N2WS opens to the Dashboard – an overview of recent backups, recoveries, alerts, resources, and costs.

Depending on your device resolution, the Alerts tile may not appear in the Dashboard. Regardless of screen resolution, all Alerts are available by selecting Alerts in the toolbar.

The first step in using N2WS is to associate one or more of your cloud accounts with N2WS.

• With AWS accounts you will be able to:

  • Perform backup and recovery operations for a variety of AWS resource types

  • Perform Disaster Recovery (DR)

  • Copy to S3

  • Manage volume usage

  • Monitor costs and savings

• With Azure accounts you will be able to:

• Perform backup and recovery operations for Azure VMs and Disks. See section 26 for complete details.

3.1 Associating an AWS Account

To associate an AWS account for Recovery, you will need to either:

• Enter AWS credentials consisting of an access key and a secret key, or

• Use an IAM role, either on the N2WS server instance or cross-account roles.

Following are the steps to associate an N2WS account with an AWS account:

1. To manage your users and roles and obtain AWS credentials, go to the IAM console at https://console.aws.amazon.com/iam/home?#users​

   1. Follow the directions to either add a new account or view an existing account.

   2. Capture the AWS credentials.

2. If the AWS account will be operating in special regions, such as China Cloud or US Government Cloud, see section 3.1.5 before adding the account in N2WS.

3. To associate the AWS account with an N2WS account, go to N2WS:

   1. In the left panel, select the Accounts tab.

   2. In the New menu, select AWS account.

   3. Complete the fields, entering the required information for the Account Type and Authentication method.

3.1.1. Account Type

If you are using the Advanced or Enterprise Edition or a free trial, you will need to choose an account type.

• The Backup account is used to perform backups and recoveries and is the default 3333.

• The DR account is used to copy snapshots to as part of cross-account functionality.

  • You choose whether this account is allowed to delete snapshots. If the account not allowed to delete snapshots when cleaning up, the outdated backups will be tagged. Not allowing N2WS to delete snapshots of this account implies that the presented IAM credentials do not have the permission to delete snapshots.

  • Enable Use Secured DR Account to select specific permissions for resource types and activities for prohibition. The Secured DR Account Check operation warns the N2WS user about the existence of Prohibited Permissions in IAM policies of the DR account. Turn on the Check Secured DR Account Periodically toggle to perform a period check of whether the DR account backups are compromised by the presence of the prohibited permissions. For details about period and immediate checking of the account, see section 3.1.4.

For accounts operating in special regions, in the AWS Cloud Type list, select the type of AWS cloud. See section 3.1.5.

3.1.2. Authentication

N2WS Supports the following methods of authentication:

• IAM User - Authentication using IAM credentials, access and secret keys.

• CPM Instance IAM Role – If an IAM role was assigned to the N2WS server at launch time or later, you can use that IAM role to manage backups in the same AWS account the N2WS server is in.

• Assume Role – This type of authentication requires another AWS account already configured in N2WS. If you want to use one account to access another, you can define a cross-account role in the target account and allow access from the first one. The operation of using one account to take a role and accessing another account is called assume role.

To allow account authentication using Assume Role in N2WS:

1. In the Authentication box, choose Assume Role.

2. In the Account Number box, type the 12-digit account number, with no hyphens, of the target account.

3. In the Role to Assume box, type the role name, not the full Amazon Resource Name (ARN) of the role. N2WS cannot automatically determine what the role name is, since it is defined at the target account, which N2WS has no access to yet.

4. The External ID box is optional unless the cross-account role was created with the 3rd party option.

5. In the Assuming Account list, choose the account that will assume the role of the target account. If you are the root user or independent user and have managed users defined, an additional selection list will appear enabling you to select the user.

6. Select Scan Resources to include the current account in tag scans performed by the system. Once Scan Resources is Enabled:

   1. In the Scan Regions list, select the regions to scan. To select all regions, select the checkbox at the top of the list. To filter regions, start typing in the search box.

