EMC Avamar For vCloud Director

Environments Backup and Recovery Services for Multi-Tenant

Private, Public and Hybrid Clouds

ABSTRACT This white paper describes features introduced in EMC® Avamar® to extend VMware

vCloud® Director’s service delivery and Virtual Data Center capabilities to include

BaaS.

April, 2014

EMC WHITE PAPER

Copyright © 2014 EMC Corporation. All Rights Reserved.

EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without

notice.

The information in this publication is provided “as is.” EMC Corporation makes no representations or warranties of any kind with

respect to the information in this publication, and specifically disclaims implied warranties of merchantability or fitness for a

particular purpose.

Use, copying, and distribution of any EMC software described in this publication requires an applicable software license.

For the most up-to-date listing of EMC product names, see EMC Corporation Trademarks on EMC.com.

VMware, vSphere, vCenter, and vCloud Director are registered trademarks or trademarks of VMware, Inc. in the United States

and/or other jurisdictions. All other trademarks used herein are the property of their respective owners.

Part Number H12940

TABLE OF CONTENTS

EXECUTIVE SUMMARY 4

Business Case 4

Solution Overview 4

Key Results 4

Audience 5

INTRODUCTION 5

EMC AVAMAR OVERVIEW 5

Avamar: Industry Leading Backup for VMware 5

EMC AVAMAR FOR VCLOUD DIRECTOR WORKFLOW OVERVIEW 6

VMware vCloud Roles 6

Backup Resource Mapping and Assignment 7

Backup Policy Configuration and Assignment 8

Extending the vCloud Director REST APIs 9

CONCLUSION 9

4

EXECUTIVE SUMMARY

BUSINESS CASE

Service Providers (SPs) face the challenge of providing easy to use backup solutions that integrate seamlessly with their hosted

VMware vCloud Director (vCD) environments. Providing a simple portal-based graphical solution, which allows their technical and

non-technical vCD customers to easily backup and restore virtual applications is critical to the successful adoption of this type of

offering. In addition, any portal-based Backup as a Service (BaaS) solution of this type must integrate into Service Provider

orchestration, management, and portal infrastructures. In addition it must integrate into tenant portal infrastructures to enable a

seamless Hybrid Cloud.

Existing dedicated, standalone, disk-based or tape-based backup offerings don’t provide the ease of use or deep integration with vCD

that Service Providers require. Therefore, these solutions do not enable providers to offer differing levels of backup as a service to

their customers.

This enhanced capability being introduced in the Avamar 7.1 release accommodates service providers with the ability to offer backup

services to all of their customers, regardless of their technical abilities or usage model.

SOLUTION OVERVIEW

This white paper describes a scalable solution to augment VMware vCloud

Director environments with backup resources, including the backup components

involved, as well as the associated portal and orchestration integration

capabilities.

This solution can be used to provide backup services for public or private cloud-

based VMware vCloud Director environments.

This white paper validates the integration of the solution’s components and

provides broad guidelines about how this type of solution can be built and

integrated into the service provider’s environment.

Key solution components include:

EMC Avamar® 7.1 — to provide centralized and scalable backup environment with deduplication and replication capabilities.

VMware vCloud™ Director™—to orchestrate the provisioning of Software-Defined Data Center services as complete Virtual Data

Centers that are ready for consumption in a matter of minutes.

KEY RESULTS

Backup as a Service enables service providers to fundamentally change the way in which they provide backup services for customers

who have purchased their hosted vCloud Director environments. By leveraging industry leading backup and recovery resources that

have been enhanced to integrate and augment into native ITaaS infrastructures such as VMware’s vCloud, service providers can

provide robust and uniform data protection capabilities and bring a truly differentiated service offering in the marketplace. The

delivery of Avamar backup services for VMware in the Public Cloud is truly an enabling technology for Enterprise Cloud.

This solution demonstrates that BaaS:

Can provide a simple ‘one-click’ backup experience

Can be leveraged through direct or channel sales

Improves flexibility and simplifies application deployment

Enables users to focus on revenue generating activities and other projects instead of equipment logistics

Figure 1: Avamar vCD services

5

Audience

This white paper is intended for EMC employees, partners, and customers including IT planners, system architects and

administrators, and any others involved in evaluating, acquiring, managing, operating, or designing a BaaS infrastructure

environment leveraging EMC technologies. Throughout this white paper we assume that you have some familiarity with the concepts

and operations related to backup and virtualization technologies, and their use in cloud and data center infrastructures.

