READYNAS INSTANT STORAGE

User Guide
Updated for RAIDiator 3.01c1-p5
Copyright 2006, Infrant Technologies Inc. All rights reserved. http://www.infrant.com
ReadyNAS, X-RAID, FrontView, RAIDar, RAIDiator, Network Storage Processor, and NSP are trademarks or registered trademarks of Infrant Technologies Inc. All other product names are the property of their respective owner. P/N: IT-05-1-1040-U-08

Page 2 2

Contents

About This Guide 7 8

1 FrontView Advanced Control Network 10

Ethernet

Speed/Duplex Mode MTU VLAN Setting Performance Setting
Wireless Global Network Settings
Hostname Default Gateway DNS

WINS DHCP Route

Security
Admin Password Security Mode Selection Share Security Mode
Specify a Workgroup Share Accounts Specify a Workgroup Setting up Accounts Managing Groups Managing Users Setting Accounts Preferences Domain/ADS Authentication

User Security Mode

Domain Security Mode

Page 3 3

Services

Setting up Accounts

Standard File Protocols Streaming Services Discovery Services

Volumes

Volume Management
Advantages of Flex-RAID Advantages of X-RAID Deleting a Volume Adding a Volume RAID Settings X-RAID Redundancy Overhead X-RAID Has one data volume Adding a 2nd DISK for Redundancy Adding a 3rd and 4th DISK for MORE Capacity Replacing All Your Disks for Even MORE Capacity
Volume Management for Flex-RAID
Volume Management for X-RAID
Changing Between X-RAID and Flex-RAID Modes Snapshot
Shares Taking and Scheduling Snapshot Resizing Snapshot Space
USB Storage Adding Shares Managing Shares
Printers Setting Share Access in Share Mode Setting Share Access in User and Domain Modes Advanced Options
USB Shares Print Shares over CIFS/SMB IPP Printing Managing Print Queues

Backup

Adding a New Backup Job
Step 1 Select Backup Source Step 2 Select Backup Destination Step 3 Choose Backup Schedule

Page 4 4

Step 4 Choose Backup Options
Viewing the Backup Schedule Programming the Backup Button Viewing the Backup Log Editing a Backup Job

System

System Time NTP Option Alerts Contacts Alerts Settings SNMP SMTP Adding a UPS for performance

Alerts

Performance Language Unicode for User, Group, and Share Names Updating ReadyNAS
Status Remote Update Local Update Settings Factory Default Disk Spin-down Option Power Timer

Power Management

Shutdown Health Logs
2 Accessing Shares Windows MAC OS X
AFP over Bonjour AFP over AppleTalk
MAC OS 9 Linux/Unix Web Browser FTP / FTPS Rsync

Page 5 5

Networked DVD Players and UPnP AV Media Adapters 3 Replacing a Failed Disk
Locate the Failed Disk Order Replacement Disk Replace the Failed Disk Re-synchronize the Volume
4 System Reset Switch 5 Changing User Passwords

A RAID Levels Simplified

RAID Level 0 RAID Level 1 RAID Level 5 RAID Level X (X-RAID)

B Input Field Format

Domain/Workgroup Name Host Host Name ReadyNAS Host Name Host Expression Share Name Share Password SNMP Community User/Group Name User Password
C Glossary D If You Need Help

Page 6 6

Please note that support for USB and PCI wireless devices is limited. Consult the hardware device compatibility list for a list of devices that are currently supported. Future updates may support additional adapters.

Page 13 13

Global Network Settings

HOSTNAME

The Hostname you specify is used to advertise the ReadyNAS on your network. You can use the hostname to address the ReadyNAS in place of the IP address when accessing the ReadyNAS from Windows, or over OS X using SMB. This is also the name that will appear in the RAIDar scan list. The default hostname is nas- followed by the last three bytes of your primary MAC address.

DEFAULT GATEWAY

The Default Gateway specifies the IP address of the system where your network traffic is routed to if the destination is outside of your subnet. In most homes and smaller offices, this is the IP address of the router connected to the cable modem or your DSL service. If you had selected the DHCP option in the Ethernet or Wireless tab, the Default Gateway field will be automatically populated with the setting from your DHCP server. If you had selected the Static option, you can manually specify the IP addresses of the default gateway server here.
The DNS box allows you to specify up to three Domain Name Service servers for host name resolution. If you are unfamiliar with DNS, the service translates host names into IP addresses. If you had selected the DHCP option in the Ethernet or Wireless tab, the domain name server fields will be automatically populated with the DNS settings from your DHCP server. If you had selected the Static option, you can manually specify the IP addresses of the DNS servers and the domain name here.

Page 14 14

The WINS option allows you to specify the IP address of the WINS (Windows Internet Naming Service) server. A WINS server is typically a Windows server on the network that will allow the ReadyNAS or other devices on the network to be (Windows) browsable from other subnets.
If you do not have an existing WINS server, you can designate the ReadyNAS to be one. Simply select the Enable WINS checkbox and configure your Windows PC to specify the ReadyNAS IP address as the WINS server. This can be useful if you wish to browse by hostname across multiple subnets, i.e. over VPN.

