Support matrix
Before you set up Phoenix, you must ensure that the virtual machines or the servers that you plan to use, meet the system requirements.
This article gives you information about:
- Browser support
- Software requirements
- Hardware requirements
- Network requirements
- Security considerations
- Supported storage regions of Phoenix
Browser support
The following table lists the supported browsers for accessing the Phoenix Management Console.
| Browser | Minimum requirements |
|---|---|
|
Web browser |
|
Software requirements
The following sections provide the software requirements for Phoenix to back up data residing on servers.
Software requirements for files and folders
Ports and communication protocols for Phoenix
Phoenix communicates with your File servers to backup and restores the data from your File servers. This communication happens through ports and protocols that are secure for communication and transition of data.
Phoenix uses Transport Layer Security (TLS) protocol for establishing a connection and initiating communication between Phoenix components and your File servers.
The following diagram depicts the ports and communication protocols that are used by Phoenix for secure connection and communication during the backup and restore operations.
Software requirements for Hyper-V
Ports and communication protocols for Phoenix
Phoenix communicates with your hosts to backup and restore data on your hosts. Phoenix talks to your Hyper-V host through ports and protocols that are secure for communication and transition of data.
Phoenix uses Transport Layer Security (TLS) protocol for establishing the connection and initiating communication between Phoenix components and your Hyper-V hosts.
The following diagram depicts the ports and communication protocols that are used by Phoenix for secure connection and communication during the backup and restore operations.
Software requirements for MS SQL servers
Certified platforms
Prerequisites
- Phoenix agent interacts with Volume Shadow Copy Service (VSS) to back up your data. To ensure successful backups from your servers, make sure that the Volume Shadow Copy Service is not disabled.
- Druva recommends that you use the Microsoft’s native VSS provider. If you are using a third-party VSS provider, you must configure Phoenix agents to recognize this provider.
- Ensure that the SQL Writer Service on your MS-SQL servers is running.
- Ensure that the disk space on the drive where your shadow copy storage is located is adequate for the cumulative size of your databases. To know how you can configure VSS to write shadow copies to a separate drive, see Set VSS to write shadow copies to a separate NTFS volume.
- Ensure that you enabled Windows authentication for your SQL servers. For more information, see Change Server Authentication Mode.
- Ensure that the Local System account has permissions listed in the following table:
Permission Description Sysadmin Required for SQL server backup and restores. - If you are running an agent with version 4.6.5 or earlier, set the SQLCMD system variable path to reflect the path to the SQLCMD utility directory. If this variable is not set correctly, backups and restores to and from your MS-SQL server will fail.
- If you want to perform log backups for the database, ensure that you set the databases to FULL RECOVERY mode. For more information about modifying recovery mode, refer to View or Change the Recovery Model of a Database.
- Phoenix supports backup of availability group databases in MS-SQL Server 2012 onward since Microsoft introduced availability group in SQL 2012.
- Ensure that you install Phoenix agent on all primary and secondary nodes in the availability group.
- Ensure that you enable the Readable secondary option for the secondary nodes for successful backups from that node.
- Ensure that all the nodes in an availability group must have the same Phoenix agent version installed on them.
- If you want the Phoenix agent to run under a domain user account:
- Ensure that the domain user is added under the local administrative group of the SQL server
- Ensure that Phoenix agent and SQL Server VSS writer service log on using the same domain user account. (By default both services log on using the local system account.)
- Ensure that Sysadmin right is assigned to the domain user in the SQL server.
Software requirements for NAS devices
Software requirements for NAS proxy
Ports and communication protocols for Phoenix
Phoenix communicates with your NAS shares to back up and restore the data. This occurs through ports and protocols that are secure for communication and transition of data. Phoenix uses Transport Layer Security (TLS) protocol to establish a connection and initiate communication between Phoenix components and your NAS device.
The following diagram depicts the ports and communication protocols that Phoenix uses for secure connection and communication during the backup and restore operations.
Software requirements for Oracle
System requirements for the Phoenix Backup Store
Ports and communication protocols for Phoenix
The Phoenix Backup Store takes incoming requests on port 9090. Since the RMAN communicates with the Phoenix Backup Store API to check the status, ensure that the port 9090 on the Phoenix Backup Store can take incoming requests over http.
