系统备份和高可用容灾架构白皮书

系统备份和高可用容灾架构白皮书目录Architecture Overview (4)1.1BCDR Solution Conceptual Design (4)1.1.1Data Protection Conceptual Design (5)1.1.2High Availability Conceptual Design (6)1.1.3Disaster Recovery Conceptual Design (6)2.Data Protection Design (8)2.1Logical Design (8)2.2Backup Datastore (9)2.2.1Backup Data Store Target Location (9)2.3Performance (10)2.4Volume Sizing (10)2.5Other Considerations (11)2.6Backup Policies (11)2.6.1Virtual Machine Backup Options (11)2.6.2Schedule Window (12)2.6.3Retention Policies (12)3.High Availability Design – Application Services (13)3.1Logical Design (14)3.2Backup and Recovery (15)4.Disaster Recovery Design (16)4.1Logical Design (16)4.2vCenter Server Logical Design (17)4.3Server for vCenter Site Recovery Manager (18)4.4Database for vCenter Site Recovery Manager (19)4.4.1Database Sizing (20)4.5Licensing for vCenter Site Recovery Manager (21)4.6Networking for vCenter Site Recovery Manager (22)4.7Storage for vCenter Site Recovery Manager (22)4.7.1Datastore Configuration Specifications (22)4.7.2Virtual Disk (.vmdk) Configuration Specifications (22)4.7.3Datastore Naming Conventions (24)4.7.4Virtual Machine Swap and Operating System Paging Files (24)4.7.5Storage Replication (25)4.7.6Third-Party Storage-Based Replication Versus vSphere Replication (26)4.7.7Placeholder Virtual Machines (28)4.7.8Snapshot Space (28)4.8Naming Conventions for vCenter Site Recovery Manager Site (28)4.9Inventory Mappings for vCenter Site Recovery Manager (28)4.9.1Resource Mappings (29)4.9.2Folder Mappings (29)4.9.3Network Mappings (29)4.9.4Protection Groups (29)4.10Messages and Commands for vCenter Site Recovery Manager (29)4.10.1Messages (29)4.10.2Commands (30)4.11Bulk IP Address Updates (31)4.12Recovery Plans for vCenter Site Recovery Manager (33)4.12.1Startup Order and Response Time (33)4.12.2Recovery Plan Test Network (33)4.12.3Recovery Site Local Virtual Machines (34)4.12.4vCenter Site Recovery Manager Recovery Plan Scenarios (34)4.13Monitoring (36)4.14Users, Groups, Permissions, and Roles (36)work Communication and Firewalls (39)Architecture Overview1.1 BCDR Solution Conceptual DesignThe solution to support BCDR of the workloads running on VMware vSphere contains various components that must be integrated to make them work well together. These components range from networking devices, infrastructure services, and storage area network (SAN) devices to vSphere and applications. Each of these components has a large number ofpotentially valid configurations, but only a few of these configurations result in an integrated, functional system that meets the specified business and technical requirements.The service management and operations processes affected by the BCDR solution are out-of-scope for this engagement and are not addressed in this document.The following figure illustrates the conceptual design for the solution.Replace the diagram with an updated version that reflects the customer’s requirements. Use the Layers option in Visio to remove components that will not be deployed.Figure 1. BCDR Solution Conceptual Design1.1.1 Data Protection Conceptual DesignThe solution to support data protection of the workloads running on vSphere must perform the following tasks:•Back up and restore virtual machines.•Store data following the retention policies specified.•Send email reports about VMware vSphere Data Protection Advanced activities.Figure 2. Data Protection Conceptual Design1.1.2 High Availability Conceptual DesignThe solution to support high availability of application services within workloads running on VMware vSphere must perform the following tasks:•Display location and availability status of the applications.•Employ user-defined remediation if a service is unavailable or unstable. Remediation actions include restart service and reset virtual machine.•Trigger alerts and notifications when services become unavailable or unstable. •Enable a remediation action to be suspended while maintenance is performed. •Integrate with VMware vSphere High Availability for reset virtual machine functionality and compatibility with VMware vSphere vMotion®.Figure 3. High Availability Conceptual Design1.1.3 Disaster Recovery Conceptual DesignThe solution to support disaster recovery of the workloads running on vSphere must support the following provisions:•All protected virtual machines must reside on vSphere at the <Site_A> (protected site) and will be recovered to <Site_B> (recovery site).•All protected virtual machines must reside on vSphere at the <Site_C> (protected site) and will be recovered to <Site_B> (recovery site).•All protected virtual machines are recovered to a single site located at the <Site_B> (recovery site).Note Detailed design of the storage, network, and replication solution is out-of-scope for this effort.Replace the diagram with an updated version that reflects the customer’s requirements. Use the Layers option in Visio to remove the multi-site option if it is not required.Figure 4. Disaster Recovery Conceptual Design2. Data Protection DesignProvide background information, any necessary context, and general considerations to keep in mind for the technology or solution.