task_backup_from_onprem.adoc

sidebar	permalink	keywords	summary
sidebar	task_backup_from_onprem.html	backing up, back up, backup, backup cloud volumes ontap, back up cloud volumes ontap, cloud volumes ontap, on-prem, on-premises, back up volumes, cloud backup, cloud backup service, backup and compliance	Complete a few steps to get started backing up data from your on-premises ONTAP systems to low-cost object storage in the public cloud. This includes creating backup files on Amazon S3 and Azure Blob.

Backing up on-premises ONTAP data to the public cloud

Complete a few steps to get started backing up data from your on-premises ONTAP systems to low-cost object storage in the public cloud. This includes creating backup files on Amazon S3 and Azure Blob.

A Beta feature released in January 2021 allows you to run Compliance scans on the backed up volumes from your on-premises systems. Typically, compliance scans are free up to 1 TB of data, and then a cost for the service is applied for data over 1 TB. When combining Backup and Compliance for your on-prem volumes, the cost for scans on those on-prem volumes is free. Learn more about how Cloud Compliance can get your business applications and cloud environments privacy ready.

Quick start

Get started quickly by following these steps, or scroll down to the remaining sections for full details.

Verify support for your configuration

• You have discovered the on-premises cluster and added it to a working environment in Cloud Manager. See Discovering ONTAP clusters for details.

  • The cluster is running ONTAP 9.7P5 or later.

  • The cluster has a SnapMirror license — which is included as part of the PREM or Data Protection bundle.

• You have subscribed to the Azure or the AWS Cloud Manager Marketplace Backup offering, or you have purchased and activated a Cloud Backup BYOL license from NetApp.

• You have a valid cloud provider subscription for the object storage space where your backups will be located.

• For AWS, you need to have an account that has an access key and the required permissions so the ONTAP cluster can back up data to S3.

Enable Cloud Backup on the system

Select the working environment and click Activate next to the Backup & Compliance service in the right-panel, and then follow the setup wizard.

Select the cloud provider and enter provider details

Select the provider and then enter the provider details. You also need to specify the IPspace in the ONTAP cluster where the volumes reside.

Note: Backup to Google Cloud Storage from on-prem ONTAP systems is not currently supported from the UI.

Define the backup policy

The default policy backs up volumes every day and retains the most recent 30 backup copies of each volume. Change to weekly or monthly backups, or select one of the system-defined policies that provide more options.

Select the volumes that you want to back up

Identify which volumes you want to back up from the cluster.

Activate Compliance scans on the backed up volumes (optional)

Choose whether you want to have Cloud Compliance scan the volumes that are backed up in the cloud.

Restore your data, as needed

Choose to restore an entire backup to a new volume, or to restore individual files from the backup to an existing volume. You can restore data to a Cloud Volumes ONTAP system that is using the same cloud provider, or to an on-premises ONTAP system.

See Restoring volume data from backup files for details.

Requirements

Read the following requirements to make sure you have a supported configuration before you start backing up on-premises volumes to object storage.

The following image shows each component when backing up an on-prem ONTAP system to Amazon S3 and the connections that you need to prepare between them:

The following image shows each component when backing up an on-prem ONTAP system to Azure Blob and the connections that you need to prepare between them:

Preparing your ONTAP clusters

Your ONTAP clusters must meet the following requirements when backing up data to cloud storage.

ONTAP requirements

ONTAP 9.7P5 and later.

A SnapMirror license (included as part of the PREM or Data Protection bundle).

Cluster networking requirements

• The ONTAP cluster initiates an HTTPS connection over port 443 to the cloud object storage.

  ONTAP reads and writes data to and from object storage. The object storage never initiates, it just responds.

• An inbound connection is required from the Connector, which can reside in an AWS VPC or Azure VNet; depending on the object storage provider you are using.

  A connection between the cluster and the Cloud Backup service is not required.

• An intercluster LIF is required on each ONTAP node that hosts the volumes you want to back up. The LIF must be associated with the IPspace that ONTAP should use to connect to object storage. Learn more about IPspaces.

  When you set up Cloud Backup, you are prompted for the IPspace to use. You should choose the IPspace that each LIF is associated with. That might be the "Default" IPspace or a custom IPspace that you created.

Discovering an ONTAP cluster

You need to discover your on-premises ONTAP clusters in Cloud Manager before you can start backing up volume data.

Learn how to discover a cluster.

Creating or switching Connectors

A Connector is required to back up data to the cloud, and the Connector must be in the same cloud provider as the destination object storage. For example, when backing up data to AWS S3 you must use a Connector that’s in an AWS VPC. You cannot use a Connector that is deployed on-premises. You’ll either need to create a new Connector or make sure that the currently selected Connector resides in the correct provider.

• Learn about Connectors

• Creating a Connector in AWS

• Creating a Connector in Azure

• Switching between Connectors

Preparing networking for the Connector

Ensure that the Connector has the required networking connections.

Steps

1. Ensure that the network where the Connector is installed enables the following connections:

   • An outbound internet connection to the Cloud Backup service over port 443 (HTTPS)

   • An HTTPS connection over port 443 to your object storage (S3 or Blob)

   • An HTTPS connection over port 443 to your ONTAP clusters

2. Enable an endpoint to your object storage:

   • For AWS: Enable a VPC Endpoint to S3. This is needed if you have a Direct Connect or VPN connection from your ONTAP cluster to the VPC and you want communication between the Connector and S3 to stay in your AWS internal network.