Page 15 15

The DHCP tab allows this device to act as a DHCP (Dynamic Host Configuration Protocol) server. DHCP service simplifies management of a network by dynamically assigning IP addresses to new clients on the network.
Click on the Enable DHCP service checkbox if you want the ReadyNAS device to act as a DHCP server. This is convenient in networks where DHCP service is not already available.

You can elect to have the ReadyNAS automatically auto-detect the domain controller, or you can specify the IP address. Sometimes auto-detect will fail, and you will need to supply the IP address of the domain controller to join the domain. If you have a large number of users in your domain, you may need to deselect the Display users from trusted domains checkbox. Otherwise, FrontView management system may slow down to an unusable state.
Use of the ReadyNAS in a domain environment with more than 1000 users is not recommended at this time.

Page 27 27

Click Apply to join the domain. If successful, users and groups from the domain will have login access to the shares on this device.
Accounts are managed on the domain controller. The ReadyNAS simply pulls the account information from the controller and displays them in the Accounts tab if you have the Display users from trusted domains option enabled.
If you wish, you can assign a disk quota to the domain users and groups. If email addresses are specified, users will be automatically notified when approaching and reaching their quotas.

Page 28 28

Services The Services menu allows you to manage various services for share access. This in effect controls the type of clients you wish to allow access to the ReadyNAS.
You will notice three tabs at the top: Standard File Protocols, Streaming Services, and Discovery Services. These different services are explained below.

Standard File Protocols

The standard file protocols are common file sharing services that allow your workstation clients file transfer to and from the ReadyNAS using built-in file manager over network file protocols on the client operating system. The available services are: CIFS, or Common Internet File Service, and often referred to as SMB. This protocol is a predominant protocol used by Microsoft Windows clients, and sometimes used by Mac OS X clients. Under Windows, when you click on My Network Places or Network Neighborhood, youre going across CIFS. This service is enabled by default and cannot be disabled. NFS, or Network File Service. NFS is used by Linux and Unix clients. Mac OS 9/X users can access NFS shares as well through console shell access. The ReadyNAS supports NFS v3 over UDP. AFP, or Apple File Protocol. Mac OS 9 and OS X works best using this protocol as it handles a large range of character set. The ReadyNAS supports AFP 3.1. FTP, or File Transfer Protocol. Widely used in public file upload and download sites. ReadyNAS supports anonymous or user access for FTP clients, regardless of the security mode selected. If you wish, you can elect to set up port-forwarding to a non-standard ports for better security when accessed over the Internet. HTTP, or Hypertext Transfer Protocol. Used by web browsers. ReadyNAS supports HTTP file manager, allowing web browsers to read and write to shares using the web browser. This service can be disabled in lieu of HTTPS to allow for a more secure

Page 29 29

transmission of passwords and data. With the option to redirect default web access to a specified share, you can transparently force access to http://readynas_ip to http://readynas_ip/share. This is useful if you do not want to expose your share listing to outsiders as well as allowing you to redirect all default web access to a share dedicated to be your website. All you need in the target share is an index file such as index.htm or index.html. You have the option of enabling or disabling login authentication to this share. HTTPS, or HTTP with SSL encryption. This service is enabled by default and cannot be disabled. Access to FrontView is strictly through HTTPS for this reason. If you want remote web access to FrontView or your HTTPS shares, you have the option of specifying a non-standard port that you can forward on your router for better security. You can also regenerate the SSL key based on the hostname or IP address that users will address the ReadyNAS. This allows you to bypass the default dummy certificate warnings whenever you access the ReadyNAS. Rsync, an extremely popular and efficient form of incremental backup made popular in the Linux platform but is now available for various other Unix systems as well as Windows and Mac. Enabling Rsync service on the ReadyNAS will allow clients to use Rsync to initiate backups to and from the ReadyNAS.

Streaming Services

Next are the Streaming File Protocols, a list of built-in streaming services available straight from the ReadyNAS, without the need to have your PC or Mac powered on.
SlimServer provides music streaming to the popular Squeezebox music players from Slim Devices. You can click on the setup link for more detail configuration options. iTunes Streaming Server enables iTunes clients to stream media files straight from the ReadyNAS. You can specify the share and folder path where your music files reside, and you can specify a name for the service that will appear in your iTunes application as well as how often your music files will be rescanned on the ReadyNAS. Rescanning is required to update your music list, and you can opt to rescan your files manually.

If you wish to reconfigure the default volume C, wish to split it into multiple volumes, specify a different RAID level, or specify a larger reserved space for snapshots, you will need to reconfigure your volume. The first step is to delete the existing volume you wish to replace.

