cancel
Showing results for 
Search instead for 
Did you mean: 

Can backups to tape be encrypted with deduplication and SLP's?

betancourth
Level 3

I am running NetBackup 7.1 whith a mix of Linux and Windoes clients backing up to a Deduplication (Master/Media Server dedup) pool and using SLP to duplicate the jobs to tape.  I need to know a way how to encrypt the data going offsite on tapes.  Is it possible with deduplication and using SLP's or am I going to have to create different jobs pointing directly to tape and enabling the ecryption at the policy level?

6 REPLIES 6

Marianne
Moderator
Moderator
Partner    VIP    Accredited Certified

Which drive type in your environment?

LTO4 and 5 can do hardware encryption.

betancourth
Level 3

Right now they are going to LTO3 but I have a new LTO5 drive that needs to be installed but either way, do you do that at the hardware level then? Or do you tell it to encrypt jobs to tape in Netbackup somewhere?

The_Director
Level 5
Certified

If you are using the built in hardware encryption of LTO5 you will have to configure the library to enable encryption which will require using some sort of key management weather its from Symantec or another vender. Once that is setup you will just set your SLP's to duplicate to tape and the encryption will be handled on the tape with no further administration from NetBackup. 

You will want to research your key management solutions to figure out what works best for your environment though. 

DO NOT backup anything to an encrypted drive without first making a copy (or multiple copies) of the encryption keys...without those keys your backups will useless.

Marianne
Moderator
Moderator
Partner    VIP    Accredited Certified

betancourth
Level 3

I guess I have to install the new tape library (LTO5) sooner in order to be able to encryp our tapes.

js88699
Level 5
Partner

Having been there and done that.  I would suggest using the hardware encyption.  A large financial company I used to work for had to go and change out ALL of their tape drives to LTO5 to enable encryption for all physical tapes.  While I was not part of the team that did that, it worked well after it was all done.