Skip to main content

Backup Gateways

A Backup Gateway lets the instances in your eCloud VPC send agent-level backups to ANS Secure Backup. This page explains what a Backup Gateway is, when to use one, and how to set one up from Glass, the API or the ANS CLI.

What a Backup Gateway is​

A Backup Gateway is a gateway that ANS deploys on your router. It carries backup traffic securely from the backup agent on your instances to ANS Secure Backup.

VPC
└── Router
    ├── Backup Gateway ──────────► ANS Secure Backup
    └── Network
        ├── Instance (backup agent)
        ├── Instance (backup agent)
        └── Instance (backup agent)

A Backup Gateway is used for agent-level (file-level) backup. This is separate from VM-level backup, which snapshots the whole virtual machine and needs no gateway. An instance can use either kind of backup, or both.

Why it exists and typical use cases​

The gateway gives the backup agent inside each instance a private, managed route to Secure Backup. Typical use cases are:

  • Restoring individual files, folders or application data, rather than the whole virtual machine.
  • Protecting many instances behind one router with a single gateway.
  • Combining agent-level backup with VM-level backup, so you can recover both whole machines and individual items.
  • Keeping backup traffic on private networks. Your instances do not need a floating IP to be backed up.

VM-level and agent-level backup​

VM-level backupAgent-level backup
ProtectsThe whole virtual machineFiles and applications inside the instance
Needs a Backup GatewayNoYes
Needs an agent in the instanceNoYes
How it runsA daily snapshot, each kept for 30 daysYou pick from a predefined list of schedules
RestoreWhole virtual machineIndividual files and application data
Instance fieldbackup_vm_enabledbackup_agent_enabled

For more on the two approaches, see VM-level backups and file-level backups.

Before you start​

You need:

  • A Secure Backup organisation on your account. Without one, creating a Backup Gateway fails with a 412 error.
  • A router in an availability zone that supports Secure Backup, and instances on a network behind that router.
  • For the CLI examples, ANS CLI v1.33.0 or later.
  • For the API examples, an API key with read/write access to eCloud.

The Automating eCloud VPC with the ANS CLI guide explains how to install the CLI and supply your API key. The curl examples on this page use the same shorthand as that guide:

export ECLOUD="https://api.ukfast.io/ecloud/v2"
H=(-H "Authorization: ${ANS_API_KEY}" -H "Content-Type: application/json" -H "Accept: application/json")

All IDs in the examples (vpc-abcdef12, rtr-abcdef12, bgw-abcdef12 and so on) are placeholders. Replace them with your own.

Set up a Backup Gateway​

The workflow has four steps: choose a specification, create the gateway, enable agent backup on the instance, then verify. Each step has tabs for Glass, the API and the CLI. The tab you pick is used for every step.

1. Choose a specification​

The specification sets the size of the gateway. Each one has an id, a name, a description and an order. For example, "Medium, Recommended for up to 50 Instances". The specification must be offered in the availability zone of your router, otherwise creating the gateway fails with a 422 error.

You choose the specification on the create form in the next step, under Choose your specification.

2. Create the gateway​

Create the gateway on the router that your instances sit behind. The gateway takes its availability zone from the router. You can give it an optional name.

  1. Go to eCloud > Networking > Backup Gateways and click Create Backup Gateway.
  2. Enter a name (optional), then select the VPC and the router.
  3. Under Choose your specification, select a specification.
  4. Click Create Backup Gateway.

Backup Gateways list

Create Backup Gateway form

The gateway is ready when its status shows Complete.

3. Enable agent backup on an instance​

The gateway must be ready, and in the same VPC, availability zone and router as the instance. Attaching the gateway (backup_gateway_id) and enabling the agent (backup_agent_enabled) are two settings. Enabling the agent needs a gateway, either sent in the same request or already set on the instance.

For an existing instance:

  1. Open the instance and go to the Backup tab.
  2. Turn on the Agent Level toggle.
  3. Click Apply Changes.

Glass selects the gateway on the instance's router for you. If there is no gateway on the router, the toggle is disabled and the tab tells you to deploy one first.

The Backup tab always shows an information banner about volume groups. It only applies if the instance has a volume group attached. In that case, contact ANS support to have the agent configured.

Instance Backup tab with Agent Level disabled because there is no Backup Gateway

Instance Backup tab before enabling Agent Level

When launching an instance:

In the Backup section of the launch form, turn on Agent Level, then select a gateway under Choose a backup gateway.

Backup options when launching an instance

4. Verify​

The agent is installed by a separate task named instance_enable_backup, which runs after the instance has finished its own deployment or update. Once the agent is installed and registered, secure_backup on the instance becomes true.

The Backup tab shows "This instance is configured for agent level backups". Restores and backup schedules are managed in the Secure Backup Command Center.

Instance Backup tab with Agent Level enabled

Instance backup fields​

FieldMeaning
backup_enabledLegacy field. Use backup_vm_enabled instead.
backup_vm_enabledVM-level backup is enabled.
backup_agent_enabledAgent-level backup is enabled. Requires a backup_gateway_id.
backup_gateway_idThe Backup Gateway the instance uses. It cannot be changed once set.
secure_backuptrue once the agent is installed and registered. Shown as backup_agent_installed in the CLI.

Limits and troubleshooting​

SymptomCause and fix
412 when creating a gateway: "Backup Gateway requires customers organisation to be registered with Commvault."Your account has no Secure Backup organisation. Contact ANS support to have one set up.
412 when deleting a gatewayInstances are still attached to it. Gateways cannot be deleted while in use.
422 when creating a gatewayThe specification is not offered in the router's availability zone. Choose one from that zone's specification list.
422 when assigning a gateway to an instanceThe gateway must be in the same VPC, availability zone and router as the instance.
"Agent level backups cannot be enabled without setting the backup gateway id"Send backup_gateway_id with backup_agent_enabled, or set the gateway first.
"Instance already has a backup gateway"An instance's gateway cannot be changed once set.
"Agent level backups cannot be disabled"You cannot disable the agent once secure_backup is true. Contact ANS support.
The instance_enable_backup task failsThe gateway may not be ready. Wait until its sync.status is complete and try again.
The instance has a volume group attachedThe agent cannot be configured automatically on these instances. Contact ANS support to have the agent configured.

Managing and deleting gateways​

You can only update the name of a gateway. To delete a gateway, first disable agent backup on every instance that uses it. If the agent is already installed on an instance (secure_backup is true), you cannot disable it yourself. Contact ANS support, or delete the instance. Then delete the gateway from the Backup Gateways list in Glass, or with the API or CLI:

ans ecloud backupgateway delete bgw-abcdef12
curl -s "${H[@]}" -X DELETE "$ECLOUD/backup-gateways/bgw-abcdef12" | jq

A router cannot be deleted while it still has a Backup Gateway.