Page 32 32

DELETING A VOLUME
To delete a volume, click on the volume tab of the volume you wish to delete or Volume C if only one volume is configured. Make sure if you have data in that volume that you back up the files you wish to keep first. All shares, files, and snapshots residing on that volume WILL BE DELETED AND ARE NON-RECOVERABLE!
Click Delete Volume in the Volume C tab. You will be asked to confirm your intention by typing:

DELETE VOLUME

Page 33 33

ADDING A VOLUME

You will then be presented with the Add Volume tab listing the available configurable space on the hard disks. All the disks will be selected by default. You can elect to specify a hot spare disk if you wish. A hot spare remains in standby mode and will automatically regenerate the data from a failed disk from the volume. A hot spare disk is only available for RAID level 1 and RAID level 5 if there is enough disks to fulfill the required minimum plus one.

Select Hard Disks

In our example here, well select the first three disks and elect not to specify any of them as a hot spare. RAID level determines how the redundancy, capacity utilization, and performance is implemented for the volume. See Appendix A, RAID Levels Simplified, for more information. Typically in a three or more disk configuration, RAID level 5 is recommended. In our example above, we selected RAID level 5 for the three selected disks. Next, select the percentage of the volume you wish to allocate for snapshots. You can elect to specify 0 if you wish to disable snapshot capability, or you can specify a percentage in 5% increment from 5 to 50%. The percentage represents the amount of data you feel would be changing while the snapshot is active. This typically depends on how often you schedule your snapshot (see previous section on snapshot), and the maximum amount of data (plus padding) you feel will change during that time. Make sure to allocate enough space for worse case as the snapshot becomes unusable when its reserved space runs out. In our example above, we selected 10% of the volume to be reserved for snapshots.
Specify reserve space for snapshot Select RAID level

Page 34 34

If you do not reserve any space for snapshots, the snapshot tab will not be displayed within the volume tab.

Mount: Locate:

Format FAT32: This option formats the device as a FAT32 file system. FAT32 format is easily recognizable by most newer Windows, Linux and Unix operating systems. Format EXT3: This option formats the device as an EXT3 file system. Select this option if you will be accessing the USB device mainly from Linux systems or ReadyNAS devices. The advantage of EXT3 over FAT32 is that file ownership and mode information can be retained using this format whereas this capability is not there with FAT32. Although not natively present in the base operating system, Ext3 support for Windows and OS X can be added. The installation images can be downloaded from the web.

Page 41 41

When the USB device is unmounted, you have the option of renaming it. The next time the same device is connected, it will use the new name rather than the default USB_FLASH_n or USB_HDD_n naming scheme. The USB storage shares are listed in the Share menu, and access restrictions can be specified there. The share names will reflect the USB device names.

USB Flash Device Option

Towards the lower portion of the USB Storage tab, youll notice the USB Flash Device Option. There, you can elect to copy the content of a USB flash device automatically on connect to a specified share. Files are copied into a unique timestamp folder to prevent overwriting previous contents. This is useful for uploading pictures from digital cameras and music from MP3 players without needing to power-on a PC. In User security mode, an additional option to set the ownership of the copied files is available.

Page 42 42

Shares The Shares menu provides all the options pertaining to share services for the ReadyNAS device. This entails share management (including data and print shares), volume management, and share service management. Well first look at how we can control the services.

Adding Shares

To add a share, click on the Volume tab. If more than one volume is configured, click on the volume you wish to add the share. The Add Share tab has two looks, depending on the security mode. In the Share mode, you will enter the share name, description, and optional password and disk quota. The share password and share disk quota is available only in this security mode.
In the User or Domain security modes, the Add Share tab consists only of fields for the share name and description. Password and disk quotas are account-specific.

Page 43 43

In either case, you can add up to five shares at a time. Once you finish adding the shares, you can refer to Chapter 2 for instructions on how to access them from different client interfaces.

Managing Shares

Once you have added shares, you may want to manually fine-tune share access in the Share List tab. This tab has two looks, one for Share security mode and one for User and Domain mode. Theyre both similar except for the password and disk quota prompts which only appear in Share mode.
If you want to delete a share, click on the checkbox to the far right of the share listing and click Delete. You have the option of deleting up to five shares at a time. The columns to the left of the Delete checkbox represent the services that are currently enabled, and the access icons in those columns summarize the access rights to the share for each of the services. You can move the mouse pointer over the access icons to get a quick glimpse of the access settings.
The settings represent: Disabled Access to this share is disabled. Read-only Access Access to this share is read-only. Read/Write Access Access to this share is read/write.

Page 44 44

Read Access with exceptions Either (1) access to this share is read-only and only allowed for specified hosts, (2) access is read-only except for one or more users or groups that are granted read/write permission, or (3) access is disabled except for one or more users or groups that are granted read-only privilege. Write Access with exceptions Either (1) access to this share is read/write and only allowed for specified hosts, (2) access is read/write except for one or more users or groups that are restricted to read-only access, or (3) access is disabled except for one or more users or groups that are granted read/write privilege. You can click on the access icons to bring up the Share Options tab where you can set the access rules for each file protocol. Keep in mind that access options will differ between protocols.
SETTING SHARE ACCESS IN SHARE MODE
In Share mode, the CIFS/Windows share options tab will look as follows:
In this tab, you can select the default access at the top and optionally specify the host(s) that you wish to allow restrict access to in the Share Access Restriction box.

