[Yandex Cloud documentation](../../index.md) > [Tutorials](../index.md) > Storing and recovering data > Fault protection with Hystax Acura # Fault protection with Hystax Acura Regardless of where you host your resources, you can protect your infrastructure with Hystax Acura. Supported platforms: * Cloud services * Hypervisors * Physical servers To get started, create a VM with [Hystax Acura Disaster Recovery](https://yandex.cloud/en/marketplace/products/hystax/hystax-acura-disaster-recovery) to manage replication and recovery. Auxiliary Hystax Cloud Agent VMs will perform continuous and periodic replication. For a detailed description of the architecture, see this [Hystax overview article](https://xn--q1ach.xn--p1ai/documentation/disaster-recovery-and-cloud-backup/index.html#_2). To run Hystax Acura Disaster Recovery, follow these steps: 1. [Get your cloud ready](#before-begin). 1. [Create a service account and authorized key](#create-sa). 1. [Configure the network traffic permissions](#network-settings). 1. [Create a VM with Hystax Acura](#create-acura-vm). 1. [Configure Hystax Acura](#setup-hystax-acura). 1. [Prepare and install disaster recovery agents](#prepare-agent). 1. [Enable replication](#start-protection). 1. [Set up subnets to run the VMs](#prepare-network). 1. [Create a disaster recovery plan](#disaster-recovery-plan). 1. [Run tests](#run-tests). 1. [Perform disaster recovery](#run-recover). If you no longer need the resources you created, [delete them](#clear-out). ## Get your cloud ready {#before-begin} Sign up for Yandex Cloud and create a [billing account](../../billing/concepts/billing-account.md): 1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account. 1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../billing/quickstart/index.md) and [link](../../billing/operations/pin-cloud.md) a cloud to it. If you have an active billing account, you can create or select a [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud). [Learn more about clouds and folders here](../../resource-manager/concepts/resources-hierarchy.md). ### Required paid resources {#paid-resources} {% note info %} Note that both the Hystax Acura infrastructure and all recovered VMs will be charged and counted against the [quotas](https://console.yandex.cloud/cloud?section=quotas). * A VM for Hystax Acura Disaster Recovery uses 8 vCPUs, 16 GB of RAM, and a 200-GB disk. * Auxiliary Hystax Cloud Agent VMs use 2 vCPUs, 4 GB of RAM, and a 10-GB disk. A single Hystax Cloud Agent VM can serve up to six replicated disks at a time. Should the number of disks exceed six, this will automatically create additional Hystax Cloud Agent VMs. {% endnote %} The cost of resources for Hystax Acura Disaster Recovery includes: * Fee for disks and continuously running VMs (see [Yandex Compute Cloud pricing](../../compute/pricing.md)). * Fee for storing images (see [Compute Cloud pricing](../../compute/pricing.md)). * Fee for using a dynamic or static external IP address (see [Yandex Virtual Private Cloud pricing](../../vpc/pricing.md)). * Fee for each protected VM (see the [product description](https://yandex.cloud/en/marketplace/products/hystax/hystax-acura-disaster-recovery) in Cloud Marketplace). ## Create a service account and authorized key {#create-sa} Hystax Acura Disaster Recovery will run under a [service account](../../iam/concepts/users/service-accounts.md): 1. [Create](../../iam/operations/sa/create.md) a service account named `hystax-acura-account` with the `editor` and `marketplace.meteringAgent` roles. 1. [Create](../../iam/operations/authentication/manage-authorized-keys.md#create-authorized-key) an authorized key for the service account. Save the following details to use at the next steps: 1. Service account ID. 1. Service account authorized key ID. 1. Service account private authorized key. ## Configure the network traffic permissions {#network-settings} Configure the network traffic permissions in the [default security group](../../vpc/concepts/security-groups.md#default-security-group). If it is unavailable, any inbound or outbound VM traffic will be allowed. If a security group is available, [add](../../vpc/operations/security-group-add-rule.md) the following rules to it: Traffic
direction | Description | Port range | Protocol | Source /
