8.1 HPE StoreOnce Systems, Catalyst & Cloud Bank Storage
Key Takeaways
Current HPE StoreOnce systems are the Gen5 3720, 3760, 5720 and all-flash 7700, plus the Gen4 Plus 3660, 5260 and 5660 and the StoreOnce VSA virtual appliance.
StoreOnce deduplicates inline with fine-grained 4 KB chunks and presents Catalyst stores, virtual tape libraries (VTL) and NFS or SMB shares.
StoreOnce Catalyst can deduplicate at the backup source and replicates with Catalyst Copy without rehydrating data, under backup-application control.
Cloud Bank Storage extends a Catalyst store to public or private object storage and is supported only as a Catalyst Copy target, not as a direct backup target.
StoreOnce security includes AES-256 data-at-rest encryption, IPsec in flight, Secure Erase, FIPS 140-2 validated modules, data immutability and dual authorization.
HPE StoreOnce Systems, Catalyst & Cloud Bank Storage
Quick Answer: HPE StoreOnce is a disk-based, deduplicating backup system. Backup software writes to Catalyst stores (best), VTL or NFS/SMB shares. Catalyst can deduplicate at the source, replicates efficiently with Catalyst Copy and is controlled from the backup application. Cloud Bank Storage keeps deduplicated copies in object storage for long retention. Current models are the Gen5 3720, 3760, 5720 and 7700, the Gen4 Plus 3660, 5260 and 5660, and the StoreOnce VSA.
Why deduplicating backup storage
Backups repeat the same operating system files, applications and unchanged data night after night. Storing every copy in full on ordinary storage is expensive. StoreOnce stores each unique chunk of data once and references it from every backup that contains it, so many restore points fit in far less disk. HPE describes its deduplication as inline and fine-grained, with 4 KB chunks, and adds compression on top. Because less data is stored and sent, backups and replication also need less bandwidth.
The current model range
| Generation | Model | Designed for | Usable capacity (TB) | Max Catalyst backup (TB/hr) | Max Cloud Bank (TB) |
|---|---|---|---|---|---|
| Gen5 | 3720 | Small and branch | 18 to 72 | 15 | 144 |
| Gen5 | 3760 | Midrange and small data centers | 108 to 216 | 25 | 432 |
| Gen5 | 5720 | Large and enterprise | 144 to 576 | 70 | 1,152 |
| Gen5 | 7700 | Fastest backup and restore (all-flash) | 92 to 552 | 300 | 2,208 |
| Gen4 Plus | 3660 | Small and branch | 56 to 200 | 25 | 400 |
| Gen4 Plus | 5260 | Midrange | 144 to 576 | 60 | 1,152 |
| Gen4 Plus | 5660 | Midrange and enterprise | 144 to 1,152 | 105 | 2,304 |
The 7700 is all-flash and grows in 92 TB steps by adding SSD expansion packs. Gen5 systems run StoreOnce Software 5.2.0; Gen4 Plus systems run 4.3.x. Hardware systems carry a three-year parts, labor and on-site warranty.
StoreOnce VSA is a software appliance that runs as a virtual machine. A single VSA scales to 500 TB usable, or 1,500 TB with Cloud Bank Storage, and it is managed in the same way as the hardware systems. It suits branch offices that should not need dedicated hardware.
Target types
| Target | How backup software sees it | Notes |
|---|---|---|
| Catalyst store | A Catalyst-aware target through the backup application's plug-in | Highest performance, source-side deduplication, application-controlled replication |
| VTL | Emulated tape libraries and drives (for example LTO-2 to LTO-7 drive types) | For applications that expect tape; VTL replication is available |
| NFS or SMB share | A network file share | For applications without Catalyst support |
HPE states that Catalyst gives higher performance, better security and more flexible control than VTL targets or file shares, and that Catalyst works over both Fibre Channel and Ethernet.
How StoreOnce Catalyst works
Catalyst is a backup-optimized interface integrated into leading backup applications, with HPE plug-ins for others.
- Source-side (federated) deduplication: the backup or media server breaks data into chunks, asks StoreOnce which chunks it already has, and sends only new chunks. This saves LAN or WAN bandwidth and is ideal for remote sites.
- Target-side deduplication: the server sends the full stream and StoreOnce deduplicates it, saving client CPU.
- Catalyst Copy: replicates backup items between StoreOnce systems. The target already holds most chunks, so only missing chunks cross the network, with no rehydration. Because the backup application controls the copy, its catalog knows where every copy is.