In addition, ensure that the firewall allows RMAN to write to the backup mount on the Phoenix Backup Store. To check which ports you need to open on the RMAN host, run:
rpcinfo -p | grep nfs
Phoenix Cloud communicates with the Phoenix Backup Store to backup and restore data on it. To backup and restore data, the Phoenix Cloud communicates to the Phoenix Backup Store through ports and protocols that are secure for communication and transition of data.
Phoenix uses Transport Layer Security (TLS) protocol for establishing the connection and initiating communication between Phoenix components.
The following diagram depicts the ports and communication protocols that are used by Phoenix for secure connection and communication during the backup and restore operations.
Note: If a firewall is set up, allow outbound TCP/IP traffic to *.druva.com through port 443.
Software requirements for VMware
Software requirements for AWS Resources
Ports and communication protocols for Phoenix
Phoenix communicates with your virtual infrastructure to backup and restore virtual machine data. This communication happens via ports and communication protocols that are secure for communication and transition of data.
Phoenix uses a combination of Transport Layer Security (TLS) and Secure Socket Layer (SSL) protocols for establishing a connection and initiating communication between Phoenix components and your virtual infrastructure components such as vCenter Server, ESXi hosts, and virtual machines.
The following diagram depicts the ports and communication protocols that are used by Phoenix for secure connection and communication during the backup and restore operations.
The following table describes the port and communication protocols used for communication between Phoenix and various VMware components.
|
Port |
Communication Protocol |
Description |
|---|---|---|
|
443 |
HTTPS+SSL |
Phoenix uses Port 443 to establish a secure connection and communication between the following:
|
|
902 |
TCP/UDP |
Phoenix uses port 902 to establish a connection between the backup proxy and ESXi host registered with Phoenix through vCenter Server. |
| 3542 | HTTPS+SSL | For application-aware backups, the backup proxy uses VMware Tools to inject two executables and a few supporting files such as certificates into the guest OS of the virtual machine. When the executables run, they start guest OS processes called guestossvc and PhoenixSQLGuestPlugin. The backup proxy uses the opened port 3542 on the guest OS so that it can communicate with guestossvc to run SQL Server backups. Ensure that this port is open on the guest OS. The backup proxy also uses this port to restore databases to the virtual machine. |
| 3545 | HTTPS+SSL | For application-aware backups, the SQL executable service PhoenixSQLGuestPlugin queries the Microsoft VSS APIs to back up and restore SQL Server databases. The guestossvc service interacts with the PhoenixSQLGuestPlugin service using this port. The PhoenixSQLGuestPlugin service cannot directly communicate with the backup proxy. |
|
3389/22
|
TCP/UDP |
During the backup cycle, the backup proxy sends network packets to Windows virtual machines (where VMware tools are installed) on port 3389 to identify if the RDP port is open or not. For Linux virtual machines, the port is 22, which is used for SSH. This is used for Phoenix DRaaS or DR restores. |
| 123 | UDP | Backup proxy accesses NTP server on Port 123 (UDP) for time synchronization. |
|
443 |
HTTPS+SSL |
Phoenix uses SSL for a secure connection that happens between the following:
|
|
443 |
HTTPS+TLS |
Phoenix uses TLS for a secure connection that happens between the following:
|
Software requirements for Phoenix CloudCache
Ports and communication protocols for Phoenix
Phoenix CloudCache communicates with your servers and Phoenix Cloud to back up and restore the data. This communication happens through ports and protocols that are secure for communication and transition of data.
Phoenix CloudCache uses Transport Layer Security (TLS) protocol to establish a connection and initiate communication with Phoenix components.
The following diagram depicts the ports and communication protocols that are used by Phoenix CloudCache for secure connection and communication during the backup and restore operations.
Hardware requirements
The Phoenix agent installer, VMware backup proxy appliance, Hyper-V FLR proxy appliance, Phoenix Backup Store package, and the CloudCache installer are available at http://downloads.druva.com/phoenix/.
You can also download the installer at the time of registering servers.
Prerequisites for Phoenix agent
This section contains the prerequisites for the Phoenix agent. This configuration is applicable for one backup or restore job at a time. Applies to:
- Hyper-V virtual machines
- Files on a server
- MS-SQL servers
Hardware requirements for installing Phoenix agent
| Hardware | Minimum requirements |
|---|---|
|
CPU |
|
| RAM | 3 GB |
|
Free space |
|
Hardware requirements for Hyper-V FLR proxy
Before you deploy and activate the FLR proxy, ensure that following system requirements on the Hyper-V host are met for the proxy:
- Memory: 2 GB
- vCPUs: 2
This is a recommended configuration for two restore jobs. If you want to run multiple restore jobs, increase the memory and number of vCPUs.