Destination name | CIDR blocks --- | --- | --- | --- | --- | --- Inbound | `http` | `80` | `TCP` | `CIDR` | `0.0.0.0/0` Inbound | `https` | `443` | `TCP` | `CIDR` | `0.0.0.0/0` Inbound | `https` | `4443` | `TCP` | `CIDR` | `0.0.0.0/0` Inbound | `vmware` | `902` | `TCP` | `CIDR` | `0.0.0.0/0` Inbound | `vmware` | `902` | `UDP` | `CIDR` | `0.0.0.0/0` Inbound | `iSCSI` | `3260` | `TCP` | `CIDR` | `0.0.0.0/0` Inbound | `udp` | `12201` | `UDP` | `CIDR` | `0.0.0.0/0` Inbound | `tcp` | `15000` | `TCP` | `CIDR` | `0.0.0.0/0` Outbound | `http` | `80` | `TCP` | `CIDR` | `0.0.0.0/0` Outbound | `https` | `443` | `TCP` | `CIDR` | `0.0.0.0/0` Outbound | `vmware` | `902` | `TCP` | `CIDR` | `0.0.0.0/0` Outbound | `vmware` | `902` | `UDP` | `CIDR` | `0.0.0.0/0` Outbound | `iSCSI` | `3260` | `TCP` | `CIDR` | `0.0.0.0/0` Outbound | `udp` | `12201` | `UDP` | `CIDR` | `0.0.0.0/0` Save the security group ID. You will need it when creating the Hystax Acura VM. ## Create a VM with Hystax Acura {#create-acura-vm} Create a VM with a boot disk from the `Hystax Acura Disaster Recovery in Yandex Cloud` image. ### Start the VM {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to create your VM. 1. Navigate to **Compute Cloud**. 1. In the left-hand panel, select ![image](../../_assets/console-icons/server.svg) **Virtual machines**. 1. Click **Create virtual machine**. 1. Under **Boot disk image**: * Navigate to the **Marketplace** tab. * Click **Show all Marketplace products**. * In the list of public images, select [Hystax Acura Disaster Recovery in Yandex Cloud](https://yandex.cloud/en/marketplace/products/hystax/hystax-acura-disaster-recovery) and click **Use**. 1. Under **Location**, select an [availability zone](../../overview/concepts/geo-scope.md) where your VM will reside. 1. Under **Disks and file storages**, enter `200 GB` as the boot [disk](../../compute/concepts/disk.md) size. 1. Under **Computing resources**, select the `8 vCPU` and `16 GB` configuration. 1. Under **Network settings**: * In the **Subnet** field, enter the ID of a subnet in the new VM’s availability zone. Alternatively, select a [cloud network](../../vpc/concepts/network.md#network) from the list. * Each network must have at least one [subnet](../../vpc/concepts/network.md#subnet). If there is no subnet, create one by selecting **Create subnet**. * If there are no networks in the list, click **Create network** to create one: * In the window that opens, specify the network name and select the folder where it will be created. * Optionally, enable the **Create subnets** setting to automatically create subnets in all availability zones. * Click **Create network**. * If the list of **Security groups** is available, select the [security group](../../vpc/concepts/security-groups.md#default-security-group) whose network traffic permissions you previously configured. If this list is not there, the system will allow all inbound and outbound traffic for the VM. 1. Under **Access**, select **SSH key** and specify the VM access credentials: * In the **Login** field, enter a username, e.g., `yc-user`. * In the **SSH key** field, select the SSH key saved in your [organization user](../../organization/concepts/membership.md) profile. If there are no SSH keys in your profile or you want to add a new key: 1. Click **Add key**. 1. Enter a name for the SSH key. 1. Select one of the following: * `Enter manually`: Paste the contents of the public SSH key. You need to [create](../../compute/operations/vm-connect/ssh.md#creating-ssh-keys) an SSH key pair on your own. * `Load from file`: Upload the public part of the SSH key. You need to create an SSH key pair on your own. * `Generate key`: Automatically create an SSH key pair. When adding a new SSH key, an archive containing the key pair will be created and downloaded. In Linux or macOS-based operating systems, unpack the archive to the `/home//.ssh` directory. In Windows, unpack the archive to the `C:\Users\/.ssh` directory. You do not need additionally enter the public key in the management console. 1. Click **Add**. The system will add the SSH key to your organization user profile. If the organization has [disabled](../../organization/operations/os-login-access.md) the ability for users to add SSH keys to their profiles, the added public SSH key will only be saved in the user profile inside the newly created resource. 1. Under **General information**, specify the VM name: `hystax-acura-vm`. 1. Under **Additional**, select `hystax-acura-account`, the service account you created earlier. 1. Click **Create VM**. