Cloud Backup:Before you begin (ACVS)

(Recommended) Use the AccessKey pair of a RAM user for backup and disaster recovery

Resource Access Management (RAM) is an Alibaba Cloud service that allows you to manage user identities and control access to resources. RAM lets you create and manage multiple identities for an Alibaba Cloud account, and grant multiple permissions to a single identity or a group of identities. Different identities can be authorized to access different Alibaba Cloud resources.

An AccessKey pair is required when you activate a disaster recovery gateway. Using the AccessKey pair from your root Alibaba Cloud account poses a security risk because it grants broad access to all your cloud resources. Therefore, the recommended best practice is to use an AccessKey pair from a RAM user to activate the disaster recovery gateway. Before you back up data, ensure that a RAM user and an AccessKey pair have been created. For more information, see Create a RAM user and Create an AccessKey pair.

Prerequisites

Before you begin, ensure that you have:

• An activated Cloud Backup service. Activating Cloud Backup is free. Using the VMware backup and disaster recovery feature incurs charges for the Cloud Backup client and backup vault. For more information, see Billing.

• The username and password for your VMware vCenter Server.

Usage notes

• Limits apply to supported operating systems and VMware platforms. Permission locations and categories may vary by vCenter version. Review the limits before proceeding. For more information, see Limits on VMware disaster recovery.

• The AccessKey pair used to activate the disaster recovery gateway may be disabled, deleted, or rotated. If the current AccessKey pair becomes invalid for any of these reasons, you must reactivate the gateway with a new, valid AccessKey pair to prevent backup failures. For more information, see How do I change the AccessKey pair of a gateway used for VMware backup and disaster recovery to reactivate the gateway?

Step 1: Prepare the VMware environment

Step 2: Log on to the ECS jump server

Create an Elastic Compute Service (ECS) instance in the VPC of the dedicated VMware environment as a jump server for accessing management components such as vCenter Server and NSX-T Manager. Select Windows Server as the operating system. If you enable Internet access from the jump server, configure security settings.

1. Log on to the ECS console and find the ECS instance that serves as the jump server.

2. In the Actions column, click Connect.

3. In the Remote connection dialog box, click Sign in now in the Workbench section.

4. In the Instance Login dialog box, set Connection Method to Terminal and Authentication to Password-based.

   • Username: Enter administrator.

   • Password: Enter the logon password that you set for the Logon Credentials parameter when you created the ECS instance.

   Confirm the information and click Log On.

Step 3: Create the disaster recovery gateway

Create a disaster recovery gateway in the Cloud Backup console, download the gateway package, and then deploy it in your ACVS environment.

1. Log on to the ECS console and find the ECS instance that serves as the jump server.

2. In the left-side navigation pane, choose Backup > VMware Backup & Disaster Recovery.

3. In the top navigation bar, select a region.

4. On the VMware Backup & Disaster Recovery page, click Create Backup & Disaster Recovery Gateway.

5. In the Create Backup & Disaster Recovery Gateway panel, configure the parameters and click Create.

   The following table describes the parameters.

   Parameter	Description
   Backup Vault	The backup vault where backup data will be stored. Valid values: Create Vault: If you select this option, specify a name for the backup vault in the Vault Name field. If you do not configure this parameter, a random name is specified. Select Vault: If you select this option, select a backup vault from the Vault Name drop-down list. Important After you create a backup vault and store backup data, you are charged for the storage usage of the backup vault. For more information, see Billing methods and billable items. The system automatically selects the redundancy type based on what the region supports. In regions that support ZRS, a ZRS-enabled backup or archive vault is created by default. In other regions, a LRS-based backup or archive vault is created. You do not need to select the type manually.
   Vault Name	The name of the backup vault.
   Vault Resource Group	This parameter is required only if you set the Backup Vault parameter to Create Vault. This parameter specifies the resource group to which the backup vault belongs. Use resource groups to manage resources owned by your Alibaba Cloud account. Resource groups help you simplify the resource and permission management of your Alibaba Cloud account. For more information, see Create a resource group.
   Gateway Name	A name for the gateway, 1 to 64 characters in length.
   VMware Platform	The VMware platform on which the VM is deployed. In this example, select Alibaba Cloud VMware Services (ACVS). On-premise vSphere: The VM is deployed in a VMware environment on the on-premises server. Alibaba Cloud VMware Services (ACVS): The VM is deployed on ACVS.
   Network Type	The network type. In this example, select VPC. If you select VPC, the VM that you want to back up must reside in a VPC and the VPC is in the same region as the backup vault.
   Use HTTPS	Specifies whether to use HTTPS to transmit encrypted data that is stored in a backup vault. Using HTTPS to encrypt data in transit enhances security but may slightly impact transmission performance. If you modify the setting of the Use HTTPS switch, the modification takes effect on the next backup or restore job.

