Component requirements

IBM Spectrum Protect Plus server requirements

IBM Spectrum Protect Plus as a virtual appliance requirements

IBM Spectrum Protect Plus is installed on a VMware or Microsoft Hyper-V virtual appliance. The virtual appliance contains the application and the inventory. Maintenance tasks are completed in vSphere Client or Hyper-V Manager by using the IBM Spectrum Protect Plus command line, or in the web-based administrative console.

Maintenance tasks are completed by a system administrator. A system administrator is usually a senior-level user who designed or implemented the vSphere and Elastic Sky X (ESX) or Hyper-V infrastructure, or a user with an understanding of IBM Spectrum Protect Plus, VMware, and Linux® command-line usage.

Infrastructure updates are managed by IBM® update facilities. The IBM Spectrum Protect Plus user interface serves as the primary means for updating IBM Spectrum Protect Plus features and underlying infrastructure components, including the operating system and file system.

Virtual appliance configuration

Virtual appliance hardware

IBM Spectrum Protect Plus as a set of containers requirements

IBM Spectrum Protect Plus can be installed on a Red Hat® OpenShift® cluster environment. The installation process uses the IBM Spectrum Protect Plus operator, which deploys and manages all the IBM Spectrum Protect Plus components on Red Hat OpenShift.

The IBM Spectrum Protect Plus operator is a Docker image that uses Ansible® Operator technology. The image contains the Kubernetes configuration files that are required to deploy and upgrade IBM Spectrum Protect Plus.

If you plan to install IBM Spectrum Protect Plus in an environment that has IBM Cloud Pak® for Multicloud Management 2.2 installed, you must use the IBM Spectrum Protect Plus operator for IBM Cloud Pak for Multicloud Management. This operator also works on environments that do not have the IBM Cloud Pak for Multicloud Management installed.

Container configuration

You must run all commands on the Linux® operating system.

For an example of system configuration, see the Figure 1.

Container hardware

Persistent storage: In order for IBM Spectrum Protect Plus to run on an OpenShift cluster, persistent storage is required. The IBM Spectrum Protect Plus operator submits requests for storage by using persistent volume claims (PVCs). The OpenShift cluster completes these requests by using an existing storage driver. A storage class must be configured to allow IBM Spectrum Protect Plus to create persistent volumes dynamically. The following table list the minimum storage capacity for the persistent volumes (PVs):

Networking: An ingress controller on OpenShift handles external communications for IBM Spectrum Protect Plus. The IBM Spectrum Protect Plus operator deploys the ingress controller, which decrypts the encrypted traffic and directs it to the proxy container. The proxy container then routes the request internally to the proper service. Each IBM Spectrum Protect Plus container uses a corresponding Kubernetes service to communicate internally with other containers.

Timeouts: By default, the ingress timeout is set to 900 seconds. This value can be updated by using the haproxy.router.openshift.io/timeout annotation of the ingress resource definition. Proxy timeouts can also be updated from the spp-proxy-config ConfigMap. The default value for the proxy timeout is set to 600 seconds. On any external load balancers that are being used, also set the timeout values to at least 900 seconds. For example, for an OpenShift cluster on Amazon Web Services (AWS), change the default value for the idle timeout setting of the Elastic Load Balancing (ELB) service from 60 seconds to 900 seconds.

CPU and memory resources: The following table lists the minimum CPU and memory resources that are required for each IBM Spectrum Protect Plus container:

IBM Spectrum Protect Plus server additional requirements

The Connectivity requirements must be met.

Use a Network Time Protocol (NTP) server to synchronize the time zone across IBM Spectrum Protect Plus resources in your environment, such as the IBM Spectrum Protect Plus server, storage arrays, hypervisors, and application servers. If the clocks on the various systems are significantly out of sync, you might experience errors during application registration, metadata cataloging, inventory operations, backup jobs, or file restore jobs. For more information about identifying and resolving timer drift, see the following VMware knowledge base article: Time in virtual machine drifts due to hardware timer drift

IBM Spectrum Protect Plus server browser support

IBM Spectrum Protect Plus was tested and validated with the following web browsers:

• Firefox 55.0.3 and later
• Google Chrome 60.0.3112 and later
• Microsoft Edge 40.15063 and later
• Microsoft EdgeHTML 15.15063 and later

If your screen resolution is lower than 1024 x 768, some items might not fit in the window. Enable pop-up windows in your browser to access the help system and some IBM Spectrum Protect Plus operations.

