The Nasuni Edge Appliance Recovery Guide contains the complete procedure for recovering a Nasuni Edge Appliance. This section is a summary of suggestions before you recover your Nasuni Edge Appliance.
There are a number of reasons for performing a recovery of a Nasuni Edge Appliance, including:
Changing virtual machine platforms (Nutanix AHV, Scale HyperCore, Google Cloud, Microsoft Hyper-V, VMware, Microsoft Azure, Amazon EC2).
Nasuni Hardware Appliance or virtual machine hardware refresh.
Human error.
Hardware and software failures.
True disaster.
Warning: Do not attempt to restore from a virtual machine snapshot or backup.
With Nasuni’s data services, your data is safely stored offsite in data centers of your choosing. Nasuni’s system of automatic, scheduled Nasuni snapshots protects your data, with no need for additional backups. Nasuni snapshots provide a full recovery image of your data, as frequently as every minute. This data is available at any time to any location. You can rapidly get access to your data. For details on restoring data, see Restore Guide.
To recover your Nasuni Edge Appliance, you follow the simple steps of downloading the virtual machine again from Nasuni.com, installing the product, and then completing the recovery process. If you have your encryption keys, the whole procedure takes about 15 minutes for a total recovery.
Side Load and Recovery
The Recovery process enables you to recover the Nasuni Edge Appliance after a true disaster, such as the loss of a data center. However, most of the time, you perform the Recovery process in order to change from one platform to another.
In such a situation, there is already an operational Nasuni Edge Appliance that contains active data in its cache. Performing the Recovery process results in a new Nasuni Edge Appliance that has an empty cache. You must then manually re-populate the new cache with data, which requires considerable inbound bandwidth from the cloud, and which can take days, weeks, or even months to complete.
The Side Load feature enables you to transfer cache data directly from the original source decommissioned Nasuni Edge Appliance to the new destination Nasuni Edge Appliance.
To view unprotected files in the cache, see “Unprotected Files”.
Before Recovering the Nasuni Edge Appliance
The Nasuni Edge Appliance Recovery Guide contains the complete procedure for recovering your Nasuni Edge Appliance. This section is a summary of suggestions before you recover your data with the Nasuni Edge Appliance.
Warning: Before attempting to recover a Nasuni Edge Appliance, you must ensure that you have all of the encryption keys for all of the volumes for the Nasuni Edge Appliance. You must have all of the encryption keys for both local volumes and remote volumes.
Important: To perform a recovery procedure, one of the following must be true:
The original source Nasuni Edge Appliance must have at least one local volume, and at least one Nasuni snapshot of the local volume must have completed.
A backup key must have been generated or uploaded. For more details, see “Backup Keys”.
Warning: If the original source Nasuni Edge Appliance has any data in the cache that has not yet been protected in cloud object storage, performing a recovery procedure can cause that data to be lost.
Before proceeding, perform a manual Nasuni snapshot.
To verify that a snapshot has been completed (both data phase and metadata phase), see “Verifying Snapshots”.
Important: Internet connectivity (HTTPS port 443) to the new destination Nasuni Edge Appliance is a prerequisite for setting up the Nasuni Edge Appliance, or to update software during the installation.
For details about ports and firewalls, see Firewall and Port Requirements.
Important: The version of the Nasuni Management Console must support the version of the Nasuni Edge Appliance that the Nasuni Management Console is to manage. If this Nasuni Edge Appliance is joined to a Nasuni Management Console, update the Nasuni Management Console software before updating the Nasuni Edge Appliance software.
For details, see “NMC version”.
Tip: Download your generated encryption keys to a safe location before shutting down the original source Nasuni Edge Appliance or performing a recovery procedure on the original source Nasuni Edge Appliance. See “Downloading (Exporting) Generated Encryption Keys” for details.
Tip: If you are planning on trying the recovery functionality during trial mode, download your encryption keys to a safe location first.
Warning: Do NOT save encryption key files to a volume on a Nasuni Edge Appliance. You will NOT be able to use these to recover data. This is NOT how to upload encryption keys to a Nasuni Edge Appliance. To upload encryption keys to a Nasuni Edge Appliance, see “Adding (Importing or Uploading) Encryption Keys”.
