Module 2 - NetWorker Automated Recovery
This module provides an overview of the NetWorker Automated Recovery using the Cyber Recovery UI
Vault NetWorker Recovery
In this lesson you will recover from a known good copy (which was analyzed by Cyber Detect and found that the copy is likely not infected) to a vault NetWorker server
1
Login to a new Vault NetWorker deployment with the same hostname as the production NetWorker (nve.demo.local) and make sure you don't see any devices and Save Sets. Open the Google Chrome browser from the Desktop shortcut and open **NetWorker-Vault** from bookmarks bar. If you see Chrome Security Warning, click **Advanced** and then click "**Proceed to nve.demo.local**"
2
Login to the Vault NW UI using the following credentials: **Username:** administrator \ **Password:** Password123!
Devices
3
Navigate to **Devices and Media --> Devices** page to make sure there are no listed devices
Storage Nodes
4
Navigate to **Devices and Media --> Storage Nodes** page to confirm that Storage Node is visible. If it's visible, proceed to the next step, otherwise add the Storage node
5
To add a Storage Node enter the Storage Node name as **nve.demo.local** and Click **Finish**
Clients
6
Navigate to **Protection --> Clients** page. There are no clients except the NetWorker Server itself
Change the server state to Disaster Recovery
7
In order to be able to recover to the vault NetWorker server, it needs to be in **Disaster Recovery** state. Click on **Server Properties** under the **Server** menu.
8
Change the Server State to **Disaster Recovery** and click Save
Production NetWorker
9
The production NetWorker is writing to **/data/col1/NW-FS** MTree on the production DD **ddveprod.demo.local** and it has one device folder where both the NetWorker server bootstrap and the client1.demo.local (/temp directory) backups are written. **NW-FS** is used for **NetWorker server bootstrap and client1.demo.local (/temp)** backups. We already replicated the NetWorker Data from Production to Vault DD and ran Secure Copy operation in the previous module. After that, we analyzed the copy using CyberSense and the new copy was INFECTED. We will use the previous GOOD Copy to recover data using the Vault Networker Application.
Configure Vault NetWorker
10
Login to Cyber Recovery using the following credentials: **Username:** cradmin\ **Password:** Password123!
11
Before we can start the recovery process, we need to add the Vault Networker Application (deployed with same hostname as the Production NetWorker) in CR UI under the **Assets --> Applications** page
12
Click ADD to add the following information: **Nickname :** VaultNW \ **FQDN or IP Address:** nve.demo.local \ **Application Type:** NetWorker Click **Next**
13
**Host Username:** root \ **Host Password:** Password123! \ **SSH Port Number:** 22 "Host Username" is the NetWorker host OS username and "Application Username" is the NetWorker Management Console (NMC) / NWUI username Click **Next**
14
**Application Username:** administrator\ **Application Password:** Password123! Click **Next**
15
Click "Finish"
16
The Vault Networker Application is now successfully configured
(Optional) Running a NetWorker Recovery Check
17
Running a scheduled or an on-demand NetWorker recovery check ensures that after a successful recovery, a copy can be recovered. To perform a recovery check, Navigate to **Recovery>Copies** tab and select the **Good** copy of the **NetWorker-FS** Cyber Recovery Policy and click on **Recovery Check**
18
Select the Vault Application Host.
19
Enter the details and click **Apply** **Storage User**: ddboost **Storage Password**: Password123!
20
Navigate to the **Jobs** page to check the Recovery check Job progress.
21
Recovery check job completed successfully.
Recovery
22
Navigate to Recovery tab and Click on "**Application**"\ \ Select Vault Networker Application Host. Provide the following credentials for Storage User and then click Apply: **ddboost** / **Password123!**\ \ where "ddboost" is a user with ddboost role on the Vault DD **ddvevault.vault.local** with the same UID as on the Production DD **ddveprod.demo.local** Optionally, users can provide the folder name where the bootstrap backups are located. In this case, there is only one device folder **NW-FS** having both bootstrap backups and client backups Select the **GOOD** copy of the **NetWorker-FS** Cyber Recovery Policy and start the Recovery process:
23
24
25
Navigate to the Jobs page to check the Recovery Job progress. It will take around 5 minutes to complete
26
Users can login to the CR Management Host with an SSH session using the RoyalTS application on the taskbar to see the commands which are run in the background on Vault Networker Application for the Recovery Process. Run the below command to see the progress **# tail -100f /opt/dellemc/cr/var/log/apps/apps.log**
27
Wait until the Recovery process is successfully completed.
