8.3 HPE GreenLake for Backup and Recovery: Architecture, Policies & Ransomware Protection
Key Takeaways
HPE GreenLake for Backup and Recovery is a SaaS data protection service in Data Services Cloud Console; HPE runs and updates the backup software.
On-premises VMware and SQL Server protection uses two HPE-managed virtual machines: the Data Orchestrator and the Protection Store Gateway.
The Protection Store Gateway uses the HPE Catalyst engine to deduplicate, compress and encrypt backups, and it never connects to DSCC directly.
Protection policies can keep copies as array snapshots, in an on-premises protection store and in the HPE Cloud Protection Store; AWS protection needs no on-premises components.
Dual authorization requires a second administrator to approve deleting a backup or snapshot, and backups can be locked as immutable for a set period.
HPE GreenLake for Backup and Recovery
Quick Answer: HPE GreenLake for Backup and Recovery is backup as a service, run by HPE in Data Services Cloud Console. It protects VMware, Microsoft SQL Server, AWS workloads and HPE array volumes with global protection policies. On premises it uses two HPE-managed VMs, the Data Orchestrator and the Protection Store Gateway, and it stores copies as array snapshots, in an on-premises protection store and in the HPE Cloud Protection Store. Immutability and dual authorization protect backups from ransomware.
What it protects
| Workload | How it is protected |
|---|---|
| VMware virtual machines and datastores | Image-level, application-consistent backups using VMware change tracking, plus array snapshots on HPE arrays |
| Microsoft SQL Server databases and instances | On VMs and on physical servers, with transaction-log backup and point-in-time roll-forward for SQL on VMware |
| AWS EC2 instances and EBS volumes | AWS snapshots and/or copies in the HPE Cloud Protection Store |
| AWS RDS | Orchestrated RDS snapshots in the customer's AWS account |
| AWS EKS | Protection of Kubernetes applications running in EKS clusters |
| HPE array volumes | Volume protection groups for volumes created in the block storage service |
Architecture
The service itself runs in the GreenLake cloud and is updated by HPE, so there is no backup server or catalog for the customer to patch.
On-premises components (VMware and SQL Server protection)
| Component | Role |
|---|---|
| Data Orchestrator (DO) | VM that connects to vCenter, SQL Server and arrays and is the only on-premises component that talks to DSCC |
| Protection Store Gateway (PSG) | VM that processes backup data, using the HPE Catalyst engine to deduplicate, compress and encrypt it, and that hosts an on-premises protection store on a VMFS datastore from any storage array |
Both run a hardened Linux operating system, are deployed and managed by the service, and can be recovered with guided recovery if they are damaged. The PSG never connects to DSCC; its management traffic goes through the Data Orchestrator, and it sends cloud copies over an encrypted link to the Cloud Protection Store. You can deploy several PSGs for more scale. A physical HPE StoreOnce system can also be registered as the on-premises protection store; the service then creates Catalyst and Cloud Bank stores whose names start with hpegreenlake_.
For AWS workloads, no on-premises components are needed.
Where copies live
| Tier | Location | Best for |
|---|---|---|
| Array snapshots | On the HPE array (local or replicated) | Fastest recovery from mistakes and corruption |
| On-premises protection store | PSG datastore or a registered StoreOnce | Fast restores without relying on the array that failed |
| HPE Cloud Protection Store | Object storage that HPE manages in the public cloud | Offsite copy and longer retention |
A policy can combine them, for example hourly snapshots kept for a day, nightly on-premises backups kept for 30 days and weekly cloud copies kept for a year. That gives copies on different media and in different places, which is the 3-2-1 idea from Chapter 7.
Protection policies and groups
- Global protection policies define schedules, retention, immutability and targets once and apply them to on-premises and cloud workloads alike.
- Protection groups collect assets to protect together. Automatic VMware protection groups can select VMs by VMware tags, so new VMs with the right tag are protected automatically.
- For array-hosted workloads that the service does not protect at application level, it can still protect the storage volumes with crash-consistent array snapshots and array-optimized backups.
Ransomware defenses
| Defense | Detail |
|---|---|
| Immutability | A policy can lock backups for a period during which they cannot be deleted or changed |
| Dual authorization | Deleting a backup or snapshot needs approval from a second user with the Administrator or Backup and Recovery Administrator role |
| Isolation | The PSG does not connect to the cloud console; on-premises components run hardened Linux |
| Encryption | Backup data is encrypted by the PSG before it is written or sent |
Relationship to StoreOnce and the arrays
GreenLake for Backup and Recovery uses StoreOnce Catalyst technology inside the PSG and can use StoreOnce appliances as targets. It integrates with HPE arrays for array snapshots and, on the B10000, with volume protection groups. StoreOnce remains the right choice when a customer runs a traditional backup application such as Veeam or Commvault; GreenLake for Backup and Recovery suits customers who want HPE to run the backup software as a service.
Scenario
A manufacturer runs 300 VMware VMs and four SQL Server databases on a B10000, plus web servers on AWS EC2. It deploys a Data Orchestrator and two Protection Store Gateways, tags production VMs "gold" and applies a global policy: array snapshots every hour for 24 hours, an on-premises protection store nightly for 30 days, and weekly copies to the Cloud Protection Store for 12 months with a 30-day immutability lock. EC2 instances use the same policy with AWS snapshots and cloud copies. Dual authorization is enabled, so a stolen administrator password alone cannot delete backups.
Common exam traps
- "The Protection Store Gateway talks to the cloud console." Only the Data Orchestrator does.
- "AWS protection needs a gateway VM." It does not.
- "It is a DR orchestrator." For continuous replication and failover, use GreenLake for Disaster Recovery and Zerto (section 8.4).
Which on-premises component of HPE GreenLake for Backup and Recovery deduplicates, compresses and encrypts backup data using the HPE Catalyst engine?
The Data Orchestrator virtual machine
The vCenter plug-in for HPE storage
The Protection Store Gateway virtual machine
The HPE Quorum Witness appliance
Which statement about network communication in HPE GreenLake for Backup and Recovery is correct?
Only the Data Orchestrator connects to DSCC; the PSG never does
Every on-premises VM connects directly to DSCC over HTTPS
Backup data always passes through DSCC before reaching the protection store
The service requires inbound connections from the cloud to vCenter
A customer wants to protect AWS EC2 instances and EBS volumes with HPE GreenLake for Backup and Recovery. Which on-premises components must it deploy?
A Data Orchestrator and a Protection Store Gateway
A StoreOnce 7700 in the customer's AWS region
A Zerto Virtual Manager in each AWS region
None
An attacker steals a backup administrator's password and tries to delete all backups. Which HPE GreenLake for Backup and Recovery feature blocks this on its own?
Global protection policies applied to every asset
Dual authorization
VMware tag-based automatic protection groups
Transaction-log backups for SQL Server databases
Sections you finish are checked off in the contents.