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. In the terminal, run this command: ```bash yc compute instance create \ --name hystax-acura-vm \ --zone \ --cores 8 \ --memory 16 \ --network-interface subnet-id=,nat-ip-version=ipv4,security-group-ids= \ --create-boot-disk name=hystax-acura-disk,size=200,image-id= \ --service-account-id \ --ssh-key ~/.ssh/id_ed25519.pub ``` Where: * `name`: VM name, e.g., `hystax-acura-vm`. * `zone`: [Availability zone](../../overview/concepts/geo-scope.md), e.g., `ru-central1-a`. * `cores`: [Number of vCPUs](../../compute/concepts/vm.md) the VM has. * `memory`: VM [RAM size](../../compute/concepts/vm.md). * `network-interface`: VM network interface description: * `subnet-id`: Subnet to connect your VM to. You can get the list of subnets using the `yc vpc subnet list` CLI command. * `nat-ip-version=ipv4`: Connect a public IP address. * `security-group-ids`: Security groups. You can get the list of groups using the `yc vpc security-group list` command. If you skip this parameter the system will assign the [default security group](../../vpc/concepts/security-groups.md#default-security-group). * `create-boot-disk`: Create a new disk for the VM: * `name`: Disk name, e.g., `hystax-acura-disk`. * `size`: Disk size. * `image-id`: Disk image ID. For this example, use `image_id` from the [product description](https://yandex.cloud/en/marketplace/products/hystax/hystax-acura-disaster-recovery) in Cloud Marketplace. * `service-account-id`: ID of the service account you [created previously](#create-sa). You can get the list of accounts using the `yc iam service-account list` command. * `ssh-key`: Path to the [public SSH key](../../compute/operations/vm-connect/ssh.md#creating-ssh-keys) file. {% endlist %} ### Convert the IP address to static VMs get a public dynamic IP address when created. Since a VM with Hystax Acura may reboot, you need to convert its IP address to static. {% list tabs group=instructions %} - Management console {#console} To convert a dynamic public IP address into a static one: 1. In the [management console](https://console.yandex.cloud), open the dashboard of the folder you are using. 1. Navigate to **Virtual Private Cloud**. 1. Navigate to the **Public IP addresses** tab. 1. Click ![image](../../_assets/options.svg) in the row with the address of your Hystax Acura VM. 1. In the menu that opens, select **Make static**. 1. In the window that opens, click **Change**. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. To convert a dynamic public IP address into a static one: 1. See the description of the CLI commands for updating the address attributes: ```bash yc vpc address update --help ``` 1. Get a list of the addresses: ```bash yc vpc address list ``` Result: ```text +----------------------+------+-----------------+----------+------+ | ID | NAME | ADDRESS | RESERVED | USED | +----------------------+------+-----------------+----------+------+ | e2l46k8conff8n6ru1jl | | 84.201.155.117 | false | true | +----------------------+------+-----------------+----------+------+ ``` The `false` value of the `RESERVED` parameter means the IP address with the `e2l46k8conff8n6ru1jl` `ID` is dynamic. 1. Convert the address to static by using the `--reserved=true` parameter and the address `ID`: ```bash yc vpc address update --reserved=true e2l46k8conff8n6ru1jl ``` Result: ```text id: e2l46k8conff8n6ru1jl folder_id: b1g7gvsi89m34pipa3ke created_at: "2023-06-02T09:36:46Z" external_ipv4_address: address: 84.201.155.117 zone_id: ru-central1-b requirements: {} reserved: true used: true ``` Now that `reserved` is `true`, the IP address is static. {% endlist %} ## Configure Hystax Acura {#setup-hystax-acura} 1. Open the `hystax-acura-vm` VM page in the [management console](https://console.yandex.cloud) and find its public IP address. 1. Enter the `hystax-acura-vm` VM public IP address in your browser. This will open the Hystax Acura initial setup screen. {% note info %} Booting the Hystax Acura Disaster Recovery VM for the first time will trigger an installation process which may take over 20 minutes. {% endnote %} 1. By default, a Hystax Acura VM has a self-signed certificate. 1. On the page that opens, fill out these fields: * **Organization**: Name of your organization. * **Admin user login**: Email address for logging in to the admin panel. * **Password**: Admin password. * **Confirm password**: Re-enter the admin password. 1. Click **Next**. 1. Specify the Yandex Cloud connection settings: * **Service account ID**: ID of the service account. * **Key ID**: ID of the service account authorized key. * **Private Key**: Private part of your service account authorized key. {% note info %} If you obtained the ID and private key in a JSON file, e.g., when creating an authorized key via the CLI, remove the line break characters (`\n`) from the ID and the private key. {% endnote %} * **Default folder ID**: ID of your folder. * **Availability zone**. * **Hystax Service Subnet**: `hystax-acura-vm` VM subnet ID. * **Public IP address of the Hystax Acura control panel**: Specify the public IP address of the Hystax Acura VM you got in step 1. 