<Customer> has one data center, Data Center_A on Site_A, and the customer wants to protect the organization’s data in case of an eventuality such as data loss, hardware failure, accidental deletion, or other disaster. Data backup is an insurance plan.2.1 Logical DesignThe logical design is a more detailed design that includes all major components and entities and their relationships. The data flows and connections are detailed in this stage. Logical designs do not include physical server names and IP addresses. They include business services application names and details and other relevant information.The following figure represents the logical design of the vSphere Data Protection Advanced solution. vSphere Data Protection Advanced protects VMware infrastructure through the VMware vCenter Server™ Manager layer. Connectivity through vCenter Server provides vSphere Data Protection Advanced with visibility to all VMware ESXi™ servers, an d therefore to the virtual machines that must be backed up.Replace the diagram with an updated version that reflects the customers’ requirements. Use the Layers option in Visio to remove the High Availability option if it is not required.Figure 5. vSphere Data Protection Advanced Logical Design2.2 Backup DatastorevSphere Data Protection Advanced uses de-duplication technology to back up virtual environments at the block level, which enables efficient disk utilization.To optimize backups and leverage the technology available from vSphere, it is important that all hosts can access the production storage, allowing vSphere Data Protection Advanced to be managed optimally to back up production virtual machines.2.2.1 Backup Data Store Target LocationThe backup datastore stores all the production data that is required in a disaster recovery event or data loss to recover production service based on a recovery point objective (RPO). It is important to choose the target location and meet the minimum performance requirements to mitigate such a scenario.2.2.1.1. Option 1: Store Production and Back up Data on the Same Storage Platform The benefits of this destination choice are the following:•You do not need to request that the storage team provide a new storage configuration to deploy and store the vSphere Data Protection Advanced appliance and the backup store. •You can take full advantage of vSphere capabilities.The risk is that if the destination datastore or the production storage is unrecoverable, you will lose the ability to recover your data.2.2.1.2. Option 2: Store the Backup Data on a Dedicated StorageIn this configuration, the benefits are the following:•If the production storage becomes unavailable, you can recover your data, because your backup data is not located on the same shared storage.•Separate production and backup workloads.•The backup schedule does not impact the production storage performance, because the backup storage is completely separated.The drawback is that you might be required to install and configure a dedicated storage volume for backups.vSphere Data Protection Advanced storage replication feature mitigates the riskof backup store failure.Table 1. VMware Backup Store Target – Design DecisionsFor this design, <Customer> has made the decisions listed in this table. DD001 Dedicated storage volume for virtual machine backup. The production virtualmachine needs to beaccessible at all times withlimited performanceimpact. The appliance cannot use VMware vSphere Distributed Resource Scheduler™ or HA features if a direct attachedstorage is used.2.3 PerformancevSphere Data Protection Advanced generates a significant amount of I/O, especially when performing multiple, concurrent backups. The storage platform must be able to handle this I/O. If the storage does not meet the performance requirements, it is possible for backupfailures to occur and for error messages to be generated. vSphere Data Protection Advancedincludes a performance analysis feature. This analysis can be run during virtual appliance deployment or post deployment.2.4 Volume SizingvSphere Data Protection Advanced can expand dynamically the backup store destination from two (2) to eight (8) TB. However, specific memory requirements placed on the appliance dictate this capability.Table 2. VMware vSphere Data Protection Sizing Guide 2 TB6 GB 4 TB 8 GB 6 TB10 GB8 TB 12 GBIt is important not to fill the backup store so that you can restore your data andavoid any virtual machine backup interruptions.2.5 Other ConsiderationsvSphere Data Protection Advanced can be deployed and protect virtual machines that reside on VMware Virtual SAN™. The virtual machine storage policy is not backed up with the virtual machine, but you can restore it by replacing the existing virtual machine.The default storage policy includes “Number Of Failures To Tolerate = 1”, whichmeans that each of these storage devices will be mirrored.2.6 Backup Policies2.6.1 Virtual Machine Backup OptionsvSphere Data Protection Advanced provides the following methods for performing a backup of a virtual machine:•Hot Add – Provides full image backups of virtual machines, regardless of the guest operating system.o The virtual machine base disk is attached directly to vSphere Data Protection Advanced to back up data where change block tracking is used to track and back upnew blocks that are altered.o The backup and restore performance is faster because the data flow is through the vmkernel layer.o A quiesced snapshot can be used to interrupt the I/O of the virtual machine to swap the virtual machine disk (vmdk) or consolidate the data when the backup is done.o Hot add does not work under a multi-writer disk mode scenario.