Support matrix
Before you set up Phoenix, you must ensure that the virtual machines or the servers that you plan to use, meet the system requirements.
This article gives you information about:
- Browser support
- Software requirements
- Hardware requirements
- Network requirements
- Security considerations
Browser support
The following table lists the supported browsers for accessing the Phoenix Management Console.
| Browser | Minimum requirements |
|---|---|
|
Web browser |
|
Software requirements
The following sections provide the software requirements for Phoenix to back up data residing on servers.
Software requirements for files and folders
Ports and communication protocols for Phoenix
Phoenix communicates with your File servers to backup and restores the data from your File servers. This communication happens through ports and protocols that are secure for communication and transition of data.
Phoenix uses Transport Layer Security (TLS) protocol for establishing a connection and initiating communication between Phoenix components and your File servers.
The following diagram depicts the ports and communication protocols that are used by Phoenix for secure connection and communication during the backup and restore operations.
Software requirements for Hyper-V
Ports and communication protocols for Phoenix
Phoenix communicates with your hosts to backup and restore data on your hosts. Phoenix talks to your Hyper-V host through ports and protocols that are secure for communication and transition of data.
Phoenix uses Transport Layer Security (TLS) protocol for establishing the connection and initiating communication between Phoenix components and your Hyper-V hosts.
The following diagram depicts the ports and communication protocols that are used by Phoenix for secure connection and communication during the backup and restore operations.
Software requirements for MS SQL servers
Software requirements for NAS devices
Software requirements for NAS proxy
Ports and communication protocols for Phoenix
Phoenix communicates with your NAS shares to back up and restore the data. This occurs through ports and protocols that are secure for communication and transition of data. Phoenix uses Transport Layer Security (TLS) protocol to establish a connection and initiate communication between Phoenix components and your NAS device.
The following diagram depicts the ports and communication protocols that Phoenix uses for secure connection and communication during the backup and restore operations.
Software requirements for Oracle
System requirements for the Phoenix Backup Store
Ports and communication protocols for Phoenix
The Phoenix Backup Store takes incoming requests on port 9090. Since the RMAN communicates with the Phoenix Backup Store API to check the status, ensure that the port 9090 on the Phoenix Backup Store can take incoming requests over http.
In addition, ensure that the firewall allows RMAN to write to the backup mount on the Phoenix Backup Store. To check which ports you need to open on the RMAN host, run:
rpcinfo -p | grep nfs
Phoenix Cloud communicates with the Phoenix Backup Store to backup and restore data on it. To backup and restore data, the Phoenix Cloud communicates to the Phoenix Backup Store through ports and protocols that are secure for communication and transition of data.
Phoenix uses Transport Layer Security (TLS) protocol for establishing the connection and initiating communication between Phoenix components.
The following diagram depicts the ports and communication protocols that are used by Phoenix for secure connection and communication during the backup and restore operations.
Note: If a firewall is set up, allow outbound TCP/IP traffic to *.druva.com through port 443.
Software requirements for VMware
Ports and communication protocols for Phoenix
Phoenix communicates with your virtual infrastructure to backup and restore virtual machine data. This communication happens via ports and communication protocols that are secure for communication and transition of data.
Phoenix uses a combination of Transport Layer Security (TLS) and Secure Socket Layer (SSL) protocols for establishing a connection and initiating communication between Phoenix components and your virtual infrastructure components such as vCenter Server, ESXi hosts, and virtual machines.
The following diagram depicts the ports and communication protocols that are used by Phoenix for secure connection and communication during the backup and restore operations.
The following table describes the port and communication protocols used for communication between Phoenix and various VMware components.
|
Port/Communication Protocol |
Description |
|---|---|
|
443 |
Phoenix uses Port 443 to establish a secure connection and communication between the following:
|
|
902 |
Phoenix uses Port 902 to establish a connection between the backup proxy and ESXi host registered with Phoenix through vCenter Server. |
|
3389/22
|
During the backup cycle, the backup proxy sends network packets to Windows virtual machines (where VMware tools are installed) on port 3389 to identify if the RDP port is open or not. For Linux virtual machines, the port is 22, which is used for SSH. This is used for Phoenix DRaaS or DR restores. |
| 123 (UDP) | Backup proxy accesses NTP server on Port 123 (UDP) for time synchronization. |
|
TLS |
Phoenix uses TLS for a secure connection that happens between the following:
|
|
SSL |
Phoenix uses SSL for a secure connection that happens between the following:
|
Software requirements for Phoenix CloudCache
Ports and communication protocols for Phoenix
Phoenix CloudCache communicates with your servers and Phoenix Cloud to back up and restore the data. This communication happens through ports and protocols that are secure for communication and transition of data.
Phoenix CloudCache uses Transport Layer Security (TLS) protocol to establish a connection and initiate communication with Phoenix components.
The following diagram depicts the ports and communication protocols that are used by Phoenix CloudCache for secure connection and communication during the backup and restore operations.
