All Products
Search
Document Center

Cloud Backup:Before you begin (ACVS)

Last Updated:Mar 20, 2024

This topic describes how to install and activate a disaster recovery gateway in an Alibaba Cloud VMware Service (ACVS) environment. After you activate the disaster recovery gateway, you can create backup and restore jobs in the Cloud Backup console. Cloud Backup allows you to back up virtual machines (VMs) deployed in ACVS and restore the backup VMs if required.

Background information

ACVS is an enterprise-class public cloud service that is jointly developed by Alibaba Cloud and VMware. ACVS implements the software-defined data center (SDDC) architecture of VMware on the cloud. Alibaba Cloud provides sales, operations, and after-sales support for ACVS.

(Recommended) Create an AccessKey pair for a RAM user

Resource Access Management (RAM) is an Alibaba Cloud service that allows you to manage user identities and control access to resources. RAM allows you to create and manage multiple identities associated with an Alibaba Cloud account and grant different permissions to a single identity or a group of identities. This way, you can authorize different identities to access different Alibaba Cloud resources.

An AccessKey pair is required when you activate a disaster recovery gateway. The AccessKey pair is an identity credential. If an AccessKey pair of your Alibaba Cloud account is used, all cloud resources that belong to the account are exposed to risks. Therefore, we recommend that you use an AccessKey pair of a RAM user to activate the disaster recovery gateway. Before you back up data, make sure that a RAM user is created and an AccessKey pair is created for the RAM user. For more information, see Create a RAM user and Create an AccessKey pair.

Prerequisites

  • Cloud Backup is activated. You are not charged for activating Cloud Backup. If you use the VMware backup and disaster recovery feature of Cloud Backup, you are charged for the Cloud Backup client that you use to back up VMware VMs and the storage usage of backup vaults. For more information, see Billing.

  • The VMware username and password used to access the vCenter Server and its resources are obtained.

Precautions

Step 1: Prepare a dedicated VMware environment

A dedicated VMware environment is the environment in which you deploy VMs. Before you back up VMs, perform the following operations:

  • Obtain the username and address that are used to log on to the VMware management component.

  • Configure a firewall between your virtual private cloud (VPC) and the dedicated VMWare environment.

    By default, the VPC bound when you create the dedicated VMware environment can access only the management components of VMware vCenter and NSX-T, and cannot directly access the NSX-T segments that you create. You must add firewall rules in the NSX-T console to allow network access between the VPC and NSX-T segments. You must also configure CIDR blocks to ensure that the business network can communicate with vCenter and ESXi networks.

  • Add the endpoints and ports to the whitelist of your firewall. This ensures that Cloud Backup can back up and restore VMware VMs as expected.

    For example, if you use ACVS in the China (Shanghai) region, add the MQTT endpoint (post-cn-4590rcihm02-internal.mqtt.aliyuncs.com), the OSS endpoint (*.oss-cn-shanghai-internal.aliyuncs.com), and the VPC endpoint (hbr-vpc.cn-shanghai.aliyuncs.com) to the whitelist of the firewall in the VMWare environment. For more information about endpoints, see What are the endpoints and ports that can be accessed by the Cloud Backup client?

Step 2: Log on to the ECS jump server

Create an Elastic Compute Service (ECS) instance in the VPC of the dedicated VMware environment. The ECS instance serves as a jump server for logging on to management components such as vCenter Server and NSX-T Manager. We recommend that you select Windows Server as the operating system. If you enable Internet access from the jump server, you must configure security settings.

Note

When you create the ECS jump server, set the VPC parameter to the VPC that is used by the dedicated VMware environment.

  1. Log on to the ECS console and find the ECS instance that serves as the jump server.

  2. In the Actions column, click Connect.

  3. In the Connection and Command dialog box, click Connect in the Workbench Connection section.

  4. In the Instance Login dialog box, configure the logon credentials and click OK.

    • Username: Enter administrator.

    • Password: Enter the logon password that you set for the Logon Credentials parameter when you created the ECS instance.

