Enterprise-class Data Protection with InfiniGuard from Infinidat

Background

Because IT is now woven into the very fabric of modern business, IT downtime has effects that ripple far beyond just the IT department. The astronomical costs of IT downtime, whether due to a successful cyberattack or the result of various IT system failures, are well publicized—often resulting in millions of dollars lost per incident. But less well documented are the other ways that business-critical application downtime can impact the business.

ESG market research reveals that modern organizations view IT downtime from at least two different perspectives—time and business factors such as lost revenue or productivity. From the time perspective, the duration of an IT outage has critical consequences for business. In fact, for most organizations, one hour of downtime can be a very long time. 15% of ESG research survey respondents stated that their organizations can tolerate essentially no downtime for their mission-critical applications—ever. And more than half (57%) reported that they cannot tolerate loss of these crucial applications for a full hour. ¹

In terms of the business factor, IT downtime affects organizations in several ways. Figure 1 shows the impacts that organizations believe can result from application downtime or lost data. At first glance, it might seem surprising that loss of employee productivity was a much more common response than loss of business revenue or damage to brand integrity. But remember that for organizations such as hospitals, utilities, and a wide range of service industries, salaries still continue and costs accrue when staff are idle. In fact, staff are so important to many organizations that loss of employee confidence was a more commonly cited response than loss of revenue. ²

Which of the following impacts to your organization could result from application downtime or lost data?
(Percent of respondents, N=378)

When security analysts are dealing with these challenges, attackers have an advantage. By investing in XDR, however, organizations can increase analyst effectiveness and efficiency―a sure way to strengthen their cybersecurity postures.

• Enterprise-class data protection performance that delivers up to 115 TB/hr. of backup performance to help customers meet the ever more stringent SLAs of the modern enterprise.

• Cost-optimized business continuity provided with a combination of technologies, including intelligent caching and data reduction.

• Enterprise-class fault tolerance that is built with an N+2 hardware redundancy philosophy that ensures data protection services will continue running after multiple concurrent hardware or media failures (e.g., N+2 processing server redundancy, InfiniRaid drive redundancy with an average media rebuild time of 15 minutes after a two-drive failure).

• Immutable cyber resilience that enables the quick and safe recovery of one or more application workloads after a cyber-attack (e.g., ransomware).

• Ease of deployment and management, enabled with plug and play interoperability for popular enterprise-class backup and database applications. To get started with InfiniGuard, simply change the configuration of an existing backup application to store backup data on a new InfiniGuard volume.

Performance has always been an important component of any good enterprise-class data protection solution. However, many of the recent innovations in this space have been focused on hero backup performance numbers and storage efficiency, often at the expense of recoverability at scale. In this section of the report, we explore some real-world recovery scenarios delivered by an InfiniGuard data protection storage solution with up to 50 PB of effective data protection storage capacity that can scale up to 115 TB/hr. of backup throughput with NetBoost.

The first scenario we explored, as shown in Figure 3, compared backup performance and restore performance in a lab environment for a database workload. The idea was to demonstrate how close InfiniGuard could come to delivering equal backup and restore performance. Here we leveraged a Linux server running a two terabyte Oracle Database with columnar compression and transparent data encryption enabled. We compared a first full backup to a full database recovery on the same Linux server connected over a 10 GbE network to a NetBoost-enabled share on an InfiniGuard target.

• Historically, full restore durations are typically a minimum of 50% longer than a full backup. InfiniGuard outperformed this metric with only a small 21% difference in duration between the Oracle Database full backup and full restore.

• The backup duration of 17 minutes and 20 seconds represents the results of full backup leveraging the NetBoost Protocol.

• The restore duration of 21 minutes and 50 seconds represents the results of complete Oracle Database recovery.

• It should be noted that with the NetBoost protocol, even the first full backup benefited from some level of client-side deduplication for improved performance. As the InfiniGuard deduplication index builds after each new backup, subsequent data protection operations should yield even higher performance results.

Next, we analyzed and audited the production environment of an organization that has deployed InfiniGuard. The customer is in the shipping and logistics industry and runs a multi-site configuration with two active data centers and one DR location. The customer migrated to InfiniGuard from a client server backup application with a mix of disk and tape targets. They have now migrated to a mostly virtual environment and leverage Veeam and InfiniGuard for backup, recovery, and DR. This new solution simplified the data protection storage infrastructure and now allows them to take advantage of improved deduplication and features like instant recovery. Even though the customer is leveraging both deduplication and immutable data snapshots, they are still able to leverage Veeam instant recovery capabilities to restore servers of any size in the environment in minutes with no discernable impact to production performance. As shown in Figure 4, data collected from the field from multiple customers and audited by ESG shows the solution is delivering a significant reduction in the amount of storage needed for protection. Call home system support data that was audited showed up to 31.8:1 data reduction with an average of 16:1 across the sample client set.

• Because of deduplication, on average only 60 GB of data needed to be stored with InfiniGuard to protect a terabyte of production data.

• InfiniGuard data reduction reduced the amount of backup data that needed to be stored by up to 97%.

