This topic provides instructions for installing and activating a disaster recovery gateway in an on-premises VMware environment. Once activated, the gateway enables backup and restoration of VMware virtual machines (VMs) via the Cloud Backup console.
(Recommended) Use the AccessKey pair of a RAM user for backup and disaster recovery
Resource Access Management (RAM) is an Alibaba Cloud service that allows you to manage user identities and control access to resources. RAM lets you create and manage multiple identities for an Alibaba Cloud account, and grant multiple permissions to a single identity or a group of identities. Different identities can be authorized to access different Alibaba Cloud resources.
An AccessKey pair is required when you activate a disaster recovery gateway. Using the AccessKey pair of an Alibaba Cloud account may expose all its associated cloud resources to security risks. Using an AccessKey pair of a RAM user is the recommended best practice to activate the disaster recovery gateway. Before you back up data, ensure that a RAM user and an AccessKey pair have been created. For more information, see Create a RAM user and Create an AccessKey pair.
Prerequisites
Cloud Backup is activated. No charges are incurred for activating Cloud Backup. However, if the VMware backup and disaster recovery feature of Cloud Backup is used, charges apply for the Cloud Backup client that you use to back up VMware VMs and the storage usage of backup vaults. For more information, see Billing.
The VMware username and password used to access the vCenter Server and its resources are obtained.
Usage notes
Limits are imposed on the supported operating systems and VMware platforms. The locations and categories of permissions may vary with the vCenter version. This information must be verified with caution. For more information, see Limits on VMware disaster recovery.
The AccessKey pair used to activate the disaster recovery gateway may expire and be rotated. If the AccessKey pair is rotated, the disaster recovery gateway must be reactivated. Otherwise, the backup fails. For more information, see How do I change the AccessKey pair of a gateway used for VMware backup and disaster recovery to reactivate the gateway?
Step 1: Create a backup account
To ensure that Cloud Backup can back up on-premises VMware VMs as expected, you must create a VMware username and password for Cloud Backup to access vCenter Server and its resources. In vCenter Server, create a VMware role and a VMware user and then assign the VMware role to the VMware user.
Log on to the vSphere Web Client.
Create a VMware role.
Click Menu and select Administration.
On the Roles tab, click the plus icon.
In the New Role dialog box, select the required permissions for the role based on the following tables. Click NEXT.
NoteThe locations and categories of permissions may vary with the vCenter version. Proceed with caution when you query the information.
Specify Role name and Description, and then click Finish.
Specify an informative name to identify the role, for example, HBRBackupAdminRole.
Create a VMware user.
Click Menu and select Administration.
On the Users and Groups tab, select a local domain name from the Domain drop-down list and click ADD USER.
In the Add User dialog box, specify User name and Password, and then click ADD.
Specify an informative name to identify the user, for example, BackupAdmin.
ImportantYou must remember the username and password and keep them confidential. When you add a vCenter Server in the Cloud Backup console, you must specify the username and password.
Assign the VMware role to the VMware user.
Click Menu and select Administration.
On the Global Permissions tab, click the plus icon.
In the Add Permission dialog box, configure the parameters and then click OK. The following table describes the parameters.
Step 2: Create a disaster recovery gateway
A disaster recovery gateway helps you back up and restore data. To configure a disaster recovery gateway and download the gateway to the server where the vSphere Client is deployed, perform the following steps:
On the server where the vSphere Client is deployed, log on to the Cloud Backup console.
In the left-side navigation pane, choose .
In the top navigation bar, select a region.
On the VMware Backup & Disaster Recovery page, click Create Backup & Disaster Recovery Gateway.
In the Create Backup & Disaster Recovery Gateway panel, configure the parameters and then click Create.
The following table describes the parameters.
Parameter
Description
Backup Vault
The backup vault to which you want to store backup data.
Create Vault: If you select this option, specify a name for the backup vault in the Vault Name field. If you do not configure this parameter, a random name is specified.
Select Vault: If you select this option, select a backup vault from the Vault Name drop-down list.
ImportantAfter you create a backup vault and store backup data, you are charged for the storage usage of the backup vault. For more information, see Billing methods and billable items.
To maximize the redundancy of backup data, the system automatically selects a vault type based on regional support. In regions that support zone-redundant storage, a zone-redundant storage (ZRS)-enabled backup vault is created by default. In other regions, a locally redundant storage (LRS)-enabled backup vault is created.
Vault Name
The name of the backup vault.
Vault Resource Group
This parameter is required only if you set the Backup Vault parameter to Create Vault. This parameter specifies the resource group to which the backup vault belongs.
Use resource groups to manage resources owned by your Alibaba Cloud account. Resource groups help you simplify the resource and permission management of your Alibaba Cloud account. For more information, see Create a resource group.
Gateway Name
The gateway name. The name must be 1 to 64 characters in length.
VMware Platform
The VMware platform on which the VM is deployed. In this example, select On-premise vSphere.
On-premise vSphere: The VM is deployed in a VMware environment on the on-premises server.
Alibaba Cloud VMware Services (ACVS): The VM is deployed on Alibaba Cloud VMware Service (ACVS).
Network Type
The network type. In this example, select Internet.
VPC: Select this option if the VM that you want to back up resides in a virtual private cloud (VPC) and the VPC is in the same region as the backup vault.