IBM Spectrum Protect Plus server ports

IBM Spectrum Protect Plus and associated services use the following ports.

IBM Spectrum Protect communication paths diagram

The following diagram is an overview of the communication paths that are managed by IBM Spectrum Protect Plus. This diagram is intended to provide a high level representation of components and their associated ports. This diagram can provide assistance for troubleshooting and network configuration for deployment scenarios. The diagram may not contain all communication paths. For a list of initiator and receiver ports, see the component communication port tables.

• The labeled resources on the gray background represent the core services of the IBM Spectrum Protect Plus virtual appliance.
• The colors of the various modules represent different types of services as defined by the key.
• The area that is labeled Firewall represents the network firewall.
• Services that appear in the Firewall area are indicative of the ports that are open on the firewall.
• Dashed arrows represent communication among resources and services.
• Arrows flow toward the listening port.

• The port numbers that must be open are indicated by the listening port.

  For example:

  • The vSnap service is represented as being external to the IBM Spectrum Protect Plus virtual appliance. The vSnap service is listening on port 8900 and other ports.
  • A component in the virtual appliance establishes a communication path with a connection to the vSnap service at port 8900.

vSnap server requirements

A vSnap server is the primary backup destination for IBM Spectrum Protect Plus.

vSnap server configuration

• vSnap server VM installation

  Before you deploy the vSnap server to the host, ensure that one of the following requirements is met:
• • vSphere 6.0, including all updates and patch levels
  • vSphere 6.5, including all updates and patch levels
  • vSphere 6.7, including all updates and patch levels (beginning with IBM Spectrum Protect V10.1.2)
  • vSphere 7.0, including all updates and patch levels (beginning with IBM Spectrum Protect V10.1.6)
  • Microsoft Hyper-V 2016
  • Microsoft Hyper-V 2019 (beginning with IBM Spectrum Protect Plus V10.1.3)

• vSnap server physical installation

  Beginning with V10.1.3, IBM Spectrum Protect Plus provides new functions that require the kernel levels that are supported in Red Hat Enterprise (RHEL) 7.5 and CentOS 7.5. If you must use operating systems earlier than RHEL 7.5 and CentOS 7.5, use IBM Spectrum Protect Plus V10.1.2 for physical vSnap installations.
• The following Linux operating systems are supported for IBM Spectrum Protect Plus physical vSnap server installations:
  • CentOS 7.1804 (7.5) (x86_64) (beginning with IBM Spectrum Protect V10.1.2)
  • CentOS 7.1810 (7.6) (x86_64) (beginning with IBM Spectrum Protect V10.1.3 patch 1)
  • CentOS 7.1908 (7.7) (x86_64) (beginning with IBM Spectrum Protect V10.1.5 patch 1)
  • CentOS 7.2003 (7.8) (x86_64) (beginning with IBM Spectrum Protect V10.1.7)
  • RHEL 7.5 (x86_64) (beginning with IBM Spectrum Protect V10.1.2)
  • RHEL 7.6 (x86_64) (beginning with IBM Spectrum Protect V10.1.3 patch1)
  • RHEL 7.7 (x86_64) (beginning with IBM Spectrum Protect V10.1.5 patch1)
  • RHEL 7.8 (x86_64) (beginning with IBM Spectrum Protect V10.1.7)
  If you are using the following operating systems, use IBM Spectrum Protect Plus for physical vSnap server V10.1.2 installations:
  • CentOS 7.3.1611 (x86_64)
  • CentOS 7.4.1708 (x86_64)
  • RHEL 7.3 (x86_64)
  • RHEL 7.4 (x86_64)

vSnap server hardware

The listed requirements are the minimum requirements for installation. Depending on the capacity and configuration of the storage pool, additional resources might be required. For more information about how to size and build an IBM Spectrum Protect Plus solution, see the IBM Spectrum Protect Plus Blueprints

For initial deployment, ensure that your VM or physical Linux server meets the following minimum requirements:

• 64-bit 8-core server
• 32 GB memory
• 16 GB free space on the root file system
• 128 GB free space in a separate file system mounted at /opt/vsnap-data

vSnap server additional requirements

The Connectivity requirements must be met.

vSnap server ports

The following ports are used by vSnap servers.