Share Access Restriction

For instance, select read-only for default access and list the hosts you wish to allow access to. Access from all other hosts will be denied. For example, to allow only host 192.168.2.101 read-only access to the share, specify the following:
Default: Hosts allowed access: Read-only 192.168.2.101
Multiple hosts can be separated with commas (see Appendix B for more description of valid host formats.) For example, if you wish to limit access to the share to particular hosts, you can enter host IP addresses or valid DNS hostnames in the Host allowed access field. In addition, you can enter a range of hosts using common IP range expressions such as:
192.168.2., 192.168.2.0/255.255.255.0, 192.168.2.0/24

Recycle Bin

You can specify how long to keep the files in the Recycle Bin and how large the Recycle Bin can get before files get permanently erased.

Advanced CIFS Permission

Page 47 47
The Advanced CIFS Permission box offers options for setting the default permission of new files and folders created via CIFS. The default permission of newly created files is read/write for the owner and owners group and read-only for others (i.e. everyone). Permission for newly created folders is read/write for everyone. If the default doesnt satisfy your security requirement, you can change it here.

ADVANCED OPTIONS

The Advanced Options tab offers advanced low-level file manipulation options that can affect remote file access through all file protocol interfaces. Care should be taken before using these options as anything that changes ownership and permissions may not be easily reversible.
The Advanced Share Permission box offers the options to override the default ownership and permission of the share folder on the embedded file system and to permeate these settings to all files and folders residing on the selected share. The Set ownership and permission for existing files and folders option will perform a one-time change. Depending on the size of the share, this can take awhile to finish.
Advanced Share Permission

Page 48 48

You can also grant rename and delete privilege to non-owners of the files option. In a collaborative environment, it may be desirable to enable this option. In a more security-conscious environment, it may be desirable to disable this option.

USB Shares

USB storage devices are shared using the name of the device appended by the partition number. The base device name can be changed in the Volumes/USB tab if desired. The ReadyNAS attempts to remember the name as long as theres a unique ID associated with the USB device so that the next time the device is connected, the same share name(s) will be available. Share access restrictions are not saved across disconnects, however.

If you utilize a SNMP management system such as HP OpenView or CA UniCenter to monitor devices on your network, you can set up the ReadyNAS device to work within this infrastructure.
To set up SNMP service, check the Enable SNMP service checkbox in the SNMP tab. You can leave the Community name as public, or specify a private name if you have opted for a more segregated monitoring scheme. Next, enter a host name or an IP address for Trap destination. This is where all trap messages will be sent. The following system events will generate a trap: Abnormal power voltage Abnormal board enclosure temperature Fan failure UPS connected UPS detected power failure RAID disk sync started and finished RAID disk added, removed, and failure Snapshot invalidated If you wish to limit SNMP access to only a secure list of hosts, please specify the hosts in the Hosts allowed access field.

Page 59 59

When you have saved the SNMP settings on the ReadyNAS, you can import the Infrant SNMP MIB to your SNMP client application. The Infrant MIB can be obtained from the included Installation CD-ROM or downloaded from the Infrant Support site at http://www.infrant.com.
The ReadyNAS device has a built-in email message transfer agent (MTA) that is set up to send alert email messages from the device. Some corporate environments, however, may have a firewall that blocks untrusted MTAs from sending out messages. If you were unable to receive the test message from the Alerts Settings tab, it may have been blocked by the firewall. In that case, please specify an appropriate SMTP server in this tab.
Internet Service Providers (ISP) for home may also block untrusted MTAs. Furthermore, they may allow you to specify their SMTP server but require you to enter a user login and password to send out email this is common with most DSL services. If this is the case, simply enter the user name and password in the fields provided.

Page 60 60

Performance
If you wish to tweak the system performance, select the Performance tab in the System menu. Note that some of the settings suggest that you utilize an Uninterruptible Power Supply (UPS) before enabling that option.
Select Enable disk write cache if you want to utilize the performance advantages of write caching on the hard disks. For the utmost protection of data, you should utilize a UPS to back up the ReadyNAS because there is a slight chance that data queued up in the cache will be lost should a power failure occur while the system is writing data to the disk. The Disable full data journaling is also recommended only if the NAS has UPS protection. Without battery backup, there is a small chance that parity written to a disk in a RAID set may become out of sync with the data disks if a power failure suddenly occurs, possibly causing incorrect data to be recovered if one disk fails. Without full data journaling, disk write performance will increase substantially. Select Disable journaling altogether if you understand the consequences of the 2nd option above, and you also dont mind a long file system check (only after unexpected power failures). File system journaling allows disk checks of only a few seconds verses possibly an hour or longer without journaling. Disabling journaling will improve disk write performance slightly.