•Network Block Device – The virtual machine data is transmitted across the network to allow vSphere Data Protection Advanced to back up the data.o The performance of the virtual machine network traffic might be impacted.o It takes a quiesced snapshot and might interrupt the I/O of the virtual machine to swap the vmdk or consolidate the data once the backup is done.o The time to complete the virtual machine backup might be longer than the backup window.o Network block device does not work in multi-writer disk mode.•vSphere Data Protection Advanced Agent inside the guest operating system.o Enables application-consistent backup and recovery with Microsoft SQL Server, Microsoft SharePoint, and Microsoft Exchange support.o Provides more granularity and flexibility to restore on the file level.With a vFlash-based disk virtual machine, Data Protection Advanced reverts tonetwork-block device transport to back up the virtual machine.Table 3. Virtual Machine Transport Mode – Design DecisionsFor this design, <Customer> has made the decisions listed in this table.vSphere Data Protection Advanced agent for backup. instance of businessapplication backup.Protection Advanced agentand maintain it.DD003 Hot add transport modewill be used to backupvirtual machines. It will optimize and speedvirtual machine backups,and avoid any impact tothe management network.All ESXi hosts must beable to access the sameset of virtual machinedatastores.2.6.2 Schedule WindowEven when vSphere Data Protection Advanced uses Changed Block Tracking technology to optimize the success rate to back up data, it is crucial to avoid any window where the production storage is in high demand to avoid any business impact.No backup or administrative activities are allowed during the vSphere DataProtection Advanced blackout window. However, restores can be performed.By default, the blackout window begins at 8 a.m. local server time andcontinues uninterrupted for three hours until 11 a.m. the same morning.2.6.3 Retention PoliciesThe retention policies are the properties of a backup job, therefore it is important to group virtual machines by business priorities and the retention requirements set by the business level.3. High Availability Design – Application Services Provide background information, any necessary context, and general considerations to keep in mind for the technology or solution.vSphere App HA works with vSphere HA host and virtual machine monitoring to improve application uptime and provide high availability. The feature can restart an application service if it detects a failure, and can reset a virtual machine if the application fails to restart.vSpher e App HA uses VMware vCenter™ Hyperic® to monitor applications. vCenter Hyperic stores and manages App HA policies, which are configured in the administration section of the VMware vSphere Web Client. Policies define items, such as the number of times vSphere App HA will attempt to restart a service, the number of minutes it will wait for the service to start, and when to reset a virtual machine if a service is unstable.The vSphere App HA solution provides the administrator the ability to define high availability for applications running in the virtual environment, and it provides a level of visibility and control through the Web Client interface for vSphere. The vSphere App HA solution provides levels of remediation by restarting failed components on the application, or by using the Application Awareness API by way of vSphere HA to reset the virtual machine if the restarting of the application does not complete correctly.<Customer> has a number of critical business applications for which they want to improve application uptime running the following services:•Apache Tomcat•Microsoft IIS•Microsoft SQL Server•Apache HTTP Server•Microsoft SharePoint•SpringSource tc Runtime•PostgreSQL•Oracle databaseFigure 6. vSphere App HA Architecture Overview3.1 Logical DesignThe logical design is a more detailed design that includes all major components and entities and their relationships. The data flows and connections are detailed in this stage. Logical designs do not include physical server names and IP addresses. They include business services application names and details, and other relevant information.vSphere App HA is shipped as an appliance. This appliance needs to be installed on an HA-enabled cluster. It tightly integrates with vCenter Server. A plug-in is also installed in vSphere Web Client for App HA management. App HA talks to vCenter Hyperic to gather service availability information.A vCenter Hyperic HQ agent is installed for each application that is monitored. The agent reports application health to the vCenter Hyperic HQ virtual appliance. vCenter Hyperic HQ enforces the vSphere App HA policies by issuing commands to either restart the application or reset the virtual machine. A new vSphere HA application monitoring command allows thevCenter Hyperic HQ agent to request a virtual machine reset.Replace the diagram with an updated version that reflects the customer’s requirements. Use the Layers option in Visio to remove the High Availability option if it is not required. Figure 7. VMware vSphere App HA Logical DesignTable 4. vSphere App HA Logical Design ComponentsvSphere App HA appliance •Remediation policy configuration•Custom servicesvCenter Hyperic Server •Communicate with App HA for services status.(This is not included in this service’s scope.) vCenter Hyperic Agent •Real-time monitoring of middleware and applications running onthe virtual machine.