Note: If you were using a hardware appliance, and you require a replacement appliance, notify your Account Manager to request a replacement appliance. You can then continue with the following procedure, which allows you to install and operate a virtual appliance to access your data.
Note: Downloading and executing the installation program for the virtual appliance is contingent upon the virtual platform you are using.
Note: For any volume that is either Pending Delete or Pending Delete Approval, the pending deletions might be canceled after the volume's Nasuni Edge Appliance is recovered.
Tip: Only the Admin user can perform the Side Load process.
Tip: To perform the Side Load procedure, the original source Nasuni Edge Appliance must be:
Running;
Decommissioned;
Using release 7.0 or above.
Tip: On Azure-based Edge Appliances only, during a reboot or recovery procedure, it is necessary to connect with IP address 169.254.169.254 in order to obtain information about the Azure VM instance. If you have configured an HTTPS proxy, this attempt to connect can cause a delay of several minutes. To avoid this delay, add the IP address 169.254.169.254 to the “Do Not Proxy” section of the HTTPS Proxy configuration.
Tip: The following settings, if configured, are not retained after the Recovery procedure. You should record your settings so that you can reconfigure these settings after the Recovery procedure.
Preparing the Original Source Nasuni Edge Appliance (if available)
The Nasuni Edge Appliance Recovery Guide contains the complete procedure for recovering your data. This section is a summary of steps for preparing the original source Nasuni Edge Appliance (if available):
Verify that the original source Nasuni Edge Appliance is installed and properly configured on your network.
Verify that the original source Nasuni Edge Appliance has at least one local volume, and that at least one Nasuni snapshot on the original source Nasuni Edge Appliance has successfully completed on a local volume.
Alternatively, verify that a backup key has been generated or uploaded. For more details, see “Backup Keys”.
If performing the Side Load procedure, verify that the original source Nasuni Edge Appliance is running and not yet decommissioned by using a Web browser to navigate to the hostname or IP address of the Nasuni Edge Appliance. The Nasuni Edge Appliance should appear and not display the “Filer Decommissioned” message.
On the original source Nasuni Edge Appliance, record the information for volumes for later verification.
If running the Side Load procedure, record the hostname or IP address of the original source Nasuni Edge Appliance. Also, record the username and password of an administrative user on the original source Nasuni Edge Appliance.
If any of the Nasuni Edge Appliance’s owned volumes have “custom” Remote Access Permissions configured for other Nasuni Edge Appliances on your account, change those Remote Access Permissions to Read/Write before performing the recovery procedure. This is because the Remote Access Permissions are set based on the Edge Appliance GUID, not on the Edge Appliance serial number: when the Edge Appliance GUID gets replaced during the recovery procedure, the Edge Appliance loses its rights to those “custom” Remote Access Permissions.
After the recovery procedure, the Remote Access Permissions can be changed back to “custom”.
Remove the original source Nasuni Edge Appliance from control of the Nasuni Management Console (NMC).
On the original source Nasuni Edge Appliance, download any generated encryption keys for both local and remote volumes.
Warning: You MUST have all of the encryption keys for all of the volumes for the original source Nasuni Edge Appliance in order to recover the Nasuni Edge Appliance.
If you escrowed any encryption keys with Nasuni, your options include the following:
Use your escrow passphrase.
Obtain a special one-time-use recovery key from Nasuni.
Warning: You MUST have all of the encryption keys for all of the volumes for the original source Nasuni Edge Appliance in order to recover the Nasuni Edge Appliance.
If the original source Nasuni Edge Appliance was under the control of the Nasuni Management Console (NMC), download the encryption keys for the NMC.
Obtain the Serial Number and Authorization Code for the original source Nasuni Edge Appliance. You use these in step 8 of Recovering the Nasuni Edge Appliance.
Important: Authorization codes (also called “Auth codes”) are intended for a single use, and are not permanent. Authorization codes change if the associated serial number is used successfully, if the authorization code is refreshed via the NMC (Account Status --> Serial Numbers, then click Refresh), and if the authorization code is regenerated via the NOC (visit https://account.nasuni.com/account/serial_numbers/, then click show, then click regen).
