Backing up on-premises ONTAP data to Google Cloud Storage

Contributors netapp-tonacki

Complete a few steps to get started backing up data from your on-premises ONTAP systems to Google Cloud Storage.

Note that "on-premises ONTAP systems" includes FAS, AFF, and ONTAP Select systems.

Quick start

Get started quickly by following these steps, or scroll down to the remaining sections for full details.

One Verify support for your configuration
  • You have discovered the on-premises cluster and added it to a working environment in Cloud Manager. See Discovering ONTAP clusters for details.

    • The cluster is running ONTAP 9.7P5 or later.

    • The cluster has a SnapMirror license — it is included as part of the Premium Bundle or Data Protection Bundle.

    • The cluster must have the required network connections to Google storage and to the Connector.

  • The Connector must have the required network connections to Google storage and to the cluster.

  • You have a valid Google subscription for the object storage space where your backups will be located.

  • You have a Google account with an access key and secret key so the ONTAP cluster can back up and restore data.

Two Enable Cloud Backup on the system

Select the working environment and click Enable > Backup Volumes next to the Backup & Restore service in the right-panel, and then follow the setup wizard.

A screenshot that shows the Backup & Restore Enable button which is available after you select a working environment.

Three Select the cloud provider and enter the provider details

Select Google Cloud as your provider and then enter the provider details. You also need to specify the IPspace in the ONTAP cluster where the volumes reside.

Four Define the default backup policy

The default policy backs up volumes every day and retains the most recent 30 backup copies of each volume. Change to hourly, daily, weekly, or monthly backups, or select one of the system-defined policies that provide more options. You can also change the number of backup copies you want to retain.

A screenshot that shows the Cloud Backup settings where you can choose the backup schedule and retention period.

Five Select the volumes that you want to back up

Identify which volumes you want to back up using the default backup policy in the Select Volumes page. If you want to assign different backup policies to certain volumes, you can create additional policies and apply them to volumes later.

Requirements

Read the following requirements to make sure you have a supported configuration before you start backing up on-premises volumes to Google Cloud storage.

There are two connection methods you can use when configuring backups from on-premises ONTAP systems to Google Cloud Storage.

  • Public connection - Directly connect the ONTAP system to Google Cloud Storage using a public Google endpoint.

  • Private connection - Use a VPN or Private Service Connect and route traffic through a Private Google Access interface that uses a private IP address.

The following image shows the public connection method and the connections that you need to prepare between the components:

A diagram showing how Cloud Backup communicates with the volumes on the source systems and the destination storage where the backup files are located.

The following image shows the private connection method and the connections that you need to prepare between the components:

A diagram showing how Cloud Backup communicates with the volumes on the source systems and the destination storage where the backup files are located.

Preparing your ONTAP clusters

You need to discover your on-premises ONTAP clusters in Cloud Manager before you can start backing up volume data.

ONTAP requirements
  • ONTAP 9.7P5 and later.

  • A SnapMirror license (included as part of the Premium Bundle or Data Protection Bundle).

    Note: The "Hybrid Cloud Bundle" is not required when using Cloud Backup.

  • Time and time zone are set correctly.

Cluster networking requirements
  • The ONTAP cluster initiates an HTTPS connection over port 443 from the intercluster LIF to Google Cloud storage for backup and restore operations.

    ONTAP reads and writes data to and from object storage. The object storage never initiates, it just responds.

  • ONTAP requires an inbound connection from the Connector to the cluster management LIF. The Connector can reside in a Google Cloud Platform VPC.

  • An intercluster LIF is required on each ONTAP node that hosts the volumes you want to back up. The LIF must be associated with the IPspace that ONTAP should use to connect to object storage. Learn more about IPspaces.

    When you set up Cloud Backup, you are prompted for the IPspace to use. You should choose the IPspace that each LIF is associated with. That might be the "Default" IPspace or a custom IPspace that you created.

  • The nodes' intercluster LIFs are able to access the object store.

  • DNS servers have been configured for the storage VM where the volumes are located. See how to configure DNS services for the SVM.

  • Note that if you use are using a different IPspace than the Default, then you might need to create a static route to get access to the object storage.

  • Update firewall rules, if necessary, to allow Cloud Backup service connections from ONTAP to object storage through port 443 and name resolution traffic from the storage VM to the DNS server over port 53 (TCP/UDP).

Creating or switching Connectors

A Connector is required to back up data to the cloud, and the Connector must be in a Google Cloud Platform VPC when backing up data to Google Cloud storage. You can’t use a Connector that’s deployed on-premises. You’ll either need to create a new Connector or make sure that the currently selected Connector resides in the correct provider.

Preparing networking for the Connector

Ensure that the Connector has the required networking connections.

Steps
  1. Ensure that the network where the Connector is installed enables the following connections:

    • An outbound internet connection to the Cloud Backup service over port 443 (HTTPS)

    • An HTTPS connection over port 443 to your Google Cloud storage

    • An HTTPS connection over port 443 to your ONTAP cluster management LIF

  2. Enable Private Google Access on the subnet where you plan to deploy the Connector. Private Google Access is needed if you have a direct connection from your ONTAP cluster to the VPC and you want communication between the Connector and Google Cloud Storage to stay in your virtual private network.

