So you just got a great deal on a hosted/ dedicated server from one of the major hosting providers. KVM (IPMI) access has been established and the host OS has been installed, in this case Server 2008 x64. The server package comes with 1 dedicated and routable IP address but more are available for purchase, usually in packs.  The goal is, partially, to host VMs that are publically accessible from the internet. Hosters such as GigeNet and SoftLayer sell IP packs that are based on networks which rely on the primary host’s IP network. In other words, you can’t just assign the IPs from these ranges to VMs because, for one reason, they’re not on the same subnet as the host. The intention of the hoster is that you’ll bind these IPs to the NIC of the host, then assign them to websites. Access to these addresses are made available via the host’s primary network which has access to a default gateway. The IP pack networks have no gateway and as such are not routable on their own, even though they’re ultimately accessible via the internet. For example, my host’s IP is x.x.50.70/19 and my IP block is x.x.220.200/29. The /29 network has no routable gateway for my VMs to use and is not in the same subnet as my host so is unusable on its own. While this presents a challenge to solve it also offers some inherent security. The host, being on a completely separate subnet with a different IP scheme means that the it cannot be easily discovered via access to the VMs. There is nothing publicly accessible that exposes this relationship. Still with me?

To pull this off we need to enable routing on the host server. The same principle should apply to any host-based virtualization platform that makes use of virtual network interfaces (vNICs) to connect VM guests. In my scenario I’m using VMware Server 2.0. The first step is to enable the Network Policy and Access Services role in Server 2008. All that you need to make this work is RRAS which includes the RAS and Routing functionalities.

Once installed, launch your virtual network configuration and set up a new virtual adapter. You could modify a default adapter but I prefer to leave these alone and build one from scratch. In VMware Server you have 3 options for virtual networks:

• Bridged - shares the Host NIC with the virtual adapter (this requires routable IPs on the guest VMs)
• NAT – allows you to put your guests on a private network (192.x) and all traffic in/out from the VMs will use the Host’s IP
• Host-only – a private network shared with the host (this can be used to create an isolated network not internet accessible)

In this scenario the only viable option is the host-only network type which will allow me to bend the rules a bit. Create a new host virtual adapter and assign the subnet from your block of assigned IPs to it. This needs to be the address of the subnet which is not a usable address and in my case is .200.

Once the new virtual adapter is created you will see a new network interface in the network connections list on the host. Assign the next IP in your block to this interface and this will become the gateway for your VMs.

Now to apply the glue to hold it all together. In RRAS, create a new static route under the IPv4 context. Select the new virtual gateway interface (VMnet2) and point it to the host server’s network, subnet mask, and gateway. The destination is the host network’s subnet address, in this case x.x.50.64.

Now when you set up your VMs, you will assign their vNICs to the VMnet2 adapter, give them usable IPs from the block (starting at .202), and specify .201 as the gateway. The VMs can now get out to the internet and are accessible directly via the internet for web hosting or whatever.

With the next generation of the venerable DL 300 series platform comes the 6th iteration of the flagship Intel-based model, the 380. Performance, density, and efficiency are the key aspects targeted by the new model. Aesthetically, the 6th gen is a large departure from its predecessor completely flipping the front-end arrangement while maintaining its 2U rack footprint.

The Insight Display and SAS cage are now on the left side with the power button, USB slots, and VGA out. An additional SAS cage can be installed to the right of the default drives doubling the drive count to 16. The DVD-ROM drive will be sacrificed if you need to do this and your server will look very much like an MSA with all 16 drives. 18 DIMM slots allow for up to 144GB DDR3 RAM but both CPUs have to be installed to activate the 2nd half of the DIMM bank. CPU choices include dual or quad core models from the 5500 Xeon series (Nahalem). The P410 Smart Array Controller ships standard on this platform which supports 6 fewer total drives than the P400 but supports PCI-E 2.0 at a x8 bus width. 2 NC382i dual-port Gig adapters ship standard doubling the onboard NIC count to 4 (5 if you include the dedicated iLo port). 6 PCI-E slots are now available, adding 2 from the 5th gen platform, optionally available in x16 width risers. Pricing starts around $2300 for base models.

