Preparations (Alibaba Cloud VMware Service)

(Recommended) Use a RAM user AccessKey for disaster recovery

Resource Access Management (RAM) is an Alibaba Cloud service that lets you create and manage multiple identities under one account with different permissions.

To activate a disaster recovery gateway, you need an AccessKey. Your Alibaba Cloud account AccessKey grants full access to all resources — if exposed, all resources are at risk. Use a RAM user AccessKey instead. Create a RAM user and AccessKey before starting: Create a RAM user, Create an AccessKey pair.

Prerequisites

• Cloud Backup is activated. ActivatingCloud Backup is free of charge. Using the VMware backup and disaster recovery feature ofCloud Backup incurs fees forCloud Backup storage capacity and VMware backup software. For more information, seeVMware backup and disaster recovery billing.

• A VMware username and password that has access to vCenter Server and its resources are obtained.

Notes

• Supported operating systems and VMware platforms are limited. The location and classification of permission items may vary by vCenter version. We recommend that you carefully check the permission item locations. For more information, seeLimits on VMware backup and disaster recovery.

• The AccessKey pair used to activate the backup gateway may expire. If the AccessKey pair is rotated, you must reactivate the backup gateway. Otherwise, backups fail. For more information, seeHow do I change the AccessKey pair of a gateway used for VMware backup and disaster recovery to reactivate the gateway?.

Step 1: Prepare a dedicated VMware environment

Step 2: Log on to the ECS jump server

Create an ECS instance in the VPC of the dedicated VMware environment as a jump server for accessing management components such as vCenter and NSX-T Manager. Use Windows Server as the operating system. If you enable public network access for the jump server, implement appropriate security measures. For information about how to create an ECS jump server, seeCreate an ECS jump server.

1. Log on to the ECS console and find the ECS jump server instance.

2. In theActionscolumn, click Remote Connection.

3. In the Remote Connection and Command dialog box, click Log On Now for Workbench Remote Connection.

4. In theLog on to Instancedialog box, setConnection MethodtoTerminal Connection，Authentication MethodtoPassword Authentication.

   • Username: administrator.

   • Password: The logon password set when you created the ECS instance.

   After you confirm the information, click Log On.

Step 3: Add a disaster recovery gateway

A disaster recovery gateway helps you perform backup and restore tasks. Configure the gateway and download it to the Alibaba Cloud VMware Service environment where vSphere Client is deployed. Perform the following steps:

1. Log on to theCloud Backup console.

2. In the left-side navigation pane, choose Back Up > VMware Backup and Disaster Recovery.

3. In the top navigation bar, select a region.

4. In the upper-right corner of the VMware Backup and Disaster Recovery page, click Create Backup & Disaster Recovery Gateway.

5. In the Create Backup & Disaster Recovery Gatewaypanel, configure the following parameters and click Create.

   The following table describes the parameters.

   Parameter	Description
   Backup Vault	The backup vault that stores your backups. Create Backup Vault: Enter a name for the new backup vault. If left empty, a random name is assigned. Select Backup Vault: Select an existing backup vault from the drop-down list. Important After you create a backup vault and store backup data, Cloud Backup charges fees for backup storage capacity usage. For more information, seeBilling methods and billable items. To ensure maximum redundancy, in regions that support zone-redundant backup vaults, Cloud Backupuses zone-redundant backup vaults by default. If a region only supports locally redundant backup vaults, Cloud Backup uses locally redundant backup vaults. You do not need to select the vault type.
   Vault Name	Specify a name for the backup vault.
   Vault Resource Group	Required only when Backup Vault is set to Create Backup Vault. Specifies the resource group to which the backup vault belongs. Resource groups help you organize resources and manage permissions within your Alibaba Cloud account. For more information, seeCreate a resource group.
   Gateway Name	Enter a name for the gateway. The name cannot exceed 64 characters.
   VMware Environment	The VMware platform where virtual machines are deployed. SelectAlibaba Cloud VMware Service (ACVS). On-premises vSphere: Virtual machines are deployed in an on-premises VMware environment. Alibaba Cloud VMware Service (ACVS): Virtual machines are deployed in an Alibaba Cloud VMware Service environment.
   Network Type	The network type. SelectVPC. The virtual machines to be backed up use Alibaba Cloud VPC and must be in the same region as the backup vault.
   Use HTTPS for Data Transmission	After data is encrypted and stored in the backup vault, you can choose whether to use HTTPS to transmit data. Using HTTPS reduces data transmission performance. Changes to this setting take effect when the next backup or restore job starts.

6. In the Create Backup & Disaster Recovery Gateway panel, click Download Gateway and Download Certificate.

   The downloaded disaster recovery gateway package is the OVF template required for Step 3: Install the disaster recovery gateway.

   Note

   The installation package connects the gateway to Cloud Backup, and the certificate activates it. You can download and deploy the gateway from the client list at any time.

Step 4: Install the disaster recovery gateway

After you download the gateway and certificate, install the gateway in the VMware environment. After installation, you can create backup and restore jobs in the Cloud Backup console. Perform the following steps:

1. Log on to the ECS jump server.

   For more information, seeStep 2: Log on to the ECS jump server.

2. Log on to the VMware Service console, find the target dedicated VMware environment, and click Actions in the Log on to Management Components.

