About MSDP mutli-domain VLAN Support
MSDP supports multi-domain NetBackup setups. In a multi-domain set-up, it is important for primary servers from other domains to connect with the MSDP storage server and the primary server of the NetBackup domain that contains the MSDP server. The primary servers and media servers must have multiple network interfaces and host names in a multi-domain setup.
When you configure MSDP VLAN, the local NetBackup domain and the other NetBackup domain must have the NetBackup version 8.2 or later.
The following table describes the hierarchy that is used in the example:
NetBackup domain A | NetBackup domain B |
|---|---|
|
|
|
primaryA is the primary server of domain A and has two host names and IP addresses. mediaA is the media server of domain A and has two host names and IP addresses. MSDP storage server is created on media server mediaA.
To let domain B access the MSDP storage server on mediaA of domain A, run the following steps:
Create an MSDP storage server on media server
mediaAof NetBackup domain A.Open the NetBackup web UI. Click . Click on the Storage server tab. Click and select .
Run following command on
mediaAto create a new MSDP usertestuser1with passwordtestuser1pass:spauser -a -u "testuser1" -p "testuser1pass" --role admin
Servers in the domain B can only access IP like 10.XX.40.*, so
primaryA2is used as the primary server host name of domain A.Run following command on
mediaBto get a CA certificate and a host certificate fromprimaryA:nbcertcmd -GetCACertificate -server primaryA2
nbcertcmd -GetCertificate -server primaryA2 -token <token_string>
If the nbcertcmd - GetCACertificate displays the error "The server name does not match any of the host names listed in the server's certificate", refer to the following article to add more host name to primary server:
Create an MSDP OpenStorage server on
mediaBof NetBackup domain B.Open the NetBackup web UI. Click . Click on the Storage server tab. Click and select .
The OpenStorage server name
mediaA2is used as the host name that has the IP address 10.XX.40.*.OpenStorage server type is PureDisk, user name is
testuser1, and password istestuser1pass. You must enter the server type as PureDisk.
Now mediaB of NetBackup domain B can use the MSDP storage server mediaA2 and the network IP address 10.XX.40.*
In a multi-domain NetBackup configuration, there are times when the media server in domain B must know the server certificate of the media server in domain A. For example, this setup is required when a VMware image recovery is performed from domain A to domain B.
To move mediaA2's server certificate to mediaB is a two-step process, and you need to be a privileged user to run the following steps:
Transfer a copy of the NGINX server certificate (
/etc/nginx/keys/spws.cert) frommediaA2tomediaB.Run the following command on
mediaBto import that certificate tomediaB's trusted keystore.Note:
The
storepassandkeypassvalues can be found in/usr/openv/var/global/jkskeyonmediaB.% /usr/openv/java/jre/bin/keytool -keystore /usr/openv/var/global/wsl/credentials/truststoreMSDP.bcfks -storetype BCFKS -providername BCFIPS -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath /usr/openv/analyticscollector/lib/bc-fips-1.0.2.3.jar -storepass 28e523bc7ddfcf91 -keypass 28e523bc7ddfcf91 -alias net126-host161.cdc.veritas.com -import -file spws.cert
Note:
Your version of the
bc-fips-X.X.X.X.jarfile can be different than the one in the previous example. Search that directory forbc-fips*to find the right version for your NetBackup installation.When you run the -list command on
mediaB, you should see something similar to the following example:% /usr/openv/java/jre/bin/keytool -list -keystore /usr/openv/var/global/wsl/credentials/truststoreMSDP.bcfks -storetype BCFKS -providername BCFIPS -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath /usr/openv/analyticscollector/lib/bc-fips-1.0.2.3.jar -storepass 28e523bc7ddfcf91 Keystore type: BCFKS Keystore provider: BCFIPS Your keystore contains 2 entries ca1, Jan 11, 2023, trustedCertEntry, Certificate fingerprint (SHA-256): 4A:52:C8:9E:B1:1F:A9:21:99:3B:AA:5A:0C:B5:C3:2F:51:(string continues) mediaA2, Jan 16, 2023, trustedCertEntry, Certificate fingerprint (SHA-256): AE:34:D1:63:B1:94:33:8C:07:5D:9A:D6:2B:CF:5B:52:D7:(string continues)
The second certificate that is listed is that of
mediaA2.
If an external CA is used in the NetBackup setup, you do not need to run the nbcertcmd - GetCACertificate and the nbcertcmd - GetCertificate commands. If NetBackup domain A and NetBackup domain B do not use the same external CA, you must synchronize the external root CA between the two NetBackup domains for MSDP communication. If the servers have multiple host names, then the Subject Alternative Name field of the external certificate must contain all the host names.