INTRODUCTION Service providers can offer BaaS to customers who need a flexible, on-demand backup infrastructure, but prefer not to purchase,

configure, or maintain it by themselves. In other cases, customers may have on premise backup resources in their private cloud, yet

are looking for backup and recovery capabilities for public cloud resources they are consuming to augment on premise infrastructure.

The features introduced in our latest release of Avamar, which our outlined here, focuses on demonstrating how a service provider

can easily leverage Avamar to provide integrated and easy-to-consume backup and recovery resources in their vCloud Director

services catalog.

Fundamentally, as with any BaaS offering, this solution enables customers to consume data protection services in much the same

manner as they consume compute, memory and storage resources today in vCD. The key is that users consume and pay for these

resources without needing to understand or maintain the component devices and infrastructure required to provide the service.

Furthermore, customers can draw on the elastic resources that cloud infrastructure delivers and pay only for the backup service they

consume.

The BaaS environment typically consists of:

Hosted vCloud Director environments

Self-service portal

Secure multi-tenant-enabled shared infrastructure

EMC AVAMAR OVERVIEW Developed to solve the challenges associated with traditional backup, EMC Avamar deduplication backup software and system,

equipped with integrated global, client-side data deduplication technology, provide fast, next-generation daily full backups for virtual

environments, NAS systems, desktops/laptops, remote offices and business critical applications. EMC Avamar reduces the size of

backup data at the client—before it is transferred

across the network and ultimately stored. Unlike

traditional backup, Avamar delivers fast, daily full

backups via existing IP networks, and makes recovery

fast and easy with single-step restore.

Avamar also deduplicates backup data globally across

applications and sites worldwide to reduce the total

required backup storage by up to 30x. As a result,

Avamar provides the benefits of efficient long-term

retention on disk while dramatically lowering capital

and operating expenses including floor space, power,

and cooling.

Avamar backups can be quickly recovered in just one

step—eliminating the hassle of restoring the last good

full and subsequent incremental backups to reach the

desired recovery point.

Avamar software, similar to the other components in

the Data Protection Suite, is integrated for multi-streaming backups to EMC Data Domain deduplication storage systems for efficient

and highly scalable backup of specific data types and applications, simplifying management and maximizing existing IT investments.

Avamar: Industry Leading Backup for VMware

Figure 2: Avamar deduplication moves less data

6

EMC® Avamar® provides variable-length client-side deduplication to accelerate the

virtualization journey by providing extremely fast and efficient backup and recovery

for the VMware environment. Avamar protects virtual machines (VMs) by

deduplicating data at the client—so that only new, unique, sub-file, variable-length

data segments are sent during daily full backups. This dramatically reduces the daily

impact on the virtual and physical infrastructure by up to 99 percent as compared to

traditional full-backup methods. While traditional backup software moves upward of

200 percent of the primary backup data on a weekly basis, Avamar moves as little as

two percent over the same seven-day period—removing backup bottlenecks and

enabling even greater levels of virtualization. Avamar backs up data globally across

physical and virtual servers. For virtualized environments, flexible backup options

include guest- and image-level backups. Avamar is certified component of VCE®

VblockTM Systems and VSPEX® converged infrastructure platforms.

Avamar is tightly integrated to the vStorage APIs for Data Protection (VADP) for agentless backups. Deduplication and backup

executes on a multi-threaded universal proxy VM, off-loading the backup from any of the VMs where the applications are running.

Through vSphere, each VM is dynamically mounted to the proxy without physically moving data across the network, enabling

Avamar to back up numerous virtual machines in just minutes. To maximize backup throughput, Avamar uses a load balancing

algorithm across multiple proxy VMs. Instead of being locked into using only a single proxy for a set of VMs, Avamar leverages

numerous proxies and sends a backup job to an available proxy. Avamar also takes advantage of VMware’s Changed Block Tracking

(CBT) to further speed up the backup and restore processes. VMware presents only changed blocks to the Avamar software, where

each block is broken into variable length segments and further evaluated for uniqueness. Only the unique segments are sent for

backup, achieving the fastest backup possible. Conversely, the restore process also leverages CBT for faster recovery. Avamar

understands the current state of the VM and determines the required blocks from the last backup, restoring the VM in just minutes.

Avamar enables full VM or file-level restore to the original VM, an existing VM or a new VM—directly from the Avamar user interface.

Also available with image backups is disk-level granularity that enables Avamar to back up specific virtual disks, thus reducing

backup times and backup storage. Thin provisioned recovery speeds up the restore process and reduces required storage.

