption Guide

Restore

In the restore workflow, there can be two DTE scenarios:

  • When the image DTE mode is Off

  • When the image DTE mode is On

In either of the scenarios, there can be one or more media servers involved (if multiple images are selected) while restoring data on a client for single NetBackup job.

Image DTE mode is Off

Table: Media server DTE mode is On (default)

Global DTE mode

DTE mode of NetBackup client 9.1 or later

NetBackup host (media server or client) earlier than 9.1

On

Off

Automatic

Preferred Off

Data is encrypted

Data is not encrypted

Data is not encrypted

Data is not encrypted

Preferred On

Data is encrypted

Data is not encrypted

Data is encrypted

Data is not encrypted

Enforced

Data is encrypted

Operation fails

Data is encrypted

Operation fails

Table: Media server DTE mode is Off

Global DTE mode

DTE mode of NetBackup client 9.1 or later

NetBackup host (media server or client) earlier than 9.1

On

Off

Automatic

Preferred Off

Operation fails

Data is not encrypted

Data is not encrypted

Data is not encrypted

Preferred On

Operation fails

Data is not encrypted

Data is not encrypted

Data is not encrypted

Enforced

Operation fails

Operation fails

Operation fails

Operation fails

Table: Mixed media servers (9.1 and 10.0 or later) - Media1: DTE mode On, Media2: DTE mode Off

Global DTE mode

DTE mode of NetBackup client 9.1 or later

NetBackup host (media server or client) earlier than 9.1

On

Off

Automatic

Preferred Off

Media1 - Data is encrypted

Media2 - Operation fails

Job state - Partial Success

Job DTE mode - On

Media1- Data is not encrypted

Media2 - Data is not encrypted

Media1- Data is not encrypted

Media2 - Data is not encrypted

Media1- Data is not encrypted

Media2 - Data is not encrypted

Preferred On

Media1- Data is encrypted

Media2- Operation fails

Job state - Partial Success

Job DTE mode - On

Media1- Data is not encrypted

Media2 - Data is not encrypted

Media1 - Data is encrypted

Media2 - Data is not encrypted

Job DTE mode - Off

Media1- Data is not encrypted

Media2 - Data is not encrypted

Enforced

Media1 - Data is encrypted

Media2 - Operation fails

Job state - Partial Success

Job DTE mode - On

Media1 - Operation fails

Media2 - Operation fails

Job state - Fail

Media1 - Data is encrypted

Media2 - Operation fails

Job state - Partial Success

Job DTE mode - On

Media1 - Operation fails

Media2 - Operation fails

Job state - Operation fails

Image DTE mode is On

If the image DTE mode is On, the default behavior is to restore with data-in-transit encryption for 9.1 and later hosts and to fail the job if any DTE unsupported host involves in the workflow . However, you can still restore by ignoring the image DTE mode.

Use the DTE_IGNORE_IMAGE_MODE configuration option that is to be set on the primary server. Possible values: NEVER (default) | ALWAYS | WHERE_UNSUPPORTED

Table: When the image DTE mode is On and the media server DTE mode is On

Global DTE mode

Host

Value of the DTE_IGNORE_IMAGE_MODE configuration option

NEVER (default)

WHERE_UNSUPPORTED

ALWAYS

Preferred Off

NetBackup client 9.1 or later with DTE mode ON

Data is encrypted

Data is encrypted

Data is encrypted

NetBackup client 9.1 or later with DTE mode OFF

Operation fails

Operation fails

Data is not encrypted

NetBackup client 9.1 or later with DTE mode AUTOMATIC

Data is encrypted

Data is encrypted

Data is not encrypted

NetBackup host earlier than 9.1 (either media server or client)

Operation fails

Data is not encrypted

Data is not encrypted

Preferred On

NetBackup client 9.1 or later with DTE mode ON

Data is encrypted

Data is encrypted

Data is encrypted

NetBackup client 9.1 or later with DTE mode OFF

Operation fails

Operation fails

Data is not encrypted

NetBackup client 9.1 or later with DTE mode AUTOMATIC

Data is encrypted

Data is encrypted

Data is encrypted

NetBackup host earlier than 9.1 (either media server or client)

Operation fails

Data is not encrypted

Data is not encrypted

Enforced

NetBackup client 9.1 or later with DTE mode ON

Data is encrypted

Data is encrypted

Data is encrypted

NetBackup client 9.1 or later with DTE mode OFF

Operation fails

Operation fails

Operation fails

NetBackup client 9.1 or later with DTE mode AUTOMATIC

Data is encrypted

Data is encrypted

Data is encrypted

NetBackup host earlier than 9.1 (either media server or client)

Operation fails

Operation fails

Operation fails

Table: When the image DTE mode is On and the DTE setting on 10.0 and later media server is Off

Global DTE mode

Host

Value of the DTE_IGNORE_IMAGE_MODE configuration option

NEVER (default)

WHERE_UNSUPPORTED

ALWAYS

Preferred Off

NetBackup Client 9.1 or later with DTE mode ON

Operation fails

Operation fails

Operation fails

NetBackup Client 9.1 or later with DTE mode OFF

Operation fails

Operation fails

Data is not encrypted

NetBackup Client 9.1 or later with DTE mode AUTOMATIC

Operation fails

Operation fails

Data is not encrypted

NetBackup host earlier than 9.1 (either media server or client)

Operation fails

Data is not encrypted

Data is not encrypted

Preferred On

NetBackup Client 9.1 or later with DTE mode ON

Operation fails

Operation fails

Operation fails

NetBackup Client 9.1 or later with DTE mode OFF

Operation fails

Operation fails

Data is not encrypted

NetBackup Client 9.1 or later with DTE mode AUTOMATIC

Operation fails

Operation fails

Data is not encrypted

NetBackup host earlier than 9.1 (either media server or client)

Operation fails

Data is not encrypted

Data is not encrypted

Enforced

NetBackup Client 9.1 or later with DTE mode ON

Operation fails

Operation fails

Operation fails

NetBackup Client 9.1 or later with DTE mode OFF

Operation fails

Operation fails

Operation fails

NetBackup Client 9.1 or later with DTE mode AUTOMATIC

Operation fails

Operation fails

Operation fails

NetBackup host earlier than 9.1 (either media server or client)

Operation fails

Operation fails

Operation fails

Note:

If the DTE_IGNORE_IMAGE_MODE is set to ALWAYS, the DTE decision is as per the table - Table: Media server DTE mode is Off.

Feedback

Was this page helpful?
Previous

Backup

Next

MSDP backup, restore, and optimized duplication

Feedback

Was this page helpful?