   2. In the Scan Resource Types list, select the types of resources to scan. Select the top checkbox for all, or use the search box to filter types.

7. The Capture VPCs option defaults to enabled. Clear Capture VPCs to disable for this account. See section 23.

8. Select Save.

3.1.3 Secured DR Account

The DR account is a secure entity. In N2WS version 3.2.0, N2WS has taken the security to a higher level with the N2WS Secured DR feature, which hardens N2WS security. It allows the N2WS user to better protect the backups of his resources by making sure that backups kept in the DR account are not compromised through the use of unwanted permissions. N2WS can perform a periodic check to alert the user about IAM Users/Roles of the DR account that have unwanted IAM permissions.

The risk of unwanted permissions is demonstrated in the following example:

• If an IAM Role of a DR account has an attached policy that includes the “ec2:DeleteSnapshot” permission, the snapshot is in danger of getting deleted.

The N2WS user has the flexibility of defining risky permissions for an account.

To define a 'Secured' DR Account and prohibited permissions:

1. In the Accounts tab, select a DR account and then select Edit.

2. Select Use Secured DR Account and then select Select Prohibited Permissions. By default, all permissions are prohibited.

3. For each type of target or action, clear the permissions to be 'allowed', and then select Apply.

4. Select Save.

N2WS will check for policies whose account has permissions defined as 'prohibited' and list them as compromised in the check log. You can then generate the Secured DR Account Report to identify the accounts and policies at risk. See section 3.1.4.

The required IAM permissions for the DR account to check its users and roles are:

• iam:ListUsers

• iam:ListRoles

• iam:SimulatePrincipalPolicy

• iam:ListAccessKeys, for authentication

3.1.4 Checking Secured DR Accounts

Two reports are available for checking Secured DR Accounts. If the Check Secured DR Account ‘Show Log’ indicates that there are compromised permissions, then you can run the Generate Secured DR Report to view the policies and users with the compromised permissions.

• Check Secured DR Account – Creates a summary status log (Show Log) with the number of policies and accounts with compromised permissions. The check can be run periodically throughout the day or run immediately.

• Generate Secured DR Report - A detailed list of the AWS policies and the prohibited permissions that are compromised for an account of the current user.

To check Secured DR Accounts:

1. In the General Settings tab, select the Security tab.

2. To check the DR accounts periodically during the day, select Check Secured DR Account, select an hourly interval in the Secured DR Check Interval list, and then select Save.

3. To run the report immediately, select Check Secured DR Account Now, and confirm.

   1. To view the progress and status of the operation, select Background Tasks in the toolbar. Background Tasks only appears after the first Check Secured DR Account or Clone VPC operation. Select View All Tasks.

4. To view the log, select Show Log. To download, selectDownload Log in the upper right corner of the log. The Secured_DR_Account_check_log_<date>_<time>.csv file contains Log Time, security Level Type, and Log Message.

To generate Secured DR Account reports:

1. In the Accounts tab, select a DR (Secured) account.

2. To check the status of the Secured DR Account periodically during the day:

   1. Select Edit.

   2. Turn on the Check Secured DR Account Periodically toggle.

   3. To view the interval for checking Secured DR Accounts, select the Secured DR Check Interval hours.

   4. Select Save.

3. To run the detailed report, in the Accounts tab list, select a DR (Secured) Account, and then select Generate Secured DR Report.

The downloaded file (Secured_DR_Account_check_<account>_<date>_<time>.csv) contains a list with the following data:

• AWS IAM Policy

• AWS Policy’s User/Role

• Compromising Permission

3.1.5 Special Regions

If the account that you are about to create will be operating with non-standard AWS regions, such as China or US government clouds, it is necessary to first contact N2WS Support (see section 3.6) to adjust the N2WS configuration. After N2WS Support has made the adjustment, when you create the N2WS account, you will be prompted for the AWS Cloud Type.

The type of cloud will appear in the Cloud column in the list of policies.

