Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. NetBackup™ Security and Encryption Guide
  3. Section II. Encryption of data-in-transit
  4. Configuring data-in-transit encryption (DTE)
  5. How DTE configuration settings work in various NetBackup operations
  6. Duplication
NetBackup™ Security and Encryption Guide

Duplication

In the duplication workflow, a backup copy is copied from one storage unit to another storage unit, so there is no client that comes into picture. The hosts that participate are source media server and target media server from the same domain.

Table: The image DTE mode is Off

Global DTE mode

Both media servers are 9.1 or later with DTE mode

One of the media servers is earlier than 9.1

On

Off

Preferred Off

Data is not encrypted

Data is not encrypted

Data is not encrypted

Preferred On

Data is encrypted

Data is not encrypted

Data is not encrypted

Enforced

Data is encrypted

Operation fails

Operation fails

Table: When the image DTE mode is On and the media server DTE setting is On

Global DTE mode

Host

Value of the DTE_IGNORE_IMAGE_MODE configuration option

NEVER (default)

WHERE_UNSUPPORTED

ALWAYS

Preferred Off

Both NetBackup media servers 9.1 or later

Data is encrypted

Data is encrypted

Data is not encrypted

Any NetBackup media server earlier than 9.1

Operation fails

Data is not encrypted

Data is not encrypted

Preferred On

Both NetBackup media server 9.1 or later

Data is encrypted

Data is encrypted

Data is encrypted

Any NetBackup media server earlier than 9.1

Operation fails

Data is not encrypted

Data is not encrypted

Enforced

Both NetBackup media server 9.1 or later

Data is encrypted

Data is encrypted

Data is encrypted

Any NetBackup media server earlier than 9.1

Operation fails

Operation fails

Operation fails

Note:

If DTE_IGNORE_IMAGE_MODE is set to ALWAYS, the DTE decision is as per the table - Table: The image DTE mode is Off .

Table: When the image DTE mode is On and the media server DTE setting on 10.0 or later is Off

Global DTE mode

Value of the DTE_IGNORE_IMAGE_MODE configuration option

NEVER

WHERE_UNSUPPORTED

ALWAYS

Preferred Off

Operation fails

Operation fails

Data is not encrypted

Preferred On

Operation fails

Operation fails

Data is not encrypted

Enforced

Operation fails

Operation fails

Operation fails

Feedback

Was this page helpful?
Previous

Catalog backup and recovery

Next

Synthetic backup

Feedback

Was this page helpful?