Login to the Vault NetWorker UI
28
Login to the Vault NetWorker to confirm that we are able to see the new devices and restore the production client **client1.demo.local (/temp)** data to the recovery host **recoveryhost.vault.local** Login using the following credentials: \ **Username:** administrator \ **Password:** Password123!
29
Step
30
The other device **ddveprod.demo.local_Backup** which was part of the Production NetWorker will be used for the Advanced NetWorker workflow in the next modules.
31
The production client **client1.demo.local** is displayed now. Because the Vault NetWorker cannot reach the production client directly, we will recover the client data in the Vault to a recovery host **recoveryhost.vault.local**
Client Recovery (Optional)
32
We will now run Client Recovery to the Vault Linux Recovery Client "**recoveryhost.vault.local**" in order to confirm that the infected data was restored from the Good copy. Add a new client "**recoveryhost.vault.local**" under **Clients** tab by clicking **+ADD** button
33
Enter the client name "**recoveryhost.vault.local**" and click **Next** and **Finish** for all the following screens
34
The Recovery Client was added successfully
Start Recovery
35
Navigate to **RecoverandSavesets** tab. Use the following options: Save Time Range Duration = 03/12/2024 to 03/13/2024
36
**Client Type** = Traditional \ **Client** = client1.demo.local Click **Search Savesets** to search the associated savesets
37
Select the latest backup of the **/temp** partition. Click **Recovery --> File System --> Save Set** to start Save Set recovery process Note: In case of an error, retry the date and client selection and then select the Save Set again. This might happen once or twice.
38
Set the destination client as **recoveryhost.vault.local** and check **Add Destination Client to Remote Access List** Click Next to proceed and click **Finish**
39
Navigate to **Monitoring --> Recover Jobs** to see the status. The Recovery is completed successfully.
Verify the data
40
Login to **RoyalTS** CLI and verify the data in the **/temp** directory on **recoveryhost.vault.local**
41
Conclusion
42
This concludes the NetWorker Automated Recovery Module. In case our Production data is compromised including Production NetWorker application and DD, we can use the replicated copy on the Vault DD to perform a NetWorker Automated Recovery. During the process, all the devices will be created on Vault NetWorker Application and all the devices will be mounted on volumes and users will be able to recover the data on Vault clients as required.
Module 2 - NetWorker Automated Recovery
This module provides an overview of the NetWorker Automated Recovery using the Cyber Recovery UI
Vault NetWorker Recovery
In this lesson you will recover from a known good copy (which was analyzed by Cyber Detect and found that the copy is likely not infected) to a vault NetWorker server
1
Login to a new Vault NetWorker deployment with the same hostname as the production NetWorker (nve.demo.local) and make sure you don't see any devices and Save Sets. Open the Google Chrome browser from the Desktop shortcut and open **NetWorker-Vault** from bookmarks bar. If you see Chrome Security Warning, click **Advanced** and then click "**Proceed to nve.demo.local**"
2
Login to the Vault NW UI using the following credentials: **Username:** administrator \ **Password:** Password123!
Devices
3
Navigate to **Devices and Media --> Devices** page to make sure there are no listed devices
Storage Nodes
4
Navigate to **Devices and Media --> Storage Nodes** page to confirm that Storage Node is visible. If it's visible, proceed to the next step, otherwise add the Storage node
5
To add a Storage Node enter the Storage Node name as **nve.demo.local** and Click **Finish**
Clients
6
Navigate to **Protection --> Clients** page. There are no clients except the NetWorker Server itself
Change the server state to Disaster Recovery
7
In order to be able to recover to the vault NetWorker server, it needs to be in **Disaster Recovery** state. Click on **Server Properties** under the **Server** menu.
8
Change the Server State to **Disaster Recovery** and click Save
Production NetWorker
9
The production NetWorker is writing to **/data/col1/NW-FS** MTree on the production DD **ddveprod.demo.local** and it has one device folder where both the NetWorker server bootstrap and the client1.demo.local (/temp directory) backups are written. **NW-FS** is used for **NetWorker server bootstrap and client1.demo.local (/temp)** backups. We already replicated the NetWorker Data from Production to Vault DD and ran Secure Copy operation in the previous module. After that, we analyzed the copy using CyberSense and the new copy was INFECTED. We will use the previous GOOD Copy to recover data using the Vault Networker Application.
Configure Vault NetWorker
10
Login to Cyber Recovery using the following credentials: **Username:** cradmin\ **Password:** Password123!
