# System Requirements for Protecting Google Cloud Instances

Planning for protection of your Google Cloud VMs with Commvault includes verifying that your environment meets the system requirements and configuring access to the resources that you want to protect. As part of this process, you'll also need to add a hypervisor and install the access node. For information on how to add a hypervisor and install the access node, see Configuring Backups for Google Instances.

## Commvault Packages

Access nodes for GC instances must have the Virtual Server Agent package installed.

## Access Node Network Requirements

To back up resources from one or more Google Cloud projects, you must install at least one Commvault access node on a Google Cloud Compute Engine instance.

## Google Cloud APIs & Services

The following APIs and services are required to manage various Google Cloud resources and services:

- Identity and Access Management (IAM) API

- Compute Engine API

- Cloud Resource Manager API

- Cloud Key Management Service (KMS) API

- KMS Inventory API

- Cloud Storage

### gcloud Commands

You can activate these APIs for the Service Account performing protection. Run the following commands in an authorized gcloud shell.

- gcloud services enable iam.googleapis.com

- gcloud services enable compute.googleapis.com

- gcloud services enable cloudresourcemanager.googleapis.com

- gcloud services enable cloudkms.googleapis.com

- gcloud services enable kmsinventory.googleapis.com

- gcloud services enable storage.googleapis.com

For example:

`gcloud services enable service_name`

For information about activating APIs, see Enabling an API.

## Deployment Considerations

### Tiers Based on Service Level Agreements (SLAs)

Different instances can have different backup and recovery options that are defined in a service level agreement (SLA) for each class of instance. For example:

- High transaction instances that provide customer application support might require multiple daily backups with the requirement to recover instances quickly.

- User instances might need the ability to recover specific files and folders on a daily basis.

- Development and test instances might only need weekly backups or the ability to recover to predefined states.

To manage different SLAs, you can create a separate VM group for each class of instance. Each VM group can have its own storage policy, backup schedule, and recovery options.

### Data Recovery Considerations

The frequency of backups should be based on your requirements for data recovery. For example:

- To determine backup frequency, determine how long the maximum window for potential loss can be. For example, if your policy calls for no more than an hour's work to be lost in the event of an instance failure, hourly backups are required.

- If immediate recovery is a priority, you can restore a copy of an instance that is frequently updated based on incremental backups.

### Deployment and Other Requirements

- Access nodes for Google Cloud instances must be present on Google Cloud.

- You can designate one access node to back up instances from multiple projects, provided that the required access rights are configured in your Google Cloud service account.

- The access node can reside in any project of a same or a different organization.

  Note

  To protect disks that are encrypted with customer managed encryption keys (CMEK), the access node must reside in the same organization.

- For faster backups and restores, designate at least one access node for each Google Cloud region.

Important

You must enable the Cloud Resource Manager API. If you do not enable the API, all backup jobs will fail (including backup jobs for clients that were created in a previous release).

Important

You can define discovery rules by a project parameter, in addition to region and zone parameters.

If an environment has discovery rules that are defined using zone or region parameters, then the following are true:

- Multiple projects can fall within a region or a zone.

- All instances in those multiple projects are backed up.

In this situation, backups might include instances that do not need to be backed up, and so incur unnecessary costs. Review all rules to ensure that only instances that need to be backed up are backed up.

## Operating System Support

Access nodes for GC instances must run one of the following operating systems.

Install the Commvault Virtual Server Agent (VSA) matching your CommServer version.

### Linux

- Install the Virtual Server Agent on a Linux machine that runs any of the following operating systems:

  - Rocky Linux 9.x, 8.x, (recommended)

  - Red Hat Enterprise Linux (RHEL) 9.x, 8.x

  - Oracle Enterprise Linux (OEL) 9.x, 8.x

- End of Life (best effort support)

  - Red Hat Enterprise Linux (RHEL) 7.x, see What to know about Red Hat Enteprise Linux 7 End of Maintenance

  - Oracle Enterprise Linux (OEL) 7.x, see Extend your OS upgrade timeline: Oracle Linux 7's Extended Support with expanded coverage)

### Windows

- Commvault supports Microsoft Windows Server Standard, DataCenter, and Core editions:

  - Microsoft Windows Server 2025 x64

  - Microsoft Windows Server 2022 x64

  - Microsoft Windows Server 2019 x64

  - Microsoft Windows Server 2016 x64

## Custom Endpoints

The following settings allow you to configure custom endpoints for Google Cloud services when required:

sGoogleCloudIsolatedEndpoint: This setting is used to configure a custom endpoint for Google Cloud services. Once this endpoint is specified, all compute-related APIs will use this custom endpoint instead of the default Google Cloud endpoint. For more information see, sGoogleCloudIsolatedEndpoint.

sGoogleCloudEndpointException: This setting provides an exclusion mechanism when the sGoogleCloudIsolatedEndpoint is in use. This setting allows you to exclude specific services from being directed to the custom endpoint defined by sGoogleCloudIsolatedEndpoint. For more information see, sGoogleCloudEndpointException.

## Firewall Requirements

Tunnel ports (for example, 8400 and 8403) must be opened in the security group for the instance to enable installation of the VSA package to GCP instances and communication with the CommServe system.

If you deploy a CommServe host in an environment with firewalls, create a persistent route from the CommServe host to the access node, as documented in Setting Up a Network Gateway Connection Using a Predefined Network Topology.

If a firewall access node is installed, configure Internet options for the firewall access node machine. On the HTTP Proxy tab of the Internet Options dialog box, enter the user name and password for the firewall access node machine, using only the user name and not including the domain name with the user name.

To access GC backup and restore services, incorporate the following URLs in your firewall or access node settings:

- https://compute.googleapis.com/compute/v1/projects

- https://content-cloudkms.googleapis.com/v1

- https://cloudresourcemanager.googleapis.com/v1

- https://storage.googleapis.com

- https://storage.googleapis.com/storage/v1/b

- https://storage.googleapis.com/upload/storage/v1/b

## Configuring a Firewall to Install the VSA Package on a Cloud VM or Instance

To deploy the access node or MediaAgent on a cloud VM or instance when other components (such as the CommServe host) are on premises <Category>, configure a firewall for an access node in the cloud between the on premises components and the cloud VM or instance.

## Hardware Specifications

For information about hardware requirements for the Virtual Server Agent, see Hardware Specifications for Virtual Server Agent.

## DISCLAIMER

Certain third-party software and service releases (together, "Releases") may not be supported by Commvault. You are solely responsible for ensuring Commvault’s products and services are compatible with any such Releases.

×

Loading...