Hardware requirements
The Phoenix agent installer, VMware backup proxy appliance, Hyper-V FLR proxy appliance, Phoenix Backup Store package, and the CloudCache installer are available at http://downloads.druva.com/phoenix/.
You can also download the installer at the time of registering servers.
Prerequisites for Phoenix agent
This section contains the prerequisites for the Phoenix agent. Applies to:
- Hyper-V virtual machines
- Files on a server
- NAS Shares
- MS-SQL servers
Hardware requirements for installing Phoenix agent
| Hardware | Minimum requirements |
|---|---|
|
CPU |
2 GHz dual-core (Intel Core series) 2.4 GHz (AMD) or equivalent |
| RAM | 4 GB |
|
Free space |
|
Hardware requirements for Hyper-V FLR proxy
Before you deploy and activate the FLR proxy, ensure that following system requirements on the Hyper-V host are met for the proxy:
- Memory: 2 GB
- vCPUs: 2
This is a recommended configuration for two restore jobs. If you want to run multiple restore jobs, increase the memory and number of vCPUs.
Disks, partitions, and files supported for File Level Restore (FLR) on Hyper-V hosts
-
Item Certified Disk Types
- Thin
- Thick
Partition Tables
- MBR
- GPT (Linux)
Partition Types
- Primary
- Extended
- LDM (Only Simple and Spanned Volumes with MBR)
- LVM (Simple/Spanned/Mirror/Striped)
File Systems
- NTFS
- FAT
- FAT32
- Ext2/3/4
- XFS
File Type
- Regular Files
- Sparse Files
- Hidden Files
Hardware requirements for NAS shares
Hardware requirements for VMware
This table lists the minimum requirements for deploying a backup proxy that is available as a virtual appliance.
Backup proxy requirements
Backup proxy is available as a virtual appliance. Deploying backup proxy creates a virtual machine with the configuration that is listed in this table. Ensure that your VMware setup can assign resources to support this requirement.
Parameter Default configuration vCPU 8 vCPU (2 virtual sockets with 4 cores per socket) RAM 6 GB Virtual disks 4 virtual disks (40 GB, 30 GB and 2 disks with 1 MB each). With the above default configuration, you can backup up to three virtual machines in parallel. For more information, see Sizing for backup proxy.
Hardware requirements for the Phoenix Backup Store
Hardware requirements for Phoenix CloudCacheNetwork requirements
Field Requirement Network Traffic rules
Phoenix agent:
Phoenix agents connect to Phoenix Cloud using port 443.
Phoenix CloudCache:
Phoenix CloudCache connects to Phoenix Cloud using port 443.
Phoenix agents connect to Phoenix CloudCache using port 443.
Phoenix Backup Store
Phoenix Backup Store connects to the Phoenix Cloud using port 443.
Firewall For all the agents and CloudCache: If the firewall is enabled, allow all outbound TCP/IP traffic to *.druva.com through port 443. Web proxy Druva supports the following proxy types: - http
- socks4
- socks5
For more information see:
Security considerations
One thing that is often overlooked when deploying a data protection solution is security. While Druva automatically handles the security of information in transit and at rest, there are other security mechanisms that organizations should consider for implementing beyond encryption when it comes to data protection. The following sections discuss the security considerations that organizations should take into account as they implement Phoenix for their data protection solution.
Roles and responsibilities
To prevent privileged users from making unauthorized changes to resources within their organization, Phoenix supports the Role Based Access Control (RBAC) for separation of duties. This capability allows organizations to limit privileged user access to a predefined set of roles and data assets. This RBAC capability makes it possible to create ethical walls to enforce privacy, as well as implement a delegated administration structure to meet customers’ organizational, compliance, or security requirements. To add RBAC in your Phoenix deployment, see Manage administrators.
Global regulatory compliance
As part of your data protection strategy, organizations need to take into account where they operate and what requirements they have on security and availability of the data. With Druva Phoenix, organizations can store data in any of twelve global regions depending on their security, compliance, data access, and availability requirements. While not only a compliance requirement, proximity to data can also help shrink the time it takes to recover in the event of a disaster.
Single sign-on
Phoenix supports SAML which allows organizations to centralized authentication for the administration of their Phoenix environment. This allows Phoenix administrators to leverage existing centralized authentication mechanisms like Okta, Ping Identity, or Active Directory which are already being used today. The use of Single sign-on (SSO) helps to guarantee the availability of access to Phoenix and eliminates local authentication stores which cause audit and compliance headaches as well as create a security risk. To integrate Phoenix with your SSO authentication mechanism, see Configure single sign-on for Phoenix.
Testing your recovery
As part of your data protection strategy, it is important to see if what you are backing up is actually getting backed up, whether part of a normal business continuity and disaster recovery process.
Conclusion
While protecting data in flight and at rest are important security capabilities of any enterprise-level data protection solution, there are definitely more issues to take into account, and more capabilities to take advantage of when it comes to protecting the overall data attack surface. For identifying and implementing more such security considerations for Phoenix, contact Druva Support.