Backing up on-premises ONTAP data to Azure Blob storage

Complete a few steps to get started backing up volume data from your on-premises ONTAP systems to Azure Blob storage.

Note that "on-premises ONTAP systems" includes FAS, AFF, and ONTAP Select systems.

Quick start

Get started quickly by following these steps, or scroll down to the remaining sections for full details.

One Verify support for your configuration

  • You have discovered the on-premises cluster and added it to a working environment in BlueXP. See Discovering ONTAP clusters for details.

    • The cluster is running ONTAP 9.7P5 or later (ONTAP 9.8P13 and later is recommended).

    • The cluster has a SnapMirror license — it is included as part of the Premium Bundle or Data Protection Bundle.

    • The cluster must have the required network connections to Blob storage and to the Connector.

  • The Connector must have the required network connections to Blob storage and to the cluster, and the required permissions.

  • You have a valid Azure subscription for the object storage space where your backups will be located.

Two Enable BlueXP backup and recovery on the system

Select the working environment and click Enable > Backup Volumes next to the Backup and recovery service in the right-panel, and then follow the setup wizard.

A screenshot that shows the Backup and recovery Enable button which is available after you select a working environment.

Three Select the cloud provider and enter the provider details

Select Microsoft Azure as your provider and then enter the provider details. You’ll need to select the Azure Subscription and the region where you want to create the backups. You can also choose your own customer-managed key for data encryption instead of using the default Microsoft-managed encryption key.

A screenshot that shows the cloud provider details when backing up volumes from an on-premises cluster to Azure Blob storage.

Four Select the cluster IPspace and optional use of a private VNet endpoint

Select the IPspace in the ONTAP cluster where the volumes reside. You can also choose to use an existing Azure Private Endpoint for a more secure connection to the VNet from your on-prem data center.

A screenshot that shows the networking details when backing up volumes from an ONTAP system to Azure Blob storage.

Five Define the default backup policy

The default policy backs up volumes every day and retains the most recent 30 backup copies of each volume. Change to hourly, daily, weekly, monthly, or yearly backups, or select one of the system-defined policies that provide more options. You can also change the number of backup copies you want to retain.

Optionally, when using ONTAP 9.12.1 and greater, you can choose to protect your backups from deletion and ransomware attacks by configuring one of the DataLock and Ransomware Protection settings. Learn more about the available BlueXP backup and recovery policy configuration settings.

By default, backups are stored in the Cool access tier. If your cluster is using ONTAP 9.10.1 or greater, you can choose to tier backups to Azure Archive storage after a certain number of days for further cost optimization. Learn more about the available BlueXP backup and recovery policy configuration settings.

A screenshot that shows the BlueXP backup and recovery settings where you can choose the backup schedule and retention period.

Six Select the volumes that you want to back up

Identify which volumes you want to back up using the default backup policy in the Select Volumes page. If you want to assign different backup policies to certain volumes, you can create additional policies and apply them to volumes later.

Requirements

Read the following requirements to make sure you have a supported configuration before you start backing up on-premises volumes to Azure Blob storage.

There are two connection methods you can use when configuring backups from on-premises ONTAP systems to Azure Blob.

  • Public connection - Directly connect the ONTAP system to Azure Blob storage using a public Azure endpoint.

  • Private connection - Use a VPN or ExpressRoute and route traffic through a VNet Private Endpoint that uses a private IP address.

The following diagram shows the public connection method and the connections that you need to prepare between the components. You can use a Connector that you’ve installed on your premises, or a Connector that you’ve deployed in the Azure VNet.

A diagram showing how BlueXP backup and recovery communicates over a public connection with the volumes on the cluster and the Azure Blob storage where the backup files are located.

The following diagram shows the private connection method and the connections that you need to prepare between the components. You can use a Connector that you’ve installed on your premises, or a Connector that you’ve deployed in the Azure VNet.

