Dell PowerProtect DD Concepts and Features

DELL POWERPROTECT
DD CONCEPTS AND
FEATURES
PARTICIPANT GUIDE
PARTICIPANT GUIDE
Table of Contents
Introduction to PowerProtect DD 4
PowerProtect DD System Overview 4
Backup Environment Without PowerProtect DD 5
PowerProtect DD System Benefits 7
Backup Environment with PowerProtect DD 10
Current Models 12
Expansion Shelves 14
Hardware Features 16
PowerProtect DD Virtual Edition Features 20
DD Operating System Features 22
Features and Capacity Licensing 25
Architecture and Technology Overview 27

Data Path and Supported Protocols 27
DDOS File System 31
Deduplication Using Stream Informed Segment Layout 33
Data Invulnerability Architecture 35
DD Operating System Features and Capabilities 37

DD Boost 37
DD Replicator 38
DD Retention Lock 40
BoostFS 41
Cloud Tier 43
DD Secure Multi-Tenancy 45
DD High Availability 50
DD Virtual Tape Library 51
Data Security 53
System Access Features 57
Secure Connect Gateway 60
DD Storage Migration 62
Dell PowerProtect DD Concepts and Features
© Copyright 2023 Dell Inc Page 2

Minimally Disruptive Upgrade 63
PowerProtect DD Management Overview 64

Command Line Interface 64
DD System Manager 67
PowerProtect DD Management Center 69
Simulation Activity: Exploring DD System Manager 71
Smart Scale 72
Overview 72

Introduction to PowerProtect DD
PowerProtect DD System Overview
PowerProtect DD systems are specialized appliances made specifically

for data protection. They are designed to minimize the amount of disk
storage needed to store and safeguard data.
One of the key differentiators that PowerProtect DD systems offer is the

ability to deduplicate, compress, and encrypt data inline as it is written to
disk. PowerProtect DD systems meet various United States and
international compliance regulations.
A PowerProtect DD system can efficiently replicate all data to a secondary

site for disaster recovery. Additionally, you have the option to send data to
the public, private, or hybrid cloud for long-term protection.

Backup Environment Without PowerProtect DD
Backup Environment Challenges
The following are some challenges in a typical backup environment:
• Increasing the storage speed and capacity for the data that is
generated along with the cost-effectiveness
• The expensive and resource-intensive tasks of gathering, storing, and
protecting data backups
• The large financial and labor resources required to write data to tapes
and ship them offsite for storage
Typical Backup Environment
The diagram illustrates the conventional process of handling backups

through backup servers:
1. Clients and servers store data on the primary storage device.

2. The backup servers handle the conventional process of backing up
and preserving the data on the primary storage device by copying it to
disk-based storage or a tape library.

3. Tapes are physically transported and stored offsite for archival and
disaster recovery purposes. If there is a negative event in the data
center, moving tapes offsite prevents the loss of backup data.
4. Data recovery requires a manual process of transporting the tapes
back to the primary storage device in the data center.

PowerProtect DD System Benefits
The benefits of the PowerProtect DD systems are the following:
Scalability and Performance
Scalability and performance are the following:
• Scalable from 1 TB up to 1.5 PB of usable capacity in a single rack.

• Reduces required storage by 50-65%.
• Protects up to 97.5 PB of logical capacity and completes backups
faster, up to 94 TB per hour, on the PowerProtect DD9900 appliance.
• A software-defined version of the PowerProtect DD series appliance,
the PowerProtect DD Virtual Edition (DDVE) scales up to 96 TB
capacity in an on-premises deployment.
• Configure backups to send only deduplicated data across the network
to reduce the bandwidth required.
Data Invulnerability Architecture
The Data Invulnerability Architecture provides a defense against data loss:
• End-to-end data verification

• Fault avoidance and containment
• Continuous fault detection
• Healing file system
Seamless Integration
PowerProtect DD series appliances:
• Integrate with existing infrastructures, enabling ease of use with

leading backup and archiving applications.
• Offers a superior performance with PowerProtect Data Manager and
Data Protection Suite.