DL380 G6

ServerSafe is the enterprise online e-vaulting service from NetMass, Inc. that employs an agentless architecture to backup files over the internet to a secure datacenter. Backup methodologies have been evolving for many years and include practices the likes of disk-to-disk (D2D) and disk-to-disk-to-tape (D2D2T). It’s the tape part that most IT workers loathe and costs companies the most. Of course at some large scale it doesn’t make sense to pay a 3rd-party to offsite your data, leaving you to implement an offsite vaulting and retention solution of your own. It’s all about “the cloud” these days and ServerSafe floats solidly in the stratosphere.

Based on the Televaulting DS-Client platform from Asigra, ServerSafe is able to provide a robust and feature rich backup solution for Windows or Unix. To get started you need a dedicated machine to serve as the DS-Client which will connect to the NetMass datacenter and stream all the bits across the internet. This is a 3-tier architecture that comprises of a DS-System (storage array), DS-Client (backup server), and DS-User (admin console). The DS-User portion can happily live on the DS-Client system or can be installed on an administrator’s workstation for remote management. Once the DS-Client is installed and authorized to connect to the NetMass datacenter, backup sets, policies, and schedules can be created. Your data is then compressed, encrypted, and sent to the NetMass datacenter, to live on their storage arrays, where they do not cap disk usage but do charge based on how much disk you consume.

All data is encrypted before it leaves your premises on it’s travel across the internet. AES is the algorithm and the bit level depends on the key you supply during install; a 32-character key will yield 256-bit encryption which is, today, unbreakable. Your data is encrypted before it gets put on the wire and will sit on the storage array encrypted as well, in-flight and at rest. Before a DS-Client can connect to the NetMass datacenter it has to be expressly permitted, which is a cooperative effort between you and the NetMass personnel. The DS-Client is secured by local security or Active Directory accounts that combine with application-level role based permissioning.

The install consists of running an x86 or x64 installer, pointing to a NetMass-provided customer information file (CRI), installing MSDE with a new SQL instance (or pointing to another SQL server), and generating an account key for AES encryption. Once this key is created it cannot be changed without destroying the DS-Client registration and starting over from scratch. For the version 8 build of the DS-Client, only Server 2003 or XP are supported as hosts. Server 2008 can be backed up by the DS-Client but it is not yet supported as a host OS. I’m told this is coming in the v9 build.

Setup

Setup is collaborative and done via a shared desktop session with a NetMass engineer. Asigra has published a 500+ page PDF manual for this product so the options run vast and deep. Once logged into the DS-Client, the first step is to set defaults that will control the behavior of the backup sets you create later. Generations will dictate the default number of versions of a file you want to store online and this number will be pre-populated in a backup set. The manual suggests setting the total number of generations allowed to something very high, like 300, then controlling them more granularly via retention rules. You could set up a base retention rule here also but it might make better sense to set these up per server or file type you’re backing up. CDP is Continuous Data Retention which means that data can be constantly backed up on-the-fly as it changes. Depending on your generation limits and retention rules this could be very costly in both online storage costs and bandwidth usage. Defaults for scheduling and email notification are set here as well. There are two options for compression: ZLIB or LZOP. Some quick unofficial research in the Asigra forums tells me that ZLIB has slightly higher ratios. The best I’ve seen so far is a 30GB SQL database being reduced to 2GB before transmission to NetMass. The other tabs are accurately descriptive providing support for features you would expect in an enterprise product. The advanced tab allows for the tweaking of a number of low-level parameters which include compression levels, retry values, and various other settings. The parameters tab controls the Admin Process which is essentially database maintenance on the DS-Client.

Backups

Core functionality is completely wizard-driven and includes scheduled backups, On demand backups, and restores. Backup options include common file types you would be most likely to protect. You can browse the network to select target hosts or enter them by name in UNC format to connect. Once connected, the client will show you all available drives and shares that you can drill down into. The DS-Client has no trouble discovering hidden file shares ($).

