dell emc avamar virtual edition for azure installation and ... · now the private ipv4 address for...

Dell EMC Avamar Virtual Edition for AzureVersion 7.5.1

Installation and Upgrade Guide302-004-298

REV 03

Copyright © 2016-2018 Dell Inc. or its subsidiaries. All rights reserved.

Published May 2018

Dell believes the information in this publication is accurate as of its publication date. The information is subject to change without notice.

THE INFORMATION IN THIS PUBLICATION IS PROVIDED “AS-IS.“ DELL MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND

WITH RESPECT TO THE INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY DISCLAIMS IMPLIED WARRANTIES OF

MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. USE, COPYING, AND DISTRIBUTION OF ANY DELL SOFTWARE DESCRIBED

IN THIS PUBLICATION REQUIRES AN APPLICABLE SOFTWARE LICENSE.

Dell, EMC, and other trademarks are trademarks of Dell Inc. or its subsidiaries. Other trademarks may be the property of their respective owners.

Published in the USA.

Dell EMCHopkinton, Massachusetts 01748-91031-508-435-1000 In North America 1-866-464-7381www.DellEMC.com

2 Avamar Virtual Edition for Azure 7.5.1 Installation and Upgrade Guide

5

Introduction 9Overview of Avamar Virtual Edition for Azure............................................. 10Appropriate environments for AVE..............................................................10

Installation 13Preinstallation requirements and best practices.......................................... 14

System requirements..................................................................... 14AVE virtual disk requirements.........................................................14Software requirements.................................................................. 15

Installation.................................................................................................. 15Deploying AVE from the Azure Marketplace...................................16Deploy AVE and DDVE together from the Azure Marketplace........ 19Network security group..................................................................21

AVE and DDVE deployment via Azure solution template.............................24Uploading the AVE image.............................................................. 25Solution template parameters........................................................26Deploying AVE and DDVE from the Azure Resource Manager....... 28Deploying AVE and DDVE from Azure Powershell..........................29Post-deployment configuration..................................................... 30

Azure security best practices......................................................................31Installing and configuring the Avamar software.......................................... 33Upgrading the Avamar software................................................................. 34Post-installation and post-upgrade tasks................................................... 35

Using NAT 37Configuring AVE to use NAT.......................................................................38

Preface

Chapter 1

Chapter 2

Appendix A

CONTENTS

Avamar Virtual Edition for Azure 7.5.1 Installation and Upgrade Guide 3

CONTENTS


PREFACE

As part of an effort to improve the product lines, revisions of the software andhardware are periodically released. Therefore, some functions that are described inthis document might not be supported by all versions of the software or hardwarecurrently in use. The product release notes provide the most up-to-date informationon product features.

Contact the technical support professional when a product does not function correctlyor does not function as described in this document.

Note

This document was accurate at publication time. To find the latest version of thisdocument, go to Online Support (https://support.EMC.com).

PurposeThis guide describes how to install the Avamar Virtual Edition solution, a single-node,non-RAIN server that runs as a virtual machine in a Microsoft Azure environment.

AudienceThe information in this guide is primarily intended for system administrators who areresponsible for installing and maintaining Avamar virtual servers.

Revision historyThe following table presents the revision history of this document.

Revision Date Description

01 February 1, 2018 GA release of Avamar 7.5.1

02 February 23, 2018 Additional updates for Avamar7.5.1.

03 May 03, 2018 Added a new sectionDeploying DDVE and AVEfrom the Azure Marketplace.

Related documentationThe following publications provide additional information:

l Avamar Release Notes

l Avamar Administration Guide

l Avamar Operational Best Practices Guide

l Avamar Product Security Guide

l Avamar Backup Clients User Guide


https://support.emc.com/

Special notice conventions used in this documentThese conventions are used for special notices.

DANGER

Indicates a hazardous situation which, if not avoided, results in death or seriousinjury.

WARNING

Indicates a hazardous situation which, if not avoided, could result in death orserious injury.

CAUTION

Indicates a hazardous situation which, if not avoided, could result in minor ormoderate injury.

NOTICE

Addresses practices that are not related to personal injury.

Note

Presents information that is important, but not hazard-related.

Typographical conventionsThese type style conventions are used in this document.

Table 1 Typographical conventions

Bold Used for names of interface elements, such as names of windows,dialog boxes, buttons, fields, tab names, key names, and menu paths(what the user specifically selects or clicks)

Italic Used for full titles of publications that are referenced in text

Monospace Used for:

l System code

l System output, such as an error message or script

l Pathnames, filenames, prompts, and syntax

l Commands and options

Monospace italic Used for variables

Monospace bold Used for user input

[ ] Square brackets enclose optional values

| Vertical bar indicates alternate selections - the bar means “or”

{ } Braces enclose content that the user must specify, such as x or y orz

... Ellipses indicate nonessential information that is omitted from theexample

PREFACE


Where to get helpThe Avamar support page provides access to licensing information, productdocumentation, advisories, and downloads, as well as how-to and troubleshootinginformation. This information may resolve a product issue before contacting CustomerSupport.

To access the Avamar support page:

1. Go to https://support.EMC.com/products.

2. Type a product name in the Find a Product by Name box.

3. Select the product from the list that appears.

4. Click the arrow next to the Find a Product by Name box.

5. (Optional) Add the product to the My Products list by clicking Add to My SavedProducts in the upper right corner of the Support by Product page.

Comments and suggestionsComments and suggestions help to continue to improve the accuracy, organization,and overall quality of the user publications. Send comments and suggestions aboutthis document to [email protected].

Please include the following information:

l Product name and version

l Document name, part number, and revision (for example, 01)

l Page numbers

l Other details to help address documentation issues

PREFACE


https://support.emc.com/products

mailto:[email protected]

PREFACE


CHAPTER 1

Introduction

This chapter includes the following topics:

l Overview of Avamar Virtual Edition for Azure.....................................................10l Appropriate environments for AVE..................................................................... 10

Introduction 9

Overview of Avamar Virtual Edition for AzureAvamar Virtual Edition (AVE) is a single-node non-RAIN (Redundant Array ofIndependent Nodes) Avamar server that runs as a virtual machine in a Microsoft Azureenvironment. AVE integrates the latest version of Avamar software with SUSE Linuxas a Hyper-V virtual machine.

