Forum Discussion

Stuart_Hagan's avatar
9 years ago

Netbackup Appliance Encryption

Hi all,

Our 5230 appliance currently does not encrypt data on the disk.  If i select the option from the Web console to start encrypting am I right in saying the only the new data backed up will be encrypted?

Also, would I expext to see slower performance on writing to disk once encryption is enabled?

many thanks,

Stuart

 

 

  • No, please do not enable encryption in the policy. This will increase size of backups as encrypted data cannot be deduped. You can enable encryption in contentrouter.cfg or in pd.conf file which will encrypt data after dedupe. See this TN for details : http://www.veritas.com/docs/000072862
  • No, please do not enable encryption in the policy. This will increase size of backups as encrypted data cannot be deduped. You can enable encryption in contentrouter.cfg or in pd.conf file which will encrypt data after dedupe. See this TN for details : http://www.veritas.com/docs/000072862
  • Hi Marianne,

    many thanks for your reply.  

    When i say enable encryption, I meant enabling it from the Appliance Web Console > Manage > Host > Deduplication > and ticking Encryption.

    Is this the same thing your talknig about when changing contentrouter.cfg or pd.conf?

    regards,

    Stuart

  • Hi Stuart

    Yes, it is the same. Please take care when enabling encryption as it would potentially (or actually) warp the previously deduplicated content because you're now going to have different hashes for the same content. There was a post on connect about it some time last year if I recall. Make sure you've got enough free space to potentially have your "first" backup run again.

    • MManna25's avatar
      MManna25
      Level 3

      Hello  RiaanBadenhorst

       

      When you say enough space for your first backup. Does it mean that netbackup appliance consider new encrypted data as new data segments and I will be backing up 100% of my data ?

  • thanks Riaan,

    It's not long been implemented so there is plenty of room.  Do you think there will be any change with regards to the performance of the writing to disk once the encyption has been swithced on?

    regards,

    Stuart

  • Hi Stuart

    I don't have any real world figures on this but if you think about it, the deduplication is hashing the data and keep it in small chunks, encryption would hash the data and usually keep it in original size. I don't think it would slow down much if any.

    My understanding of the process might be incorrect and anyone is welcome to explain exactly what happens. Given the aforementioned, I don't really see what the point of encryption is. I suppose its a tick box for auditors :)

  • Stuart,

     

    I have enabled MSDP encryption on a number of appliaces.  I have not noticed any impact and a couple of our systems are fairly heavily loaded.   That said I did not benchmark it.

    My understanding is only new data will be encrypted.  Any data stored prior to enabling the encryption will not be encyprted.

     

    Eric

  • I was told by a knowlegdable pre-sales NBU tech that the impact of on-disk encryption within an appliance is negligible to a degree, to only a few percentage points, because the encryption is performed in hardware by the CPUs.

    You're primary concern will be the fact that the first time any old, or any new data, arrives at the appliance then after encryption it will effectively appear to be new data for de-dupe purposes.  You need to think about your data volumes.  Your first batch of backups may well appearto run slowly.  In what appears to be  counter-intuitive measure... you may be better placed enabling on-disk encryption within the appliance just before your first round of incremental backups and not just before a round of full backups.