    Note that Private Google Access works with VM instances that have only internal (private) IP addresses (no external IP addresses).

Verify or add permissions to the Connector

To use the Cloud Backup Search & Restore functionality, you need to have specific permissions in the role for the Connector so that it can access the Google Cloud BigQuery service. See the permissions below, and follow the steps if you need to modify the policy.

Steps
  1. In Cloud Console, go to the Roles page.

  2. Using the drop-down list at the top of the page, select the project or organization that contains the role that you want to edit.

  3. Click a custom role.

  4. Click Edit Role to update the role’s permissions.

  5. Click Add Permissions to add the following new permissions to the role.

    bigquery.jobs.get
    bigquery.jobs.list
    bigquery.jobs.listAll
    bigquery.datasets.create
    bigquery.datasets.get
    bigquery.jobs.create
    bigquery.tables.get
    bigquery.tables.getData
    bigquery.tables.list
    bigquery.tables.create
  6. Click Update to save the edited role.

Verify license requirements

  • Before you can activate Cloud Backup for your cluster, you’ll need to either subscribe to a pay-as-you-go (PAYGO) Cloud Manager Marketplace offering from Google, or purchase and activate a Cloud Backup BYOL license from NetApp. These licenses are for your account and can be used across multiple systems.

    • For Cloud Backup PAYGO licensing, you’ll need a subscription to the Google Cloud Manager Marketplace offering to use Cloud Backup. Billing for Cloud Backup is done through this subscription.

    • For Cloud Backup BYOL licensing, you’ll need the serial number from NetApp that enables you to use the service for the duration and capacity of the license. Learn how to manage your BYOL licenses.

  • You need to have a Google subscription for the object storage space where your backups will be located.

    You can create backups from on-premises systems to Google Cloud Storage in all regions where Cloud Volumes ONTAP is supported. You specify the region where backups will be stored when you set up the service.

Preparing Google Cloud Storage for backups

When you set up backup, you need to provide storage access keys for a service account that has Storage Admin permissions. A service account enables Cloud Backup to authenticate and access Cloud Storage buckets used to store backups. The keys are required so that Google Cloud Storage knows who is making the request.

Steps
  1. Create a service account that has the predefined Storage Admin role.

  2. Go to GCP Storage Settings and create access keys for the service account:

    1. Select a project, and click Interoperability. If you haven’t already done so, click Enable interoperability access.

    2. Under Access keys for service accounts, click Create a key for a service account, select the service account that you just created, and click Create Key.

      You’ll need to enter the keys in Cloud Backup later when you configure the backup service.

Enabling Cloud Backup

Enable Cloud Backup at any time directly from the on-premises working environment.

Steps
  1. From the Canvas, select the working environment and click Enable > Backup Volumes next to the Backup & Restore service in the right-panel.

    A screenshot that shows the Backup & Restore Enable button which is available after you select a working environment.

  2. Select Google Cloud as your provider and click Next.

  3. Enter the provider details and click Next.

    1. The Google Cloud Project where you want the Google Cloud Storage bucket to be created for backups. (The Project must have a Service Account that has the predefined Storage Admin role.)

    2. The Google Access Key and Secret Key used to store the backups.

    3. The Google region where the backups will be stored.

    4. The IPspace in the ONTAP cluster where the volumes you want to back up reside. The intercluster LIFs for this IPspace must have outbound internet access.

      A screenshot that shows the cloud provider details when backing up volumes from an on-premises cluster to Google Cloud Storage.

  4. If you don’t have an existing Cloud Backup license for your account, you’ll be prompted at this point to select the type of charging method that you want to use. You can subscribe to a pay-as-you-go (PAYGO) Cloud Manager Marketplace offering from Google (or if you have multiple subscriptions you’ll need to select one), or purchase and activate a Cloud Backup BYOL license from NetApp. Learn how to set up Cloud Backup licensing.

  5. In the Define Policy page, select an existing backup schedule and retention value, or define a new default backup policy, and click Next.

    A screenshot that shows the Cloud Backup settings where you can choose your backup schedule and retention period.

  6. Select the volumes that you want to back up using the default backup policy in the Select Volumes page. If you want to assign different backup policies to certain volumes, you can create additional policies and apply them to those volumes later.

    • To back up all volumes, check the box in the title row (button backup all volumes).

    • To back up individual volumes, check the box for each volume (button backup 1 volume).

      A screenshot of selecting the volumes that will be backed up.

    If you want all volumes added in the future to have backup enabled, just leave the checkbox for "Automatically back up future volumes…​" checked. If you disable this setting, you’ll need to manually enable backups for future volumes.

  7. Click Activate Backup and Cloud Backup starts taking the initial backups of your volumes.

Result

Cloud Backup starts taking the initial backups of each selected volume and the Volume Backup Dashboard is displayed so you can monitor the state of the backups.

What’s next?

You can start and stop backups for volumes or change the backup schedule.
You can also restore volumes or files from a backup file to a Cloud Volumes ONTAP system in Google, or to an on-premises ONTAP system.