AVE is similar to single-node Avamar servers in the following ways:

l Runs autonomously as a target for all Avamar client backups

l Supports replication in the cloud.AVE on Azure can be used to replicate on-premises physical Avamar servers andAVEs, including non-Azure types of AVEs. However, because of securityconsiderations, replication should be performed by using a VPN, VPC, or a directconnect link.

AVE supports four configurations: 0.5 TB, 1 TB, 2 TB, and 4 TB licensed capacity. AVEis not scalable to a multi-node Avamar server and resizing the virtual machine is notsupported. You can increase storage capacity by deploying additional AVE virtualmachines, and then divide backups among them. Or you can replicate the data toanother AVE server, delete the smaller virtual machine, create a larger virtual machine,and replicate the data back to the larger virtual machine.

Appropriate environments for AVEThe following factors have the most direct impact on the long-term reliability,availability, and supportability of the AVE virtual machine:

l I/O performance capability of the AVE storage subsystem

l Amount of data added daily to the AVE virtual machine (change rate)

l Capacity that is utilized within the AVE virtual machine

Specifications in this section and AVE virtual disk requirements on page 14 describeminimum or maximum requirements for these factors. AVE generally performs betterwhen I/O performance is higher. Change rate and utilized capacity are also lower. Tomaximize the capacity the AVE virtual machine can use, the daily change rate of thedata AVE protects must be balanced with adequate I/O performance.

The first step in determining the proper implementation of AVE is to establish whichkind of customer environment AVE is used to protect, file server or mixedenvironment. File server environments include file system data and mixedenvironments include file system data and structured data (for example, databasedata).

The following table describes the maximum change rates that AVE supports for fileserver and mixed environments.

Table 2 Maximum change rates AVE supports for file server and mixed environments

Configuration File server data Mixed data

0.5 TB AVE Less than 2 GB per day Less than 5 GB per day

1 TB AVE Less than 4 GB per day Less than 10 GB per day


Introduction


Table 2 Maximum change rates AVE supports for file server and mixedenvironments (continued)

Configuration File server data Mixed data


Actual results depend on the retention policy and the actual data change rate. Whenthe daily change rate exceeds the limits that are specified in the previous table, deploya single or multi-node Avamar server.

Introduction

Appropriate environments for AVE 11

Introduction


CHAPTER 2

Installation

This chapter include the following topics:

l Preinstallation requirements and best practices................................................. 14l Installation.......................................................................................................... 15l AVE and DDVE deployment via Azure solution template.....................................24l Azure security best practices............................................................................. 31l Installing and configuring the Avamar software..................................................33l Upgrading the Avamar software.........................................................................34l Post-installation and post-upgrade tasks........................................................... 35

Installation 13

Preinstallation requirements and best practicesBefore you install an AVE virtual machine, follow the preinstallation requirements andreview the best practices in the following sections.

The following items are new for Avamar 7.5.1:

l The default password is no longer a fixed value. Instead, the default password isnow the private IPv4 address for the AVE virtual machine.

l Direct root access via SSH is no longer allowed, before or after installation of theAvamar software.

Note

Using third party tools to create clones or exact copies of deployed Avamar VirtualEdition systems is known to cause issues. Cloning of Avamar Virtual Edition systems isnot supported.

System requirementsAvamar Virtual Edition (AVE) is supported on Microsoft Azure.

The following table defines the minimum system requirements for each size of AVE.

Table 3 Minimum requirements for AVE

0.5 TB AVE 1 TB AVE 2TB AVE 4 TB AVE

Processors Minimum two 2GHz processors

Minimum two 2GHz processors

Minimum two 2GHz processors

Minimum four 2GHz processors

Memory 6 GB 6 GB 14 GB 28 GB

Disk space 850 GB 1,600 GB 3,100 GB 6,100 GB

Networkconnection

1 GbE connection 1 GbE connection 1 GbE connection 1 GbE connection

Azure StandardTier

A5 A6 A5 A6

AVE virtual disk requirementsThe AVE disk layout comprises one operating system disk (126 GB) and severalstorage partitions (250 GB, 500 GB, or 1000 GB, depending on the AVEconfiguration).

The OS disk stores the operating system, Avamar application, and log files.

The storage partitions store the backup data. Backup data is evenly distributed acrossthe storage partitions. The primary amount of the disk read, write, and seek usageoccurs on the storage partitions.

In addition to the OS partition, the following table defines the number and size ofvirtual disks that are required for each AVE configuration.

Installation


Table 4 AVE virtual disk requirements

AVE configuration Number of virtual disks

0.5 TB 3 storage partitions (250 GB each)

1 TB 6 storage partitions (250 GB each)



Software requirementsBefore you install AVE, ensure that you have the software that is listed in the followingtable.

Table 5 Additional AVE software installation requirements

Requirement Description

Applications Azure Cloud subscription

7zip to decompress virtual hard drive file (.vhd) from Avamar

Azure Powershell to execute Azure specific Powershell commands

Files AVE Package, operating system security patches (if applicable)

Support for application databases in standalone configuration onlyBackup and recovery of the following applications are supported with AVE on Azure.However, these applications are supported in standalone configuration only. Clusteredconfigurations of application databases are not supported with AVE on Azure.

l SQL

l Exchange

l SharePoint

l Lotus

l DB2

l Sybase

l SAP

l Oracle

InstallationThe following sections are describe how to install an AVE virtual machine in MicrosoftAzure environments.

This section provides instructions for preparing the virtual machine in the Azure Portal(also known as the Azure Resource Manager).