    登录ecs跳转机

Step 3: Create a disaster recovery gateway

A disaster recovery gateway helps you back up and restore data. To configure a disaster recovery gateway and download the gateway to ACVS where the vSphere Client is deployed, perform the following steps:

  1. Log on to the Cloud Backup console by using the ECS jump server.

  2. In the left-side navigation pane, choose Backup > VMware Backup & Disaster Recovery.

  3. In the top navigation bar, select a region.

  4. In the VMware Backup & Disaster Recovery page, click Create Backup & Disaster Recovery Gateway.

  5. In the Create Backup & Disaster Recovery Gateway panel, configure the parameters and click Create.

    The following table describes the parameters.

    Parameter

    Description

    Backup Vault

    The backup vault to which you want to store the backup data. Valid values:

    • Create Vault: If you select this option, specify a name for the backup vault in the Vault Name field. If you do not configure this parameter, a random name is specified.

    • Select Vault: If you select this option, select a backup vault from the Vault Name drop-down list.

    Important

    After you create a backup vault and store backup data, you are charged for the storage usage of the backup vault. For more information, see Billing methods and billable items.

    To maximize the redundancy of your backup data, Cloud Backup uses zone-redundant storage (ZRS)-enabled backup vaults by default in regions that support ZRS-enabled backup vaults. For regions that support only locally redundant storage (LRS)-enabled backup vaults, Cloud Backup uses LRS-enabled backup vaults. You do not need to manually select a backup vault type.

    Vault Name

    The name of the backup vault.

    Vault Resource Group

    This parameter is required only if you set the Backup Vault parameter to Create Vault. This parameter specifies the resource group to which the backup vault belongs.

    You can use resource groups to manage resources owned by your Alibaba Cloud account. Resource groups help you simplify the resource and permission management of your Alibaba Cloud account. For more information, see Create a resource group.

    Gateway Name

    The gateway name. The name must be 1 to 64 characters in length.

    VMware Platform

    The VMware platform on which the VM is deployed. In this example, select Alibaba Cloud VMware Services (ACVS).

    • On-premise vSphere: The VM is deployed in a VMware environment on the on-premises server.

    • Alibaba Cloud VMware Services (ACVS): The VM is deployed on ACVS.

    Network Type

    The network type. In this example, select VPC.

    If you select VPC, the VM that you want to back up must reside in a VPC and the VPC is in the same region as the backup vault.

    Use HTTPS

    Specifies whether to use HTTPS to transmit encrypted data that is stored in a backup vault. If you use HTTPS to transmit data, the performance of data transmission is degraded. If you modify the setting of the Use HTTPS switch, the modification takes effect on the next backup or restore job.

  6. In the Create Backup & Disaster Recovery Gateway panel, click Download Gateway and Download Certificate.

    Note

    The disaster recovery gateway is used to connect your VM to Cloud Backup, and the certificate is used to activate the disaster recovery gateway. On the Backup & Disaster Recovery Gateway tab, you can download and deploy a disaster recovery gateway at any time.

Step 4: Install the disaster recovery gateway

After you download the gateway and certificate, you need to install the gateway in your VMware environment. After the gateway is installed, you can run backup and restore jobs in the Cloud Backup console. To install the gateway, perform the following steps:

  1. Log on to the ECS jump server.

    For more information, see Step 2: Log on to the ECS jump server.

  2. Log on to the ACVS console, find the dedicated VMware environment, and then click Login management component in the Actions column.

  3. Log on to the vSphere Web Client on the ECS jump server by using the vCenter username and vCenter address that you obtained in Step 2.

  4. In the left-side navigation pane, right-click the VM and select Deploy OVF Template from the shortcut menu.

    ovfmubanFor more information, see Deploying OVF and OVA Templates.

    1. In the Deploy OVF Template dialog box, select Local file. Click Browse, select the gateway package that you downloaded in Step 3: Create a disaster recovery gateway and then click NEXT.

      Note

      To reduce the download time, Cloud Backup provides a gateway package in the open virtual appliance (OVA) format. You can use the package to deploy Open Virtual Format (OVF) templates on the vSphere Web Client.

      ovf模板

    2. Enter the name of the OVF template, select the location where you want to deploy the template, and then click NEXT.

      选择位置

    3. Select a computing resource and click NEXT.

      计算资源

    4. Verify the template details and click NEXT.

      详细信息

    5. Select the format of the virtual disk, select a storage resource to which you want to store the files of the deployed template, and then click NEXT.