Note that alert notification and automatic system optimization is available only with UPS utilizing a USB monitoring interface.

Page 62 62

Language
The Language tab offers the option of setting the ReadyNAS device to the appropriate character set for file names.
For example, selecting Japanese allows sharing of files with Japanese names in Windows Explorer.

Page 63 63

It is best to select the appropriate language based on the region that this device will operate in.
This option does not set the web browser language display browser settings must be done using the browser language option.
Unicode for User, Group, and Share Names
If desired, you can elect to enable use of Unicode for user, group, and share names, allowing for greater flexibility in non-English speaking regions. This option, once selected, cannot be reversed.
HTTP and WebDAV access will not work with Unicode user names. Other restrictions may exist.

Updating ReadyNAS

The ReadyNAS device offers the option of upgrading the operating firmware either automatically using the Remote Update option or manually loading an update image downloaded from the Infrant Support website.

REMOTE UPDATE

The preferred and quicker method if the ReadyNAS has Internet access is the Remote update option.
Simply click Check for Update to check for updates on the Infrant update server.

Page 64 64

If you wish to continue, click Perform System Update. After the update image has been downloaded, you will be asked to reboot the system. The update process only updates the firmware image and does not modify your data volume. However, it is always a good idea to backup your important data whenever you perform an update.

LOCAL UPDATE

When the ReadyNAS device is not connected to the Internet, or Internet access is blocked, you can download an update file from the Support site and upload that file to the ReadyNAS in the Local update tab.
Click on the Browse button to select the update file and click the Upload and verify image button. The process will take several minutes at which time you will be requested to reboot the system to proceed with the upgrade. DO NOT click on the browser Refresh button during the update.

Page 74 74

MAC OS X To access the same share over AFP with OS X, select Network from the Finder Go menu.
At this point, there are two ways in which you can access your AFP share, depending on how you have chosen to advertise your AFP share.

AFP over Bonjour

To access the AFP share advertised over Bonjour on Mac OS X, select Network from the Finder Go menu to see a listing of available networks.
Open the My Network folder to display the ReadyNAS hostname.

Page 75 75

Double-click on the hostname icon to display the share listing.
In Share security mode, simply select Guest to access the shares. In User or Domain security mode, enter the user name and password you wish to connect to the ReadyNAS as.

Page 76 76

Select the Share you would like to view.

AFP over AppleTalk

If you had chosen to advertise your AFP service over AppleTalk, you will see a listing of available networks.
Open the My Network folder to display the ReadyNAS hostname. Select the one that has the hostname only.
Youll be prompted with a connection box.

Page 77 77

Select Guest and then the share you wish to connect to, and click OK.
In Share security mode, you will need to only specify user name and password if you have set up a password for your share. Enter the share name in place of the user name. In User or Domain security mode, enter the user name and password you wish to connect to the ReadyNAS as. You should see the same file listing as you would in Windows Explorer.

Page 78 78

MAC OS 9 To access the same share under Mac OS 9, select Connect to Server from the Finder menu, choose the NAS device entry from the AppleTalk selection, and click Connect.
When you are prompted to login, enter the share name and password if the ReadyNAS is configured for Share security mode, or enter a valid user account and password otherwise.
If no share password is set in Share mode, you can select Guest user and leave the password field blank. If your login is successful, you will be given a listing of one or more shares. Select the share you wish to connect to.

Page 79 79

You should see the same files in the share that you do under Windows Explorer.

Page 80 80

Linux/Unix To access this share from a Linux or Unix client, you will need to mount the share over NFS, i.e. type:
mount ipaddr:/backup /backup
where backup is the share name. Running the ls command in the mounted path displays the share content.

Infrant Technologies patent-pending Expandable RAID technology.

Page 97 97

If You Need Help
If you have questions or you encounter problems with the setup, you can visit our support site at http://www.infrant.com. There, youll find links to FAQs, message board, and live online support. Infrant also has a lively community forum at http://www.infrant.com/forum which is often monitored by advanced users and Infrant support and engineering staff.

