2 Configuring N2WS

BEFORE upgrading to version 3.0 from versions 2.4-2.7, Copy to S3 customers must review section 2.3.2 (Wizard Step 4) about special conditions for data recovery.
The N2WS management console is accessed via a web browser over HTTPS.
When a new N2WS Server is launched, the server will automatically generate a new self-signed SSL certificate. This certificate will be used for the web application in the configuration step.-
If no other SSL certificate is uploaded to the N2WS Server, the same certificate will be used also for the main N2WS application.
Every N2WS Server will get its own certificate.
Since the certificate is not signed by an external Certificate Authority, you will need to approve an exception in your browser to start using N2WS.
When configuring the N2WS server, define the following settings:
AWS Credentials for the N2WS root user.
Time zone for the server.
Whether to create a new CPM data volume or attach an existing one from a previous N2WS server.
Whether to create an additional N2WS server from an existing data volume during Force Recovery Mode.
Proxy settings. Configure proxy settings in case the N2WS server needs to connect to the Internet via a proxy. These settings will also apply to the main application.
The port the web server will listen on. The default is 443. See section 1.3.3.
Whether to upload an SSL certificate and a private key for the N2WS server to use. If you provide a certificate, you will also need to provide a key, which must not be protected by a passphrase.
Register the AWS account with N2W Software. This is mandatory only for free trials but is recommended for all users. It will allow N2WS to provide quicker and enhanced support. Registration information is not shared.
For the configuration process to work, as well as for normal N2WS operations, N2WS needs to have outbound connectivity to the Internet, for the HTTPS protocol. Assuming the N2WS server was launched in a VPC, it needs to have:
A public IP, or
An Elastic IP attached to it, or
Connectivity via a NAT setup, Internet Gateway, or HTTP proxy.
If an access issue occurs, verify that the:
Instance has Internet connectivity.
DNS is configured properly.
Security groups allow outbound connections for port 443 (HTTPS) or other (if you chose to use a different port).
Following are the configuration steps:
1.Approve the end-user license agreement.
2.Define the root username, email, and password.
3.Define the time zone of the N2WS Server and usage of data volumes.
4.Fill in the rest of the information needed to complete the configuration process.
2.1 Instance ID
To initially be identified as the owner of this instance, you are required to type or paste the N2WS server instance ID. This is just a security precaution.
In the next step of the configuration process, you will also be required to approve the end-user license agreement.
2.2 License Agreement and Root User
The License field is presented. Select I’m starting a free trial for a free trial. Otherwise, select the appropriate license option in the list, such as Bring Your Own License (BYOL) Edition. Alternatively, if your organization purchased a license directly from N2W Software, additional instructions are shown.
The AWS root user (IAM User) is no longer allowed to control the operation of the N2WS server. A user with the Authentication credentials for N2WS Instance IAM Role is the only user allowed to install N2WS, log on to the system server, and operate it. As shown below, you need to define the root username, email, and password. This is the third step in the configuration process. The email may be used when defining Amazon Simple Notification Service (SNS) based alerts. Once created, choose to automatically add this email to the SNS topic recipients.
Passwords: N2WS recommends that you use passwords that are difficult to guess and that are changed from time to time. For the password rules that N2WS enforces, see section 16.2.3.
2.3 Defining Time Zone, Data Volume, Force Recovery Mode, Web Proxy
In the fourth step of the configuration process, you can:
Set the time zone of the N2WS Server.
If using a paid license, choose whether to create a new data volume or to use an existing one. Your AWS credentials will be used for the data volume setup process.
Create an additional N2WS server in recovery mode only, by choosing an existing data volume and set Force Recovery Mode.
Configure proxy settings for the N2WS server. See section 2.3.3.
As you will see in section 4.1.3, all scheduling of backup is performed according to the local time of the N2WS Server. You will see all time fields displayed by local time; however, all time fields are stored in the N2WS database in UTC. This means that if you wish to change the time zone later, all scheduling will still work as before.