EMC AVAMAR FOR VCLOUD DIRECTOR WORKFLOW OVERVIEW The following sections of this white paper will walk end to end through a typical service provider ITaaS model and how backup

resource and policy creation, assignment, and consumption occurs within an Avamar powered vCloud Director protection solution.

VMware vCloud Roles

Before we dive into each process, let’s review the specific administrator roles involved in a typical vCD workflow:

Cloud Admin

The cloud administrator and team manage the infrastructure and overall management of providing consumable

services and provisioning those services for consumption by individual tenant orgs. In the case of an SP, each

tenant would be a distinctly different client consuming ITaaS resources offered by the SP. As we will discuss

further in the sections below, the cloud administration team will manage EMC Avamar systems as the foundation

of Backup Resources included in new or existing tenant service catalogs. This includes allocation of underlying backup repositories to

each vCD tenant, creating backup policy service-level templates, and enforcing resource usage quotas in those policies.

Organization Admin

The Organization Admin (Org Admin) plays a hybrid role within the vCD workflow. While acting as a consumer of

resources provided and assigned by the SP, the Org Admin is also a provider and administrator of virtualized

application (vApp) services to sub-tenants who are often the organization’s lines of business admins. Within the

vCD environment the Org Admin has full rights to manage and deploy the vApp instances control and rights are

Figure 3: Avamar VM image backup

7

limited and controlled by the policy SLAs delivered by the Cloud Admin. For backup resources, while the cloud admin instantiates

backup policy templates into backup policies, the Org Admin can manipulate these polices, assign them as default to VDCs and

assign them explicitly to vApps.

Line of Business Admin

The line of business admin (LOB Admin) is a pure consumer of the vApp resources provisioned by the Org

Admin, and administers the business critical applications running on those vApp instances for end-users.

Working together with the Org Admin to assure availability of applications for backup and recovery operations,

LOB Admins have full control to run ad-hoc backups and recoveries as necessary to protect vApps as needed

but have limited control and require collaboration with the Org Admin to set backup schedule and retention.

Unlike other solutions offering protection for vCloud Director resources, Avamar natively integrates within vCloud’s Role-Based

Access Control mechanisms to map access to backup and recovery resources and policies without the requirement for creating

additional service accounts and access rights for each role within Avamar. Seamlessly applying backup and recovery services within

the existing vCD workflow was a top requirement for development of this functionality.

Backup Resource Mapping and Assignment

As mentioned above, Avamar introduces through tight integration with vCD the ability to provision and assign backup resources to

tenants and sub-tenants. Let’s take a closer look at how physical infrastructure implemented via Avamar along with its integration

with Data Domain systems can be incorporated and leveraged within vCD.

The foundation of consumable backup resources is the “Backup Appliance.” A Backup Appliance can be an Avamar Data Store,

Avamar Virtual Edition, or Avamar with one or more Data Domain systems. For the illustration shown in Figure 2 below, the process

begins with the Cloud Administrator. A member of the cloud administration team is responsible, and is provided with the capabilities

to manage all the backend backup appliances and corresponding physical infrastructure.

As we begin working through the multi-tenant structure, the Cloud Admin creates “Backup Repositories” that have a Many:1

relationship to Backup Appliances. Using the Backup Repository abstraction, the pool of Backup Appliances can now be split amongst

tenants who will consume their resources. While a repository can only be created using one Backup Appliance, a single backup

appliance can support multiple backup repositories. This is ultimately what allows multiple tenants to be assigned and logically

partitioned on a single backup appliance.

As you can see in Figure 3, the right-most backup appliance is hosting both Repository 3 and Repository 4. This is a similar paradigm

to how multiple Organizational VDCs are assigned to a single Provider VDC in vCloud Director.

Figure 4: Backup resource mapping

8

For this example, illustrated are two organizations or tenants represented as “Org VDC A” and “Org VDC B”. The cloud administrator

upon enrolling each tenant, or adding backup services to an already existing tenant, will map a desired repository to each tenant.

Repository mappings to Org VDCs were designed with flexibility in mind to meet the needs of each tenant. In this example, we are

mapping Repository 1 to Org VDC B and Repository 2 to Org VDC A. By doing this we are able to dedicate physical backup appliances

to a tenant for regulatory purposes. As hosted-cloud and public clouds are in their nature agile and flexible, depending on the

capacity and changing performance requirements for particular tenants it may be necessary to map multiple Backup Repositories to

a particular Org VDC.

