How to configure a Netapp FAS controller to use NDMP

Author: NetworkAdminKB.com Created: 2011-03-34 Modified: 2011-07-22

Information: This article will explain the basic process used to configure a Netapp FAS controller to use NDMP to communicate with a VTL or standalone tape device over Fiber Channel. This is a basic configuration used to show the general steps involved in the process. There are many configuration options available for using NDMP in conjunction with third party backup software. You should review your backup software documentation for specific configurations that are supported. In general NDMP supports Virtual and Physical Tape Libraries as well as stand alone tape devices. Assumptions and Perquisites The version of Data Ontap needed to support your tape device is currently installed. You have access to the Netapp NOW site and associated downloads for your Netapp controllers. You have a basic understanding of NDMP and its associated concepts. You have administrative rights to the Netapp Controller(s) and know how to access their configuration files stored in the etcfolder (aka the etc$ share). You know how to run various Data Ontap commands by connecting to the Netapp controller using Telnet / SSH etc. You know how to perform a takeover and giveback of the Netapp FAS cluster. You have verified your planned configuration is supported by Netapp. You have a FC tape device that can be dedicated for use by Netapp. The FC tape device being used for NDMP cannot be shared with other devices. You understand basic Fiber Channel (FC) concepts and terminology. You know how to zone FC ports using an FC switch, or you are attaching the tape device directly to one of the Netapp FC ports. Important: In order for the Netapp controller to use NDMP over fiber channel it must have one FC port not currently zoned to other devices, and this port should not be used to present LUNs to FC hosts. Usually all Netapp FC ports connected to the FC fabric are configured as Target Ports so they can accept incoming connections. This port will be reconfigured as an Initiator Port to support NDMP. If you do not have an available FC port you can purchase an FC expansion card or you can reconfigure an embedded FC port as an Initiator port. 1) Verify the tape device is on Netapps Data Protection Supported Devices list a. http://www.netapp.com/us/solutions/a-z/data-protection-devices.html

b. Download the configuration file for your device from this web site. c. The configuration file should have a TCF extension. 2) Verify / Install the Tape Configuration file a. Check the Netapp etc$\tape_config folder to see if the configuration file already exists. b. If the configuration already exists in the etc$\tape_config folder do not overwrite it, Netapp may restore the original files in the future. c. Note: the configuration file is just a text file that can be opened in any text editor. 3) Configure the appropriate Netapp FC port as an Initiator a. Warning: Changing the selected Netapp FC port from Target to Initiator will change the WWN associated with the port. b. Typically only the embedded Netapp FC ports can be configured as either Target or Initiator. Because of this thefcadmin commands only work on those ports. Usually, the expansion HBAs installed into the Netapp Controllers are ordered hardcoded as Target or Initiator ports and can not be changed. c. The embedded Netapp FC ports are usually labeled as 0a, 0b, 0c, or 0d. Be sure you know which FC port is being changed to the Initiator port. i. To map WWN to Netapp FC labels use this command. fcp show adapter d. Run the following command to view the current FC Port configuration. fcadmin config

e.

Disable the selected port fcadmin config -d ##

f.

Change the selected port to an Initiator fcadmin config -t initiator ##

g.

If this is a Netapp FAS Cluster you need to perform the same configuration, on the same port, on the partner Netapp controller. Thus, in the above examples port 0c would be configured in the same manner on the partner Netapp Controller. This is required to support proper takeover and giveback during a failure. Reboot the controller i. If this Netapp FAS Cluster perform a takeover, reboot, and giveback on each of the controllers in the Netapp FAS cluster. ii. If this is a single controller reboot the controller Enable / Verify the selected Netapp FC port i. The port should come back online after the reboot. Use this command to verify. fcadmin config

h.

i.

ii. If the port is not enabled use the following command to enable it. fcadmin config -e ## j. Obtain the current WWPN of the selected initiator port. storage show adapter

i. The WWPN may be needed to do the FC zoning or provide access to the tape device in Enterprise VTLs. 4) Connect the Tape Device to the selected Netapp FC Port a. If using an FC Switch i. Zone the selected Netapp FC port to the FC tape device. b. If using a directly connected FC tape device i. Connect the FC tape device directly to the Netapp FC port. c. If using an Enterprise VTL i. Grant the Netapp WWPN access to the VTL as required. 5) Bounce the selected Netapp FC Port a. You must bounce the selected FC port on the Netapp Controller(s) to force a scan for new devices. A scan for new devices is only done during a reboot or fiber state change. i. A fiber state change can be initiated using one of the following methods. 1. On the FC Switch disable then enable the Switch port the selected Netapp FC port is connected to. 2. Unplug the selected Netapp FC port from the switch or directly connect tape device. ii. Leave the port down for at least 2 minutes so the Netapp Controller properly detects the fiber state change and configures the FC port as offline. iii. Review the Netapp messages log after the bounce is completed you should see messages similar to these.