Important security information: Process requests to vSnap data ports (NFS, SMB, and iSCSI) only when the request comes from a node in the internal network. Requests that come from external (non-private) network nodes must be blocked. To ensure that proper security practices are followed, work with your network security administrator.

VADP proxy requirements

In IBM Spectrum Protect Plus, running VM backup jobs through VADP requires significant system resources. By creating VADP backup job proxies, you enable load sharing and load balancing for IBM Spectrum Protect Plus backup jobs. If proxies exist, the entire processing load is shifted from the IBM Spectrum Protect Plus server onto the proxies.

VADP proxy configuration

This feature is supported only in 64-bit quad core or higher configurations with a minimum kernel version of v2.6.32 in the following Linux environments:

• CentOS 6.5 and later maintenance and modification levels (beginning with IBM Spectrum Protect Plus V10.1.1 patch 1)
• CentOS 7.0 and later maintenance and modification levels (beginning with IBM Spectrum Protect Plus V10.1.1 patch 1)
• RHEL 6.4 and later maintenance and modification levels (beginning with IBM Spectrum Protect Plus V10.1.1)
• RHEL 7 and later maintenance and modification levels (beginning with IBM Spectrum Protect Plus V10.1.1)
• SUSE Linux Enterprise Server (SLES) 12 and later maintenance and modification levels (beginning with IBM Spectrum Protect Plus V10.1.1)
• SLES 15 and later maintenance and modification levels (beginning with IBM Spectrum Protect Plus V10.1.7)

For more information about how to build an IBM Spectrum Protect Plus solution, see the IBM Spectrum Protect Plus Blueprints

VADP proxy hardware

For initial deployment of a VADP proxy server, ensure that your Linux server meets the following minimum requirements:

• 64-bit quad core processor
• 8 GB of random access memory (RAM) required, 16 GB preferred
• 60 GB of free disk space

Because of increased processor usage and concurrency on the VADP proxy server, the memory that is allocated on the proxy server must be increased.

VADP proxy additional requirements

The Connectivity requirements must be met.

To create VADP proxies, you must have a user ID with the SYSADMIN role assigned. For more information about roles, see Managing roles.

VADP proxies support the following VMware transport modes: File, SAN, HotAdd, NBDSSL, and NBD. For more information about VMware transport modes, see Virtual Disk Transport Methods

VADP proxy ports

The following ports are used by VADP proxies.

Port updates:

• Port 8761: In earlier releases, this port was used to automatically discover VADP proxies and for IBM Spectrum Protect Plus VM backup operations. Beginning with IBM Spectrum Protect Plus V10.1.6, the VADP proxy architecture is modified and port 8761 is no longer required to be open. When IBM Spectrum Protect Plus is updated to V10.1.6 or later, the associated VADP proxies in the environment are also updated.
• Port 5671: In earlier versions, this port was used for internal and external message and log management. Beginning with IBM Spectrum Protect Plus V10.1.7, the VADP proxy architecture is modified and port 5671 is no longer required to be open.

If the firewall command script is not available on your system, edit the firewall manually to open or close the necessary ports, and restart the firewall. For instructions about editing firewall ports, see Editing firewall ports.

VADP proxy on vSnap server

VADP proxies can be installed on the vSnap servers in your IBM Spectrum Protect Plus environment. A combination VADP proxy and vSnap server must meet the minimum requirements of both devices. Consider the system requirements of both devices and add the core and RAM requirements together to identify the minimum requirements of the combination VADP proxy and vSnap server.

For a VADP proxy installed on a virtual vSnap server, the following requirements must be met:

• 64-bit 8-core processor
• 48 GB RAM

All required VADP proxy ports and vSnap server ports must be open on the combination VADP proxy and vSnap server.