Perform Nasuni snapshots on all volumes.
Tip: This process can take considerable time, depending on the size of the cache and the amount of changed and new data in the cache.
Warning: If all Nasuni snapshots have not completed, some data might not be protected in the cloud.
To verify that a snapshot has been completed (both data phase and metadata phase), see “Verifying Snapshots”.
Perform the
preparedrprocedure command on the console of the original source Nasuni Edge Appliance.Tip: For Microsoft Azure, this article describes how to enable the service console: https:// azure.microsoft.com/en-us/blog/virtual-machine-serial-console-access/.
Warning: During the PREPAREDR command procedure, the SMB volumes on the original source Nasuni Edge Appliance are set to read-only, and any necessary final Nasuni snapshots are performed. This processing temporarily impacts access to data on this Nasuni Edge Appliance.
Tip: To revert back to previous settings after running ‘preparedr’ on the console, reboot the appliance and reset the CIFS Administrative Users. For details, see “Configuring CIFS (SMB) settings”.
If performing a Side Load procedure using the original source Nasuni Edge Appliance, DO NOT shut down the Nasuni Edge Appliance.
If NOT performing a Side Load procedure, perform a shutdown of the original source Nasuni Edge Appliance.
Recovering the Nasuni Edge Appliance
Warning: Do not attempt to restore from a virtual machine snapshot or backup.
Important: Edge Appliances and the NMC must be configured with operational DNS servers and a time server (internal or external) within your environment.
Important: When using virtual machine Edge Appliances or NMCs, Nasuni recommends running under a hypervisor that is still supported by its vendor. If a customer runs an Edge Appliance or NMC on an unsupported hypervisor version, a warning is logged at boot time. The warning is of the form:
“Nasuni recommends running the Management Console on ESX 7.0 or later.”
The Nasuni Edge Appliance Recovery Guide contains the complete procedure for recovering your Nasuni Edge Appliance. This section is a summary of steps for recovering your data:
If you have not already done so, obtain the Serial Number and Authorization Code for the original source Nasuni Edge Appliance. You use these in step 9. There are several ways to obtain the Serial Number and Authorization Code:
You can obtain the Serial Number and Authorization Code for the original source Nasuni Edge Appliance on the Account Serial Numbers page of the Nasuni Management Console.
Otherwise, if you have the credentials to log in to your Nasuni.com account (https:// account.nasuni.com/account/login/), you can obtain the Serial Number and Authorization Code for the original source Nasuni Edge Appliance there.
Otherwise, if you do not have these credentials, obtain the Serial Number and Authorization Code for the original source Nasuni Edge Appliance from the person who has the credentials.
Important: Authorization codes (also called “Auth codes”) are intended for a single use, and are not permanent. Authorization codes change if the associated serial number is used successfully, if the authorization code is refreshed via the NMC (Account Status --> Serial Numbers, then click Refresh), and if the authorization code is regenerated via the NOC (visit https://account.nasuni.com/account/serial_numbers/, then click show, then click regen).
Log in to your Nasuni account Web site (https://account.nasuni.com/) and click Downloads. The Downloads page appears.
.png)
Figure 14-1: Downloads page.
Select the appropriate format for your virtual environment from these choices:
AMAZON EC2: Scroll down to the “Appliance AMIs on EC2” area, and follow the instructions to continue installation using appliance AMIs.
AZURE FORMAT: A
.vhdfile, appropriate for Microsoft Azure environments.GOOGLE CLOUD FORMAT: A
disk.rawfile contained in a.tar.gzfile, appropriate for Google Cloud environments.HYPER-V FORMAT: Hyper-V format is appropriate for Microsoft Hyper-V environments: versions 2019 and later.
NUTANIX FORMAT: A
.qcow2file appropriate for Nutanix AHV environments.SCALE FORMAT: A file appropriate for Scale HyperCore environments.
OVF FORMAT: OVF format is appropriate for VMware ESXi 7.0 and above environments.
From the drop-down list, select an available release for the Edge Appliance or NMC. The list of available releases can change.
.png)
Figure 14-2: Sample release drop-down list.
