Before you protect Google Cloud Firestore data, make sure your environment meets the following requirements for access nodes, network connectivity, and indexing.
-
If you deploy your own access node in your internal network, IP allowlisting is typically not required. Follow the access node deployment documentation, and make sure the Commvault infrastructure can reach your access node.
-
If you use a Commvault-managed access node, allowlist the access node IP address so it can connect to your Google Cloud Firestore endpoint (https://firestore.googleapis.com). For information about IP allowlisting, see IP Allowlist for Controlling Access to the Command Center.
-
The Index Server runs on a MediaAgent. Make sure you have at least one MediaAgent configured for indexing operations.
Additional requirements
-
The GCP Service Account used for authentication must have the required IAM roles:
roles/datastore.importExportAdminandroles/storage.objectAdmin. -
The target GCS bucket must exist before backup and must be accessible by the Service Account.
-
For incremental backups on MongoDB-compatible Firestore databases, each collection must have a change stream pre-configured.
Required ports
| Source | Destination | Port | Protocol | Purpose |
|---|---|---|---|---|
| Commvault access node | https://firestore.googleapis.com | 443 | HTTPS | Google Cloud Firestore API calls (backup and restore) |
| Commvault access node | https://storage.googleapis.com | 443 | HTTPS | Google Cloud Storage access for index metadata |
Note
This workload requires a backup plan created on Air Gap Storage (Amazon S3, Azure Blob Storage, or Google Cloud Storage). For details, see Configure and validate backups for Google Cloud Firestore.