NBU Appliance 5220, Tape out, VMware integration, SAN transport mode, read-only LUNs, port usage

[cmorrall]

I am currently integrating a NetBackup Appliance 5220, and I am now detailing the SAN configuration. The intended use is to zone the the NBU appliance to the same LUNs as the ESX hosts and thus leveraging the SAN transport mode to pull the backups over Fibre Channel.

I have configured this in another vendor's backup solution and I'm fairly confident I can make it work.

However, this appliance already has a tape library connected via FC, and as such one of two available FC ports is used as the tape out port.

From reading the documentation, Symantec suggests to only use an FC port in one mode, FT SAN client (which I am not intending to use), replication between appliances (not currently in the scope, I only have one appliance although that might change), VMware integration (my intended use) and tape out (what I already am using).

I also read that on my current release, 2.6.0.2, multipathing to SAN LUNs is supported. I cant' find any device specific details, in my case it is an HP 3Par 7400 array.

However, if the suggestion is that I reserve one port for tape out, a consequence would be that I can only use one remaining port as the initiator to connect to the VMware datastores. Not really multipath, although this single initiator could still be spread across several target ports in the array I suppose.

Also, I, as well as the VMware people, are a bit apprehensive about presenting datastore LUNs to a third party host which is running Linux. Are we absolutely sure nothing will ever happen in the appliance, causing it to go nuts and overwrite data? In another environment I could present the LUNs as read-only to the backup host on the array level, thus eliminating this fear. I am not sure the 3Par array has this capability though.

Comments are appreciated.

[RiaanBadenhorst · Accepted solution]

Hi,

You can spread the load across the 2 HBAs. You're probably not going to be writing to tape at the same time you're backing up from the datastores.

As for presenting the luns read only, we usually get that concern from Windows teams when presenting the disk from the vmfs to a media server. In the appliance you're not really allowing any admin (besides maybe you) to access the system, and even then it should be via the CLISH only. So no harm can be done to those VM luns. Valid concern, but process safeguards you.

You might be able to get away with read-only but then restores will go over LAN.

[chashock]

Riaan is correct.  You absolutely can combine tape and VM traffic across the same initiator, it isn't recommended due to performance conflicts that can arise if trying to do tape out and VM backups simultaneously.

On the multi-pathing, the appliance uses DMP as the technology to provide that function, and there is no configuration necessary on the appliance to make it work.

As to the zoning, the appliance doesn't write to the LUNs unless in a restore scenario, and technically speaking, it is mounting the snapshot of the LUN, not the LUN itself.  If you don't want to do a restore over the fabric (which is the real value of SAN Transport) you can present them read-only but as Riaan says you'd lose restore capability.  I'm pretty sure a 3Par array can do this, but I don't recall the steps required. There is no way to configure that at the appliance level, however.

While I won't try to predict the future and say no appliance would ever be able to "go nuts" and do something to a VMFS datastore, I've got lots of customers using this functionality and never seen it happen on appliances or in a build your own configuration.

[cmorrall]

Well, I'll just have to put faith in Symantec and the software. We have done a few tests and presented LUNs to the appliance. All is functioning as expected, backup and restores go over the SAN. I can verifiy that the load is balanced across both HBA ports in the appliance.

I still wish I had a little more instrumentation with regards to the DMP details. I tried going into the shell but when I tried the DMP specific commands I needed to elevate, and this appears no longer a possibility due to security concerns.

As product feedback, I would like to have some documentation on what version of DMP is used and a definite list of supported hardware arrays so I'm sure I'm getting full multipath support.

[RiaanBadenhorst]

Hi,

Sorry didn't see this. I don't have a system at hand but my 7.6.0.1 is running SF 6.0.

You can check compatibility on sort

https://sort.symantec.com/hclcentral