As you can see below, the choice of new or existing data volume is made here. Actual configuration of the volume will be accomplished at the next step.
AWS credentials are required to create a new Elastic Block Storage (EBS) data volume if needed and to attach the volume to the N2WS Server instance.
If you are using AWS Identity and Access Management (IAM) credentials that have limited permissions, these credentials need to have permissions to view EBS volumes in your account, to create new EBS volumes, and to attach volumes to instances. See section 16.3. These credentials are kept for file-level recovery later on and are used only for these purposes.
If you assigned an IAM Role to the N2WS Server instance, and this role includes the needed permissions, select Use Instance’s IAM Role, and then you will not be required to enter credentials.
2.3.1 New Data Volume
When creating a new data volume, the only thing you need to define is the capacity of the created volume. You also have the option to encrypt the volume, as described in section 2.4.1.
The volume is going to contain the database of N2WS’s data, plus any backup scripts or special configuration you choose to create for the backup of your servers. The backup itself is stored by AWS, so normally the data volume will not contain a large amount of data.
The default size of the data volume is 5 GiB.
This is large enough to manage roughly 50 instances and about 3 times as many EBS volumes.
If your environment is larger than 50 instances, increase the volume at about the ratio of 1 GiB per 10 backed-up instances.
The new volume will be automatically created in the same AZ as the N2WS instance It will be named N2WS Data Volume. During the configuration process, the volume will be created and attached to the instance. The N2WS database will be created on it.
2.3.2 Existing Data Volume
Important notice for Copy to S3 customers BEFORE upgrading to version 3.0:
All data previously archived to S3, using versions 2.4-2.6.x, cannot be recovered using version 3.0.
To allow recovery of such data in the future, create an AMI of your current N2WS instance BEFORE upgrading to version 3.0.
To do this, follow all the steps outlined in the version 3.0 Upgrade Instructions BEFORE continuing your upgrade.
For additional information, see Release Notes.
The Existing data volume option is used if:
You have already run N2WS and terminated the old N2WS server, but now wish to continue where you stopped.
You are upgrading to new N2WS releases.
You are changing some of the configuration details.
You want to configure an additional N2WS server in recovery mode only. See section 2.3.4.
The select box for choosing the volumes will show all available EBS volumes in the same AZ as the N2WS Server instance. When choosing the volumes, consider the following:
It is important to create the instance in the AZ your volume was created in the first place.
Another option is to create a snapshot from the original volume, and then create a volume from it in the AZ you require.
Although N2WS data volumes typically have a special name, it is not a requirement. If you choose a volume that was not created by an N2WS server for an existing data volume, the application will not work.
2.3.3  Proxy Settings
If the N2WS server needs an HTTP proxy to connect to the Internet, define the proxy address, port, user, and password. The proxy settings will be kept as the default for the main application. In the N2WS UI, proxy settings are made in the Proxy tab of 
 Server Settings > General Settings.
Make sure to enable SSH connections (port 22) through your proxy.
2.3.4 Force Recovery Mode
You can configure an additional N2WS server, in recovery mode only, by choosing an existing data volume:
In step 4, choose to use an existing volume and in the Force Recovery Mode, select Yes.
In step 5, in the Existing CPM Data Volume list, select the volume that holds your backup records.
The N2WS server configured for recovery mode will NOT:
Perform backups.
Perform data Lifecycle Management operations.
Have Resource Control management.
Perform any scheduled operations.
2.4 Complete Remaining Fields in N2WS Configuration
In the fifth step, you will fill in the rest of the information needed for the configuration of the data volume for the N2WS Server.
If you chose to create a new volume, you can choose the volume capacity, type, and whether to encrypt.
If you chose to use an existing volume, you will see a drop-down volume selection box instead of the volume capacity field:
2.4.1 Encrypting a New Data Volume
If you choose a new data volume, you have an option to encrypt CPM user data. You also have the option to encrypt a new data volume if using the silent configuration mode. See section 2.8.