6) List the currently discovered devices. a. List the tape devices sysconfig -t b. List robotic Tape Library devices sysconfig -m c. If the tape devices are not listed review your configuration and/or perform another bounce of the selected Netapp FC port. If using a VTL typically you need to provide access to the Media Changer as well as the Tape Device.

7) Review and Enable NDMP on the Netapp Controller(s) a. Check NDMP current status ndmpd status b. Enable NDMP ndmpd on Configuring Netapp to support Third Party Backup Software for use with NDMP In general to support third party backup software integration with NDMP you will need to configure most of the following options on the Netapp controller(s). Your specific needs may vary. Its recommended you use dedicated tape devices (virtual or physical) for each Netapp controller, this will simplify your configuration. 1) On the Netapp Controller a. Add a backup user account for use by the software useradmin user add backupuser -g Backup Operators i. Change the backupuser name as needed for your environment ii. Enter the user password when prompted. b. Specify the NDMP password length

i. Users that do not have root access must enter a system generated NDMP password to run NDMP operations on the Netapp controller. This password will also be used to authenticate the backup user when used with third party backup software. options ndmpd.password_length {8 | 16} ii. The system generated password can be either 8 or 16 characters in length. c. Generate an NDMP password for the backup user. i. Use the following command to generate the NDMP password. ndmpd password backupuser ii. Record the generated NDMP password. iii. This password is good until the regular password for this account it changed. Once the regular password is changes you must repeat this command to obtain a new system generated password. iv. The system generated password will be unique to each Netapp Controller. d. Grant NDMP access to the host name of the server running the third party backup software. options ndmpd.access host=server.domain.fqdn i. This host name must be resolved via DNS or it should be manually added to the etc$\hosts file. You may use the IP Address instead of the DNS name. ii. Optionally, you can grant NDMP access to all hosts using the following command. options ndmpd.access all 1. By default all hosts should be granted NDMP access. It is recommended you leave this setting at its default value. e. Specify the NDMP authentication type options ndmpd.authtype {challenge | plaintext | plaintext,challenge} i. Challenge (MD5) is the preferred and more secure method.

ii. Refer to your third party backup software to determine which authentication type you should configure. f. Enable or disable NDMP connection logging i. This will log NDMP connections to the etc$\messages file and can be useful for troubleshooting or auditing access. options ndmpd.connectlog.enabled {on | off} Configure the type of Tape Reservation to use. i. Sharing the Tape Drive and/or Media Changer between multiple systems requires all the systems to use the same Tape Reservation method. This may not be required if the Tape Drive and/or Media Changer is dedicated to a single Netapp Controller. options tape.reservations {scsi | persistent | off} ii. The two tape reservation methods are SCSI-Reserve and SCSIPersistent. SCSI-Persistent reservations are not affected by error recovery mechanisms, such as loop reset, but not all devices implement SCSIPersistent reservations correctly. h. Determine or set NDMP version i. Determine NDMP version ndmpd version ii. Set NDMP version ndmpd version {1 | 2 | 3| 4} 1. Use this command to specify an NDMP version compatible with your third party backup software. The highest NDMP version is 4. Configure your third party backup software You can now configure your third party backup software as needed to support NDMP. Review the third party backup software documentation for on how to configure their application to use NDMP. You may want to verify your software is compatible with Netapps NDMP. http://www.netapp.com/us/solutions/a-z/backup-to-tape/backup-to-tape-ndmp.html

g.

Interesting limitations I encountered with my Netapp and third party backup software and NDMP. Not sure if these are common to all applications or not, given the general recommendations of dedicated tape devices for NDMP I think these apply universally. Software issues: o The backup software was unable to duplicate an NDMP tape from a VTL to the ATL, thus making the VTL useless. Monitoring and Managing NDMP sessions You can monitor and manage NDMP sessions directly from the Netapp system console using the following commands 1) View NDMP Session details a. ndmpd probe [session] 2) Terminating an NDMP session a. ndmpd kill session 3) Enable NDMP debug log messages a. ndmpd debug {10 | 30 | 50 | 70} 4) View current NDMP debug log setting a. ndmpd debug Miscellaneous Netapp commands 1) Display current aliases a. storage alias 2) Remove all tape device aliass a. storage unalias -t 3) Remove all media changer aliass a. storage unalias -m 4) Show tape devices a. storage show tape 5) Show storage adapters a. storage show adapter