3.2 Associating an Azure Account

To associate an Azure account with an N2WS account, see section 26.

3.3. Deleting Accounts

There are two options when deleting an account:

• Delete the CPM account and all its resources and metadata, BUT leave the AWS account and all its related data on AWS. Select Delete.

• Delete the CPM account and all its resources and metadata, AND delete the AWS account and all its data, including S3 Repositories. Select Delete Account and Data.

In each case, you will be provided with an explanation of the scope of the delete and a prompt to confirm. In the Delete Account confirmation dialog box, type ‘delete me’ and then select Delete.

3.4 Managing Volume Usage

As part of starting to use N2WS, you might want to enable alerts for when a volume's usage exceeds high and low thresholds. Volume usage reporting can become an integral part of the Dashboard.

If the Volume Usage Alert is enabled, a generic message for volumes exceeding the threshold will appear on the Dashboard Alerts tile. In the Volume Usage Percent tile, the number of volumes below, within, and above the thresholds are shown.

To report volume usage:

1. In General Settings of the Server Settings, select the Volume Usage Percent tab.

2. Select Enable Volume Usage Alert.

3. Enter a percentage in the High Usage Threshold and Low Usage Threshold (%) boxes for when to initiate an alert.

4. To enable an alert for each time a backup is run on a volume with usage exceeding the High or Low Usage Threshold, select Alert Recurring Volume. The recurring alert is turned off by default, and the alert is initiated only when there is a change in the usage or a change in the threshold that has caused the initiation.

5. Select Save.

If there is a volume usage alert, select the Volume Usage tab in the main screen to view the specific volume and percentage which initiated the message.

You can evaluate whether additional volumes are nearing the alert thresholds by adjusting the High Usage and Low Usage Thresholds in the Volume Usage screen and selecting the Enter key.

If a volume’s usage changes from high to low, or low to high, there will be an additional alert for that volume.

3.5 Importing Non-N2WS Backups to S3

You can quickly lower your storage costs for existing non-N2WS backups by moving them to a more economical S3 storage class. After successfully importing your snapshots with the AnySnap Archiver feature, you can then safely delete the original snapshots.

Importing consists of the following steps:

1. In AWS, apply custom tags to backups to import.

2. In N2WS, create an S3 Repository. See section 21.1.

3. In the Policies tab, create an Importer Policy with identical custom tags. The maximum number of custom tags per policy is 20.

4. Verify a scan of the snapshots to import by executing Import Dry Run.

5. Start the import. Review the progress in the Policies tab.

6. If necessary, pause the import to change the S3 configuration or to postpone the migration process. See section 21.2.1.

7. Review the import process with Show Imported Backups or Show Import Log for snapshots imported to S3.

8. After the import process, N2WS attaches an import_policy_name tag with the name of the policy to the snapshot. The tag excludes the snapshot from additional importing.

   1. If necessary to restart the import, remove the import_policy_name tag using the AWS Snapshot console.

   2. For bulk tag removals, use the AWS Resource Group service. Verify that you have the correct tag key/value pair.

The Import Dry Run scans all AWS snapshots defined in the Importer Policy and marks for import those meeting the following criteria:

• Snapshot date is within the Start/End Time Range.

• AWS tag values equal the Import by Tags values defined in the Policy.

• Snapshot date is the latest within the Record Duration. N2WS marks for import the last backup made within the number of hours defined as record duration. If the duration is set for 2 and there are 3 snapshots with import tags within a 2-hour period, only the last snapshot will be imported.

3.5.1 Creating an Importer Policy

1. In the Policies tab, select New Importer Policy.

2. In the Policy Details tab:

   1. Enter the policy Name, and select the User and Account.

   2. The optional Description box would be an excellent place to identify details of the import.

3. In the Import Parameters tab:

   1. Select the Start/End Source Data Time Range. End Time defaults to Up to Import Start.

   2. In the Backup Record Interval (Hours) list, select the number of hours from which to select the latest snapshot. For example, if you select 6 and there are 4 snapshots within a period of 6 hours, only the last one of the 4 snapshots is imported.

