System Requirements for Virtual Server Agent with Amazon

The following requirements are for the Virtual Server Agent with Amazon.

Also see Best Practices for Using Commvault with Amazon Web Services.

Hardware Specifications

For information about hardware requirements for the Virtual Server Agent, see Hardware Specifications for Virtual Server Agent.

Virtual Server Agent Proxy Requirements

To provide better throughput for streaming backup and backup copy operations, use a compute-optimized instance hosted in Amazon. For more information, see Amazon EC2 Instance Types.

The VSA proxy must be in the same Amazon account and located in the same region as the instances to be backed up.

For restores, the VSA proxy can be an Amazon instance or an external machine.

For IntelliSnap backups and restores from IntelliSnap jobs, the VSA proxy can be an Amazon instance or an external machine.

The VSA proxy must meet the following requirements:

• The VSA proxy machine must be one of the following types of machines:

  • Windows Server 2019

  • Windows Server 2016

  • Windows Server 2012 R2

  • For Linux proxy support, configure a VSA proxy on a Linux instance using one of the following methods:

    • Deploy an AWS Marketplace AMI to serve as a Virtual Server Agent proxy for Amazon.

    • Configure a CentOS 7.4, CentOS 8, RHEL 7.5, or RHEL 8, instance with the required software.

      Note

      For CentOS 8 or RHEL 8 instances, to install operating system packages that must enable automatic installation of Mono, register the instances with CentOS, or Red Hat.

    • Configure an AWS Linux instance that uses a 64-bit Arm processor with the required software.

      When you use an AWS instance with the 64-bit ARM processor as a Linux access node for VSA, you can back up instances or restore full instances, but you cannot restore guest files.

    For more information, see Linux Proxy Support for Amazon Web Services.

• Minimum of 100 GB disk space recommended.

• Minimum of 4 GB RAM required beyond the requirements of the operating system and running applications.

• The VSA proxy machine must be able to connect to ec2.amazonaws.com, or the regional equivalent if the Amazon account is restricted to specific regions. To route communications through an HTTP or HTTPS proxy, provide proxy information in the CommServe Control Panel, on the HTTP Proxy tab of the Internet Options dialog box. To use an HTTPS proxy, you must provide authentication details.

For VSA proxies running on Amazon instances, the following additional requirements apply:

• Windows Server instances where the Virtual Server Agent is installed must upgrade to the latest paravirtual (PV) driver.

• EBS optimized, high IOPS volume.

• For streaming backups and backup copies, if the VSA proxy used for backups and restores is running on an Amazon instance, the proxy must be available in the same user account as the instance being backed up or restored, or you must configure the AWS account that contains the proxy as an Admin account as described in Using Resources from an Admin Account. This requirement does not apply to IntelliSnap backups.

User Permissions

See the following topics for user permission requirements:

• Amazon Web Services User Permissions for Backups and Restores

• Amazon Web Services User Permissions for VM Conversion

Amazon Regions

When Amazon adds a new region, Software Development Kit upgrades are required before Commvault support can be added. For this reason, Commvault support for newly added regions will be added after the new regions are made available by Amazon. See Amazon Regions for a list of regions supported by Commvault for the current service pack.

You can limit communication across Amazon regions as described in Creating an Amazon Client.

Guest Operating Systems

Instances being backed up can have any of the guest operating systems that are supported by the Amazon platform.

Network Connectivity

The Virtual Server Agent requires Layer 3 network connectivity to the upstream MediaAgent on port 8403. If the MediaAgent and the access node (VSA proxy) are in different accounts or in different Virtual Private Clouds (VPCs), you can configure Amazon VPC peering as described in the AWS article VPC peering basics.

Firewall Requirements

In an environment with firewalls, the following requirements apply:

• To enable installation of the Virtual Server Agent to Amazon instances and communication with the CommServe system, open tunnel ports (for example, 8400 and 8403) in the security group for the instance.

• To perform backup and restore operations using a VSA proxy on an Amazon instance, open port 443 in the security group for the VSA proxy instance.

Configuring a Firewall to Install the Virtual Server Agent on an AWS Instance

To back up Amazon instances, you must deploy the Virtual Server Agent (VSA) on an AWS instance that is in the same region as the instances to be backed up. For restores, you can use a VSA proxy running on an AWS instance or a VSA proxy running on a machine outside of Amazon.

The CommServe host and MediaAgent can also be deployed on Amazon instances, or can reside on machines outside of AWS,

The CommServe host, MediaAgent, and VSA proxy must all be able to communicate with each other using one of the following connections:

• AWS Direct Connect - On premises components and the AWS instance are within the same network. No firewall configuration is required.

• AWS VPN - Only available if the AWS instance is accessible through VPC. On premises components and the AWS instance are within the same network. No firewall configuration is required.

• If you are not using AWS Direct Connect or AWS VPN for communication between on premises components and the AWS proxy instance, you can configure a Commvault firewall connection between the on premises components and the AWS proxy instance.

For more information, see the following topics:

• Configuring a Firewall to Install the Virtual Server Agent on a Cloud VM or Instance

• Best Practices for Network Security

DISCLAIMER

Certain third-party software and service releases (together, “Releases”) may not be supported by Commvault. You are solely responsible for ensuring Commvault’s products and services are compatible with any such Releases.