Multicloud Protection
Multicloud protection includes:
• Software-defined protection storage on premises with PowerProtect

DD Virtual Edition (DDVE) and in-cloud with APEX Protection Storage
for Public Cloud.
• APEX Protection Storage for Public Cloud scales up to 256 TB.
• Improved in cloud restore performance up to 10x.
• Long-term retention up to 3 PB capacity for public, private, or hybrid
cloud with Dell Cloud Tier.
• Low-cost cloud disaster recovery
− Cloud Disaster Recovery (Cloud DR) solution allows enterprises to

copy backed-up VMs from their on-premises PowerProtect DD
series appliances to the public cloud and to orchestrate DR testing
and failover of workloads to the cloud in a disaster scenario with
end-to-end orchestration.

Operational Simplicity
Operational simplicity includes:
• Management of a single PowerProtect DD system with an enhanced

DD System Manager that provides a complete chassis overview.
• Single point of management for all PowerProtect DD series appliances
with PowerProtect DD Management Center.
• Support for Smart Scale1
Instant Access and Instant Restore
If there is a failure or disaster in a virtualized environment, instant access

provides the ability to boot a virtual machine (VM) from the disk storage in
a PowerProtect DD series appliance to access data. This step reduces the
amount of time that is required to restore the VM. To perform a full restore,
use vMotion to copy the VM to the new production environment when it is
ready.
Smart Scale
Smart Scale enables grouping multiple PowerProtect DD systems into a

logical system pool under a unified namespace driving down management
complexity while increasing storage efficiency. Smart scale manages,
protects, and recovers data efficiently, with high performance, flexibility,
and security for multisite environments.
1Smart Scale allows you to manage up to 32 PowerProtect DD series

appliances in a single system pool under a unified namespace driving
down management complexity while increasing storage efficiency.

Backup Environment with PowerProtect DD
PowerProtect DD systems support many backup, archive, and enterprise

applications including:
• Dell Avamar, Dell NetWorker, PowerProtect Data Manager, and Data

Protection Suite
• Quest, Veritas, Oracle, HP, IBM, SAP HANA, and others
The diagram illustrates the process of handling backups through backup

servers with a PowerProtect DD system:
1. Clients and servers store data on the primary storage device.

However, if you use NetWorker or Avamar to back up clients, the
clients may also back up data directly to the PowerProtect DD
appliance.
2. In a backup environment with a PowerProtect DD appliance:
a. If clients do not back up directly to the PowerProtect DD appliance
using Avamar or NetWorker, the backup servers preserve the data
on the PowerProtect DD appliance.
b. Deduplication greatly reduces the data footprint before the data is
backed up.

c. Global compression technology combines an efficient high-

performance inline deduplication technology with a local
compression technique.2
d. If regulatory or corporate policies require tape backups, the
PowerProtect DD environment can incorporate tape backups using
the DD Virtual Tape Library (DD VTL) feature.
3. DD Replicator software transfers only the deduplicated and
compressed unique changes across any IP network.
PowerProtect DD appliances use replication methods that require a
fraction of the bandwidth, time, and cost, compared to traditional
replication methods.
4. By eliminating the need for time-consuming and resource-intensive
tape handling, the data recovery process is more efficient
2The reduced data footprint allows data to be retained on-site for longer
periods and allows transfer across the network for archival.

Current Models
Dell PowerProtect DD series appliances deliver a fast, secure, and

efficient solution that is optimized for multicloud data protection and future
demands.
DD series consists of the DD9900, DD9400, DD6900, DD6400, DD3300,

and a software-defined appliance with PowerProtect DD Virtual Edition
(DDVE) for on-premises, and Dell APEX protection storage for public
cloud.