Installation

Software requirements 15

Deploying AVE from the Azure MarketplaceThe Avamar Virtual Edition (AVE) software is available in the Microsoft Azuremarketplace.

Note

For security considerations, deploy AVE in a private network and configure a securegateway from which you can install, configure, and manage the Avamar server. Azuresecurity best practices provides detailed information on how to set up an additionalsecure gateway system for AVE maintenance in the cloud.

Procedure

1. Open the Azure portal at https://portal.azure.com and log in to the Azureaccount.

2. In the Azure Marketplace, search for and deploy the Avamar Virtual editionapplication.

3. To start the Avamar Virtual Edition Deployment wizard, click Create.

4. Configure the basic setting for the virtual machine:

a. In the Name field, type a name for the virtual machine.

Note

The maximum length of the virtual machine name is 10 characters.

b. In the VM disk type field, select HDD.

c. In the User name field, type a username.

d. In the Authentication type field, select one of the following options:

l In the SSH Public Key field, type the public key.

l In the Password field, type the password.

e. Verify the subscription information.

f. In the Resource Group, perform one of the following steps:

l To create a resource group, click Create new.

l To select a resource group, click Use existing and then select theresource group that you would like to use.

g. In the Location field, select a location to deploy the virtual machine.

h. Click OK to continue.

5. Choose the size of the virtual machine:

a. Select at least A5 Standard for the VM size that you would like to deploy.

Refer to the following table for minimum system requirements for each sizeof AVE.

Installation


HTTPS://PORTAL.AZURE.COM/

Table 6 Minimum requirements for AVE

0.5 TB AVE 1 TB AVE 2TB AVE 4 TB AVE

Processors Minimum two2 GHzprocessors

Minimum two2 GHzprocessors

Minimum two2 GHzprocessors

Minimum four2 GHzprocessors

Memory 6 GB 6 GB 14 GB 28 GB

Disk space 850 GB 1,600 GB 3,100 GB 6,100 GB

Networkconnection

1 GbEconnection

1 GbEconnection

1 GbEconnection

1 GbEconnection

AzureStandard Tier

A5 A6 A5 A6

b. Click Select to continue.

6. Configure settings for the virtual machine.

a. In the Availability set field, select None.

b. In the Storage field, keep the default setting of Yes.

c. In the Virtual network field, select an existing or create a new virtualnetwork.

d. In the Subnet field, select a subnet.

e. In the Public IP address field, select None.

Note

For security considerations, deploy AVE in a private network and leave thePublic IP address field set to None.

f. In the Network security group (firewall) field, add inboud/outbound rules.

Network security group on page 21 contains information about requiredinbound/outbound rules for the AVE.

g. In the Extensions field, keep the default setting of No extensions.

h. In the Enable auto-shutdown field, keep the default setting of Off.

i. In the Boot diagnostics field, keep the default setting of Enabled.

j. In the Guest OS diagnostics field, keep the default setting of Disabled.

k. In the Diagnostics storage account field, select an existing or create astorage account.

l. Click OK to continue.

7. Review the summary for the Avamar Virtual Edition (AVE) software and thenclick Create.

8. Create the data disks for AVE by performing the following steps:

a. From the disks configuration page for the virtual machine, click Add datadisk.

b. Click Create new.

Installation

Deploying AVE from the Azure Marketplace 17

c. Type a name for the data disk.

d. Select Use existing for Resource Group and select the resource group thatyou created in the previous step.

e. Select Standard_LRS for Account type.

f. Select empty disk for Source type.

g. Create the following disks, as specified for the AVE size:

Table 7 AVE virtual disk requirements

AVE configuration Number of virtual disks

0.5 TB 3 storage partitions (250 GB each)




Note

Verify that all of the storage partitions are the same size before continuing.

9. Create a static IP address for the virtual machine by performing the followingsubsteps:

a. From the network interface configuration page for the virtual machine, clickIP Configurations.

b. Click the network name.

c. Select Static for the Private IP Address.

10. Obtain the AVE private IPv4 address by performing one of the followingsubsteps:

a. Use the Azure Portal to obtain the private IPv4 address.

The Microsoft documentation for the Azure Portal provides moreinformation.

b. Use the Azure CLI to obtain the private IPv4 address by typing the followingcommand:

az vm list-ip-addresses --name vm-name

c. Record the private IPv4 address for future use. This value is the defaultpassword for AVE.

11. Install the AVE.

Installing and configuring the Avamar software on page 33 containsinstructions.

Installation


https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-static-private-ip-arm-pportal#how-to-retrieve-static-private-ip-address-information-for-a-vm

Note

After launching the instance, the AVE initializes and restarts automatically.During this process, which takes 15–25 minutes, the AVE installs drivers and anupdated kernel. You cannot install the AVE until this process is completebecause the AVE installation package, ave-config, is not available in theAvamar Installation Manager. SSH is also unavailable during this time.

Deploy AVE and DDVE together from the Azure MarketplaceThis section provides information on how to deploy the AVE and DDVE softwaretogether from the Microsoft Azure Marketplace.

Note

For security considerations, deploy AVE in a private network and configure a securegateway from which you can install, configure, and manage the Avamar server. Azuresecurity best practices provides detailed information on how to set up an additionalsecure gateway system for AVE maintenance in the cloud.

Procedure


2. In the Azure Marketplace, search for and deploy the Dell EMC Avamar and DataDomain Virtual Edition.

3. To start the Dell EMC Avamar and Data Domain Virtual Edition wizard, clickCreate.

4. Configure the basic setting for the virtual machine:

a. In the Subscription field, select a type of subscription from the optionsavailable from the list.

b. In the Resource Group, perform one of the following steps:

l To create a resource group, click Create new.

l To select a resource group, click Use existing and then select theresource group that you would like to use.

c. In the Location field, select a location to deploy the virtual machine.

d. Click OK to continue.

5. Configure the infrastructure for the virtual machine:

a. In the Virtual network field, select an existing or create a new virtualnetwork.

b. In the Subnet field, select a subnet.

c. In the Diagnostics storage account field, select an existing or create astorage account.

d. Click OK to continue.