Page 98 98

READYNAS INSTANT STORAGE
Using Rsync for NAS-to-NAS Backups
Infrant Technologies 3065 Skyway Court, Fremont CA 94539 www.infrant.com
Using Rsync For NAS-To-NAS Backups
Youve heard it before, but its worth repeatingan organizations most valuable asset is the data that comprises its information store. With ever increasing amounts of data, and the need to find an efficient method for ensuring its confidentiality, integrity, and availability, organizations often find themselves struggling with managing data stores. The ReadyNAS product line (1000S, NV, 600, and X6) of network attached storage devices provides a cost-effective way for organizations to share information without investing in expensive server-class hardware, bloated network operating systems, and seemingly endless client access licenses. Yet, they provide many of the same benefits as traditional file serving methods, including support for multiple sharing protocols as well as share-based, user-based, and domain-based security models. At the same time, because of their large data store capabilities, they need to be backed up as efficiently as possible. In this guide, well focus our attention on implementing NAS-to-NAS backups using Rsync, a native file synchronization service included with the ReadyNAS devices. In our presentation, youll discover methods for backing up NAS devices on a LAN, between subnets isolated from each other by a firewall, and across a WAN connection using Virtual Private Networking (VPN) technologies. Moreover, each method well present builds on the previous one, so you can implement the appropriate backup strategy as your needs change.
Rsync vs. traditional backups
Traditional backup methods typically copy source data into a proprietary file format for archival purposes. If you need to access the data thats been backed up, you need to restore it from the archive. Rsync, which has its roots in the UNIX world, operates differently. Instead of copying data into an archive, it keeps the data in its native format, meaning its readily available without going through a timely restore process. The first time you run an Rsync backup job, a full backup is performed, i.e. all the data is copied from the source NAS device to the destination NAS device. When you run the backup job subsequent to the first backup, only incremental changes in the source data are copied to the destination. This makes Rsync an efficient and practical method for ensuring that two locations have the same data store.

Infrant Technologies

The process
In this guide, well discuss several different network topologies and walk you through the process of performing NAS-to-NAS backups unique to each one. More specifically, well: Set up two ReadyNAS devices on a local LAN segment. Create an Rsync-based backup job and verify its operation. Relocate one ReadyNAS device to a remote location, residing behind a NAT firewall. Configure the NAT device to accept incoming Rsync requests. Create a virtual private network with two VPN endpoints. Define a gateway and network policy to support Rsync backups over a VPN. Discuss snapshots, a feature unique to ReadyNAS devices that allows you to freeze your data a given point in time. Tie everything together by providing an example of a typical backup scenario.

System requirements

To complete the tasks presented in this article, youll need: A LAN segment with the appropriate switches and cabling. An administrative workstation with a web browser installed. Two ReadyNAS devices. A NAT router. Two VPN endpoint routers.

Rsync in practice

Consider the topology illustrated in Figure A. In this scenario, a local ReadyNAS can maintain a copy of all the data generated at one or more remote locations. For example, the local device can reside at an off-site location, such as a home office or other facility, and back up the data stored at a remote business site. Rsync can accomplish this goal in two different ways: Each remote device can push its data to the local device. The local device can pull data from each remote device. If you choose the push solution, you need to create a backup job at each remote site. However, this can add administrative overhead to your organization because you need to maintain separate backup jobs residing at potentially different locations. Choosing the pull solution is more efficient because, although you still need to create a backup job for each remote site, all the backup jobs are maintained on the local device. In general, you can think of each location as a separate network, either internal or external to your organization. For the purpose of this guide, the ReadyNAS device hosting the backup jobs is the local device and the ReadyNAS devices you want to back up via Rsync are the remote devices.
Figure A: A ReadyNAS device can be either a local or a remote device.

Deploy Rsync on your LAN

Because each backup job runs initially as a full backup, youll want to create and test it locally before implementing it across subnets or over a WAN connection. Doing so not only makes the initial backup run more efficiently but also ensures that the job operates as expected. Once you have everything working properly, you can relocate the remote device to its intended location. Because we want the local device to pull data from the remote device, well set up the local device as the Rsync client and the remote device as the Rsync server, as shown in Figure B. Well provide the details on accomplishing this in the upcoming sections. For now, lets just set up the devices on a local LAN segment, so that we can create and test a typical backup job.
Figure B: The remote device makes its shares available to the local device. To set up the ReadyNAS devices on your LAN: 1. Physically connect each device to the same subnet on your LAN. 2. Use the RAIDar discovery utility to complete the initial setup of each device. 3. Name one device local-nas and the other device remote-nas to make following our examples easier.

Enable the Rsync service

After you install the ReadyNAS devices, you need to enable the Rsync service on both the local and the remote devices. This allows you to easily reverse the roles of the devices if your needs change. When you enable the Rsync service, youre essentially allowing shares on the ReadyNAS device to act as Rsync servers; Rsync clients can then connect to these servers. As noted previously, the remote device acts as an Rsync server (it makes its data available via Rsync) while the local device acts as an Rsync client (it retrieves data from the Rysnc server). To enable the Rsync service: 1. Log in to each ReadyNAS device using your administrative credentials. 2. Navigate to the Standard File Protocols tab, as shown in Figure C.

Figure C: Enable the Rsync service on both ReadyNAS devices. 3. Scroll to the bottom of the list of available services, and then enable the Rsync check box. 4. Click the Apply button.
Configure the Rsync protocol
After enabling the Rsync service, you need to configure the Rsync protocol for each share that you want to back up. Doing so enables the respective share to assume the role of an Rsync server. This involves specifying the shares default access (Read/Write or Read Only) as well as optionally restricting access to it. You can restrict access to the share in two different ways: by specifying allowed hosts and by specifying login credentials. To configure the Rsync protocol: 1. Navigate to the remote devices Share list tab, as shown in Figure D.
Figure D: The Rsync column appears only if youve enabled the Rsync service. 2. Identify the share that you want to back up via Rsync, e.g. Remote_Data. 3. Click the document icon located at the intersection of the share name and the Rsync column.
4. On the Rsync tab that appears and is shown in Figure E, complete the required information in the Share Access Restrictions and the Rsync Password Option sections.
Figure E: To protect the source data, specify the Default Access as Read-Only. 5. Click the Apply button.