NoteThe on-premises VMware backup client requires a routed connection to the Alibaba Cloud VPC. This connection must allow the client to access one of the following Alibaba Cloud service CIDR blocks:
100.64.0.0/10,100.64.0.0/11, or100.96.0.0/11.Internet: Select this option if no VPCs are available.
Use HTTPS
Specifies whether to use HTTPS to transmit encrypted data that is stored in the backup vault. If you use HTTPS to transmit data, the performance of data transmission is degraded. If you modify the setting of the Use HTTPS switch, the modification takes effect on the next backup or restore job.
In the Create Backup & Disaster Recovery Gateway panel, click Download Gateway and Download Certificate.
NoteThe disaster recovery gateway is used to connect your VM to Cloud Backup, and the certificate is used to activate the disaster recovery gateway. A disaster recovery gateway can be downloaded and deployed on the Backup & Disaster Recovery Gateway tab at any time.
Step 3: Install the disaster recovery gateway
Installation of the gateway in the VMware environment is required to enable backup and restore jobs in the Cloud Backup console. The process is as follows:
Log on to the vSphere Web Client.
Cloud Backup supports only vCenter Server 6.7 and later.
Use a browser to log on to the Flash-based or HTML5-based vSphere Web Client.
In the left-side navigation pane, right-click the VM and select Deploy OVF Template from the shortcut menu.
For more information, see Deploying OVF and OVA Templates. In the Deploy OVF Template dialog box, select Local file. Click UPLOAD FILES, select the gateway package that you downloaded, and then click NEXT.
NoteTo reduce the download time, Cloud Backup provides a client package in the Open Virtual Appliance (OVA) format. Use the package to deploy Open Virtual Format (OVF) templates on the vSphere Web Client.
Enter the name of the VM, select the location where you want to deploy the VM, and then click NEXT.
Select the location where you want to run the deployed template and click NEXT.
Verify the template details and click NEXT.
Select the format of the virtual disk, select a storage resource to which you want to store the files of the deployed template, and then click NEXT.
Select a destination network for each source network and click NEXT.
Configure the required deployment properties for the software solution and click NEXT.
If you use DHCP to obtain an IP address, you do not need to specify the Gateway, IP, and Netmask parameters. If you use a static IP address, you must specify the preceding parameters based on the obtained IP address.
You must make sure that the specified primary DNS server and secondary DNS server can resolve the domain names of Cloud Backup, vCenter, and ESXi.
Set the Admin User Name and Admin User Password parameters to the username and password of the gateway VM that you created. This user has root permissions and can be used to log on to the VM.
Verify the configurations and click FINISH.
On the Recent Tasks page, view the progress of each deployment task.
Step 4: Activate the disaster recovery gateway
If a VMware disaster recovery gateway is not activated within 48 hours after it is created, Cloud Backup automatically deletes the gateway.
After the deployment tasks are completed, start the VM on which the OVF template is deployed.
Open a browser, and then enter
http://hostname:8011in the address bar.The value of
hostnameis the IP address of the VM on which the OVF template is deployed.On the Register page, configure the parameters and click Register to log on to the disaster recovery gateway. The following table describes the parameters.
Parameter
Description
AccessKey ID
The AccessKey ID and AccessKey secret of the RAM user that is used to access Cloud Backup. Get the AccessKey ID and AccessKey secret of a RAM user from your Alibaba Cloud account for which Cloud Backup is activated. For more information, see How do I create an AccessKey pair for a RAM user?
AccessKey Secret
Password
The password that is used to log on to the gateway. The password must be at least six characters in length.
Certificate
The certificate that you downloaded from the Cloud Backup console. If the gateway is shut down for more than five days after you use the certificate to activate the gateway, the certificate expires. You must download a new certificate and reactivate the gateway.
After the gateway is installed, the status of the gateway changes to Activated on the Backup & Disaster Recovery Gateway tab of the VMware Backup & Disaster Recovery page. The following operations are available in the Actions column:
Throttle Bandwidth: Set traffic limits in different time periods to prevent backup jobs from consuming excessive VMware resources.
More:
Download Gateway: Download the installation package of the disaster recovery gateway.
Download Certificate: Download the certificate used to activate the disaster recovery gateway.
Delete: After you delete a Cloud Backup client, the backup data is also deleted and running backup and restore jobs fail. Before you delete a Cloud Backup client, make sure that you no longer need the backup data generated by the client and no backup or restore jobs are being performed by the client.
Gateway Settings: Specify whether to transfer data over HTTPS, the maximum number of worker threads, and the maximum number of CPU cores.
FAQ
Why am I unable to upload an OVA template?
You may be unable to upload an OVA template because the vCenter Server version of the vSphere Web Client is not supported, the browser is not supported by the vCenter Server, or the language of the browser is not supported. Perform the following steps to troubleshoot the error:
Check whether the vCenter Server version of the vSphere Web Client is supported by Cloud Backup. Cloud Backup supports only vCenter Server 6.7 and later.
If a message appears to remind you of a common error when you deploy an OVA template, change the language of your browser to English and then deploy the OVA template again.
Why am I unable to add a vCenter Server instance to the disaster recovery gateway even if the IP address, username, and password are correct?
A vCenter Server may fail to be added if the password contains the following special characters:
` ^ ~ = ; ! / ( [ ] { } @ $ \ & # % +
As a best practice, create a vCenter Server account dedicated to backup operations. This account must be assigned the administrator role. To prevent potential authentication failures, use only periods (.) as special characters in its password. For more information, see Create a backup account.