1. Click **Next**. Hystax Acura will automatically check whether it can access your cloud. If everything is correct, you can now log in to the Hystax control panel using your email address and password. ## Prepare and install the agents for disaster recovery {#prepare-agent} The agents will install on the VMs that will be recovered in Yandex Cloud. To download and install an agent: 1. In the Hystax Acura control panel, click the Hystax logo in the top-left corner. 1. Under **Machines Groups**, create a group of protected VMs, e.g, `Prod-Web`. 1. Go to the **Download agent** tab. 1. Select one out of three agent types depending on the OS: * VMware. * Windows. * Linux. Click **Next**. 1. Download and install the agent on the VMs you would like to protect: {% list tabs group=operating_system %} - VMware {#vmware} 1. From the drop-down list, select an instance group to prepare agents for, e.g., `Prod-Web`. 1. Select **New VMware vSphere** and fill in these fields: * **Platform Name**. * **Endpoint**: Public IP address of the ESXi host. * **Login**: User login. This user must have the admin permissions. * **Password**. Click **Next**. 1. Click **Download agent** and wait for the download to complete. 1. Unpack the downloaded OVA agent file on the ESXi host. 1. Start the VMs with the agent. - Windows {#windows} 1. From the drop-down list, select an instance group to prepare agents for, e.g., `Prod-Web`. 1. Click **Next**. 1. Click **Download agent** and wait for the download to complete. 1. Unpack the archive and install the agent from `hwragent.msi` on the VMs you want to protect. - Linux {#linux} 1. From the drop-down list, select an instance group to prepare agents for, e.g., `Prod-Web`. 1. Select the Linux distribution: * **CentOS/RHEL (.rpm package)**: CentOS or Red Hat-based. * **Debian/Ubuntu (.deb package)**. 1. Select the driver installation method: * **Pre-built**: Install a driver binary. * **DKMS**: Compile as you install. 1. Click **Next**. 1. You will get agent installation commands. Run these commands following the instructions for your distribution and installation method. {% endlist %} ## Enable replication {#start-protection} After the agent is installed on the VMs under protection, they will appear in the list as `Unprotected`. To enable VM replication: 1. Open the Hystax Acura control panel. Click the Hystax logo. 1. Under **Machines Groups**, deploy an instance group, e.g., `Prod-Web`. 1. In the right-hand VM list, click ![image](../../_assets/options.svg). 1. Set up a replication schedule and snapshot retention period using the **Edit replication schedule** and **Edit retention policies** options. For more information, see the [Hystax tutorials](https://xn--q1ach.xn--p1ai/documentation/disaster-recovery-and-cloud-backup/dr_overview.html#edit-retention-policies). 1. Select **Enable protection**. This will start VM replication. Once it is complete, the VMs will change their status to `Protected`. ## Set up the subnets to run the VMs {#prepare-network} The recovery process will create a cloud site, i.e., an infrastructure to support your application in Yandex Cloud that includes [subnets](../../vpc/concepts/network.md#subnet) and recovered VMs. Create subnets whose CIDRs will contain the IP addresses of your VMs. For example, if you are protecting two VMs with IP adresses `10.155.0.23` and `192.168.0.3`, create two subnets with CIDRs `10.155.0.0/16` and `192.168.0.0/24`. The subnets must reside in the same [availability zone](../../overview/concepts/geo-scope.md) as the Hystax Acura Disaster Recovery VM. To create subnets: {% list tabs group=instructions %} - Management console {#console} 1. Open the **Virtual Private Cloud** section in the folder where you want to create a subnet. 1. Click the cloud network name. 1. Click **Create subnet**. 1. Enter a name for the subnet, e.g., `net-b-155`. 1. From the drop-down list, select an availability zone, e.g., `ru-central1-b`. 1. Enter the subnet CIDR, such as `10.155.0.0/16`. 1. Click **Create subnet**. Save the **IDs** of the created subnets. You will need these when you create your disaster recovery (DR) plan. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. 