You can use Hybrid Backup Recovery (HBR) to back up the images of on-premises VMware vSphere virtual machines (VMs). You can then restore VMs from the images as needed. This topic describes how to prepare for data backup.

(Recommended) Prepare an AccessKey pair for a RAM user

Resource Access Management (RAM) is a service provided by Alibaba Cloud. It allows you to create and manage multiple identities under an Alibaba Cloud account and then grant diverse permissions to a single identity or a group of identities. In this way, you can authorize different identities to access different Alibaba Cloud resources.

An AccessKey pair is required when you activate a backup client. The AccessKey pair is an identity credential. If an AccessKey pair of your Alibaba Cloud account is used, all cloud resources that belong to the account are exposed to risks. Therefore, we recommend that you use an AccessKey pair of a RAM user to activate backup clients. Before you back up data, make sure that a RAM user is created and an AccessKey pair is created for the RAM user. For more information, see Create a RAM user and Create an AccessKey pair for a RAM user.

Step 1: Create a backup client

Before you back up and restore images of VMs, you must install a backup client on the server where the vSphere Client is deployed. To create a backup client in the HBR console and download the template of the client, perform the following steps:

  1. On the server where the vSphere Client is deployed, log on to the HBR console.
  2. In the left-side navigation pane, choose Backup > On-Premises Backup.
  3. In the top navigation bar, select a region.
  4. On the On-Premises Backup page, click VMware VM.
  5. In the upper-right corner of the On-Premises Backup page, click Add Client.
  6. In the Add Client panel, set parameters and click Create.
    The following table describes the parameters.
    Parameter Description
    Backup Vault The backup vault where you want to store backup data. A backup vault is a repository that HBR uses to store backup data. You can use a single vault to store backup data that is received from multiple backup clients.
    • If you have created backup vaults,

      select a vault from the Vault Name drop-down list.

    • If you have not created a backup vault,

      click Create Vault and enter a backup vault name in the Vault Name field. The name must be 1 to 64 characters in length.

    Client Name The name of the backup client. The name must be 1 to 64 characters in length.
    Software Platform The software platform of the VM from which you want to back up data. Default value: vSphere.
    Network Type
    • Virtual Private Cloud (VPC): Select this option if the server or VM from which you want to back up data resides in a VPC and the VPC is in the same region as the backup vault.
      Note VM backup clients are connected to VPCs by using routes. You can use a VM backup client to access the IP addresses in the CIDR blocks,, and of VPCs from an on-premises VM.
    • Internet: Select this option if no VPCs are available.
    Use HTTPS Specifies whether to use HTTPS to transmit encrypted data that is stored in a backup vault. Note that HTTPS compromises the performance of data transmission. Data that is stored in the backup vault is encrypted, regardless of the setting of this switch. If you modify the setting of this switch, the modification takes effect on the next backup or restore job.
  7. In the Add Client panel, click Download Client and Download Certificate.
    Note The backup client is used to connect your VM to HBR. The certificate is used to activate the client. You can also download the client and the certificate from the client list.

Step 2: Install the backup client

After you download the client template and certificate, install the backup client on a VM. You can then use the client to back up VM images and restore VMs from images. To install a backup client, perform the following steps:

  1. Log on to the vSphere Web Client.
    • HBR supports only vCenter Server 5.5, 6.0, 6.5, 6.7 and 7.0.
    • You can use a browser to log on to the Flash-based or HTML5-based vSphere Web Client.
  2. In the left-side navigation pane, right-click the virtual machine that you want to deploy and select Deploy OVF Template from the shortcut menu.
    For more information, see Deploying OVF and OVA Templates.
    1. In the Deploy OVF Template dialog box, select Local file. Click Browse, select the client template that you downloaded, and then click Next.
    2. Enter the name of the open virtual format (OVF) or open virtual appliance (OVA) template, select the location where you want to deploy the template, and then click Next.
    3. Select the location where you want to run the deployed template and click Next.
    4. Verify the information of the template and click Next.
    5. Select the format of the virtual disk as needed, select a storage to store files for the deployed template, and then click Next.
    6. Select the destination network for each source network and click Next.
    7. Configure the required deployment properties for the software solution and click Next.
      Note Enter a reachable IP address in the VPC that you want to access. If no domain name server (DNS) for mapping domain names to VPC endpoints is available on your host, enter the server IP address of Alibaba Cloud DNS PrivateZone, such as or
    8. Verify the configurations and click Finish.
  3. View the progress of the deployment tasks in the Recent Tasks section.
  4. After the deployment tasks are completed, start the VM on which the OVF or OVA template is deployed.
  5. Open a browser, and enter http://hostname:8011 in the address bar.
    The value of hostname is the IP address of the VM on which the OVF or OVA template is deployed.
  6. On the Register page, set the parameters and click Register to log on to the backup gateway. The following table describes the required parameters.
    Parameter Description
    AccessKey ID The AccessKey ID and AccessKey secret of the RAM user that is used to access HBR. You can obtain the AccessKey ID and AccessKey secret of a RAM user from your Alibaba Cloud account for which HBR is activated. For more information, see Create an AccessKey for a RAM user.
    AccessKey Secret
    Password The password that is used to log on to the backup client. The password must be at least six characters in length.
    Certificate The certificate that you download from the HBR console. If a VM is shut down for more than five days after you use the certificate to activate the client on the VM, the certificate expires. In this case, you must download a new certificate and reactivate the client.


  • Why am I unable to upload an OVA template?

    You may be unable to upload an OVA template because the vCenter Server version of the vSphere Web Client is not supported, the browser is not supported by the vCenter Server, or the language of the browser is not supported. The vCenter Server version must be 5.5, 6.0, 6.5, 6.7 or 7.0. Perform the following steps to troubleshoot the error:

    • Verify that HBR supports the version of vCenter Server.
    • If you are using vCenter Server 6.0, use Firefox of an earlier version such as Firefox 38.0 to deploy the OVA template.
    • If a message appears to remind you of a common error, we recommend that you switch the language of your browser to English and try again.
  • Why am I unable to add a vCenter Server instance to the HBR gateway when the IP address, username, and password are correct?

    A vCenter Server may fail to be added if the password contains the following special characters:

    ` ^ ~ = ; ! / ( [ ] { } @ $ \ & # % +

    Note We recommend that you create a vCenter Server account that is dedicated for backup. We recommend that you use periods (.) instead of other special characters in the password of the account.

What to do next

Back up VMware VM images