6. Configure AVE for the virtual machine:

a. In the AVE Version field, select the version from the list.

Installation

Deploy AVE and DDVE together from the Azure Marketplace 19


b. In the AVE Name field, enter the host name of the AVE.

You can enter a maximum of ten characters for the AVE host name.

c. In the AVE Size field, select an option available from the options available inthe list.

d. In the Admin User Name field, enter the name for the administrator.

You can ssh to the AVE with this user, admin or root is not allowed for theuser name.

e. In the Admin Authentication Type field, select one of the following options:

l If you select SSH Public Key, enter the public key.

l If you select Password, type the password you want in the Passwordand Confirm Password fields.

f. Click OK to continue.

7. Configure DDVE for the virtual machine:

a. In the DDVE Version field, select the version from the list.

b. In the DDVE Name field, enter the host name of the DDVE.

You can enter a maximum of ten characters for the DDVE host name.

c. In the DDVE VM Size field, select an option available from the optionsavailable in the list.

d. In the Data Disk Size field, select the size of the disk from the optionsavailable in the list.

e. In the SysAdmin Authentication Type field, select one of the followingoptions:

l If you select SSH Public Key, enter the public key.

l If you select Password, type the password you want in the Passwordand Confirm Password fields.

f. Click OK to continue.

8. Review the summary for the AVE and DDVE software and then click OK.

9. In the Buy section, review the terms of use and click Create.

The application displays the Azure user account and the status of thedeployment.

Note

To monitor and view the details of the deployment, click on the deployment.After the deployment is complete, you can get a private IP of AVE and DDVEfrom the output of the deployment.

Note

After the deployment is complete you need to complete the post deploymentconfiguration. For more information on post deployment configuration, see Post-deployment Configuration.

Installation


Network security groupThe following tables describe the rules that should be added to an Azure networksecurity group.

Inbound ports for the Azure network security groupThe following tables describe the rules that should be added to an Azure networksecurity group.

Note

If you want to restrict the source of traffic, set the source with IPv4 or IPv6 CIDRblock, or a single IPv4 or IPv6 address.

Note

Avamar 7.5.1 removes support for HTTP access to TCP port 80. Use the HTTPS ports443 to access these services instead.

Table 8 Inbound ports for the Azure network security group

Type Protocol Port Range Source

SSH TCP 22 0.0.0.0/0

SSH TCP 22 ::/0

Custom TCP Rule TCP 161 0.0.0.0/0

Custom TCP Rule TCP 161 ::/0

Custom UDP Rule UDP 161 0.0.0.0/0

Custom UDP Rule UDP 161 ::/0





HTTPS TCP 443 0.0.0.0/0

HTTPS TCP 443 ::/0





Custom TCP Rule TCP 7778 - 7781 0.0.0.0/0

Custom TCP Rule TCP 7778 - 7781 ::/0



Installation

Network security group 21

Table 8 Inbound ports for the Azure network security group (continued)
















Outbound ports for the Azure network security group

Note

If you want to restrict the source of traffic, set the source with IPv4 or IPv6 CIDRblock, or a single IPv4 or IPv6 address.

By default, Azure has a rule AllowInternetOutBound with priority 65001 to allow alloutbound internet traffic. Override this rule by adding a rule with a priority (that is, aninteger number) that is greater than all customized rules' priority, and less than65000: source: *, destination: *, protocol: *, action: Deny. Azuredocumentation contains information about creating a firewall rule.

Table 9 Outbound ports for the Azure network security group




SSH TCP 22 0.0.0.0/0

SSH TCP 22 ::/0

SMTP TCP 25 0.0.0.0/0

SMTP TCP 25 ::/0

DNS (UDP) UDP 53 0.0.0.0/0

DNS (UDP) UDP 53 ::/0

Installation


Table 9 Outbound ports for the Azure network security group (continued)




Custom TCP Rule UDP 111 0.0.0.0/0

Custom TCP Rule UDP 111 ::/0









HTTPS TCP 443 0.0.0.0/0

HTTPS TCP 443 ::/0




















Installation

Network security group 23

Table 9 Outbound ports for the Azure network security group (continued)





Custom TCP Rule TCP 28001-28010 0.0.0.0/0

Custom TCP Rule TCP 28001-28010 ::/0



Custom TCP Rule TCP 30001-30010 0.0.0.0/0

Custom TCP Rule TCP 30001-30010 ::/0

AVE and DDVE deployment via Azure solution templateThe following topics describe how to deploy AVE and Data Domain Virtual Edition(DDVE) virtual machines in Azure by using a solution template. The solution templateuses the DDVE 6.1.0 image in the Azure marketplace (ddve-31-ver-060100).

Solution templates are JSON files that simplify the deployment of multiple Azureresources and dependencies. Use the template to programmatically deploy thecombined AVE and DDVE solution.

Obtain the solution template for AVE and DDVE from Online Support (https://support.emc.com/) before proceeding. The solution template contains two files:

l AVE_DDVE_SolutionTemplate.jsonl AVE_DDVE_SolutionTemplate_parameters.json

The parameter file is only required for deployment via Powershell.

The complete deployment process consists of the following steps:

1. Upload an AVE virtual machine image to Azure and configure prerequisite items.

2. Deploy AVE and DDVE using the solution template.

3. Configure a secure gateway system.

4. Configure DDVE.

5. Configure AVE.

6. Attach the DDVE system to AVE.

Steps 3–6 are outside the scope of this installation guide. The following publicationsprovide additional information to complete the deployment process:

l Avamar Administration Guide

l Avamar and Data Domain System Integration Guide

l Data Domain Operating System Initial Configuration Guide

l Data Domain Operating System Administration Guide

This installation guide includes steps for the Azure Resource Manager and forPowershell. The following Microsoft documentation provides additional informationabout using solution templates with both interfaces:

Installation


HTTPS://SUPPORT.EMC.COM/


l Deploy resources with Resource Manager templates and Azure portal

l Deploy resources with Resource Manager templates and Azure CLI

l Deploy resources with Resource Manager templates and Azure PowerShell

l Parameter files

Uploading the AVE imageThe solution template uses this AVE image for each automatic deployment. This taskalso configures several important prerequisite items. Record the indicated values forlater use.