A diagram showing how BlueXP backup and recovery communicates over a private connection with the volumes on the cluster and the Azure Blob storage where the backup files are located.

Preparing your ONTAP clusters

You need to discover your on-premises ONTAP clusters in BlueXP before you can start backing up volume data.

Learn how to discover a cluster.

ONTAP requirements

  • Minimum of ONTAP 9.7P5; ONTAP 9.8P13 and later is recommended.

  • A SnapMirror license (included as part of the Premium Bundle or Data Protection Bundle).

    Note: The "Hybrid Cloud Bundle" is not required when using BlueXP backup and recovery.

    See how to manage your cluster licenses.

  • Time and time zone are set correctly.

    See how to configure your cluster time.

Cluster networking requirements

  • The ONTAP cluster initiates an HTTPS connection over port 443 from the intercluster LIF to Azure Blob storage for backup and restore operations.

    ONTAP reads and writes data to and from object storage. The object storage never initiates, it just responds.

  • ONTAP requires an inbound connection from the Connector to the cluster management LIF. The Connector can reside in an Azure VNet.

  • An intercluster LIF is required on each ONTAP node that hosts the volumes you want to back up. The LIF must be associated with the IPspace that ONTAP should use to connect to object storage. Learn more about IPspaces.

    When you set up BlueXP backup and recovery, you are prompted for the IPspace to use. You should choose the IPspace that each LIF is associated with. That might be the "Default" IPspace or a custom IPspace that you created.

  • The nodes' and intercluster LIFs are able to access the object store.

  • DNS servers have been configured for the storage VM where the volumes are located. See how to configure DNS services for the SVM.

  • Note that if you use are using a different IPspace than the Default, then you might need to create a static route to get access to the object storage.

  • Update firewall rules, if necessary, to allow BlueXP backup and recovery service connections from ONTAP to object storage through port 443 and name resolution traffic from the storage VM to the DNS server over port 53 (TCP/UDP).

Creating or switching Connectors

If you already have a Connector deployed in your Azure VNet or on your premises, then you’re all set. If not, then you’ll need to create a Connector in either of those locations to back up ONTAP data to Azure Blob storage. You can’t use a Connector that’s deployed in another cloud provider.

Preparing networking for the Connector

Ensure that the Connector has the required networking connections.

Steps

  1. Ensure that the network where the Connector is installed enables the following connections:

    • An HTTPS connection over port 443 to the BlueXP backup and recovery service and to your Blob object storage (see the list of endpoints)

    • An HTTPS connection over port 443 to your ONTAP cluster management LIF

    • In order for the BlueXP backup and recovery Search & Restore functionality to work, port 1433 must be open for communication between the Connector and the Azure Synapse SQL services.

    • Additional inbound security group rules are required for Azure and Azure Government deployments. See Rules for the Connector in Azure for details.

  2. Enable a VNet Private Endpoint to Azure storage. This is needed if you have an ExpressRoute or VPN connection from your ONTAP cluster to the VNet and you want communication between the Connector and Blob storage to stay in your virtual private network (a private connection).

Verify or add permissions to the Connector

To use the BlueXP backup and recovery Search & Restore functionality, you need to have specific permissions in the role for the Connector so that it can access the Azure Synapse Workspace and Data Lake Storage Account. See the permissions below, and follow the steps if you need to modify the policy.

Before you start

You must register the Azure Synapse Analytics Resource Provider (called "Microsoft.Synapse") with your Subscription. See how to register this resource provider for your subscription. You must be the Subscription Owner or Contributor to register the resource provider.

