KMS on media server

[ElGringo]

Hello,

I am using NetBackup Appliance 5230 runing N2.6.1.2.

How to configure KMS and the appliance (According to the HCL it is supported) ? I want to use LTO hardware encryption.

There is nothing about KMS configuration in NetBackup Applicaxe guides ...

Many Thanks !

[mnolan · Accepted solution]

Since the appliance is NOT a master server it is supported.

For configuration you will be reviewing

Symantec NetBackup 7.6 Security and Encryption Guide
Article:000003744 Publish:September 14, 2015 Article URL:http://www.veritas.com/docs/000003744

Addtl information:

KMS considerations
Article:000075382 Publish:October 22, 2015 Article URL:http://www.veritas.com/docs/000075382

[Michal_Mikulik1]

Hello,

to avoid misunderstanding:

You can use KMS for a Media Server / Appliance connected library drives, but you must configure it on Master Server - KMS is always configured on the Master by design.

Regards

Michal

[ElGringo]

Hi

thaks for answers !

I use quantum scalar i80 library. Do I have to licence something at quantum side ?

[Marianne]

Best to speak to your Quantum reseller about Quantum licensing. If I look at the datasheet (download from here: http://www.quantum.com/products/tapelibraries/scalari40i80/index.aspx ) it seems as if "Quantum Scalar Key Manager License for Scalar i80" is listed as additional option. Again - this is something that you need to discuss with your Quantum reseller.

[V4]

I believe, Tape Hardware KMS is different than NBU KMS. The only licensing part i see here is Tape drive must support encryption (which most of do)

You can configure KMS on NBU master and create volume pool with ENCR as prefix have your backups targeted to tape drives attached to appliance and check in jobs reports there should be flag of encrypted

Again this is NBU KMS which is different from Tape hardware KMS and another offering from NBU MSEO KMS .

KMS is meant to run on master server only, media server is to either perform encryption at server level (if MSEO is used) or have tape drives do it attached to media server.

Give it a try and let us know if above serves your purpose

[sdo]

NetBackup KMS on Appliance based NetBackup Master Server is supported:

https://www.veritas.com/community/forums/netbackup-kms-when-appliance-mastermedia

NetBackup KMS should not need any additional licensing from either Veritas or your tape hardware vendor - assuming you already have the required licenses to match your normal NetBackup based tape operations.

However, as previously suggested by Marianne, do check with your tape hardware vendor that they haven't disabled LTO SCSI T10 ENCRYPTION by locking it in to their own licensing.  BTW, I've never heard of this type of vendor behaviour, so probably nothing to worry about.

If you already have the requisite software and hardware, why not try a POC ?

[nbutech]

Were you able to implement KMS or you are still looking for help with configuration?

[ElGringo]

hello,

Sorry for this long delay !

Yes ! I was able to. There is no CLISH to configure KMS, so I needed to configure it with a NetBackupCLI user.

BTW, my appliance is also a master/media server (runing N2.6.1.2)

Many thanks