11
Before we can start the recovery process, we need to add the Vault Networker Application (deployed with same hostname as the Production NetWorker) in CR UI under the **Assets --> Applications** page
12
Click ADD to add the following information: **Nickname :** VaultNW \ **FQDN or IP Address:** nve.demo.local \ **Application Type:** NetWorker Click **Next**
13
**Host Username:** root \ **Host Password:** Password123! \ **SSH Port Number:** 22 "Host Username" is the NetWorker host OS username and "Application Username" is the NetWorker Management Console (NMC) / NWUI username Click **Next**
14
**Application Username:** administrator\ **Application Password:** Password123! Click **Next**
15
Click "Finish"
16
The Vault Networker Application is now successfully configured
(Optional) Running a NetWorker Recovery Check
17
Running a scheduled or an on-demand NetWorker recovery check ensures that after a successful recovery, a copy can be recovered. To perform a recovery check, Navigate to **Recovery>Copies** tab and select the **Good** copy of the **NetWorker-FS** Cyber Recovery Policy and click on **Recovery Check**
18
Select the Vault Application Host.
19
Enter the details and click **Apply** **Storage User**: ddboost **Storage Password**: Password123!
20
Navigate to the **Jobs** page to check the Recovery check Job progress.
21
Recovery check job completed successfully.
Recovery
22
Navigate to Recovery tab and Click on "**Application**"\ \ Select Vault Networker Application Host. Provide the following credentials for Storage User and then click Apply: **ddboost** / **Password123!**\ \ where "ddboost" is a user with ddboost role on the Vault DD **ddvevault.vault.local** with the same UID as on the Production DD **ddveprod.demo.local** Optionally, users can provide the folder name where the bootstrap backups are located. In this case, there is only one device folder **NW-FS** having both bootstrap backups and client backups Select the **GOOD** copy of the **NetWorker-FS** Cyber Recovery Policy and start the Recovery process:
23
24
25
Navigate to the Jobs page to check the Recovery Job progress. It will take around 5 minutes to complete
26
Users can login to the CR Management Host with an SSH session using the RoyalTS application on the taskbar to see the commands which are run in the background on Vault Networker Application for the Recovery Process. Run the below command to see the progress **# tail -100f /opt/dellemc/cr/var/log/apps/apps.log**
27
Wait until the Recovery process is successfully completed.
Login to the Vault NetWorker UI
28
Login to the Vault NetWorker to confirm that we are able to see the new devices and restore the production client **client1.demo.local (/temp)** data to the recovery host **recoveryhost.vault.local** Login using the following credentials: \ **Username:** administrator \ **Password:** Password123!
29
Step
30
The other device **ddveprod.demo.local_Backup** which was part of the Production NetWorker will be used for the Advanced NetWorker workflow in the next modules.
31
The production client **client1.demo.local** is displayed now. Because the Vault NetWorker cannot reach the production client directly, we will recover the client data in the Vault to a recovery host **recoveryhost.vault.local**
Client Recovery (Optional)
32
We will now run Client Recovery to the Vault Linux Recovery Client "**recoveryhost.vault.local**" in order to confirm that the infected data was restored from the Good copy. Add a new client "**recoveryhost.vault.local**" under **Clients** tab by clicking **+ADD** button
33
Enter the client name "**recoveryhost.vault.local**" and click **Next** and **Finish** for all the following screens
34
The Recovery Client was added successfully
Start Recovery
35
Navigate to **RecoverandSavesets** tab. Use the following options: Save Time Range Duration = 03/12/2024 to 03/13/2024
36
**Client Type** = Traditional \ **Client** = client1.demo.local Click **Search Savesets** to search the associated savesets
37
Select the latest backup of the **/temp** partition. Click **Recovery --> File System --> Save Set** to start Save Set recovery process Note: In case of an error, retry the date and client selection and then select the Save Set again. This might happen once or twice.
38
Set the destination client as **recoveryhost.vault.local** and check **Add Destination Client to Remote Access List** Click Next to proceed and click **Finish**
39
Navigate to **Monitoring --> Recover Jobs** to see the status. The Recovery is completed successfully.
Verify the data
40
Login to **RoyalTS** CLI and verify the data in the **/temp** directory on **recoveryhost.vault.local**
41
Conclusion
42
This concludes the NetWorker Automated Recovery Module. In case our Production data is compromised including Production NetWorker application and DD, we can use the replicated copy on the Vault DD to perform a NetWorker Automated Recovery. During the process, all the devices will be created on Vault NetWorker Application and all the devices will be mounted on volumes and users will be able to recover the data on Vault clients as required.