Disks, partitions, and files supported for File Level Restore (FLR) on Hyper-V hosts
-
Item Certified Disk Types
- Thin
- Thick
Partition Tables
- MBR
- GPT (Linux)
Partition Types
- Primary
- Extended
- LDM (Only Simple and Spanned Volumes with MBR)
- LVM (Simple/Spanned/Mirror/Striped)
File Systems
- NTFS
- FAT
- FAT32
- Ext2/3/4
- XFS
File Type
- Regular Files
- Sparse Files
- Hidden Files
Hardware requirements for NAS shares
Hardware requirements for VMware
This table lists the minimum requirements for deploying a backup proxy that is available as a virtual appliance.
Backup proxy requirements
Backup proxy is available as a virtual appliance. Deploying backup proxy creates a virtual machine with the configuration that is listed in this table. Ensure that your VMware setup can assign resources to support this requirement.
Parameter Default configuration vCPU 8 vCPU (2 virtual sockets with 4 cores per socket) RAM 6 GB Virtual disks 4 virtual disks (40 GB, 30 GB and 2 disks with 1 MB each). With the above default configuration, you can backup up to three virtual machines in parallel. For more information, see Sizing for backup proxy.
Hardware requirements for the Phoenix Backup Store
Hardware requirements for Phoenix CloudCacheNetwork requirements
Field Requirement Network Traffic rules
Phoenix agent:
Phoenix agents connect to Phoenix Cloud using port 443.
Phoenix CloudCache:
Phoenix CloudCache connects to Phoenix Cloud using port 443.
Phoenix agents connect to Phoenix CloudCache using port 443.
Phoenix Backup Store
Phoenix Backup Store connects to the Phoenix Cloud using port 443.
Firewall For all the agents and CloudCache: If the firewall is enabled, allow all outbound TCP/IP traffic to *.druva.com through port 443. Web proxy Druva supports the following proxy types: - http
- socks4
- socks5
For more information see:
-
Security considerations
One thing that is often overlooked when deploying a data protection solution is security. While Druva automatically handles the security of information in transit and at rest, there are other security mechanisms that organizations should consider for implementing beyond encryption when it comes to data protection. The following sections discuss the security considerations that organizations should take into account as they implement Phoenix for their data protection solution.
Roles and responsibilities
To prevent privileged users from making unauthorized changes to resources within their organization, Phoenix supports the Role Based Access Control (RBAC) for separation of duties. This capability allows organizations to limit privileged user access to a predefined set of roles and data assets. This RBAC capability makes it possible to create ethical walls to enforce privacy, as well as implement a delegated administration structure to meet customers’ organizational, compliance, or security requirements. To add RBAC in your Phoenix deployment, see Manage administrators.
Global regulatory compliance
As part of your data protection strategy, organizations need to take into account where they operate and what requirements they have on security and availability of the data. With Druva Phoenix, organizations can store data in any of twelve global regions depending on their security, compliance, data access, and availability requirements. While not only a compliance requirement, proximity to data can also help shrink the time it takes to recover in the event of a disaster.
Single sign-on
Phoenix supports SAML which allows organizations to centralized authentication for the administration of their Phoenix environment. This allows Phoenix administrators to leverage existing centralized authentication mechanisms like Okta, Ping Identity, or Active Directory which are already being used today. The use of Single sign-on (SSO) helps to guarantee the availability of access to Phoenix and eliminates local authentication stores which cause audit and compliance headaches as well as create a security risk. To integrate Phoenix with your SSO authentication mechanism, see Configure single sign-on for Phoenix.
Testing your recovery
As part of your data protection strategy, it is important to see if what you are backing up is actually getting backed up, whether part of a normal business continuity and disaster recovery process.
Conclusion
While protecting data in flight and at rest are important security capabilities of any enterprise-level data protection solution, there are definitely more issues to take into account, and more capabilities to take advantage of when it comes to protecting the overall data attack surface. For identifying and implementing more such security considerations for Phoenix, contact Druva Support.
Supported storage regions
The supported storage regions for Phoenix Cloud and Phoenix GovCloud are mentioned on the Cloud Status page of the Druva Support Portal.
You can hover over the relevant donut chart on the Cloud Status page or click VIEW DETAILS to see the information.