Select Encrypted in the Encrypt Volume drop-down list and choose a key in the Encryption Key list. You have the option to use a custom ARN.
2.4.2 Web Server Settings
Port 443 is the default port for the HTTPS protocol, which is used by the N2WS manager. If you wish, you can configure a different port for the web server. But, keep in mind that the specified port will need to be open in the instance’s security groups for the management console to work, and for any Thin Backup Agents that will need to access it.
The final detail you can configure is an SSL certificate and private key.
If you leave them empty, the main application will continue to use the self-signed certificate that was used so far.
If you choose to upload a new certificate, you need to upload a private key as well. The key cannot be protected by a passphrase, or the application will not work.
If a corrupted SSL certificate is installed, it will prevent the N2WS server from starting.
2.4.3 Anonymous Reports Setting
Leaving the Anonymous Usage Reports value as Allow permits N2WS to send anonymous usage data to N2W Software. This data does not contain any identifying information:
No AWS account numbers or credentials.
No AWS objects or IDs like instances or volumes.
No N2WS names of objects names, such as policy and schedule.
It contains only details like:
How many policies run on an N2WS server
How many instances per policy
How many volumes
What the scheduling is, etc.
2.5 Registering and Finalizing the Configuration
After filling in the details in the last step, you are prompted to register. This is mandatory for free trials and optional for paid products.
Select Configure System to finalize the configuration. The configuration will take between 30 seconds and 3 minutes for new volumes, and usually less for attaching existing volumes. After the configuration is complete, a ‘Configuration Successful – Starting Server …’ message appears. It will take a few seconds until you are redirected to the login screen of the N2WS application.
If you are not redirected, refresh the browser manually. If you are still not redirected, reboot the N2WS server via AWS Management Console, and it will come back up, configured, and running.
2.6 Configuration Troubleshooting
Most inputs you have in the configuration steps are validated when you select Next. You will get an informative message indicating what went wrong.
A less obvious problem you may encounter is if you reach the third step and get the existing volume select box with only one value in it: No Volumes found. This can arise:
If you chose to use an existing volume and there are no available EBS volumes in the N2WS Server’s AZ, you will get this response. In this case, you probably did not have your existing data volume in the same AZ. To correct this:
Terminate and relaunch the N2WS server instance in the correct zone and start over the configuration process, or
Take a snapshot of the data volume, and create a volume from it in the zone the server is in.
If there is a problem with the credentials you typed in, the “No Instances found” message may appear, even if you chose to create a new data volume. This usually happens if you are using invalid credentials, or if you mistyped them. To fix, go back and enter the credentials correctly.
In rare cases, you may encounter a more difficult error after you configured the server. In this case, you will usually get a clear message regarding the nature of the problem. This type of problem can occur for several reasons:
If there is a connectivity problem between the instance and the Internet (low probability).
If the AWS credentials you entered are correct, but lack the permissions to do what is needed, particularly if they were created using IAM.
If you chose an incorrect port, e.g., the SSH port which is already in use.
If you specified an invalid SSL certificate and/or private key file.
If the error occurred after completing the last configuration stage, it is recommended that you:
1.Terminate the N2WS server instance.
2.Delete the new data volume (if one was already created).
3.Try again with a fresh instance.
If the configuration still fails, the following message will display. If configuring a new instance does not solve the problem, contact N2W Software Support Team. To access configuration error details, select Download Configuration Logs.
2.7 Modifying the Server Configuration 
If you need to change the configuration of your N2WS server after it has already been created, you may need to:
Change the time zone
Reset the N2WS root user password
Change SSL credentials
Change the HTTPS port
The process to make these changes is to terminate the current N2WS server instance and create a new one. After you terminate the N2WS server, the data volume becomes available. Configure the server as needed and connect to the old (existing) data volume.
Remember to launch the new server in the same AZ.
For the N2WS root user, you may change the email or the password. The username of the root user cannot be changed. If during the configuration process, you type a different username than the original, N2WS will assume you forgot the root username. In that case, the username will not change, and a file named /tmp/username_reminder will be created on the N2WS server. It will contain the username. You can connect to N2WS server using SSH to view this file. See section 7.1.