For SQL Servers you need to choose the path to which the database files live and the DS-Client will display each database. Choose the databases you want to include in the backup set and then decide if you want to run DBCC and truncate the logs. If your SQL Server is running in simple recovery mode then you do not need to truncate the logs here and you will see deprecation warnings on your servers. The DS-Client uses standard Microsoft API calls and via T-SQL triggers all operations against the database. Remember this is all done agentless, so the backup client connects to SQL like a regular consumer with administrative privileges. A dump of the database has to be performed which can occur in the same directory as the DB files, a remote location, or in the DS-Client buffer (DS-Client machine). If you have the disk space, dumps in the same place as the DB are easiest. It is important to note that this can affect production performance as the DS-Client will generate additional server load in the form of IO and network traffic.

Next you can choose to use an existing retention rule, create a new one, or use none at all. While retention rules can be created separately, this is an easy way to mate online retention with backup sets as you create them. Three options are available at this time in the DS-Client, via NetMass, with regard to online retention:

• Deletion of files removed from source: how long to keep files online whose source file has been deleted
• Time-based online retention: how many generations to keep online and for how long
• Enable local storage retention: keeping generations locally in addition to online

Deletion of files if removed from source defaults to 30 days with no kept generations. This may work fine or you could keep the last changed generation of a file online even after it’s been deleted from the source, just in case. Keep in mind, however, that this will keep all files until an applicable retention rule deletes them from the DS-System.

Time-based retention dictates how long to store generations online, near and long term. This is useful for compliance requirements, especially if you work in an industry that has specific data retention requirements. You can get extremely granular with these rules which can be mind-bending to your non-technical senior management staff. For instance, a good general policy might be to protect data for up to 7 years. This essentially ensures that the last, most recent copy of every file, whether it was deleted or not, will be stored up to 7 years online. As time goes on and changes to a file slow down, its generations will slow as well. For example, following this policy for a document that eventually stops getting updated will result in a single generation of the file, the last update, kept for 7 years.

1 generation every day for a week
1 generation every week for a month
1 generation every month for a year
1 generation every year for 7 years

Local retention policy is married to online policy so unfortunately you can’t set local retention higher. But this option is still useful for quick restores that can be retrieved from local media without having to be pulled down from NetMass across the wire. The same compression and encryption applies to backup sets you store on locally-attached media. Server storage or a dense USB drive would work fine for this.

The next step sets up options in the backup set including taking an initial backup to local media if your online backup would otherwise take days. Once your initial backups are complete, NetMass will either come get the drive from you or you can send it to them so the data can be put directly in the array. After the initial backup the mode switches to differential so much less data travels the internet.

Notification options are plentiful but your inbox can become overwhelmed easily with daily status messages. Scheduling options are also plentiful allowing granularity for as many schedules as you care to create.

As a final step, you can go ahead and make the new backup active by designating it as a regular set type, or you can make it statistical. Statistical set type will allow you to do a test run of the backup and estimate how much online storage that job will consume.

Restores

The restore process is very clean and can be executed on any backup set that has data online. Once you launch the wizard you can see the directories and files associated with a particular backup set. This is also one way to look at what and how much you have stored online. Clicking “file info” on any selected file shows you how many generations are stored online and the size of each. You can also look at only the files that were modified in any folder. The last step is deciding whether to restore files to their original location or an alternate.

The other way to look at what you’re storing online is to open the Online File Summary under Reports. This tells you almost everything you need to know about your online data and can chart certain filters as well. This is one area that could be made a little better I think. Too much digging is required to find out exactly what you have online with how many generations. If Asigra could tie this to the backup set information better, in the same context, I think it would be much more user friendly overall.

Backup sets can be suspended or deleted outright but you can get much more granular with selective backups to remove any online generations of individual files. Overall I am very impressed with the ServerSafe offering from NetMasss and think it is a great next gen offsite backup solution. I’m currently running my trial DS-Client on an old P4 PC running XP Pro and the jobs are completing with no problem. I have roughly 100GB worth of data being protected now. While a large company may not find much value paying NetMass to store their backup data, they could implement the Asigra DS solution and create an e-vaulting architecture of their own, in-house. We all hate tapes and this is a solid alternative. The trial of ServerSafe is a snap and can seamlessly transition into a production state as soon as you say you’re ready. NetMass is all about low pressure and let’s you become acclimated at your own pace. I look forward to see what’s new in the next major release of the DS-Client.