Review the table below to learn more about each PowerProtect DD model.
DDVE at DD3300 DD6400 DD6900 DD9400 DD9900

96 TB
Max Up to 4 Up to 4.2 Up to Up to 15 Up to 26 Up to 41
Throughput TB/hr TB/hr 12.7 TB/hr TB/hr TB/hr
TB/hr
Max Up to Up to 7.0 Up to Up to 33 Up to 57 Up to 94
Throughput 11.2 TB/hr 27.7 TB/hr TB/hr TB/hr
(DD Boost) TB/hr TB/hr
Logical Up to 4.8 Up to 1.6 Up to Up to Up to Up to

Capacity PB PB 11.2 PB 18.7 PB 49.9 PB 97.5 PB
Logical Up to Up to 4.8 Up to Up to Up to Up to
Capacity 14.8 PB PB 33.5 PB 56.1 PB 149.8 PB 293 PB
with Cloud
Tier
Usable Up to 96 4 TB–32 8 TB– 24 TB– 192 TB– 576 TB -

Capacity TB TB 172 TB 288 TB 768 TB 1.5 PB
Usable Up to 288 Up to 96 Up to Up to Up to 2.3 Up to

Capacity TB TB 516 TB 864 TB PB 4.5 PB
with Cloud
Tier
Deep Dive: The latest current PowerProtect DD models is

available on the Dell PowerProtect DD Series Appliances
website.

Expansion Shelves
PowerProtect DD appliances can use ES40 and DS60 expansion shelves

to add storage capacity.
The FS25 is a solid-state expansion shelf. The FS25 is used exclusively

for the metadata cache in the active or extended retention tiers of a
PowerProtect DD appliance. On the DD6900, DD9400, and DD9900 the
FS25 is only supported with a high availability (HA) configuration.

Review the table below to learn more about the capacities and
compatibilities of the options for the expansion shelves.
Description ES40 DS60 FS25
Number of 15 15, 30, 45, or 603 10 or 15

Drives
Drive Size 4 TB, or 8 TB 3 TB, or 4 TB SAS 4 TB SSD Drives

Drives
Spare One hot spare 1, 2, 3, or 4 hot 1

Drives drive spare drives
Two parity drives 2, 4, 6, or 8 parity
drives
Compatible DD6400 DD6900 DD6900 (HA only)

Systems DD6900 DD9400 DD9400 (HA only)
DD9400 DD9900 DD9900 (HA only)
DD9900
Deep Dive: For more information about expansion shelves,

go to the Dell PowerProtect DD Series Appliances website.
3 The DS60 expansion shelf ships with 60 drives installed. Depending on

the capacity license applied to the PowerProtect DD system either 15, 30,
45, or 60 drives are accessible.

Hardware Features
PowerProtect DD appliances are based on basic hardware architecture.
Head Unit and Expansion Shelves
The hardware features common to most models include:
• Rack mountable in 4-post racks

• Hot-swappable disks with redundant hot-swappable fans
• Redundant hot-swappable power modules
• Dual In-line memory module (DIMM) modules for Random Access
Memory (RAM)
• A battery-backed nonvolatile RAM card (NVRAM), Persistent RAM
(PRAM), or virtual NVRAM
• Monitor, keyboard, and mouse ports
• Front panel Light Emitting Diodes (LEDs) that provide system status
indicators
Most PowerProtect DD systems support the addition of one or more

storage expansion shelves to increase capacity.

Connectivity
Connectivity features include USB ports for connecting a keyboard and

mouse, a VGA port for connecting a monitor, and serial and Ethernet
connectivity. Many systems include mini-SAS ports to connect expansion
shelves to increase capacity, and Fiber Channels for SAN connections.
All PowerProtect DD systems may be connected to Ethernet networks for

TCP/IP-based data transfer and system management. All models have a
minimum of five integrated ports. One Ethernet port is the Integrated Dell
Remote Access Controller (iDRAC). Some models may be configured with
additional ports by adding optional Ethernet expansion cards to provide
additional network connectivity.
Connecting to a Fiber Channel-based storage area network is supported

by adding a host bus adapter card. In these environments, the
PowerProtect DD VTL software license or DD Boost software license is
also required.