Important: When performing a recovery procedure, unsupported upgrade paths are blocked. If so, the error message displayed during the procedure might incorrectly state that you are attempting to update to an older version. To avoid this issue, before beginning the recovery process, deploy a Nasuni version that corresponds to the major version of the source appliance.
For all supported update paths, see Compatibility and Support. In summary:
Edge Appliance update paths:
9.12.x → 9.15.4 → 10.0
NMC update paths:
23.1.2 → 23.2.x → 24.1.6 → 25.1
Note: If you are running a recovery procedure, select the same version family as your existing Edge Appliance to ensure software compatibility. For example, if the existing Edge Appliance is running version 9.5.1, you could select version 9.5.4 (which is in the same 9.5.x version family), but not version 9.7.1 (which is in a different version family). If you need to use a different version than those offered, contact Nasuni Customer Support.
Tip: For update paths, see Compatibility and Support.
Note: You can perform the Recovery process to the same version of the software that you were running, or to a newer version than you were running, but not to an older version.
Note: If you already have the software installation file, you do not have to download it again.
However, the software installation file must not be older than the version you are recovering.
Save the Nasuni Edge Appliance software .zip file to a location on your local drive.
The amount of time to download the Nasuni Edge Appliance software file depends on your Internet connection. The file is approximately 900 MB in size.
Unzip the Nasuni Edge Appliance software file.
Launch the Nasuni Edge Appliance install program for your platform.
Follow the setup wizard. After you have configured your network using the setup wizard, open the specific URL to continue. The “Enter your serial number and authorization code” wizard page appears.
.png)
Figure 14-3: “Enter your serial number and authorization code” wizard page.
Enter the Filer Serial Number and Authorization code for this Nasuni Edge Appliance, found under the Account section of www.nasuni.com, or on the Account Status page of the Nasuni Management Console. To recover a prior installation, such as during recovery, choose the Nasuni Edge Appliance Serial Number of the prior installation. Click Continue to proceed.
Important: Authorization codes (also called “Auth codes”) are intended for a single use, and are not permanent. Authorization codes change if the associated serial number is used successfully, if the authorization code is refreshed via the NMC (Account Status --> Serial Numbers, then click Refresh), and if the authorization code is regenerated via the NOC (visit https://account.nasuni.com/account/serial_numbers/, then click show, then click regen).
Note: If the administrative account for this Nasuni Edge Appliance was reset (such as, for a forgotten password), and this Nasuni Edge Appliance was under the control of the Nasuni Management Console, and if you are using the Filer Serial Number for that prior installation, you must wait 1 hour from the time that you reset the administrative account for the Nasuni Edge Appliance before entering the Filer Serial Number and Authorization code and clicking Continue.
The Perform Disaster Recovery on existing Filer page appears.
.png)
Figure 14-4: Perform Disaster Recovery on existing Filer page.
Enter “
Perform Disaster Recovery” without the quotation marks in the Confirmation text box, then click Continue to proceed.Note: After performing this step, the original source Nasuni Edge Appliance is decommissioned.
The second Perform Disaster Recovery on existing Filer page appears.
.png)
Figure 14-5: Second Perform Disaster Recovery on e xisting Filer page.
If you escrowed any of your encryption keys (including the backup key) with Nasuni, and you either intend to use your escrow passphrase or intend to have Nasuni issue a special one- time-use recovery key, perform the following steps:
Select Yes from the drop-down list.
Tip: You can select Yes even if you also have non-escrowed encryption keys, which you provide separately.
The Escrow Passphrase or Recovery Key text box becomes available.
.png)
Figure 14-6: Escrow Passphrase or Recovery Key text box.
If you set an encryption key escrow passphrase and you have the passphrase, enter the passphrase.
Alternatively, if you do not have an encryption key escrow passphrase available: Contact Nasuni Support to verify your identity and obtain your one-time-use recovery key. Then enter the recovery key.
Tip: For details about the escrow passphrase, see “Escrow Passphrase”.
Click Continue.
Important: If you have previously escrowed your encryption keys with Nasuni, and you use these escrowed encryption keys as part of the recovery process, you MUST re-escrow those encryption keys with Nasuni if you want those encryption keys to continue to be escrowed with Nasuni. After the recovery is complete, the Nasuni Edge Appliance treats all encryption keys as if they were not created by this Nasuni Edge Appliance. For details, see, “Escrowing Encryption Keys with Nasuni”.