(This is not included in this service’s scope.)3.2 Backup and RecoveryTo protect the vSphere App HA appliance, you have to make a proper backup plan thatincludes a vPostgres database.4. Disaster Recovery DesignProvide background information, any necessary context, and general considerations to keep in mind for the technology or solution.<Customer> has two sites: protected <Site_A> at Location_A and recovery <Site_B> at Location_B. The vCenter Site Recovery Manager design provides a solution for automating the setup and execution of the disaster recovery plans or workflows.<Site_A> has the virtual machine workloads that are being protected and is referred to as the protected site in this document. <Site_B> is the disaster recovery site and is referred to as the recovery site.4.1 Logical DesignThe logical design is a more detailed design that includes all major components and entities, and their relationships. The data flows and connections are detailed in this stage. Logical designs do not include physical server names and IP addresses. They include business services application names and details, and other relevant information. Check the VMware Virtualization Technical Materials ZIP file for the requirement.The following represents the overall logical design for the disaster recovery solution.<Customer> has various business applications and services, referred to as business applications in this document that must be available in the event of a disaster. These business applications are running as virtual machines on vSphere, but have some dependencies on other applications and services that run on physical systems.Users access these business applications over the corporate Local Area Network (LAN) in<Site_A>, Wide Area Network (WAN) from <Site_B>, and Virtual Private Network (VPN) from other branch offices and remote locations.There is network connectivity between <Site_A> and <Site_B>, and data from <Site_A> is replicated to <Site_B> using VMware vSphere Replication™ or the appropriate storage vendor solution.<Site_A> has a cluster of ESXi hosts with pre-production virtual machines that must be protected. <Site_B> has a cluster of ESXi hosts with non-production virtual machines. Each site has an instance of vCenter Server that manages the ESXi hosts within the site. Each site also has a vCenter Site Recovery Manager server and a vCenter Site Recovery Manager database. A storage vendor-provided Storage Replication Adapter (SRA) is installed on the vCenter Site Recovery Manager server to provide communication between the vCenter Site Recovery Manager Server and the storage array.vSphere Replication can be configured to perform the replication betweendisparate storage arrays between <Site_A> and <Site_B>.It is important to read the SRA release note provided from the vendor in SRAbundles to obtain the requirement list for configuring the LUNs to be managedby vCenter Site Recovery Manager.4.2 vCenter Server Logical Design<Customer>’s vCenter Server des ign includes a total of two virtual vCenter Server 5.5systems. One vCenter Server is located on <Site_A> and one vCenter Server on <Site_B>. These are deployed within the same three-node ESXi cluster in each. Each vCenter Server provides specific functions as follows: •VMware vCenter Server 1 – Located within the <Site_A> data center to providemanagement of the Pre-Production Cluster and integration with vCenter Site Recovery Manager.•VMware vCenter Server 2 – Located within the <Site_B> data center on the Recovery Cluster to provide management of the Recovery Cluster and integration with vCenter Site Recovery Manager.As part of the vCenter Site Recovery Manager project, the vCenter Server instances located within <Site_A> and <Site_B> must be running the same version. They work as peers. The vCenter Site Recovery Manager version is dependent on the vCenter Server (see the VMware Product Interoperability Matrixes at/comp_guide2/sim/interop_matrix.php?).Figure 8. VMware vCenter Site Recovery Manager Logical DesignPRIMARY SITESECONDARY SITESee the VMware Software-Defined Data Center Services Architecture Design Diagrams to check the possibilities for a DR scenario.Figure 9. BCDR SDDC Management Cluster Logical Diagram4.3 Server for vCenter Site Recovery ManagerThe following is a sample design decision based on VMware recommended practice. Multiple valid design choices are possible. Update this to reflect the <Customer>-specific information in order to determine the most appropriate design choice.A vCenter Site Recovery Manager server is required at both the primary site (sometimes referred to as the protected site) and the secondary site (sometimes referred to as the recovery site). The vCenter Site Recovery Manager Server operates as an extension to the vCenter Server at a site. Because the vCenter Site Recovery Manager server depends on vCenter Server for some services, you must install and configure vCenter Server at a site before vCenter Site Recovery Manager can be implemented.vCenter Site Recovery Manager takes advantage of vCenter Server services, such as storage management, authentication, authorization, and guest customization. vCenter Site Recovery Manager also uses the standard set of vSphere administrative tools to manage these services.You can use vCenter Site Recovery Manager and vSphere Replication with the VMware vCenter Server Appliance™ or with a standard vCenter Server installation. You can have a vCenter Server Appliance on one site and a standard vCenter Server installation on the other. The vCenter Site Recovery Manager server deployment is supported in a few scenarios that include:•Deployed as either a physical or virtual system.