The figure and table below describe the PowerProtect DD system back
panel:
Panels, ports, and slots Description
1, 4, 5 Full-height PCIe expansion card slots
2 Half-height PCIe expansion card slot
3 Rear handle
6 Power supply unit (2)
7 Network Interface (NIC) ports
8 USB port (2)
9 VGA port
10 Serial port
11 iDRAC9 dedicated port
12 System identification button

Redundancy
Components under high mechanical or electrical stress such as spinning

drives, fans, and power supplies are provided with N+1 redundant
configuration. N+1 redundancy is a system configuration where certain
components have at least one backup component so that the system
functionality continues if a part fails. For data, RAID 6 technology provides
additional protection of data integrity when up to two disks fail.
 PowerProtect DD6400 uses Storage Pool RAID technology for

protection of data integrity.
 DDVE uses RAID on LUN (ROL) for protection of data integrity.
Deep Dive: For more information about specific

PowerProtect DD hardware models, go to the PowerProtect
hardware documents website.

PowerProtect DD Virtual Edition Features
The Dell PowerProtect DD Virtual Edition

(DDVE) is a software-only protection
storage appliance that provides data
protection for entry, enterprise, and
service provider environments. Dell
Technologies offers a DDVE preinstalled
evaluation license that provides 90 days of
full functionality and a maximum
supported capacity of 96 TB on-premises.
DDVE runs the DD Operating System
(DDOS) and includes the DD System
Manager (DDSM) user interface and the DDOS command-line interface
(CLI) for performing system operations.
DDVE Features
• High-speed, variable length deduplication for a 10 to 30 times

reduction in storage requirements
• Data integrity to ensure reliable recovery
• Seamless integration with leading backup and archiving applications
• DD Boost to speed backups by 50 percent
• DD Encryption for enhanced security of data
• DD Replicator for network efficient replication that enables faster time-
to-DR readiness
• Support for the following protocols: CIFS, NFS, DD Boost over IP, and
DD Boost FS (BoostFS)

DDVE Platforms
• On premises, DDVE supports VMware, Hyper-V, KVM, and VxRail.

• In the cloud, DDVE also runs in:
a. Amazon Web Services (AWS)

b. Azure
c. VMware Cloud (VMC) on AWS cloud platforms
d. Google Cloud Platform (GCP)
e. Alibaba Cloud
Deep Dive: For more information about the features and

capabilities of the Dell PowerProtect DD Virtual Edition, see
the Dell PowerProtect DDVE on Premises Installation and
Administration Guide on the Dell Support website.

DD Operating System Features
The DD Operating System (DDOS) is the intelligence that powers Dell

PowerProtect DD series appliances. DDOS provides the agility, security,
and reliability that enables the PowerProtect DD platform to deliver
scalable, high-speed, and cloud-enabled protection storage for backup,
archive, and disaster recovery.
DDOS has a wide range of features to protect sensitive data.

The table below shows some of the DDOS features:
Feature Description
DD Boost DD Boost is a private protocol that is more efficient than

CIFS or NFS. DD Boost has a private and efficient data
transfer protocol with options to increase efficiencies.
Dell Cloud Dell Cloud Tier enables a system to move data from the
Tier active tier to low-cost, high-capacity object storage in the
public, private, or hybrid cloud for long-term retention.
DD DD Encryption allows data encryption on system drives or

Encryption external storage when moving the system to another
location to protect user data.
DD DD Replicator provides automated, policy-based, network-

Replicator efficient, and encrypted replication for disaster recovery and
multisite backup and archive consolidation. DD Replicator
replicates only compressed, deduplicated data over a Wide
Area Network (WAN). This eliminates up to 99% of the
bandwidth required compared to standard replication
methods.
DD DD Retention Lock enables IT organizations to efficiently

Retention store and manage different types of governance and
Lock compliance archive data on a single PowerProtect DD
system. DD Retention Lock helps to ensure that data
integrity is maintained. Any data that is locked cannot be
overwritten, modified, or deleted for a user-defined retention
period of up to 70 years.