Procedure

1. Download and decompress the AVE virtual appliance file.

Download the required software from https://support.emc.com/.


3. Create a resource group by selecting New > Management > Resource Group.

4. Record the name of the new resource group.

5. Create a storage account under this resource group by performing the followingsubsteps:

a. Select New > Storage > Storage Account.

b. Select Use existing for Resource Group and select the resource group thatyou created in the previous step.

6. Record the name of the new storage account.

The storage account also stores the diagnostic logs from the deployment.

7. Create a container under this storage account by performing the followingsubsteps:

a. Click All Resources in the Navigation page.

b. Select the storage account.

c. Click Containers.

d. Click + Containers.

8. Upload the AVE virtual appliance file to the container by performing thefollowing substeps:

a. In the container, click Upload.

b. Transfer the AVE virtual appliance file as a Page blob.

Transferring the file may take some time.

If you encounter difficulty while uploading the AVE virtual appliance file, retrythe upload with the Azure command line tool AzCopy or the Azure command-line interface (CLI).

l https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy provides more information about AzCopy, including downloadinstructions and usage examples.

l https://docs.microsoft.com/en-us/azure/virtual-machines/linux/classic/create-upload-vhd provides more information about the Azure CLI, includingusage examples.

Installation

Uploading the AVE image 25

https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-template-deploy-portal#deploy-resources-from-custom-template

https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-template-deploy-cli#deploy-local-template

https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-template-deploy#deploy-a-template-from-your-local-machine

HTTPS://DOCS.MICROSOFT.COM/EN-US/AZURE/AZURE-RESOURCE-MANAGER/RESOURCE-GROUP-TEMPLATE-DEPLOY#PARAMETER-FILES



https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy

https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy

https://docs.microsoft.com/en-us/azure/virtual-machines/linux/classic/create-upload-vhd

https://docs.microsoft.com/en-us/azure/virtual-machines/linux/classic/create-upload-vhd

Transfer the AVE virtual appliance file as a Page blob.

9. Create a virtual network by clicking New > Networking > Virtual network.

Select the resource group that you created in the previous step, and select thesame location as is used by the resource group.

10. Record the name of the new virtual network.

11. Create a subnet by performing the following substeps:

a. Select Virtual networks.

b. Select the new virtual network.

c. Click Subnets.

d. Click +Subnet.

e. Type a name for the subnet.

f. Type a unique address range within the virtual network.

g. (Optional) Associate a network security group with the subnet.

h. (Optional) Associate a route table with the subnet.

i. (Optional) Associate users and roles with the subnet.

j. Click OK.

12. Record the name of the new subnet.

13. Create an image by performing the following substeps:

a. In the Portal, click the plus (+) sign to create a resource.

b. Select Image.

c. Click Create.

d. Type a name for the image.

e. Select Use existing for Resource Group and select the resource group thatyou created in the previous step.

f. Select the same location as is used by the resource group.

g. Select Linux for OS type.

h. Browse to the uploaded .vhd file for Storage blob.

i. Select HDD for Account Type.

j. Select Read/write for Host caching.

14. Record the resource ID that is associated with the new AVE image.

Solution template parametersThese template parameters are common, whether you deploy the solution through theAzure Resource Manager or through Azure Powershell. Use the following descriptionsto provide parameters to the template:

AVE Name

Required. Type the hostname to assign to AVE. Limited to 10 characters, specialcharacters are prohibited.

AVE Image Resource ID

Required. Provide the value that you recorded when you uploaded the AVE image.

Installation


AVE Size in TB

Select the installed capacity for this AVE instance: either 2 or 4 TB. This selectiongoverns the choice of Azure standard tier, as detailed in Table 3 on page 14, andthe automatic creation of virtual disks, as detailed in Table 4 on page 15.

AVE Username

Required. Type the name of a new user with administrative privileges for AVE.Cannot be root or admin.

AVE Authentication Mode

Select the method by which users are authenticated when initiating an SSHconnection: either Password or SSH Public Key.

AVE User Password

Type a password for the new user. Input must be 12–72 characters that includeany three of the following: one lowercase letter, one uppercase letter, onenumber, and one special character. Complete this field even if using an SSHpublic key for authentication. The Avamar Product Security Guide provides moreinformation.

The default is Changeme123#.

AVE Ssh Public Key

Required. Provide the representation of the new user's SSH public key. This fieldapplies only when SSH Public Key authentication is selected. Complete this fieldeven if using a password for authentication.

DDVE Name

Required. Type the hostname to assign to DDVE. Limited to 10 characters, specialcharacters are prohibited.

DDVE Virtual Machine Size

Select the maximum installed capacity for this DDVE instance: eitherStandard_F4 or Standard_F8. This selection governs the choice of Azurestandard tier and the automatic creation of virtual disks. All virtual disks are 1000GB.

Standard_F4 supports a maximum capacity of 7 TB. Standard_F8 supports amaximum capacity of 15 TB.

DDVE Data Disk Size in TB

Select the actual installed capacity for this DDVE instance: integer valuesbetween 1–15 TB. The choice of DDVE Virtual Machine Size limits the valuesthat are available for selection.

The 0.5 TB value is only for use with the evaluation license. Do not use this valuefor any other installations.

DDVE Authentication Mode

Select the method by which users are authenticated when initiating an SSHconnection: either Password or SSH Public Key.

DDVE Sysadmin Password

Type a password for the sysadmin user. Input must be 12–72 characters thatinclude any three of the following: one lowercase letter, one uppercase letter, onenumber, and one special character. Complete this field even if using an SSH

Installation

Solution template parameters 27

public key for authentication. The Data Domain Product Security Guide providesmore information.