Otherwise, select No from the drop-down list, then click Continue.
This means that either you do not have any encryption keys escrowed with Nasuni at all, or you do have encryption keys escrowed with Nasuni, but you intend to provide your escrowed encryption keys yourself.
If you selected No, the Upload Encryption Keys page appears.
.png)
Figure 14-7: Upload Encryption Keys page.
Click Choose File to navigate to your encryption key file (including your backup key file), enter the Key Passphrase if necessary, then click Upload Key(s).
Important: For security reasons, encryption keys that you upload cannot be downloaded from the system.
Note: If an uploaded encryption key has an associated passphrase, that passphrase is removed from the encryption key when it is uploaded. The Edge Appliance does not need the passphrase in order to use the encryption key. However, if you do not escrow this encryption key, if you ever perform a recovery procedure on the Edge Appliance, you must provide that passphrase when you upload that encryption key during the recovery procedure.
Caution: The maximum length of a file name is 255 bytes.
In addition, the length of a path, including the file name, must be less than 4,000 bytes.
Since the UTF-8 representation of characters from some character sets can occupy several bytes, the maximum number of characters that a file path or a file name might contain can vary.
If a particular client has other limits, the smaller of the two limits applies.
If several encryption key files are necessary, the Upload Encryption Keys page could appear several times. For details, see step 12 above.
The “Ready to perform disaster recovery!” page appears.
.png)
Figure 14-8: “Ready to perform disaster recovery!” page.
Click Continue. Recovery of the Nasuni Edge Appliance begins.
After recovery, the Filer Recovery Complete page appears.
.png)
Figure 14-9: Filer Recovery Complete page.
Click Continue. The “Terms of Service and License Agreement” page appears.
.png)
Figure 14-10: “Terms of Service and License Agreement” page.
You can print or download a copy of the Terms of Service and License Agreement by clicking the appropriate icon.
Select I accept the Terms of Service, then click Continue.
The “Enter a username and password for Administration of this Filer” page appears.
.png)
Figure 14-11: “Enter a username and password for Administration of this Filer” page.
Set up an administrator for the Nasuni Edge Appliance by creating a Username (case- sensitive) and a Password (case-sensitive). An indicator of password strength appears. Although password strength is not enforced, you should use strong passwords. The newly defined user is automatically a member of the Filer Administrators permission group for this Nasuni Edge Appliance.
Click Continue.
The recovery and restoration process is complete. The Configuration Complete page appears.
.png)
Figure 14-12: Configuration Complete page.
You can reboot the Nasuni Edge Appliance, or click the link “here” to proceed directly to the Login page.
Note: When a reboot is requested, a notification is logged that the reboot was requested and by whom the reboot was requested.
The Nasuni Edge Appliance becomes available in a few moments. The Login page appears.
.png)
Figure 14-13: Nasuni Edge Appliance Login page.
Log in to the Nasuni Edge Appliance with your Username (case-sensitive) and Password (case-sensitive). Click Log in.
Important: If the previous Nasuni Edge Appliance was in Active Directory mode, you must re-join Active Directory to maintain ACL support. Similarly, if the previous Nasuni Edge Appliance was in LDAP, you must re-join LDAP.
With the new instance of the Nasuni Edge Appliance running, you have regained access to your volumes and data. You can access volumes and data using the CIFS shares, NFS exports, or FTP directories that you created. Folders and files are available.
Tip: If this Nasuni Edge Appliance previously accessed a volume with custom permissions for Remote Access, you must explicitly set those permissions for this Nasuni Edge Appliance.
Important: If you have previously escrowed your encryption keys with Nasuni, and you used these escrowed encryption keys as part of the recovery process, you MUST re- escrow those encryption keys with Nasuni if you want those encryption keys to continue to be escrowed with Nasuni. After the recovery is complete, the Nasuni Edge Appliance treats all encryption keys as if they were not created by this Nasuni Edge Appliance. For details, see “Escrowing Encryption Keys with Nasuni”.