   3. Enter at least 1 Import by Tags. All regions in the specified account will be scanned.

4. In the S3 Storage Configuration tab, there must be at least 1 retention condition:

   1. In the Keep backups in S3 for at least lists, select a minimum retention period.

   2. To move S3 backups for archival in Glacier, turn on the Archive to Glacier toggle and select the archiving frequency and retention period.

   3. In the Target repository list, select the repository to import to.

   4. In the S3 Storage class list, select the storage type for this import. Default is Standard.

   5. If Archive to Glacier is enabled, select an Archive Storage Class.

5. Select Save. After saving, the Import Dry Run and Start Import buttons are enabled, and the import status in the far-right column is Not Started.

3.5.2 Testing Import with Dry Run

After creating the Importer policy, select the policy, and then select Import Dry Run. In the upper right corner, the Dry Run Started message appears. Shortly after the Dry Run completes and the Started message has automatically closed, the Import Snapshots Dry Run [policy name] yyyy mm dd hh mn.CSV file downloads. The report contains the list of the snapshots scanned and whether they meet the criteria for import. Fields include Backup Record number, CPM Account number, AWS Account number, Import (Yes or No), Region, Type (Resource), Volume, Snapshot ID, Start Time, Volume Size in GB, and the Dry Run Parameters.

Review and make adjustments to the Import policy or tags as needed.

3.5.3 Running the Migration

To perform the actual import:

1. Select the policy, and then select Start Import. The Import policy started message appears.

2. To view progress details of the import process:

   1. Select Show Import Log.

   2. In the far-right column, view the migration status symbol. Refer to the table of status symbols in section 3.5.4.

3. If it is necessary to pause the import to S3, in the Policies tab, select Pause Import. To resume, select Resume Import, and the process will restart the copy of the paused snapshot from scratch.

4. If it is necessary to stop the import to S3, in the Backup Monitor, when the Lifecycle Status is 'Storing in S3 ...', select Abort Copy to S3. To resume, in the Policies tab, select Resume Import, and the process will restart the copy of the snapshot from the beginning.

5. In the Backup Monitor, you can view the final status of the import in the Lifecycle Status column. For statuses other than Stored in S3, hover over the symbol for a description of the status.

6. In the Policy tab, when the import is finished:

   1. Select Show Imported Snapshots.

   2. To lower costs, you can Delete EBS Snapshots. The icon is active only if the import was 100% successful.

Snapshots imported to S3 are included in the Backup and Snapshot reports. See section 17.7.

3.5.4 Migration Progress and Status Symbols

During the actual migration, you can monitor the progress in the Policies tab by viewing the following migration status symbols in the far-right column. A symbol indicates that the policy is an importer policy, and its color and design indicate its migration status. Following is a summary of the symbol colors:

• Yellow: Not started, paused, pausing, no items found

• Green: Scanning, running, deleting EBS snapshots (with some yellow)

• Blue: Copy complete, moved to S3

• Red: Copy failed

3.6 N2WS Help and Support

You can email support issues to N2W Software support.

For online help and support, select Help & Support in the upper right toolbar.

You can view your current privileges on the N2WS licensed server or activation key by selecting About and then selecting Show license and server details.

For self-service support using the N2WS knowledge base, documentation, how-to guides, and tutorial videos go to the N2WS Support Center by selecting Support.

To go directly to the docs and guides, select Documentation.

To collect and download support logs, selectDownload Logs. In the Download Support Logs dialog box, select the relevant logs and time frame, and then select Download Logs.

• Check AWS permissions – Against the required permissions for AWS services and resources.

• Collect S3 Worker Logs – When S3 support is needed.

• Collect System Logs – For comprehensive system debugging.

• Collect Backup Logs from Last - Select Day, Week, or Month in the list.

​