Secure SMT for PowerProtect DD systems is a feature that enables

Multi- secure isolation of many users and workloads on a shared
Tenancy system. As a result, tenants cannot see or notice the
(SMT) activities or operations that are performed by other tenants.
This capability improves cost efficiencies through a shared
infrastructure while providing each tenant with the same
visibility, isolation, and control that they would have with
their own system.
DD DD Storage Migration enables migration of data from one

Storage enclosure to another to support replacement of older, lower-
Migration capacity enclosures. The replacement of existing storage
enclosures usually offers higher performance, higher
capacity, and a smaller data footprint.
DD Virtual DD VTL enables the use of a protection system as a virtual

Tale tape library over a Fibre Channel network and eliminates the
Library (DD challenges of physical tape.
VTL)
High If there is a system failure, the HA feature lets you configure

Availability two protection systems as an active-standby pair, providing
redundancy. HA keeps the nonvolatile random-access
memory (NVRAM) of the active and standby systems
synchronized. If the active node were to fail due to hardware
or software issues, the standby node can take over services
and continue where the failing node left off.
Deep Dive: For more information about the DDOS system

features, see the DDOS Administration Guide on the Dell
Support website.

Features and Capacity Licensing
Feature licenses allow you to purchase only those features you intend to
use.
The following are some examples of the features that require additional
licensing:
• DD Boost
• DD VTL
• DD Encryption
• DD Replicator
• DD Retention Lock Compliance Edition
• DD Retention Lock Governance Edition
• Dell Cloud Tier
PowerProtect DD series appliances may require licensing for specific

capacities.

Important: Consult with a Dell sale representative for

information about purchasing licensed features.
Deep Dive: For more information about the features

requiring licenses, see the DDOS Administration Guide at
the Dell Support website.

Architecture and Technology Overview
Data Path and Supported Protocols
PowerProtect DD appliances support several protocols over either

Ethernet and Fibre Channel.
A description of the data path and supported protocols is below:

Administrative Access
You can administer PowerProtect DD appliances remotely over Ethernet

using:
• SSH and Telnet to run CLI commands for management and setup.
− Telnet is disabled by default.
• HTTPS and HTTP to access the DD System Manager (DDSM) to
perform management and setup tasks.
− HTTP access is disabled by default.
• Representational State Transfer (REST) to administer a PowerProtect
DD system.
Clients and Servers
You can backup clients using the protocols that the backup software
supports. PowerProtect DD systems support standard TCP/IP protocols
such as CIFS and NFS, or the Dell proprietary DD Boost protocol.
Client Direct
Some backup appliances and applications, such as Dell NetWorker and

Dell Avamar, have a client direct feature allowing direct access to the
PowerProtect DD appliance over Ethernet and fiber channels. Both
NetWorker and Avamar use the DD Boost protocol with their client direct
feature.

Backup and Archive Servers
Backup and archive media servers send data from clients to the
PowerProtect DD appliance on the network. A direct connection between
a dedicated port on the backup management server and a dedicated port
on the PowerProtect DD appliance may also be used.
Backup and archive media servers use the following protocols to send
data to a PowerProtect DD appliance over Ethernet:
• CIFS
• NFS
• DD Boost
• Network Data Management Protocol (NDMP)
Fibre Channel
Fibre Channel is a high-speed data transfer protocol. A PowerProtect DD

appliance with a supported FC HBA can connect to a vDisk (Virtual Disk
Device) for a storage direct solution, or a Fibre Channel system-attached
network and use the PowerProtect DD Virtual Tale Library (DD VTL) and
DD Boost protocols for backup operations.
With the DD VTL license, the backup or archive server sees the
PowerProtect DD appliance as one or multiple DD VTLs.
With the DD Boost license, any supported backup, archive, or enterprise

application can perform backup and restore operations using the DD
Boost protocol over the Fibre Channel.