6. In the Create Backup & Disaster Recovery Gateway panel, click Download Gateway and Download Certificate.

   Note

   The disaster recovery gateway is used to connect your VM to Cloud Backup, and the certificate is used to activate the disaster recovery gateway. A disaster recovery gateway can be downloaded and deployed on the Backup & Disaster Recovery Gateway tab at any time.

Step 4: Install the gateway

After downloading the gateway and certificate, install the gateway in your VMware environment. After installation, run backup and restore jobs in the Cloud Backup console:

1. Log on to the ECS jump server.

   For more information, see Step 2: Log on to the ECS jump server.

2. Log on to the ACVS console, find the dedicated VMware environment, and then click Login management component in the Actions column.

3. On the ECS jump server, log on to the vSphere Web Client using the vCenter username and address from Step 2.

4. In the left-side navigation pane, right-click the VM and select Deploy OVF Template from the shortcut menu.

   For more information, see Deploying OVF and OVA Templates.

   1. In the Deploy OVF Template dialog box, select Local file. Click Browse, select the gateway package that you downloaded in Step 3: Create the disaster recovery gateway and then click NEXT.

      Note

      To reduce the download time, Cloud Backup provides a gateway package in the open virtual appliance (OVA) format. Use the package to deploy Open Virtual Format (OVF) templates on the vSphere Web Client.

      

   2. Enter the name of the OVF template, select the location where you want to deploy the template, and then click NEXT.

      

   3. Select a computing resource and click NEXT.

      

   4. Verify the template details and click NEXT.

      

   5. Select the format of the virtual disk, select a storage resource to which you want to store the files of the deployed template, and then click NEXT.

      

   6. Select a destination network for each source network and click NEXT.

      

   7. Configure the network and admin user password, and then click NEXT.

      • If you use DHCP to obtain an IP address, you do not need to specify the Gateway, IP, and Netmask parameters. If you use a static IP address, you must specify the preceding parameters based on the obtained IP address.

      • You must make sure that the specified primary DNS server and secondary DNS server can resolve the domain names of Cloud Backup, vCenter, and ESXi.

        Note

        Enter the IP address of a DNS server that is reachable from the gateway VM and can resolve the required endpoints. If no DNS server is available for mapping domain names to VPC endpoints, enter the server IP address of Alibaba Cloud DNS PrivateZone, for example, 100.100.2.136 or 100.100.2.138.

      • Set the Admin User Name and Admin User Password parameters to the username and password of the gateway VM that you created. This user has root permissions and can be used to log on to the VM.

      

   8. Verify the configurations and click FINISH.

      

5. On the Recent Tasks page, view the progress of each deployment task.

Step 5: Activate the gateway

1. After the deployment tasks are completed, start the VM on which the OVF template is deployed.

2. Open a browser, and enter http://hostname:8011 in the address bar.

   The value of hostname is the IP address of the gateway on which the OVF template is deployed.

3. On the Register page, configure the parameters and click Register to log on to the Cloud Backup gateway. The following table describes the parameters.

   Parameter	Description
   AccessKey ID	The AccessKey ID and AccessKey secret of the RAM user that is used to access Cloud Backup. You can obtain the AccessKey ID and AccessKey secret of a RAM user from your Alibaba Cloud account for which Cloud Backup is activated. For more information, see How do I create an AccessKey pair for a RAM user? Note The AccessKey pair used to activate the disaster recovery gateway may expire and be rotated. If the AccessKey pair is rotated, you must reactivate the disaster recovery gateway. Otherwise, the backup fails. For more information, see How do I change the AccessKey pair of a gateway used for VMware backup and disaster recovery to reactivate the gateway?
   AccessKey Secret
   Certificate	The certificate that you downloaded from the Cloud Backup console. If a VM is shut down for more than five days after you use the certificate to activate the gateway on the VM, the certificate expires. You must download a new certificate and reactivate the gateway.

   After the gateway is installed, the status of the gateway changes to Activated on the Backup & Disaster Recovery Gateway tab of the VMware Backup & Disaster Recovery page. The following operations are available in the Actions column:

   • Throttle Bandwidth: Set traffic limits in different time periods to prevent backup jobs from consuming excessive VMware resources.

   • More:

     • Download Gateway: Download the installation package of the disaster recovery gateway.

     • Download Certificate: Download the certificate used to activate the disaster recovery gateway.

     • Delete: Deleting a Cloud Backup client also deletes its backup data and causes any running jobs to fail. Before you delete a Cloud Backup client, make sure that you no longer need the backup data generated by the client and no backup or restore jobs are being performed by the client.

     • Gateway Settings: Specify whether to transfer data over HTTPS, the maximum number of worker threads, and the maximum number of CPU cores.

   After you complete the preceding operations, view the vCenter Servers on the Managed vCenter Servers tab.

   

FAQ