Restoring the disaster recovery package on Windows
After a disaster, you need to restore the disaster recovery package that corresponds to the catalog backup that you want to restore. This package is created during the catalog backup and contains the NetBackup primary server host identity.
Note the following about restoring the disaster recovery package and catalog recovery:
To restore the disaster recovery package, you must install NetBackup in the disaster recovery mode and import the required package. After you recover the disaster recovery package, you can recover the catalog.
After you restore the disaster recovery package, you must immediately perform catalog recovery.
Note the following when you want to recover a clustered primary server:
The disaster recovery package contains the identity files and configuration only for the virtual name.
After the DR installation, the virtual name's certificate is restored.
Cluster node-specific certificates and configuration options are not backed up and therefore are not recovered. You must redeploy or reconfigure NetBackup or external certificates after the DR installation.
After a catalog recovery, NetBackup freezes the removeable media that contains the catalog backup. This operation prevents a subsequent accidental overwrite action on the final catalog backup image on the media. This final image pertains to the actual catalog backup itself, and its recovery is not part of the catalog recovery. You can unfreeze the media.
If any external CA-signed certificates are used in your NetBackup domain, ensure the following:
The certificate file path is configured, accessible, and is the same as the one that was backed up.
You have configured the required certificate revocation lists (CRL) before you begin the disaster recovery installation, if applicable.
Refer to the NetBackup Security and Encryption Guide.
You have copied the required external certificates in the Windows certificate store, if applicable.
In some cases when an external certificate was configured on the primary server before the disaster, the DR installation fails. You can set an environment variable that lets you correct the external certificate configuration.
You can restore the disaster recovery package of the NetBackup primary server either during installation or after installation.
See Restore the disaster recovery package during NetBackup installation on Windows.
See Restore the disaster recovery package after NetBackup installation on Windows.
The following procedure describes how to restore the disaster recovery package during the installation of NetBackup.
To restore the disaster recovery package of the NetBackup Appliance, you must follow a different procedure.
See Restore the disaster recovery package after NetBackup installation on Windows.
To restore the disaster recovery package during NetBackup installation
- Start the NetBackup software installation.
Refer to the "Installing server software on Windows systems" section in the NetBackup Installation Guide.
- On the NetBackup License Key and Server Type screen, select the Disaster Recovery Master Server option.
- On the NetBackup Disaster Recovery screen, specify the location of the disaster recovery package. Click Browse to select the package location that you want to restore.
- Provide the passphrase that is associated with the disaster recovery package that you want to restore.
Caution:
Ensure that you specify the appropriate passphrase.
If you specify a wrong passphrase or the passphrase is lost, you need to deploy security certificates on all hosts after installation. The disaster recovery package cannot be restored during installation. To restore the disaster recovery package after installation, refer to the following article:
- (Conditional) Note the following if any external CA-signed certificates were used in your NetBackup domain at the time of the catalog backup before the disaster. During the DR installation, the Installer shows a warning message to configure the certificate revocation list (CRL). The CRL settings are also displayed that you can configure.
Review the value of the ECA_CRL_CHECK configuration option.
For more information on catalog backup and external certificate configuration options, refer to the NetBackup Administrator's Guide, Volume I.
If the ECA_CRL_CHECK configuration option is set to DISABLE, you do not need to do the CRL configurations.
If the ECA_CRL_CHECK configuration option is enabled, you are prompted to configure the CRL.
Configure the CRLs and continue with the DR installation.
Depending on the value that is specified for the ECA_CRL_PATH option, make the required CRLs available.
If ECA_CRL_PATH is not specified, NetBackup uses the CRLs from the CRL distribution point (CDP) of the peer host's certificate. Ensure that the URLs that are available in the CDP are accessible.
If ECA_CRL_PATH is specified, NetBackup uses the CRLs that are available in the directory that is specified for this option. Copy the valid CRLs in the directory that you specify for ECA_CRL_PATH.
Note the following if you used a Windows certificate store to store the external CA-signed certificates and they were not backed up in the DR package. A warning indicates that you must configure the external CA-signed certificates. Configure the following external certificate configuration options on the primary server according to the valued that are provided in the Installer or in the corresponding disaster recovery email:
ECA_CERT_PATH
ECA_PRIVATE_KEY_PATH
ECA_KEY_PASSPHRASEFILE
ECA_TRUST_STORE_PATH
ECA_CRL_PATH
For more information on external certificate configuration options, refer to the NetBackup Administrator's Guide, Volume I.
(Conditional) If the DR_PKG_MARKER_FILE environment variable was set before the DR installation, a message indicates that the touch file exists. After you complete the external certificate configuration, delete the touch file.
NetBackup services are started.
(Conditional) If the key management service (KMS) was configured on the primary server before the disaster, run the following command to start the KMS service:
Install_path\bin\nbkmscmd -discoverNBKMS
- Refer to the Installing server software on Windows systems section from the NetBackup Installation Guide.
The following procedure describes how to restore the disaster recovery package after the installation of NetBackup.
Use this option to restore the disaster recovery package of the NetBackup Appliance.
To restore the disaster recovery package after NetBackup installation
- Run the nbhostidentity -import -infile file_path command after NetBackup installation.
Refer to the NetBackup Commands Reference Guide.
- Clean up the allowed list cache and restart the NetBackup services on all hosts in the domain.
- Refresh the certificate revocation list (CRL) using the following command:
nbcertcmd -getcrl
- If the key management service (KMS) was configured on the primary server before the disaster, run the following command to start the KMS service:
Install_path\bin\nbkmscmd -discoverNBKMS
- Carry out the given step to remove the NetBackup certificate files in the following scenario:
NetBackup was configured to use only external CA-signed certificates before the disaster and NetBackup was configured to use NetBackup certificates or both NetBackup and external certificates before you manually imported the disaster recovery package.
Remove the NetBackup certificate files using the following command:
configureWebServerCerts -removeNBCert
More Information