Dell EMC PowerProtect for VMware Cloud on AWS
Article ID: 328213
Updated On:
Products
Issue/Introduction
Purpose
This article provides information about Dell EMC PowerProtect 19.3 support for VMware Cloud on AWS. With Dell EMC PowerProtect 19.3, you can administrate backup, replication and restore operations in VMware Cloud on AWS environments.
Disclaimer: The partner solution referenced in this article is a solution that is developed and supported by a partner. Use of this product is also governed by the end user license agreement of the partner. You must obtain from the partner the application, support, and licensing for using this product. For more information, see Dell EMC PowerProtect
Resolution
Below is a summary of target use cases, solution architecture, solution components, and support information.
Target use cases:
Use cases that are supported on VMware Cloud on AWS
Dell EMC PowerProtect 19.3 and later releases provide you with the ability to perform virtual machine protection and recovery by using the Dell EMC PowerProtect solution with the VM proxy appliance. Refer to the Dell EMC PowerProtect Data Manager 19.3 Administration and User Guide for all the supported use cases for image based virtual machine protection.
Use cases that are not supported on VMware Cloud on AWS
Some of the VMware features and permissions are not granted within the VMware Cloud on AWS (VMC) environment. Thus, some dependent Dell EMC PowerProtect features will be limited or not operating. Depending on VMware update releases for VMware Cloud on AWS, the situation may change, and the features listed below may become available to be qualified and supported by Dell EMC.
Dell EMC PowerProtect Data Manager in VMware Cloud on AWS does not currently support the following operations:
- File-level restore from an image-level backup.
- Instant access recovery of an image-level backup.
- Emergency restore (image-level restore directly to an ESXi host, bypassing the vCenter).
- Image-level backups and restores using NBD or NBDSSL transport mode.
- VM proxy appliance configured with “dual stack” or “IPv6 only” is not supported.
- Application-consistent data protection for MS-SQL with the VM proxy appliance.
- If datacenter is placed inside a folder in the SDDC, image backup and restore is not supported
- PowerProtect plug-in (HTML5) for vSphere Client is not supported
Resolution
Solution Architecture
Dell EMC PowerProtect Data Manager for VMware Cloud on AWS
This solution allows image based (via VADP) data protection for the workloads running in VMware Cloud on AWS.
Dell EMC PowerProtect Data Manager solution in VMware Cloud on AWS requires the following virtual appliances:
- Dell EMC PowerProtect Data Manager 19.3 software virtual appliance
- Data Domain Virtual Edition (DDVE) version 4.0 or later
Topology 1:
Data Domain appliance running in VMC VPC (needs minimum version of DDVE 4.0) for the backup copy, with the backup data being stored in S3 object store of AWS VPC. Data Domain appliance for the replication copy running in the AWS VPC as an EC2 instance. Both Data Domain appliances running in different AWS regions as a best practice.
Topology 2:
Data Domain appliances running in AWS VPC for both backup copy as well as replication copy, as EC2 instances. Both Data Domain appliances running in different AWS regions as a best practice.
To perform data protection and disaster recovery tasks in VMware Cloud on AWS, consider the following recommendations and requirements on the backup infrastructure deployment:
PowerProtect Data Manager: it is recommended to deploy Dell EMC PowerProtect Data Manager in VMware Cloud on AWS environment.
PowerProtect VM Proxy: it is recommended to deploy the VM proxy appliance in VMware Cloud on AWS environment. Deploy at least one VM proxy per each SDDC cluster in the VMware Cloud on AWS.
Data Domain Virtual Edition: it is recommended to have your backups stored outside of the VMware Cloud on AWS environment, for example, on the Amazon AWS VPC. This type of deployment allows for efficient data transfer over the fast ENI connection used by VMware to communicate with Amazon AWS.
It is also recommended to replicate your backups to another Data Domain running either in the same AWS geographical location or in a different AWS geographical location. This type of deployment allows backup copies to be stored for longer retention, leveraging the AWS network for transferring data at lower latency and cost when compared to the public Internet.
The Dell EMC PowerProtect Data Manager 19.3 Administration and User Guide provides details on how to set up and configure the PowerProtect Data Manager solution for VMware Cloud on AWS.
VMware Cloud on AWS Network configuration
Domain Name System (DNS) resolution is critical for Dell EMC PowerProtect deployment and configuration. All infrastructure components should be resolvable through a fully qualified domain name (FQDN). This is especially important for the Dell EMC PowerProtect Data Manager, Dell EMC PowerProtect VM proxy, and Data Domain appliance. Resolvable means that components are accessible through both forward (A) and reverse (PTR) look-ups. Review the following prerequisites prior to configuring Dell EMC PowerProtect in a VMware Cloud on AWS. Also, ensure that you plan your firewall according to these prerequisites.
VMware Cloud on AWS web portal console
In the “VMware Cloud on AWS” web portal console please ensure the following:
§ By default, there is no external access to the vCenter Server system in your SDDC (Software Defined Data Center). You can open access to your vCenter Server system by configuring a firewall rule. Set the firewall rule in the compute gateway of VMware Cloud on AWS to enable communication to the vCenter public IP address and tcp port 443 from the desired logical network of your SDDC. The Dell EMC PowerProtect Data Manager will not allow you to add the vCenter Server if this firewall rule is not configured in the SDDC.