The default is Changeme123#.

DDVE Ssh Public Key

Provide the representation of the sysadmin user's SSH public key. This fieldapplies only when SSH Public Key authentication is selected.

Vnet Existing Resource Group

Required. Type the name of the resource group in which you created the virtualnetwork.

Vnet Name

Required. Type the name of the new virtual network.

Vnet Subnet Name

Required. Type the name of the subnet that you created within the new virtualnetwork.

Diagnostics Storage Account Existing Resource Group

Required. Type the name of the resource group in which you created the storageaccount.

Diagnostics Storage Account Name

Required. Type the name of the new storage account.

Deploying AVE and DDVE from the Azure Resource ManagerThe Azure Resource manager provides a graphical interface for deployment of theappliances.

Procedure

1. Extract AVE_DDVE_SolutionTemplate.json to a temporary folder on thelocal computer.

2. Return to the Azure portal.

3. Click My Dashboard > Template Deployment.

If you do not see Template Deployment, use the dashboard search field tolocate it.

4. Click Create.

The Custom Deployment page opens.

5. Click Build your own template in the editor.

The Edit Template page opens to an empty template and default values in theeditor.

6. Click Load File.

7. Browse to AVE_DDVE_SolutionTemplate.json and then click Open.

The AVE/DDVE template opens in the editor.

8. Click Save.

The Custom Deployment page opens and displays the new template.

9. The Basics section is common to all Azure deployments. Choose an appropriateSubscription, Resource Group, and Location.

Installation


10. Provide all required AVE and DDVE parameters.

Some fields are preconfigured. Mandatory fields have red names and an *.Validated fields have a purple border and a green check mark.

Solution template parameters on page 26 provides additional information onparameter values.

11. Review the terms and conditions, and then check I agree to the terms andconditions stated above.

12. Click Purchase.

Deployment may take 15–30 minutes. Note all of the return values from thedeployment process.

Deploying AVE and DDVE from Azure PowershellYou can also deploy the appliances from the command line by using Azure Powershell.This method provides the required parameters in theAVE_DDVE_SolutionTemplate_parameters.json file.

Procedure

1. Extract AVE_DDVE_SolutionTemplate.json andAVE_DDVE_SolutionTemplate_parameters.json to a temporary folderon the local computer.

2. Edit AVE_DDVE_SolutionTemplate_parameters.json with a text editorand provide the required values.

Solution template parameters on page 26 provides additional information. Eachparameter in this file corresponds to an input field in the Azure ResourceManager method.

For example:

{ "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#", "contentVersion": "1.0.0.0", "parameters": { "AVEName": { "value": "AVE-test" }, "AVEImageResourceID": { "value": "/subscriptions/azure-test/resourceGroups/rg-test/providers/provider-test/vm-image/ave-image" }, "AVESizeInTB": { "value": "2" }, "AVEUsername": { "value": "test" }, "AVEAuthenticationMode": { "value": "Password" }, "AVEUserPwd": { "value": "S3cure#P@ssW0rd!" }, "AVESshPublicKey": { "value": "Input only when SSH Public Key is selected as the authentication mode." }, "DDVEName": { "value": "DDVE-test" },

Installation

Deploying AVE and DDVE from Azure Powershell 29

"DDVEVirtualMachineSize": { "value": "Standard_F4" }, "DDVEDataDiskSizeInTB": { "value": "1" }, "DDVEAuthenticationMode": { "value": "Password" }, "DDVESysadminPwd": { "value": ".DdV3#P@ssW0rd%" }, "DDVESshPublicKey": { "value": "Input only when SSH Public Key is selected as the authentication mode." }, "vnetExistingResourceGroup": { "value": "rg-test" }, "vnetName": { "value": "vnet-test" }, "vnetSubnetName": { "value": "subnet-test" }, "diagnosticsStorageAccountExistingResourceGroup": { "value": "rg-test" }, "diagnosticsStorageAccountName": { "value": "storage-test" } }}

3. Save and close the file.

4. In the Azure Powershell interface, log in and select an appropriate subscription.

5. In the Azure Powershell interface, type the following command on one line:

New-AzureRmResourceGroupDeployment -Name <DeploymentName> -ResourceGroupName <ResourceGroupName> -TemplateFileAVE_DDVE_SolutionTemplate.json -TemplateParameterFileAVE_DDVE_SolutionTemplate_parameters.jsonwhere:

l <DeploymentName> is a unique name for this AVE and DDVE deployment.

l <ResourceGroupName> is a resource group in which to place the newinstances of AVE and DDVE.

Deployment may take 15–30 minutes. Note all of the return values from thedeployment process.

Post-deployment configurationThese steps prepare the deployed AVE for installation of the Avamar software.

Before you begin

Note and record the deployment status, and the AVAMARURL and DDSMURL valuesfrom the deployment task. Access to these URLs requires a secure gateway system,which is beyond the scope of this installation guide.

Procedure

1. Create a static IP address for the virtual machine by performing the followingsubsteps:

Installation


a. From the network interface configuration page for the virtual machine, clickIP Configurations.

b. Click the network name.

c. Select Static for the Private IP Address.

2. Obtain the AVE private IPv4 address by performing one of the followingsubsteps:

a. Use the Azure Portal to obtain the private IPv4 address.

The Microsoft documentation for the Azure Portal provides moreinformation.

b. Use the Azure CLI to obtain the private IPv4 address by typing the followingcommand:

az vm list-ip-addresses --name vm-name

c. Record the private IPv4 address for future use. This value is the defaultpassword for AVE.

3. Configure a secure gateway system.

4. Install the AVE.

Installing and configuring the Avamar software on page 33 containsinstructions.

Note

After launching the instance, the AVE initializes and restarts automatically.During this process, which takes 15–25 minutes, the AVE installs drivers and anupdated kernel. You cannot install the AVE until this process is completebecause the AVE installation package, ave-config, is not available in theAvamar Installation Manager. SSH is also unavailable during this time.