Replication
The PowerProtect DD appliance writes backup data to its file system. You
can physically separate backup and replication traffic by configuring two
separate Ethernet interfaces on the PowerProtect DD appliance. This
separation allows backups and replication to run simultaneously without
network conflicts.
You can send replication traffic between two PowerProtect DD appliances

using either a LAN or WAN connection.

DDOS File System
The DD Operating System (DDOS) has a file system for system and
administrative files and another for storing backup data.
/ddvar file system
The /ddvar is an ext3 file system that stores:
• Administrative files
• Core files
• Log files
• Support bundles
• Upgrade packages
You cannot rename or delete the /ddvar file system, and it does not
provide access to all subdirectories. Only Dell Support can access the
/ddvar file system.

MTree
The Managed Tree (MTree) file structure provides a root directory in the
/data/col1 folder and:
• It is the destination directory for user data.

• You can configure your backup application on a specific MTree.
• Provides a granular space management and reporting.
• Simplifies the management of several features including replication,
snapshots, quotas, and retention lock.

Deduplication Using Stream Informed Segment Layout
Overview
The DD Operating System (DDOS) uses stream-informed segment layout

(SISL) to implement inline deduplication. SISL uses fingerprints and RAM
to identify segments already on disk. SISL scaling architecture provides
faster, and more efficient deduplication by minimizing excessive disk
accesses to check if a segment is on disk.
The benefits of SISL are the following:
• Identifies 99% of duplicate data segments inline in RAM before the

store data to disk.
• Scales with PowerProtect DD appliances using newer and faster CPUs
and RAM.
• Increases the throughput-rate of newly added data.

Deduplication Using SISL
The deduplication process using SISL consists of:
1. Segment the data into variable-length segments.

2. Fingerprint or hash each segment for identification.
3. Filter and identify duplicate segments before storing on disk4. If a
segment is a duplicate, it is referenced and discarded.
4. Compress and group new segments using common algorithms such as
lz, gz, gzfast, or off for no compression. For newer PowerProtect DD
models the default algorithm is gzfast.
5. Write data5 to containers stored on disk.
4 Summary vector and segment locality techniques in RAM, inline, are

used to identify duplicate segments before storing them on disk.
5 Segments, fingerprints, metadata, and logs.

Data Invulnerability Architecture
Data Invulnerability Architecture (DIA) is a PowerProtect DD technology

that provides safe and reliable storage. DIA protects data from loss due to
hardware and software failures.
DIA consists of an architectural design to provide data invulnerability:
1. Inline verification provides an end-to-end verification of all file system

data and metadata to confirm they are correct, recoverable, and stored
correctly.
2. Fault avoidance and containment ensure that the data stays correct.
New data never overwrites existing data. New data is always written in
new containers, and old containers and references remain in place and
are safe even in the face of software issues or hardware faults that
may occur when new backups are stored.

3. Fault detection and healing use RAID 6 redundancy to heal faults and
periodically rechecks the integrity of the RAID stripes.
a. PowerProtect DD6400 uses Storage Pool RAID technology for fault
detection and healing.
b. DDVE uses RAID on LUN (ROL) for fault detection and healing.
4. File system recovery reconstructs lost or corrupted file system
metadata6 and includes check tools that can bring the system back
online safely and quickly.
6The file system re-creates by scanning the logs and rebuilding from
metadata.

DD Operating System Features and Capabilities
DD Boost
DD Boost is a private protocol that:
• Provides advanced integration with backup and enterprise applications

for increased performance and ease of use.
• Enables the backup server or application client to send unique data
segments across the network to the PowerProtect DD appliance. This
process reduces the amount of data that is transferred over the
network by 80% to 99%.
• Distributes parts of the deduplication process out of the PowerProtect
DD system and into the backup or application server. This process
enables client-side deduplication for faster and more efficient backup
and recovery.
• Speeds backups by up to 50%, enables more efficient resource
utilization, and reduces the impact on the server by 20% to 40%.
DD Boost runs on the backup server and integrates into backup

applications such as Dell NetWorker, Dell Avamar, and other leading
backup and enterprise applications.
In the protection system, DD Boost exposes the storage units to the

backup applications.