   • For Azure: Enable a VNet service endpoint to Azure storage. This is needed if you have an ExpressRoute or VPN connection from your ONTAP cluster to the VNet and you want communication between the Connector and Blob storage to stay in your virtual private network.

Supported regions

You can create backups from on-premises systems to the public cloud in all regions where Cloud Volumes ONTAP is supported.

• For Azure, you specify the region where the backups will be stored when you set up the service.

• For AWS, backups are stored in the region where Cloud Manager is installed.

Note: Backup to Google Cloud Storage from on-prem ONTAP systems is not currently supported from the UI.

License requirements

For Cloud Backup PAYGO licensing, you’ll need a subscription to the Azure or the AWS Cloud Manager Marketplace Backup offering before you enable Cloud Backup. Billing for Cloud Backup is done through this subscription.

For Cloud Backup BYOL licensing, you need the serial number from NetApp that enables you to use the service for the duration and capacity of the license. See Adding and updating your Backup BYOL license.

And you need to have a subscription from your cloud provider for the object storage space where your backups will be located.

Preparing Amazon S3 for backups

When you are using Amazon S3, you must configure permissions for Cloud Manager to access the S3 bucket, and you must configure permissions so the on-premises ONTAP cluster can access the S3 bucket.

Steps

1. Provide the following S3 permissions (from the latest Cloud Manager policy) to the IAM role that provides Cloud Manager with permissions:

   {
               "Sid": "backupPolicy",
               "Effect": "Allow",
               "Action": [
                   "s3:DeleteBucket",
                   "s3:GetLifecycleConfiguration",
                   "s3:PutLifecycleConfiguration",
                   "s3:PutBucketTagging",
                   "s3:ListBucketVersions",
                   "s3:GetObject",
                   "s3:ListBucket",
                   "s3:ListAllMyBuckets",
                   "s3:GetBucketTagging",
                   "s3:GetBucketLocation",
                   "s3:GetBucketPolicyStatus",
                   "s3:GetBucketPublicAccessBlock",
                   "s3:GetBucketAcl",
                   "s3:GetBucketPolicy",
                   "s3:PutBucketPublicAccessBlock"
               ],
               "Resource": [
                   "arn:aws:s3:::netapp-backup-*"
               ]
           },

2. Provide the following permissions to the IAM user so that the ONTAP cluster can back up data to S3.

   "s3:ListAllMyBuckets",
   "s3:ListBucket",
   "s3:GetBucketLocation",
   "s3:GetObject",
   "s3:PutObject",
   "s3:DeleteObject"

   See the AWS Documentation: Creating a Role to Delegate Permissions to an IAM User for details.

3. Create or locate an access key.

   Cloud Backup passes the access key on to the ONTAP cluster. The credentials are not stored in the Cloud Backup service.

   See the AWS Documentation: Managing Access Keys for IAM Users for details.

Enabling Cloud Backup

Enable Cloud Backup at any time directly from the on-premises working environment.

Steps

1. From the Canvas, select the working environment and click Activate next to the Backup & Compliance service in the right-panel.

   

2. Select the provider, and then enter the provider details:

   • For Azure, enter:

     1. The Azure subscription used for backups and the Azure region where the backups will be stored.

     2. The resource group - you can create a new resource group or select and existing resource group.

     3. The IPspace in the ONTAP cluster where the volumes you want to back up reside.

        

   • For AWS, enter:

     1. The AWS Access Key and Secret Key used to store the backups.

     2. The IPspace in the ONTAP cluster where the volumes you want to back up reside.

        

        Note that you cannot change this information after the service has started.

3. Then click Continue.

4. In the Define Policy page, select the backup schedule and retention value and click Continue.

   

   See the list of existing policies.

5. Select the volumes that you want to back up.

   • To back up all volumes, check the box in the title row ().

   • To back up individual volumes, check the box for each volume ().

     

6. Click Activate and Cloud Backup starts taking the initial backups of your volumes.

   You are prompted whether you want to run compliance scans on the backed up volumes. Cloud Compliance scans are free when you run them on the backed up volumes (except for the cost of the deployed Cloud Compliance instance).

   

7. Click Go to Compliance to activate compliance scans on the volumes. (If you choose Close and not to scan these backed up volumes, you can always enable this functionality later from Cloud Compliance.)

   • If an instance of Cloud Compliance is already deployed in your environment, you are directed to the Configuration page to select the volumes you want to scan in each on-premises working environment that has backups. See how to choose the volumes.

     

   • If Cloud Compliance has not been deployed, you are directed to the Compliance page where you can choose to deploy Compliance in the cloud or in your premises. We strongly recommend deploying it in the cloud. Go here for installation requirements and instructions.

     

     After you have deployed Compliance you can choose the volumes you want to scan as described above.

Result

Cloud Backup backs up your volumes from the on-premises ONTAP system, and optionally, Cloud Compliance runs compliance scans on the backed up volumes.

What’s next?

You can start and stop backups for volumes or change the backup schedule and you can restore entire volumes or individual files from a backup file.

You can also view the results of the compliance scans and review other features of Cloud Compliance that can help you understand data context and identify sensitive data in your organization.

Note	The scan results are not available immediately because Cloud Backup has to finish creating the backups before Cloud Compliance can start compliance scans.