Tip: A best practice for Nasuni Edge Appliances is to join an Active Directory or LDAP domain as soon as recovery is complete. If the previous Nasuni Edge Appliance was in Active Directory or LDAP mode, re-join Active Directory or LDAP by clicking ‘Save Settings’. If the previous Nasuni Edge Appliance has not previously joined any domain, see “Procedure for joining Nasuni Edge Appliance (not previously joined) to domain”.
Tip: If this Nasuni Edge Appliance was under the control of the Nasuni Management Console, return it to the control of the Nasuni Management Console. Click Services, then select Nasuni Management Console from the list. From the “NMC Management is” drop-down list, select enabled, then click Save.
Tip: If any of the Nasuni Edge Appliance’s owned volumes had “custom” Remote Access Permissions configured for other Nasuni Edge Appliances on your account, you must reconfigure those “custom” Remote Access Permissions after the recovery procedure. This is because the Remote Access Permissions are set based on the Edge Appliance GUID, not on the Edge Appliance serial number: when the Edge Appliance GUID gets replaced during the recovery procedure, the Edge Appliance loses its rights to those “custom” Remote Access Permissions.
You can reconfigure the “custom” Remote Access Permissions on the Edge Appliance that owns the volume, if that Edge Appliance is not under NMC management, or using the NMC.
For remote volumes with Remote Access Permissions of Read/Write or Read-Only for all appliances, the remote volumes re-connect automatically.
Tip: If the previous Nasuni Edge Appliance had Remote Support enabled, you must disable, then enable, Remote Support. See “Remote Support Service”.
Tip: The following settings, if configured, are not retained after the Recovery procedure. You should record your settings so that you can reconfigure these settings after the Recovery procedure.
At this point, you can consider using the Side Load process to transfer data to the cache.
If any of the Nasuni Edge Appliance’s CIFS shares had Shared Links defined, and Shared Links Global User is not enabled for the share, these links must be regenerated. Use Web Access to view links that must be regenerated, and regenerate them. See Recovery.
Performing the Side Load process
The Nasuni Edge Appliance Recovery Guide contains the complete procedure for performing the side load process. This section is a summary of steps for performing the side load process.
Important: You can only perform the Side Load procedure as part of the entire Recovery procedure.
In particular, before performing the Side Load procedure, you must perform the procedure “Preparing the Original Source Nasuni Edge Appliance (if available)”, which includes running the preparedr command on the console of the original source Nasuni Edge Appliance, as described in step 13.
Also, before performing the Side Load procedure, you must perform the procedure “Recovering the Nasuni Edge Appliance” , which includes the original source Nasuni Edge Appliance becoming decommissioned, as described in step 10.
Tip: To revert back to previous settings after running ‘preparedr’ on the console, reboot the appliance and reset the CIFS Administrative Users. For details, see Configuring CIFS (SMB) settings .
Tip: Only one Side Load process is permitted at a time for each Nasuni Edge Appliance.
Tip: Only the Admin user can perform the Side Load process.
Tip: The original source Nasuni Edge Appliance must be:
Running;
Decommissioned;
Using release 7.0 or above.
Warning: If the total data available on the original source Nasuni Edge Appliance exceeds the available cache space on the new destination Nasuni Edge Appliance, you receive a warning message and notification.
Tip: Any Quality of Service (QoS) limits to bandwidth do not pertain to the Side Load process.
The Side Load process uses all the available bandwidth to copy data.
You can configure Notifications to notify you by email when the Side Load process completes.
On the new destination Nasuni Edge Appliance, click Services, then select Side Load from the list. The Side Load page appears.
Enter the host address of the original source Nasuni Edge Appliance, the administrator username for the specified original source Nasuni Edge Appliance, and the password for the specified Admin Username for the specified original source Nasuni Edge Appliance. Then click Connect and Start. When the Side Load process completes, the Complete label appears on the bar graph.
Tip: Record any information you want to retain from the screen before clicking Done.
Other Steps
After completing the recovery procedure, you can verify the volumes on the new destination Nasuni Edge Appliance.
When you are satisfied that the original source Nasuni Edge Appliance is no longer necessary, you can shut down the original source Nasuni Edge Appliance, if it has not been shut down already.