Finally, we audited the results of an ongoing proof of concept (PoC) evaluation. A financial firm focused on college-level educational services was considering replacing their existing purpose-built backup appliances with InfiniGuard. As shown in Figure 5, we compared the restore throughput for a single production VM single stream recovery to InfiniGuard’s restore throughput.

• The InfiniGuard solution delivered 284% more throughput than the competitive solution.

• ESG expects that the InfiniGuard throughput advantage would be even greater for a multi-streamed restore of larger VMs.

Architecture Detail

A high-level overview of the architecture of the purpose-built InfiniGuard data protection appliance is depicted in Figure 6. Backup applications and database servers connect to up to 50 petabytes of effective capacity with up to 24 ports of Fibre Channel and Ethernet connectivity. Host connectivity options include a mix of FC and Ethernet storage networking transports and protocols (e.g., NFS for Unix servers and SMB for Windows servers as well as backup software specific protocols like NetBackup OST and VEEAM data mover).

Intelligent caching combines the cost effectiveness of high-capacity hard drives for persistent data storage with the performance acceleration of a relatively small amount of DRAM memory and SSD flash storage for caching. The combination of affordable hard drives for capacity and a judicious amount of intelligent caching for performance acceleration delivers near all-flash performance at a fraction of the cost of an all-flash backup appliance.

InfiniBand mesh interconnect provides a high-speed communications path between the connectivity, processing, and persistent layers of the InfiniGuard architecture. Any storage node in an InfiniGuard cluster can directly access memory in any of the other nodes in the cluster via direct memory access (i.e., RDMA). This approach reduces the cost, complexity, and latency overhead of a purpose-built backup appliance that uses a switched network for internal communication.

Capacity reduction is provided by deduplication and compression algorithms that are running on industry-standard servers in the processing layer. NetBoost source-side deduplication (currently supported for General Purpose File-system Targets on Linux and Windows Servers, Veritas NetBackup OST, Oracle RMAN, and IBM Db2) reduces network traffic and magnifies the capacity reduction savings.

Immutable snapshots and replication provide the write once read many (WORM) backup images and network isolation that are needed to ensure safe and rapid recovery after a cyber-attack (e.g., ransomware attack).

Figure 7 demonstrates how the CyberRecovery tab of the InfiniGuard management interface can be used to quickly recover from a ransomware attack.

System Management and Data Protection Integration

InfiniGuard is easy to manage via an intuitive HTML5 GUI that makes typically complex backup, replication, and recovery operations simpler while supporting most major backup applications already deployed in the data center.

ESG Validation testing began with a quick tour of the InfiniGuard management interface. Figure 8 shows 1PB of storage with two deduplication engines (DDE App A & DDE App B) with 400TB each, plus 200TB set aside for snapshots. Note how the available capacity and deduplication for each volume can be monitored with this intuitive user interface. If jobs were running, all the activity would be showing against the two active deduplication engines on the top left with a more typical data reduction rate of ten to 1 (10.0:1)

System health is displayed in the top center of the management interface where an indicator currently shows “peak health” as the status. To drill down deeper, “system health” is selected from the left side bar to display a dynamic user interface where you can click on a warning as shown towards the bottom right of Figure 8. In this case, we see a failed drive that needs attention. Due to the highly redundant architecture, the system can withstand many types of failures with no effect on performance or capacity. System snapshots can also be made immutable, giving users added protection and recoverability from a cyber-attack. Events are logged, and event rules can be set with alerts using SNMP or SMTP. System users are managed using an Active Directory via LDAP.

Provisioning InfiniGuard shares for data protection applications is easily done from the configuration tab. Figure 9 illustrates how two new NAS shares are provisioned. To create a NAS share, we started by naming the share and then choosing a protocol. Protocol options include CISF, SMB, and NFS or are application-specific. In this example, the application-specific NetBoost protocol was chosen with a goal of enabling source-side deduplication.

Figure 9 illustrates how two shares were created on a pair of data deduplication engines (DDEs). The “configure” option was used to configure replication settings, including the type of replication, the IP address of the remote InfiniGuard appliance, and access credentials.

InfiniGuard works with most major backup and recovery solutions to enhance their performance while providing advanced deduplication and compression technologies. Provisioning InfiniGuard to work with a customer’s chosen vendor is an easy process. Figure 10 shows a configuration with Commvault that can be done by configuring SMB, NFS, or NetBoost shares. For this example, NetBoost was configured. The process starts at InfiniGuard with the Deduplication Engine tab on the left sidebar. Next, we added a name for the share (cvnetboost2) and chose the “application specific” option to enable the NetBoost protocol. Finally, we assigned the IP address for the new share and configured Commvault credentials.

To run an initial full backup, we used the Commvault management interface to create a new job (or edit an existing job) with the InfiniGuard mount point as the new backup volume name (as shown in Figure 10). We ran the job on demand, and the first full backup started. From this same location, we scheduled incremental backups. As shown, creating and configuring InfiniGuard to work with Commvault or other backup software is a straightforward and easy process.

InfiniGuard offers deep integration with Veeam backup and replication software. To create an InfiniGuard backup repository in Veeam, we simply chose an NFS mount that was previously created with the InfiniGuard management interface (i.e., the DDE1DAE1 we created earlier, as shown in Figure 11).