§ The default compute gateway firewall rules prevent all virtual machine traffic from reaching the internet. To allow your Dell EMC PowerProtect Data Manager virtual machine to connect to the internet, you need to create a compute gateway firewall rule to allow outbound traffic on the logical network that your Dell EMC PowerProtect Data Manager virtual machine is connected to.
§ Configure DNS to allow machines in your SDDC to resolve fully-qualified domain names (FQDNs) to IP addresses belonging to the internet. The Dell EMC PowerProtect Data Manager will not allow you to add the vCenter Server using the server's public FQDN or IP address if the DNS server is not configured in your SDDC.
§ It is recommended that you deploy the Data Domain system as a virtual appliance in the Amazon VPC (Virtual Private Cloud) of your choice. During the SDDC creation, ensure that you connect your SDDC to an AWS account, and select a VPC and subnet within that account.
§ The Data Domain system running in your Amazon VPC must be connected to your VMware SDDC by way of the VMware Cloud Elastic Network Interfaces (ENIs), allowing your SDDC and services in the AWS VPC and subnet in your AWS account to communicate without needing to route traffic through the internet gateway.
The same ENI channel is recommended for access to Data Domain systems (for the PowerProtect Data Manager solution)
· Detailed steps on configuring ENI are provided by VMware at https://vmc.vmware.com/console/aws-link
§ Ensure that you configure the inbound and outbound firewall rules of your compute gateway for Data Domain connectivity if DDVE is running in your Amazon VPC.
§ If using NSX-T then you need to configure the DNS to resolve to internal IP address of the vCenter (Go to your SDDC Management – Settings – vCenter FQDN and select the Private vCenter IP address) so that you can directly access the management network over the built-in firewall. TCP Port 443 of the vCenter needs to be opened in both the management gateway as well as compute gateway.
§ Please refer to the PowerProtect Data Manager 19.3 Security Configuration Guide for detailed information on what incoming/outgoing ports need to be opened for PowerProtect and VM proxy solution
Amazon AWS web portal
In the “Amazon AWS” web portal, note the following requirements:
§ Configure the inbound and outbound firewall rules of your Amazon VPC security group to provide connectivity between the VMware SDDC compute gateway and Data Domain connectivity if Data Domain is running in your Amazon VPC.
§ If replicating from one Data Domain system to another, ensure that you configure the inbound rule for the security group in AWS to allow all traffic from the respective private IPs of Data Domain Virtual Editions running in your Amazon VPC.
§ If you have more than one Data Domain running in AWS to perform replication, then ensure that both Data Domain systems can ping each other using the FQDNs.
vCenter server inventory
In the vCenter server inventory of your SDDC, note the following requirements:
§ An internal DNS name lookup server must be running inside the vCenter inventory. This will be referenced by all the workloads running in the VMware SDDC.
§ The internal DNS server must have Forwarders enabled to access the internet. This is required in order to resolve the vCenter Server's public FQDN
Interoperability with VMware Cloud on AWS product features
VMware Cloud on AWS has certain restrictions when it comes to workloads and resource pools. For proper operation, you can select the specific areas marked as “Workload” or “Compute”. Avoid using the non-accessible areas, for example:
- vsanDatastore datastore
- Management VMs folder in VMs and Templates view
- Mgmt-ResourcePool resource pool in Hosts and Clusters view
Support Information
Configuration best practices:
a. When deploying or configuring the Dell EMC PowerProtect Data Manager or VM proxy, please ensure that correct DNS server IP pointing to the internal DNS server running in the vCenter inventory is specified.
b. Also ensure that both forward and reverse lookup entries in the internal DNS server are in place for all the required components such as Dell EMC PowerProtect Data Manager, Dell EMC PowerProtect VM proxy, DDVE appliance etc.
c. If using NSX-T, it is recommended to add the vCenter server to the Dell EMC PowerProtect Data Manager using the FQDN
d. If using NSX-V, add the vCenter server to the Dell EMC PowerProtect Data Manager using the public FQDN of the vCenter server.
e. While adding the vCenter server to the Dell EMC PowerProtect Data Manager, specify the login credentials for the [email protected] user.
f. While configuring the VM proxy in the Dell EMC PowerProtect Data Manager, ensure you select transport mode as hot add only.
VMware Cloud on AWS does not support NBD or NBDSSL transport mode, hence we recommend to always set the transport mode to hot add only.
g. VM proxy gets deployed to the root of the cluster instead of inside the “Compute-Resource Pool”, post deployment of the VM proxy it is recommended to manually move it inside the required resource pool in the inventory
Troubleshooting:
When restoring as new VM, the reconnect NIC option may not work correctly.
Workaround 1: Edit settings of the restored new VM and change the network to "VM Network" and Apply, reopen again the edit setting configuration pane of the VM, and change the network to the correct desired NSX-T network logical switch and click "Connect".
Workaround 2: Power off the restored VM – Change the network to "VM Network" and Apply, reopen again the edit setting configuration pane of the VM, and change the network to the correct desired NSX-T network with “connected” & “connect at power on” option checked and then power on the VM.
For VMware Protection using PowerProtect Data Manager, please refer to section “Best Practices and Troubleshooting” chapter in Dell EMC PowerProtect Data Manager 19.3 Administration and User Guide
Log collection:
Please refer to section “Add a log bundle” in chapter “Modifying the System Settings” in Dell EMC PowerProtect Data Manager 19.3 Administration and User Guide
See Also
Documentation available at https://www.dellemc.com/en-us/data-protection/powerprotect-software.htm, provides additional and detailed information on setup as well as configuration for all of the solution components
Feedback