In this scenario we are also assigning Repository 4 to Org VDC B and Repository 3 to Org VDC A. The majority of cases will find

tenants sharing a backup appliance by assigning multiple repositories to each backup appliance. When multiple repositories are

assigned to an Org VDC only one repository is considered “active” at a time. It is the responsibility of the Cloud Administrator to

determine which repository should be “Active” for a specific tenant. Repositories in an Active state will service any new incoming

backup requests while “non-active” repositories simply retain previously run backups and service restores. In this example, upon

adding Repositories 3 and 4, Repositories 1 and 2 are no longer active.

The backup repository construct also serves another purpose for the cloud administrator, the ability to enable and configure service

quotas for specific tenants. Both total capacity usage quotas as well as daily capacity usage quotas can be configured on each

repository, therefore controlling consumption of tenants and sub-tenants and assuring control of agreed upon service-level

agreements. This is similar to how Org VDCs allow limits to the consumption of compute, network, and storage resources.

Finally, once assigned to the Org VDCs, backup repository resources are able to be consumed and leveraged for protection of vApps

and VMs by both Org Admins as well as LOB Admins. End-to-end these mappings provide appropriate layers of abstraction for

secure and efficient consumption and integration, but without losing flexibility and control for those customers requiring it.

Backup Policy Configuration and Assignment

When creating and scheduling backup policies for vCD, the cloud administrator must first create a series of backup policy templates.

As illustrated in Figure 5, a policy template contains a schedule, retention, and an option set that you define based on Desired SLAs

being offered. For example, this option set could take advantage of advanced options for in-flight encryption or to control guest file

system quiescing for VMs that are sensitive to VMware snapshots. Overall the attributes of each component of the specific template

is tailored to meet a desired service-level that the service provider is offering to the tenant. Usually these policy templates are

designated and created to provide “Gold, Silver, or Bronze” levels of service that have a corresponding tiered cost structure for

services rendered, for example. Upon enrolling a new tenant, or adding a new VDC for an existing tenant, the cloud admin will create

a policy catalog and then create new or insert existing policy templates into it. With the policy templates now grouped together in the

catalog each tenant can employ and assign those policies to Org VDCs. This now makes the policy templates available for selection

and application as a default policy for all vApps or to customize and assign to specific virtual applications.

Figure 5: Backup policy configuration workflow

9

If we refer back to our vCloud Director Roles we outlined earlier, we mentioned that the Org Admin has a hybrid role as a consumer

and a provider. Looking more specifically at the role from a backup policy workflow, the Org Admin will select a policy from the

catalog that was pre-assigned to his VDC and assign these policies as the default policy or customize certain attributes, if allowed by

the provider, and assign them to specific vApps. With this policy assignment and provisioning approach it allows the org admins the

flexibility they needs, while providing the cloud administrator with the control to make sure the tenant is operating within agreed

upon and paid for SLAs. Once the backup policies are assigned and in place, the backup scheduler will take care of backups

automatically.

Extending the vCloud Director REST APIs

We have detailed up to this point how Avamar provides data protection resources that mimic vCloud hierarchy and are able to be

deployed at “vCloud scale.” We briefly pointed out for you how unlike other solutions, Avamar’s implementation approach is to

embed native backup service extensions inside of vCloud Director’s already existing management and role based access control

mechanisms. The benefits of this approach are that Avamar requires no other tools or management interfaces to enable current

vCloud Director Admin Roles. The familiar vCloud Director REST API including its authentication and authorization capabilities is all

that is needed for integration of Avamar backup services. Additionally, this means that since all backup and recovery operations are

executed leveraging vCloud Director REST APIs, compatibility with any other tools in VMware’s vCloud Suite utilizing those APIs is

Simple.

Ultimately, this provides service providers with a streamlined approach to including backup services to their tenants in a

straightforward and cost effective manner while helping to accelerate Hybrid Cloud adoption by end users that will be more confident

in consuming Public Cloud resources.

CONCLUSION This solution covered in this white paper provides service providers with a simple to use, easy to implement, native, and scalable

multi-tenant data protection solution for VMware vCloud Director. While we didn’t review all of the great foundational technology

some of you already know Avamar employs for virtual machine backup and recovery, all of those industry leading features such as

the following are included:

Full image backups of running virtual machines

Utilizes efficient transport (SCSI hotadd), which avoids copying the entire vmdk image over the network

Fully leverages the VMware vSphere APIs for Data Protection, including Changed-Block Tracking for both VM Image backup and

recovery.

Leverages virtual backup and recovery proxy server load balancing to achieve parallelism for superior backup throughput

It’s cloud ready data protection built on an innovative technology leading foundation and long track record as the fastest in the

industry for VMware data protection.