2.8 Configuring in Silent Mode
Launching an EC2 instance in AWS can optionally be set with User Data. See the description of how such user data can be utilized at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html.
The N2WS instance can also use this user data when launching.
If the string CPMCONFIG exists in the user data text, then the text following it is used for the CPM configuration.
The extraction is until the string CPMCONFIGEND or the end of the data.
The extracted text is assumed to be in .ini file format.
The extracted configuration text of the new N2WS instance should start with a [SERVER] section, followed by the configuration details.
For the relevant time_zone parameter value, see Appendix C.
Following is an example of the whole script:
1
[any-script-before-cpmconfig]
2
CPMCONFIG
3
[SERVER]
4
user=<username for the N2WS user>
5
password=<password>
6
volume_option=<new or existing>
7
volume_size=<in GB, used only for the new volume option>
8
volume_id=<Volume ID for the data volume, used only in the existing volume option>
9
volume_type=<set your storage performance and cost.
10
   The default is “gp3”. It can be set to “io1”, "io2", “gp2” or "gp3">
11
snapshot_id=<snapshot ID to create the data volume from, used only with the existing volume option, and only if volume_id is not present>
12
encryption_key=<encrypt user-data volume by setting the ARN of the 
13
   KMS key. used only for the new volume option>
14
time_zone=<set N2WS server’s local time.
15
   The default timezone is GMT. See Appendix C for available time zones.> 
16
allow_anonymous_reports=<send anonymous usage data to N2W Software. 
17
   The default is “False”>
18
force_recovery_mode=<allow additional N2WS server to perform recovery
19
   operations only. The default is “False”. If it set to “True” - it
20
   requires volume_option=existing>
21
activation_key=<Activation Key>
22
CPMCONFIGEND
23
[any-script-after-cpmconfig]
Copied!
Additionally, if you need the N2WS server to connect to the Internet via an HTTP proxy, add a [PROXY] section:
1
[PROXY]
2
proxy_server=<address of the proxy server>
3
proxy_port=<proxy port>
4
proxy_user=<user to authenticate, if needed>
5
proxy_password=<password to authenticate, if needed>
Copied!
The snapshot option does not exist in the UI. It can be used for the automation of a Disaster Recovery (DR) server recovery. Additionally, if you state a volume ID from another AZ, N2WS will attempt to create a snapshot of that volume and migrate it to the AZ of the new N2WS server. This option is for DR only.
You are not required to select the license terms when using the silent configuration option, since you already approved the terms when subscribing to the product on AWS Marketplace.
After executing the configuration, on the AWS Instances page, select the Tags tab. If the CPM_Silent_Configuration key value equals ‘succeeded’, then the CPM instance was successfully launched with the user data configured in silent mode.
To verify configuration user data:
1.In AWS, select the CPM instance.
2.In the right-click menu, select Instance Settings, and then select View/Change User Data.
2.9 Maintaining N2WS
To keep your N2WS running at its highest efficiency, N2WS will occasionally send you notification of the existence of a patch through an Announcement or an email. Download the patch according to the notification instructions.
To install patches:
1.In the top right toolbar, select 
 Server Settings and then select Patches.
2.Select Choose file to select the patch file.
3.Select Upload and Install.
2.10 Using AWS Key Management Service
The AWS Key Management Service (KMS) allows you to securely share custom encryption keys between accounts. For details on enabling shared custom keys, see https://aws.amazon.com/blogs/security/share-custom-encryption-keys-more-securely-between-accounts-by-using-aws-key-management-service/.
The use of custom keys is required in the following cases:
Authentication of cpmuser to N2WS server using a non-default certificate with a private key.
Encrypting new volumes.
Associating an account for File Level Recovery.
Authentication of IAM User.
Running scripts.
Performing Recoveries, DR, and Cross-Account activities for RDS, EC2, and EFS resources.