Steps

  1. Identify the role assigned to the Connector virtual machine:

    1. In the Azure portal, open the Virtual machines service.

    2. Select the Connector virtual machine.

    3. Under Settings, select Identity.

    4. Click Azure role assignments.

    5. Make note of the custom role assigned to the Connector virtual machine.

  2. Update the custom role:

    1. In the Azure portal, open your Azure subscription.

    2. Click Access control (IAM) > Roles.

    3. Click the ellipsis (…​) for the custom role and then click Edit.

    4. Click JSON and add the following permissions:

      "Microsoft.Compute/virtualMachines/read",
"Microsoft.Compute/virtualMachines/start/action",
"Microsoft.Compute/virtualMachines/deallocate/action",
"Microsoft.Storage/storageAccounts/listkeys/action",
"Microsoft.Storage/storageAccounts/read",
"Microsoft.Storage/storageAccounts/write",
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
"Microsoft.Storage/storageAccounts/listAccountSas/action",
"Microsoft.KeyVault/vaults/read",
"Microsoft.KeyVault/vaults/accessPolicies/write",
"Microsoft.Network/networkInterfaces/read",
"Microsoft.Resources/subscriptions/locations/read",
"Microsoft.Network/virtualNetworks/read",
"Microsoft.Network/virtualNetworks/subnets/read",
"Microsoft.Resources/subscriptions/resourceGroups/read",
"Microsoft.Resources/subscriptions/resourcegroups/resources/read",
"Microsoft.Resources/subscriptions/resourceGroups/write",
"Microsoft.Authorization/locks/*",
"Microsoft.Network/privateEndpoints/write",
"Microsoft.Network/privateEndpoints/read",
"Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
"Microsoft.Network/virtualNetworks/join/action",
"Microsoft.Network/privateDnsZones/A/write",
"Microsoft.Network/privateDnsZones/read",
"Microsoft.Network/privateDnsZones/virtualNetworkLinks/read",
"Microsoft.Compute/virtualMachines/extensions/delete",
"Microsoft.Compute/virtualMachines/delete",
"Microsoft.Network/networkInterfaces/delete",
"Microsoft.Network/networkSecurityGroups/delete",
"Microsoft.Resources/deployments/delete",
"Microsoft.ManagedIdentity/userAssignedIdentities/assign/action",
"Microsoft.Synapse/workspaces/write",
"Microsoft.Synapse/workspaces/read",
"Microsoft.Synapse/workspaces/delete",
"Microsoft.Synapse/register/action",
"Microsoft.Synapse/checkNameAvailability/action",
"Microsoft.Synapse/workspaces/operationStatuses/read",
"Microsoft.Synapse/workspaces/firewallRules/read",
"Microsoft.Synapse/workspaces/replaceAllIpFirewallRules/action",
"Microsoft.Synapse/workspaces/operationResults/read",
"Microsoft.Synapse/workspaces/privateEndpointConnectionsApproval/action"

      View the full JSON format for the policy

    5. Click Review + update and then click Update.

Supported regions

You can create backups from on-premises systems to Azure Blob in all regions where Cloud Volumes ONTAP is supported; including Azure Government regions. You specify the region where the backups will be stored when you set up the service.

Verify license requirements

  • Before you can activate BlueXP backup and recovery for your cluster, you’ll need to either subscribe to a pay-as-you-go (PAYGO) BlueXP Marketplace offering from Azure, or purchase and activate a BlueXP backup and recovery BYOL license from NetApp. These licenses are for your account and can be used across multiple systems.

  • You need to have an Azure subscription for the object storage space where your backups will be located.

    You can create backups from on-premises systems to Azure Blob in all regions where Cloud Volumes ONTAP is supported; including Azure Government regions. You specify the region where backups will be stored when you set up the service.

Preparing Azure Blob storage for backups

  1. You can use your own custom-managed keys for data encryption in the activation wizard instead of using the default Microsoft-managed encryption keys. In this case you will need to have the Azure Subscription, Key Vault name, and the Key. See how to use your own keys.

  2. If you want to have a more secure connection over the public internet from your on-prem data center to the VNet, there is an option to configure an Azure Private Endpoint in the activation wizard. In this case you will need to know the VNet and Subnet for this connection. See details about using a Private Endpoint.