•Deployed on a shared system, such as the vCenter Server, or on a dedicated system.For this design, <Customer> has made the decisions listed in this table. DD004The vCenter Site Recovery Manager Server will be deployed within a virtual machine.All components of the solution should bedelivered using the highest levels of availability.Running the vCenter Site Recovery Manager Server as a virtual machine allows it to make use of theunderlying vSphere cluster capabilities.VMware recommends that there be a clear separation of management infrastructure frommanaged infrastructure. Use resource pools to make sure that adequate resources are available. If no dedicated management cluster exists, one might be needed.DD005The vCenter Site Recovery Manager Server will be deployed using a dedicated server.The disaster recovery solution must not impact the performance of day-to-day operations, so separation must beprovided. Deploying on a dedicated system allows for easier upgrades.Deploying the vCenter Site Recovery Manager Server on a dedicated system will increase the overall licensing costs of the solution.4.4 Database for vCenter Site Recovery ManagerThe following is a sample of the design choices, evaluation, and design decision. Multiple valid design choices are possible. Update this to reflect the <Customer>-specific information to determine the most appropriate design choice.The vCenter Site Recovery Manager server requires its own database to store data, such as recovery plans and inventory information. The vCenter Site Recovery Manager database is a critical part of a vCenter Site Recovery Manager installation, and it cannot use the vCenter Server database because it has different database schema requirements.Each vCenterSite Recovery Manager site requires its own instance of the vCenter Site Recovery Manager database. vCenter Site Recovery Manager does not require the databases on each site to be identical. You can run different versions of a supported database from the same vendor on each site, or you can run databases from different vendors on each site. The vCenter Site Recovery Manager database deployment is supported in a few scenarios that include: • A shared database systemA dedicated database systemFor this design, <Customer> has made the decisions listed in this table.deployed on a shared database system where a dedicated instance will be created. database system that is highly-available, so a shared vCenter Site Recovery Manager database system offers better availability.4.4.1 Database SizingUse the vCenter Site Recovery Manager database sizing calculator to get an estimate of the size of the vCenter Site Recovery Manager database.The vCenter Site Recovery Manager database at each site holds information about virtual machine configuration, protection groups, and recovery plans. The VMware vCenter Site Recovery Manager Administration Guide provides the configuration maximums for vCenter Site Recovery Manager.Based on these configuration maximums, the size of the vCenter Site Recovery Manager database instance is less than 1 GB on the protected site and the recovery site.VMware recommends that you allocate at least 3 GB to the vCenter Site Recovery Manager database on both the protected and recovery sites, because the database space requirements are small, and it is possible to set up either site as a protected site.Update this to reflect the <Customer>-specific information to determine the correct number of vCenter Site Recovery Manager licenses required by the <Customer>.If vCenter Site Recovery Manager is configured to fail over virtual machines only from the primary site to the secondary site, you are required to have vCenter Site Recovery Manager licenses only for the protected virtual machines at the primary site.If vCenter Site Recovery Manager is configured to fail over a set of virtual machines from a primary site to a secondary site, and is also configured to fail over a different set of virtual machines from the secondary site to the primary site, you are required to have vCenter Site Recovery Manager licenses for the protected virtual machines at both sites.Note Verify that you have properly installed the software for vCenter Site Recovery Manager as well as the necessary plug-ins.VMware recommends that <Customer> purchase adequate licenses for the primary and recovery sites to make the failback process simpler. This also allows for the capability of providing bidirectional failover, if necessary.Table 7. vCenter Site Recovery Manager Licenses – Single Direction ProtectionNumber of protected virtual machines on ESXi hosts 10 01 0Number of vCenter Site Recovery Manager licenses(25 protected virtual machines per license)Total per-virtual machine 25-pack vCenter Site Recovery Manager licenses needed = 1 (up to 25 protected virtual machines total).Table 8. vCenter Site Recovery Manager Licenses – Bi-Directional ProtectionNumber of protected virtual machines on ESXi hosts 10 51 1Number of vCenter Site Recovery Manager licenses(25 protected virtual machines per license)Total per-virtual machine 25-pack vCenter Site Recovery Manager licenses needed = 2 (up to 25 protected virtual machines in Site_A and up to 25 protected virtual machines in Site_B).。