Create a backup job

Now that youve enabled the Rsync service and youve configured the Rsync protocol for the share you want to back up, you need to create a backup job. When you create the backup job, you specify the Rsync server as the backup source and the Rsync client as the backup destination. The path to the Rsync Server takes the form host::module/path, where host is the name or IP address of the remote device, module is the name of the share you want to backup, and /path is an optional subdirectory of the source share. The path to the Rsync Client takes the form /path, where /path is an optional subdirectory of the destination share on the local device. To create a backup job: 1. On the local device, navigate to the Add a New Backup Job tab. 2. Specify the Backup Source and Backup Destination, as shown in Figure F.

Figure F: The remote device is the backup source and the local device is the backup destination. 3. Click the Test Connection button to ensure that the local device can communicate with the remote device.
4. In the Choose Backup Schedule section shown in Figure G, schedule your backup job to run during off-peak hours; this avoids server overload and traffic congestion.
Figure G: You can schedule backup jobs as well as specify the frequency of full backup. 5. In the Choose Backup Options section, choose a time interval to perform a full backup, the desired logging level, and any other options you want. 6. Click the Apply button.

Test the backup job

After you create the backup job, it appears on the Backup Listing tab. When you run the backup job, a full backup is performed, i.e. all the files from the source are copied to the destination. Each subsequent run copies only those files that have changed on the source device, i.e. incremental changes. You should run the job at least twiceonce to perform a full backup and once to perform the first incremental backup, so you can verify that it operates as expected. To test the backup job: 1. On the Backup Listing tab shown in Figure H, make sure the job you want to run is enabled.
Figure H: On the ReadyNAS NV, you can associate a backup job with the backup button located on the front of the device. 2. Click the Go button and wait for the job to complete. 3. Click on the View Log link to examine the backup job log. 4. If you need to modify the backup job to correct errors, click the job number button, e.g. 001.
Deploy Rsync across network boundaries
The next scenario well examine is deploying Rysnc across network boundaries. In particular, well examine its operation when a firewall exists between two networks. The two networks could be distinct subnets on your LAN (e.g. different departmental workgroups), or they could be a WAN-LAN pair (e.g. a business site and a home office). In the topology shown in Figure I, the remote network is sitting behind a NAT router with an integrated firewall. As you can see, the Rsync servers IP address and the NAT routers internal IP address are on the same subnet, namely 10.0.200.0/24. You can also see that the IP address of the Rsync client and the NAT routers external IP address are on an entirely different subnet, namely 192.168.100.0/24. Its worth noting that the latter subnet could also be a WAN segment with a public rather than a private IP address. In order for the Rsync client to connect to the Rsync server, the NAT router must forward incoming Rsync requests to the appropriate ReadyNAS device on the remote network. So, you must open TCP/UDP port 873 on the NAT router, and forward Rsync requests to 10.0.200.x in this example.

Figure I: You must open port 873 on the NAT router to support Rsync across network boundaries.
To deploy Rsync across network boundaries: 1. 2. 3. 4. Install the local ReadyNAS device on the WAN side of the firewall. Install the remote ReadyNAS device on the LAN side of the firewall. Log in to the NAT routers management utility. Navigate to the routers Port Forwarding section; consult your routers documentation if necessary. 5. Specify that incoming Rsync requests on port 873 be forwarded to the remote devices IP address, as shown in Figure J. 6. Edit the backup job you created earlier such that the IP address of the backup source is the same as the IP address of the routers WAN port. 7. Run the backup job to test its operation.
Figure J: Rysnc requests received on a WAN port can be forwarded to a ReadyNAS device on your LAN.