- Single-console control: the administrator manages restore points and copy locations from the backup application.
Worked bandwidth example
A remote office backs up 2 TB nightly, of which about 5% is new data after deduplication. Without source-side deduplication about 2 TB crosses the WAN; with Catalyst source-side deduplication only about 100 GB of unique chunks (plus small metadata) is sent. The change rate is what matters, so measure it during assessment.
Cloud Bank Storage
Cloud Bank Storage is an extension to Catalyst that adds connected object storage, on premises or in the public cloud, to a StoreOnce system. Deduplicated data is kept in the object store, so long retention costs less than keeping everything on local disk.
Key rules from the QuickSpecs:
- Cloud Bank is supported as a Catalyst Copy target, but because of object-storage performance it is not supported as a direct backup target.
- It is licensed, in 1 TB, 10 TB or 100 TB increments, up to each model's maximum.
- Cloud Bank Storage Detach detaches a store that will not change so it can move to a low-cost cold tier, which is too slow for normal Cloud Bank operation. Detach is also licensed.
- Supported object stores are listed in the StoreOnce support matrix in SPOCK.
Security and data integrity
| Feature | What it does |
|---|---|
| Data-at-rest encryption | Software AES-256 encryption per store (Catalyst, VTL, NFS or SMB), applied after deduplication and before writing to disk; local or external key management |
| Data-in-flight encryption | IPsec for low-bandwidth Catalyst backup, Catalyst Copy and replication |
| Secure Erase | Shreds selected backup data to NIST SP 800-88 with 1, 3, 5 or 7 overwrite passes |
| FIPS 140-2 | Uses validated cryptographic modules |
| Data immutability | Protects backups from being changed or deleted during their retention |
| Dual Authorization | Requires a second user (security officer) to approve protected operations such as deleting data |
| StoreOnce Integrity Plus | Checks data integrity throughout its life on the system |
Management and integration
- Browser GUI on each system, and a federation that manages up to 40 StoreOnce systems from one interface.
- REST API for reporting and automation.
- Data Ops Manager: Gen5 systems can be onboarded to the GreenLake platform and used as backup targets in B10000 volume protection policies.
- HPE GreenLake for Backup and Recovery can register a physical StoreOnce as an on-premises protection store.
- X10000 accelerator nodes are based on StoreOnce Gen5 technology.
- HPE Zerto can use StoreOnce Catalyst for long-term retention.
Choosing a model
- Start with the front-end data to protect, the daily change rate and the retention policy.
- Size usable capacity with NinjaSTARS (or DD Analyse when replacing a Data Domain).
- Check the backup window against the model's Catalyst throughput, remembering that VTL and NAS are slower.
- Add Cloud Bank capacity for long-term copies and replicate to a second site with Catalyst Copy.
Common exam traps
- Backing up directly to Cloud Bank: not supported; Cloud Bank is a Catalyst Copy target.
- Using NFS shares when Catalyst is available: you lose source-side deduplication and application-controlled copies.
- Ignoring Dual Authorization: it is a key defense against a compromised administrator deleting backups.
An administrator wants backup jobs to write directly to a StoreOnce Cloud Bank store in public cloud object storage to avoid buying local capacity. What should the architect explain?
Cloud Bank is supported as a Catalyst Copy target, not as a direct backup target
Cloud Bank is the recommended primary backup target for every workload
Cloud Bank works only with VTL targets and requires Fibre Channel
Cloud Bank requires LTO-9 media to be written into the object store
A company backs up a remote office over a slow WAN link to a StoreOnce system at headquarters. Which StoreOnce capability most reduces the data sent over the WAN?
Presenting the StoreOnce to the remote office as an SMB share
Running Secure Erase on expired backups at headquarters
Catalyst source-side deduplication
A VTL with many virtual drives presented over the WAN
Which HPE StoreOnce model is the all-flash system positioned for the fastest backup and restore, with Catalyst backup of up to 300 TB per hour?
StoreOnce 3720 (Gen5)
StoreOnce 5660 (Gen4 Plus)
StoreOnce VSA software appliance
StoreOnce 7700
Which StoreOnce feature requires a second, separate user to approve sensitive operations such as deleting backup data?
StoreOnce Integrity Plus
Dual Authorization
Cloud Bank Storage Detach
StoreOnce federation
Sections you finish are checked off in the contents.