   In the Log on to Management Components dialog box, view the management component logon information. The dialog box indicates that you must first create an ECS instance (Windows Server recommended) in the VPC of the dedicated VMware environment as a jump server, and then access the management component URL through a remote desktop connection to the jump server. Record the vCenter username (format: xxx@acvs.aliyuncs.com), as well as the vCenter address (format: https://vcenter.xxx.aliyuncs.com), as well as the NSX-T username (cloud_admin), as well as the NSX-T address (format: https://nsx-mxxx.aliyuncs.com). We recommend that you use Chrome, Firefox, or Edge browser. For more information, see Log on to a dedicated VMware environment.

3. Use the Step 2to log on to the vSphere Web Client from the ECS jump server.

4. In the left navigation pane, select the virtual machine to deploy, right-click and selectDeploy OVF Template.

   For more information about how to deploy an OVF template, seeDeploy OVF Template.

   1. On theDeploy OVF Templatepage, selectLocal file.Click Browseto select the gateway file downloaded inStep 3: Add a disaster recovery gateway, and then click Next.

      Note

      Cloud Backup provides the gateway in OVA format for easier download. This package can be directly used for Web Client OVF template deployment.

   2. Enter the OVF name, select a deployment location, and then click Next.

      For example, enter Hybrid-Backup-Recovery-Appliance

   3. Select a compute resource and then click Next.

      Confirm that the Compatibility section displays Compatibility check succeededbefore you continue.

   4. Verify the template details and then click Next.

      The page shows the product as Hybrid Backup Recovery Appliance, version 1.0.18, download size 1.9 GB, and disk size 3.7 GB(thin provisioned) or 100.0 GB(thick provisioned).

   5. Select a virtual disk format as needed, select a location to store the deployed template files, and then click Next.

      In this example, selectVirtual disk format for As defined in VM storage policy,VM storage policy for Datastore Default, and WorkloadDatastorefrom the data store list. Confirm that the compatibility check passes.

   6. Select a destination network for each source network and then click Next.

      In the IP allocation settings section, selectIP allocation for Static - Manual andIP protocol for IPv4.

   7. Configure the network and system user password, and then click Next.

      • If you use DHCP to obtain an IP address, you do not need to fill in the Gateway, IP, and Netmask fields. If you use a static IP address, enter the IP address and related information.

      • The Primary DNS and Secondary DNS must be able to resolve the domain names of Cloud Backup, vCenter, and ESXi.

        Note

        Enter an IP address that can connect to the Alibaba Cloud VPC. If no DNS server in the environment can resolve Alibaba Cloud VPC domain names, enter the Alibaba Cloud VPC DNS 100.100.2.136 or 100.100.2.138.

      • The Admin User Name and Admin User Password parameters configure the username and password for the new gateway virtual machine. This user has root permissions and can be used to log on to the virtual machine.

   8. Review the configuration data and then click Finish.

5. View the task status in the Task Console and wait for the task to complete.

Step 5: Activate the disaster recovery gateway

1. After the deployment is complete, start the virtual machine deployed from the OVF template.

2. Open a browser and enterhttp://hostname:8011.

   hostname is the IP address of the gateway deployed from the OVF template.

3. On the Activate Gatewaypage, enter the required parameters and then click Registerto log on to the Cloud Backup gateway. The following table describes the parameters.

   Parameter	Description
   AccessKey ID	Download the AccessKey ID and AccessKey Secret from the Alibaba Cloud account where Cloud Backup is activated. For more information, seeHow do I create an AccessKey pair for a RAM user?. Note The AccessKey pair used to activate the backup gateway may expire. If the AccessKey pair is rotated, you must reactivate the backup gateway. Otherwise, backups fail. For more information, seeHow do I change the AccessKey pair of a gateway used for VMware backup and disaster recovery to reactivate the gateway?.
   AccessKey Secret
   Certificate File	Select the certificate downloaded from the console. If the virtual machine is shut down for more than 5 days after the certificate is activated, the certificate becomes invalid. You must download and activate the certificate again.

   After the installation is complete, you can view the disaster recovery gateway on theVMware Backup and Disaster Recoverypage under theBackup & Disaster Recovery Gatewaytab. The gateway status isActivated. You can also perform the following operations in the Actions column:

   • Throttle Bandwidth: Set traffic limits for different time periods to avoid overloading VMware resources.

   • <hd> More </hd>:

     • Download Gateway: Download the disaster recovery gateway installation package.

     • Download Certificate: Download the certificate used to activate the disaster recovery gateway.

     • Delete: Deleting a client deletes all existing backup data and causes running backup and restore jobs to fail. Before you delete a client, make sure that you no longer need the backup data and that no backup or restore jobs are running.

     • Gateway Settings: Configure HTTPS for data transmission, the maximum number of worker threads, and the maximum number of CPU cores.

   After the operation is complete, you can view the vCenter server on theManaged vCentertab. On the VMware Backup and Disaster Recovery page, click the Managed vCenters tab to view the connection status (Activated) of added vCenter servers. Expand a row to view details such as UUID, server address, server version, OS type (linux-x64), API type (VirtualCenter), and vendor (VMware, Inc.). In the Actions column, click Create Backup Plan or More to perform subsequent operations.

Why does adding a vCenter server fail even when the IP address, username, and password are correct?

This operation can fail if the password contains any of the following special characters:

` ^ ~ = ; ! / ( [ ] { } @ $ \ & # % +

How do I replace the AccessKey pair for a VMware backup and disaster recovery gateway?

To reset (reactivate) a VMware backup gateway:

1. Go to the data directory in the client installation path:cd /opt/alibabacloud/hbr/data/

2. Delete console.mv.db:rm -f console.mv.db

3. Restart the service. The command issystemctl restart hbr.

4. Reactivate the gateway in the Cloud Backup console with the new AccessKey pair.