Deploy Rsync over a VPN

While transferring data across networks is a business necessity, so also is ensuring the information doesnt fall into the wrong hands. For example, a malicious user can sniff data in transit and steal confidential information, or he can perform a man-in-the-middle attack and modify critical information during transit. Although Rsync doesnt provide any native facility to encrypt data, it can be used effectively over a VPN connection. In brief, a VPN allows you to create a secure tunnel (between two endpoints) over a public network, such as the Internet. There are three common types of VPNs, listed here from least to most secure: Point-to-Point Tunneling Protocol (PPTP) Layer 2 Tunneling Protocol (L2TP) IP Security (IPSec). Each type of VPN offers its own authentication and encryption algorithms, and a complete discussion of each is beyond the scope of this guide. Our discussion focuses primarily on creating the necessary gateway and network policies to support a VPN. And finally, because the configuration details can vary significantly between router manufacturers, well provide only a general outline of the procedures. Lets start by examining the scenario shown in Figure K.
Figure K: Using a VPN, you can ensure that your Rsync backup jobs are secure.
In this topology, note the following: Each ReadyNAS device (an Rsync client and an Rsync server) resides on its own private network. Each private network is connected to an untrusted network (192.168.100.0/24) via a VPN router. Typically, the untrusted network is the Internet, but it can also be parent LAN segment as in our example. A VPN tunnel on the untrusted network ensures a secure connection between the WAN side of each VPN router, i.e. the tunnel endpoints. When the Rsync client on the local network runs its backup job, the Rsync request passes through the VPN tunnel to the WAN port on the VPN router at the remote network. The remote VPN router forwards the request (via TCP/UDP port 873) to the Rsync Server on the remote network. In order to set this up, you typically need to create a gateway policy, which defines the endpoints of the VPN tunnel, and a network policy, which defines the visibility of each private network. To create a remote gateway policy: 1. Log in to the local VPN router using your administrative credentials. 2. Navigate to the Gateway Policy section, as shown in Figure L.

Figure L: You need to define a remote gateway policy on the local VPN router. 3. 4. 5. 6. Provide a descriptive name for the policy youre creating, e.g. Remote Office Gateway. Enter the IP address of the WAN side of the remote VPN router. Enter the IP address of the WAN side of the remote VPN router. Define the authentication method to use, typically a pre-shared key or an SSL certificate.
To create a remote network policy: 1. Log in to the local VPN router using your administrative credentials. 2. Navigate to the Network Policy section, as shown in Figure M.
Figure M: You define a remote network policy on the local VPN router and associate it with the remote gateway policy. 3. Provide a descriptive name for the policy youre creating, e.g. Remote Office Network. 4. Associate the network policy with the gateway policy you created earlier. 5. Specify the IP address space on the local network that should be visible to the remote network. 6. Specify the IP address space on the remote network that should be visible to the local network. 7. Define the data encryption method to use.
After you create the gateway and network policies, review the tunnel summary, as shown in Figure N. As you can see, the gateway policy defines the endpoints of the VPN tunnel while the network policy defines the two private networks sitting behind the VPN routers.
Figure N: Make sure the remote gateway and the network policies are correct before proceeding. To test the backup job: 1. Edit the backup job you created earlier such that the IP address of the backup source is the same as the IP address of the remote VPN routers WAN port. 2. On the local device, open the tunnel by clicking the Dial button. 3. Run the backup job to test its operation.
Combine backups with snapshots
You can combine your backups with snapshots. In brief, a snapshot is an image of your data frozen in time. However, because the image isnt the actual data but rather pointers to the it, snapshots are virtually instantaneous while remaining transparent to the user. You can schedule a snapshot of any volume at a specified frequency and time interval. Why would you want to do that? Well, imagine that a LAN workstation becomes infected with a virus one morning, and that the virus spreads to the files on a ReadyNAS share. If you had scheduled a daily snapshot at midnight, you could go back to the snapshot of the share and restore the version of the files as of midnight. After you take a snapshot, you can schedule a backup of it. Rather than backing up live shares from the ReadyNAS while file contents are potentially changing, you can backup the snapshot instead, i.e. your data frozen in time. If you coordinate your backup job to start shortly after your snapshot is taken, even if the backup process is still running into the day, you won't have to worry about backing up potentially inconsistent and outdated data. To schedule a snapshot: 1. In the Snapshot Space section of the Volume tab shown in Figure O, specify the percentage of the volume you want to reserve for snapshots.

Figure O: The snapshot Schedule section is available only after you reserve snapshot space. Infrant Technologies 18
2. Click the Save button, and then follow the prompts to reboot the ReadyNAS device. 3. In the Snapshot Schedule section, specify the frequency and time interval for snapshots. 4. Click the Save button. Snapshots are identified by snap appended to the original share name, as shown in Figure P. As you can see, when you take a snapshot, all the shares on a given volume are included in the snapshot. To back up a snapshot, you simply create a backup job as you normally would, specifying the share with the appended snap as the backup source.
Figure P: You can use RAIDar to browse for existing snapshots.

Putting it all together

Now that weve discussed several different network topologies as well as scheduling backup jobs and snapshots, lets tie everything together in a final example. For this example, well use a local ReadyNAS to host backup jobs and a remote ReadyNAS whose data we want to back up. Well backup snapshots from the remote device to the local device on a daily basis using Rsync. Furthermore, we want the ability to restore up to a week's worth of changes. 1. Set up your network Use the discussion presented earlier in this guide to choose a network topology. Make sure the devices can communicate properly by testing connections thoroughly. 2. Schedule a snapshot On the remote device, schedule a snapshot to occur once a day on each day of the week, as shown in Figure Q.
Figure Q: The snapshots are schedule on the remote device.
3. Create backup jobs On the local device, create seven backup jobsone for each day of the week, as shown in Figure R. Notice that the destination for each backup job specifies the path to a folder representing a particular day of the week.
Figure R: The backup jobs are scheduled on the local device.