Enabling BlueXP backup and recovery

Enable BlueXP backup and recovery at any time directly from the on-premises working environment.

Steps

  1. From the Canvas, select the working environment and click Enable > Backup Volumes next to the Backup and recovery service in the right-panel.

    If the Azure Blob destination for your backups exists as a working environment on the Canvas, you can drag the cluster onto the Azure Blob working environment to initiate the setup wizard.

    A screenshot that shows the Backup and recovery Enable button which is available after you select a working environment.

  2. Select Microsoft Azure as your provider and click Next.

  3. Enter the provider details and click Next.

    1. The Azure subscription used for backups and the Azure region where the backups will be stored.

    2. The resource group that manages the Blob container - you can create a new resource group or select an existing resource group.

    3. Whether you will use the default Microsoft-managed encryption key or choose your own customer-managed keys to manage encryption of your data. (See how to use your own keys).

      A screenshot that shows the cloud provider details when backing up volumes from an on-premises cluster to Azure Blob storage.

  4. If you don’t have an existing BlueXP backup and recovery license for your account, you’ll be prompted at this point to select the type of charging method that you want to use. You can subscribe to a pay-as-you-go (PAYGO) BlueXP Marketplace offering from Azure (or if you have multiple subscriptions you’ll need to select one), or purchase and activate a BlueXP backup and recovery BYOL license from NetApp. Learn how to set up BlueXP backup and recovery licensing.

  5. Enter the networking details and click Next.

    1. The IPspace in the ONTAP cluster where the volumes you want to back up reside. The intercluster LIFs for this IPspace must have outbound internet access.

    2. Optionally, choose whether you will configure an Azure Private Endpoint. See details about using a Private Endpoint.

      A screenshot that shows the networking details when backing up volumes from an ONTAP system to Azure Blob storage.

  6. Enter the backup policy details that will be used for your default policy and click Next. You can select an existing policy, or you can create a new policy by entering your selections in each section:

    1. Enter the name for the default policy. You don’t need to change the name.

    2. Define the backup schedule and choose the number of backups to retain. See the list of existing policies you can choose.

    3. Optionally, when using ONTAP 9.12.1 and greater, you can choose to protect your backups from deletion and ransomware attacks by configuring one of the DataLock and Ransomware Protection settings. DataLock protects your backup files from being modified or deleted, and Ransomware protection scans your backup files to look for evidence of a ransomware attack in your backup files. Learn more about the available DataLock settings.

    4. When using ONTAP 9.10.1 and greater, you can choose to tier backups to Azure Archive storage after a certain number of days for further cost optimization. Learn more about using archival tiers.

      A screenshot that shows the BlueXP backup and recovery settings where you can choose your schedule and backup retention.

  7. Select the volumes that you want to back up using the defined backup policy in the Select Volumes page. If you want to assign different backup policies to certain volumes, you can create additional policies and apply them to those volumes later.

    • To back up all existing volumes and any volumes added in the future, check the box "Back up all existing and future volumes…​". We recommend this option so that all your volumes will be backed up and you’ll never have to remember to enable backups for new volumes.

    • To back up only existing volumes, check the box in the title row ().

    • To back up individual volumes, check the box for each volume ().

      A screenshot of selecting the volumes that will be backed up.

    • If there are any local Snapshot copies for read/write volumes in this working environment that match the backup schedule label you just selected for this working environment (for example, daily, weekly, etc.), an additional prompt is displayed "Export existing Snapshot copies to object storage as backup copies". Check this box if you want all historic Snapshots to be copied to object storage as backup files to ensure the most complete protection for your volumes.

  8. Click Activate Backup and BlueXP backup and recovery starts taking the initial backups of your volumes.

Result

A Blob storage container is created automatically in the resource group you entered, and the backup files are stored there. The Volume Backup Dashboard is displayed so you can monitor the state of the backups. You can also monitor the status of backup and restore jobs using the Job Monitoring panel.

What’s next?