Connectivity requirements

Repository server storage requirements

If you plan to use IBM Spectrum Protect as a repository server for copying data to cloud storage, ensure that you are using IBM Spectrum Protect V8.1.11.

Cloud storage requirements

Disk cache area

For all functions related to data copy and restore operations to and from cloud and archival targets, the vSnap server requires a disk cache area to be present on the vSnap server:

• During copy operations, this cache is used as a temporary staging area for objects that are pending upload to the cloud endpoint.
• During restore operations, the disk cache area is used to cache downloaded objects and to store any temporary data that might be written into the restore volume.

For instructions about sizing and installing the cache, see the IBM Spectrum Protect Plus Blueprints.

Multipath

During copy operations to object storage, IBM Spectrum Protect attaches and detaches virtual cloud devices on vSnap servers. If a mutipath configuration is enabled on the vSnap server by using dm-multipath, the configuration can interfere with the copy operation. To avoid this interference, the virtual cloud devices must be excluded from the multipath configuration. Add the following lines under the blacklist section of the multipath configuration file /etc/multipath.conf:

After you make this change, reload the multipath configuration by using the following command:

Certificates

• Self-signed certificates

  If the cloud endpoint or repository server uses a self-signed certificate, you must specify the certificate in Privacy Enhanced Mail (PEM) format when you register the cloud or repository server in the IBM Spectrum Protect user interface.

• Certificates signed by a private certificate authority

  If the cloud endpoint or repository server uses a certificate signed by a private certificate authority (CA), the endpoint certificate must be specified (in PEM format) when you register the cloud or repository server in the IBM Spectrum Protect user interface.

  In addition, you must add the root or intermediate certificate of the private CA to the system certificate store in each vSnap server by using the following procedure:

  1. Log in to the vSnap server console as the serveradmin user and upload any private CA certificates (in PEM format) to a temporary location.
  2. Copy each certificate file to the system certificate store directory (/etc/pki/ca trust/source/anchors/) by running the following command: $ sudo cp /tmp/private-ca-cert.pem /etc/pki/ca-trust/source/anchors/
  3. To incorporate the newly added custom certificate and update the system certificate bundle, run the following command: $ sudo update-ca-trust

• Certificates signed by public certificate authority

  If the cloud endpoint uses a public CA-signed certificate, no special action is required. The vSnap server validates the certificate by using the default system certificate store.

• Wildcard certificates

  If the cloud endpoint uses a wildcard certificate, note that the wildcard applies only to one subdomain level of the domain name. For example, if the certificate is for *.example.com, the certificate will match hostname level1.example.com but will not match level1.level2.example.com. If the bucket name contains periods (for example, "my.bucket") and it is part of the hostname used for registering the cloud endpoint in IBM Spectrum Protect (for example, "my.bucket.example.com"), certificate validation can fail. In such cases, ensure that the bucket name does not contain periods.

  Network

  The following ports are used for communication between the vSnap servers and cloud or repository server endpoints.

  Table 8. Communication ports when the target is a cloud server or repository server endpoint

  Port	Protocol	Initiator	Target	Description
  443	TCP	vSnap server	Cloud server endpoints	Allows the vSnap server to communicate with Amazon Simple Storage Service (S3), Microsoft Azure, or IBM Cloud Object Storage endpoints.
  9000	TCP	vSnap server	Repository server endpoints	Allows the vSnap server to communicate with IBM Spectrum Protect (repository server) endpoints.

Any firewalls or network proxies that inspect SSL or conduct a deep packet inspection of traffic between the vSnap servers and cloud endpoints might interfere with SSL certificate validation on vSnap servers. This interference can also cause cloud copy job failures. To prevent this interference, the vSnap servers must be exempted from SSL interception and inspection in the firewall or proxy configuration.

Cloud provider

Native lifecycle management is not supported. IBM Spectrum Protect manages the lifecycle of uploaded objects automatically by using an incremental-forever approach where older objects can still be used by newer snapshots. Automatic or manual expiration of objects outside of IBM Spectrum Protect leads to data corruption.

If the cloud provider uses an SSL certificate that is self-signed or signed by a private certificate authority, see Connectivity requirements.