      选择存储

    6. Select a destination network for each source network and click NEXT.

      选择网络

    7. Configure the network and admin user password, and then click NEXT.

      • If you use DHCP to obtain an IP address, you do not need to specify the Gateway, IP, and Netmask parameters. If you use a static IP address, you must specify the preceding parameters based on the obtained IP address.

      • You must make sure that the specified primary DNS server and secondary DNS server can resolve the domain names of Cloud Backup, vCenter, and ESXi.

        Note

        You can enter a reachable IP address of the VPC that you want to access. If no DNS server is available for mapping domain names to VPC endpoints, enter the server IP address of Alibaba Cloud DNS PrivateZone, for example, 100.100.2.136 or 100.100.2.138.

      • Set the Admin User Name and Admin User Password parameters to the username and password of the gateway VM that you created. This user has root permissions and can be used to log on to the VM.

      自定义模板

    8. Verify the configurations and click FINISH.

      查看配置数据

  5. On the Recent Tasks page, view the progress of each deployment task.

image

Step 5: Activate the disaster recovery gateway

  1. After the deployment tasks are completed, start the VM on which the OVF template is deployed.

  2. Open a browser, and enter http://hostname:8011 in the address bar.

    The value of hostname is the IP address of the gateway on which the OVF template is deployed.

  3. On the Register page, configure the parameters and click Register to log on to the gateway. The following table describes the parameters.

    Parameter

    Description

    AccessKey ID

    The AccessKey ID and AccessKey secret of the RAM user that is used to access Cloud Backup. You can obtain the AccessKey ID and AccessKey secret of a RAM user from your Alibaba Cloud account for which Cloud Backup is activated. For more information, see How do I create an AccessKey pair for a RAM user?

    Note

    The AccessKey pair used to activate the disaster recovery gateway may expire and be rotated. If the AccessKey pair is rotated, you must reactivate the disaster recovery gateway. Otherwise, the backup fails. For more information, see How do I change the AccessKey pair of a gateway used for VMware backup and disaster recovery?

    AccessKey Secret

    Password

    The password that is used to log on to the gateway. The password must be at least six characters in length.

    Certificate

    The certificate that you downloaded from the Cloud Backup console. If a VM is shut down for more than five days after you use the certificate to activate the gateway on the VM, the certificate expires. You must download a new certificate and reactivate the gateway.

    Control Network Type

    Select VPC.

    Message Channel Network Type

    Select VPC.

    After the gateway is installed, the status of the gateway changes to Activated on the Backup & Disaster Recovery Gateway tab of the VMware Backup & Disaster Recovery page. You can perform the following operations in the Actions column:

    • Throttle Bandwidth: You can set traffic limits in different time periods to prevent backup jobs from consuming excessive VMware resources.

    • More:

      • Download Gateway: You can download the installation package of the disaster recovery gateway.

      • Download Certificate: You can download the certificate used to activate the disaster recovery gateway.

      • Delete: After you delete a Cloud Backup client, the backup data is also deleted and running backup and restore jobs fail. Before you delete a Cloud Backup client, make sure that you no longer need the backup data generated by the client and no backup or restore jobs are being performed by the client.

      • Gateway Settings: You can specify whether to transfer data over HTTPS, the maximum number of worker threads, and the maximum number of CPU cores.

    After you complete the preceding operations, you can view the vCenter Servers on the Managed vCenter Servers tab.

Why am I unable to add a vCenter Server instance to the disaster recovery gateway even if the IP address, username, and password are correct?

A vCenter Server may fail to be added if the password contains the following special characters:

` ^ ~ = ; ! / ( [ ] { } @ $ \ & # % +

How do I change the AccessKey pair of a gateway used for VMware backup and disaster recovery?

To reactivate the disaster recovery gateway for VMware VMs, perform the follow steps:

  1. Go to the client installation directory: cd /opt/alibabacloud/hbr/data/.

  2. Run the rm -f console.mv.db command to delete console.mv.db.

  3. Run the following command to restart the service: systemctl restart hbr.

  4. Reactivate the disaster recovery gateway with the new AccessKey pair in the Cloud Backup console.

What to do next

Back up VMware VMs