5. Configure the DDVE instance.

If you cannot access the DDVE instance from the secure gateway via HTTP orHTTPS, perform the following substeps:

a. SSH to the DDVE instance and log in as the sysadmin user.

b. Type the following command:

adminaccess enable http/https

6. Attach the DDVE system to AVE.

Azure security best practicesConsider the following issues when deploying AVE to an Azure environment, to createas secure an environment as possible.

Follow the Azure network security best practicesFollow the Azure network security best practices at https://docs.microsoft.com/en-us/azure/best-practices-network-security to define an Information SecurityManagement System (ISMS). Build a set of security policies and processes for theorganization to protect the Avamar server and clients in the Azure cloud.

Installation

Azure security best practices 31

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-static-private-ip-arm-pportal#how-to-retrieve-static-private-ip-address-information-for-a-vm

HTTPS://DOCS.MICROSOFT.COM/EN-US/AZURE/BEST-PRACTICES-NETWORK-SECURITY

HTTPS://DOCS.MICROSOFT.COM/EN-US/AZURE/BEST-PRACTICES-NETWORK-SECURITY

Disable the public IP address when launching AVEBecause AVE in the cloud only backs up resources in the same Virtual Private Cloud(VPC), AVE does not need a public IP address. Isolating AVE from public networkaccess helps to secure AVE in a cloud environment.

When creating the virtual machine, select None for the public IP address setting todisable the public IP address for AVE.

Set up an additional secure gateway system for AVE maintenance in the cloudYou can also set up a secure gateway system, with a public IP address, in the sameVPC as AVE and the clients. Perform all operation and maintenance of AVE throughthis secure gateway system. Configure the gateway system for high security by, forexample, defining the security group to enable only a must-have level of networkaccess.

l For Linux gateways, enable only the SSH port, with key-based SSH access, andthe VNC port range. Restrict the permitted original network address (a white-listed IP address or range is suggested).

l For Window gateways, enable only the RDP port. Restrict the permitted originalnetwork address (a white-listed IP address or range is suggested).

You can install Avamar Administrator on the Secure gateway system. In this case,configure a security group for the following ports:

Table 10 Inbound ports for Linux gateways

Type Protocol Port range Source

Custom TCP rule TCP 7778-7781 Subnet IPv4 CIDR

HTTPS TCP 443 Subnet IPv4 CIDR

SSH TCP 22 0.0.0.0/0

Table 11 Inbound ports for Windows gateways

Type Protocol Port range Source

Custom TCP rule TCP 7778-7781 Subnet IPv4 CIDR

RDP TCP 3389 0.0.0.0/0

HTTPS TCP 443 Subnet IPv4 CIDR

SSH TCP 22 Subnet IPv4 CIDR

Use only key-based SSH accessUse an SSH public key when launching AVE in Azure. Select SSH public key as theAuthentication type when creating the virtual machine.

Use a security group with custom IP address rangesIn addition to the ports, restrict the source and destination network address ranges inthe inbound/outbound security group. Enable only the necessary ports for bothinbound and outbound network access, as defined in Network security group on page21.

Timely application of Avamar security patchesAvamar releases quarterly OS security patch roll-ups. Apply these patches to AVE on aregular basis.

Installation


Installing and configuring the Avamar softwareTo install Avamar software on a new AVE virtual machine, follow the instructions thatare included in the help file for the AVE installation workflow on the SW Releasespage of the Avamar Installation Manager.

Procedure

1. Open a web browser and log in to Avamar Installation Manager:

The Avamar Administration Guide contains information about the AvamarInstallation Manager.

a. Type the following URL:

https://Avamar-server:7543/aviwhere Avamar-server is the IP address or the resolvable hostname of theAvamar server.

Note

Ensure that the hostname does not contain more than 63 characters.

The Avamar Installation Manager login page appears.

b. Log in as the root user for the Avamar software with the default password.

Note

The default password is either changeme or the private IPv4 address for thevirtual machine, depending on the environment.

c. Click Login.

2. Click SW Releases.

3. Click the ? button for the AVE installation package ave-config to open the helpfile for the AVE installation workflow.

4. Click Install next to the AVE installation package ave-config.

5. Monitor the installation progress on the Installation Progress page andrespond to any installation problems:

a. To resolve the problem, take the appropriate action.

b. After resolving the problem, click Call Support.

The Call Support dialog box appears.

c. Click Issue resolved, continuing the installation.

The installation resumes.

d. Repeat these steps for all problems that occur during the installation.

Installation

Installing and configuring the Avamar software 33

Upgrading the Avamar softwareTo upgrade the Avamar software on an AVE virtual machine, follow the instructionsthat are included in the workflow guide for the AVE upgrade workflow package on theSW Releases page of the Avamar Installation Manager.

Procedure

1. Download the AVE upgrade workflow package for the appropriate version ofAVE.

Download the required software from https://support.emc.com/.

You can also use the Avamar Download Manager or Local Downloader Serviceto download the software. The Avamar Administration Guide contains informationabout configuring and using the Avamar Download Manager and the LocalDownloader Service.

2. Log in to the Avamar Installation Manager by performing the following substeps:

a. Open a web browser and type the following URL:

https://Avamar-server:7543/aviwhere Avamar-server is the IP address or the resolvable hostname of theAvamar server.

Note

Ensure that the hostname does not contain more than 63 characters.

The Avamar Installation Manager login page appears. The AvamarAdministration Guide contains information about the Avamar InstallationManager.

b. Log in as the Avamar software root user.

The root user password is typically created with the ave_config workflowwhen you install the Avamar software.

c. Click Login.

3. Upload the AVE upgrade workflow package that you downloaded in step 1 onpage 34 by performing the following substeps:

a. Click Repository.

The Repository tab appears.

b. For Package Upload, click Browse and select the package to upload.

Once the package upload completes, it automatically appears in theRepository table.