1. Get a list of the cloud networks: ```bash yc vpc network list ``` Result: ```text +----------------------+----------------+ | ID | NAME | +----------------------+----------------+ | enplum7a98s1t0lhasi8 | network | +----------------------+----------------+ ``` 1. Select `NAME` or `ID` of the cloud network you need. Create a subnet: ```bash yc vpc subnet create \ --name net-b-155 \ --network-name network \ --zone ru-central1-b \ --range 10.155.0.0/16 ``` 1. To view the subnet list, run the command below: ```bash yc vpc subnet list ``` Result: ```text +----------------------+-------------+----------------------+----------------+---------------+------------------+ | ID | NAME | NETWORK ID | ROUTE TABLE ID | ZONE | RANGE | +----------------------+-------------+----------------------+----------------+---------------+------------------+ | e2lgjspicv43ainspl0n | net-b-155 | enplum7a98s1t0lhasi8 | | ru-central1-b | [10.155.0.0/16] | | e2l8g5u9ijd1sursv2ov | net-b-192 | enplum7a98s1t0lhasi8 | | ru-central1-b | [192.168.0.0/24] | | e2l1hqsrpp932ik74aic | net-b | enplum7a98s1t0lhasi8 | | ru-central1-b | [192.168.1.0/24] | +----------------------+-------------+----------------------+----------------+---------------+------------------+ ``` Save the `ID`s of the subnets you created. You will need these when you create your disaster recovery (DR) plan. {% endlist %} For more details, see [Step-by-step guides](../../vpc/operations/subnet-create.md) in the Virtual Private Cloud documentation. ## Create a disaster recovery plan {#disaster-recovery-plan} The DR plan includes a VM description and the network settings. You can have a plan generated automatically or create one manually. {% list tabs group=instructions %} - Automatically {#auto} To generate a DR plan automatically: 1. Open the Hystax Acura control panel. Click the Hystax logo. 1. Select the VMs you need from the list, click **Bulk actions**, and select **Generate DR plan**. You can also generate a plan for a VM group by clicking ![image](../../_assets/options.svg) in the group header. 1. In the **Title** field, enter the name: `Plan-1`. 1. Under **Subnets** on the right, specify the parameters of the previously created subnets: **Subned ID** and **CIDR**. 1. Click **Save**. - Manually {#manual} To create a DR plan manually: 1. Open the Hystax Acura control panel. Click the Hystax logo. 1. Click **Add DR plan**. 1. In the **Title** field, enter the name: `Plan-1`. 1. Use one of the modes below: * `Basic`: Create a plan with regular settings. * `Expert`: Create a plan with flexible settings using JSON (see the detailed syntax description [here](https://hystax.com/documentation/dr/dr_overview.html#id2)). 1. Add VMs by clicking ![image](../../_assets/options.svg). If required, specify an initialization order by using the **Move to another Rank** option. 1. If required, modify the parameters of the new VMs. To do this, specify the following in the **Flavor name** field: `---`, e.g., `2-8-16-100`. 1. Under **Subnets** on the right, specify the properties of the previously created subnets: **Subned ID** and **CIDR**. 1. Click **Save**. {% note warning %} Make sure you specified a valid IP address for each VM. {% endnote %} {% endlist %} ## Run tests {#run-tests} With regular tests, you can check your infrastructure fault tolerance as well as make early configuration changes. To run a test without shutting down the primary infrastructure: 1. Open the Hystax Acura control panel. Click the Hystax logo. 1. In the top navigation panel, select **Run test Cloud Site**. 1. Tick the disaster recovery plans you need in the list. Expand and edit the plan, if required. 1. Click **Next**. 1. In the **Cloud Site Name** field, enter a name, e.g., `Cloud-Site-from-Plan-1`. 1. In the **Restore point time** field, open the calendar window and select the restore point that will be used to create your VMs. 1. Under **Final DR plan**, make sure the plan is up-to-date and correct. 1. Click **Run Recover**. You will see the **Cloud Sites** section in the Hystax Acura control panel. Wait for `Cloud-Site-from-Plan-1` to change its status to `Running`. Open the [management console](https://console.yandex.cloud) and make sure these actions moved the required resources and your applications are ready to run. ## Perform disaster recovery {#run-recover} A real disaster recovery is no different to a test one: 1. Open the Hystax Acura control panel. Click the Hystax logo. 1. In the top navigation panel, select **Run Cloud Site**. Repeat the [test recovery](#run-tests) steps. ## How to delete the resources you created {#clear-out} Some resources are not free of charge. Delete the resources you no longer need to avoid paying for them: 1. [Delete](../../compute/operations/vm-control/vm-delete.md) `hystax-acura-vm`. 1. [Delete](../../compute/operations/vm-control/vm-delete.md) the secondary `cloud-agent` VMs. 1. [Delete](../../iam/operations/sa/delete.md) the `hystax-acura-account` service account. If you reserved a public static IP address, [delete it](../../vpc/operations/address-delete.md).