4. Click SW Upgrade.

The SW Upgrade tab appears.

5. Click the ? button for the AVE upgrade workflow package (AvamarUpgrade-version.avp) to open the workflow guide.

6. Click Upgrade.

7. Monitor the upgrade progress on the Installation Progress page and respondto any problems:

Installation


https://support.emc.com/

a. To resolve the problem, take the appropriate action.

b. After resolving the problem, click Call Support.

The Call Support dialog box appears.

c. Click Issue resolved, continuing the installation.

The upgrade resumes.

d. Repeat these substeps for all problems that occur during the upgrade.

Post-installation and post-upgrade tasksPerform the following tasks after completing the installation or upgrade of the AVEserver.

Restarting the backup schedulerThe pre-upgrade steps included suspending the backup scheduler. Restart the backupscheduler by typing the following command as the admin user:

dpnctl start schedOutput similar to the following appears:

Identity added: /home/admin/.ssh/dpnid(/home/admin/.ssh/dpnid)dpnctl: INFO: Resuming backup scheduler...dpnctl: INFO: Backup scheduler resumed.

Restarting the maintenance schedulerThe pre-upgrade steps included suspending the maintenance scheduler. Restart themaintenance scheduler by typing the following command as the admin user:

dpnctl start maintOutput similar to the following appears:

Identity added: /home/admin/.ssh/dpnid (/home/admin/.ssh/dpnid)dpnctl: INFO: Resuming maintenance windows scheduler...dpnctl: INFO: maintenance windows scheduler resumed.

Rebooting Avamar proxy clientsIf Avamar proxy clients are installed, reboot the proxy clients by typing the followingcommands:

su -mccli mcs reboot-proxy --all=trueexitOutput similar to the following appears:

0,22357,Initiated request to recycle proxy power.

Testing Data Domain integrationIf you use AVE with Data Domain, verify the status of the Data Domain integration andopen any necessary service requests with Customer Support when problems occur.The Avamar and Data Domain System Integration Guide contains information aboutreplication.

Installation

Post-installation and post-upgrade tasks 35

Generating new certificates with Data Domain systemsWhen you upgrade an AVE that is connected to a Data Domain system to Avamarrelease 7.3 or greater, and session ticket authentication is enabled during upgrade, youmust generate new certificates on the Data Domain system. The Avamar ProductSecurity Guide contains more information.

Setting the passphrase on Data Domain systemsWhen you upgrade an AVE that is connected to a Data Domain system to Avamarrelease 7.3 or greater, enable a passphrase for the DD Boost user by performing thefollowing steps:

1. Log in to the Data Domain system.

2. Type the following command at the Data Domain CLI:

system passphrase set3. When prompted, type a passphrase.

Note

The DD Boost user must have admin rights.

Testing replicationIf replication was configured before the AVE upgrade, verify the status of replicationand open any necessary service requests with Customer Support when problemsoccur. The Avamar Administration Guide contains information about replication.

Upgrading the Avamar client downloadsThe Avamar Client Downloads and Client Manager Installer Upgrades Technical Note,which is available on Online Support (https://support.emc.com) contains informationabout the procedures to upgrade client installation packages.

Installing the server hotfixes and the Avamar platform security patch rollupServer hotfixes and the Avamar platform security patch rollup are released on aperiodic basis. When available, you should install these hotfixes and the Avamarplatform security patch rollup on new and existing AVE systems.

The Avamar Administration Guide contains information about installing hotfixes, and theSupport KB article https://support.emc.com/kb/335359 provides instructions forinstalling the Avamar platform security patch rollup.

Installation


https://support.emc.com

https://support.emc.com/kb/335359

APPENDIX A

Using NAT

If you intend to use the public IP address to back up data to AVE, configuring NATallows external clients to cross the network boundary.

l Configuring AVE to use NAT.............................................................................. 38

Using NAT 37

Configuring AVE to use NATThe following instructions explain how to set up the probe.xml file to enable AVE touse Network Address Translation (NAT). These instructions assume that AVE has aunique address (from the Avamar client's perspective), and that you configure thevirtual network to apply transparent one-to-one network address translation.

Some or all Avamar clients can access AVE by using an IP address that undergoesNAT. To make NAT information known to AVE, the probe.xml file (node resourcedatabase) must contain nat-address elements. After a client makes initial contactwith AVE, Avamar provides a routable address to each client. In the absence of a nat-address element, Avamar supplies a "real" (untranslated) virtual network interfaceaddress.

The following figure illustrates an example in which AVE uses NAT.

Figure 1 NAT configuration

Procedure

1. Open a command shell and log in to the server as admin.

2. Add a NAT address to probe.xml with the nodedb command:

Example:

nodedb update if --addr=10.6.250.87 --new-nat=INITIAL=TARGETwhere both INITIAL and TARGET are the AVE NAT IP address.

Note

AVE is a special case of a single-node server.

The nodedb command updates an existing network interface element in theprobe.xml file with NAT information that corresponds to the example diagramshown above.

3. If the Avamar storage subsystem is currently stopped, restart it by typing thefollowing command:

dpnctl start gsan

4. Re-read the probe.xml file by typing the following command:

avmaint networkconfig /usr/local/avamar/var/probe.xml --avamaronly

Using NAT


5. Register clients by using the avregister (UNIX) or avregister.bat(Windows) commands, or by using Avamar Administrator.

"Client registration" in the Avamar Administration Guide provides moreinformation about registering clients.

6. Open /usr/local/avamar/var/mc/server_data/prefs/mcserver.xml in a plain text editor.

7. Change the property of the external_nonat_addr to contain a hostname that isresolvable from the client and server sides.

8. Save the change and close the text editor.

9. Restart the MCS and the scheduler by typing the following commands:

dpnctl start mcs

dpnctl start sched

Using NAT

Configuring AVE to use NAT 39

Using NAT


dell emc avamar virtual edition for azure installation and ... · now the private ipv4 address for...

Documents