DD Replicator
DD Replicator provides automated, policy-based, network-efficient, and

encrypted replication for disaster recovery (DR) and multisite backup and
archive consolidation. DD Replicator replicates only compressed and
deduplicated data over a wide area network (WAN).
DD Replicator performs two levels of deduplication to reduce bandwidth

requirements by up to 99%:
• Local deduplication determines the unique segments to be replicated

over a WAN.
• Cross-site deduplication further reduces bandwidth requirements when
multiple sites replicate to the same destination system. Any redundant
segment previously transferred by any other site, or because of a local
backup or archive, is not replicated again.
Replication consists of a source PowerProtect DD system and one or

more destination PowerProtect DD systems. You can configure a
PowerProtect DD system as the source or destination in a replication pair.
Replication Topologies
• A one-to-one replication topology performs whole-system mirroring

from a PowerProtect DD source system to a PowerProtect DD
destination system.
• In a bi-directional topology, data from a source MTree on a
PowerProtect DD system A replicates to a destination PowerProtect
DD system B, and replicates from another MTree on a PowerProtect
DD system B to a PowerProtect DD system A.
• In one-to-many replication, data flows from a source MTree on one
PowerProtect DD system to several destination PowerProtect DD
systems.
• In many-to-one replication, replication data flows from several source
PowerProtect DD systems to a single destination PowerProtect DD
system.
• In a cascaded replication topology, a source MTree chains among
three PowerProtect DD systems.

Replication Types
• Managed file replication is a type of replication that the backup

software manages and controls where backup images are directly
transferred from one PowerProtect DD system to another, one at a
time, at the request of the backup software.
• MTree replication replicates MTrees between PowerProtect DD
systems. Periodic snapshots are created on the source, and the
differences between them are transferred to the destination by
leveraging the cross-site deduplication mechanism of the system.
• Collection replication7 performs whole-system mirroring in a one-to-one
topology, continuously transferring changes in the underlying
collection, including all of the logical directories and files of the
PowerProtect DD file system.
7Collection replication does not have the flexibility of the other types, but it
can provide higher throughput and support more objects with less
overhead, which may work better for high-scale enterprise cases.

DD Retention Lock
DD Retention Lock enables organizations to efficiently store and manage

different types of archive data on a PowerProtect DD system. DD
Retention Lock helps ensure that data integrity is maintained. Users
cannot overwrite, modify, or delete any locked data for a retention period
that they define up to 70 years.
There are two DD Retention Lock editions:
• DD Retention Lock Governance Edition retains the functionality of DD

Retention Lock prior to DDOS 5.2. With DD Retention Lock
Governance Edition, you can define retention policies for data to meet
internal IT governance policies set by the system administrator.
• DD Retention Lock Compliance Edition enables you to meet the
strictest data permanence requirements of regulatory standards, such
as SEC 17a-4(f) and other standards. Compliance with these
standards ensures that files that are locked on a PowerProtect system
using DD Retention Lock Compliance Edition software cannot be
altered or destroyed before the retention period expires. DD Retention
Lock Compliance Edition requires a security officer to implement
policies. System administrators and security officers can access an
audit log of policy changes.

BoostFS
DD Boost Filesystem (BoostFS) provides a general file-system interface to

the DD Boost library, allowing standard backup applications to take
advantage of DD Boost features. The BoostFS resides on the application
system and presents a standard file system mount point to the application.
With direct access to a BoostFS mount point, the application can leverage
the storage and network efficiencies of the DD Boost protocol for backup
and recovery.
The benefits of integrating the backup application with BoostFS are:
• Improvement in backup performance

• Reduction in bandwidth consumption
• Reduction on the server load
• Data protection during transmission over a network using in-flight
encryption

• A higher data throughput using link aggregation with Dynamic Interface

Groups
• Gives application owners control of backups
• Supports DD Secure Multi-Tenancy

Cloud Tier
Cloud Tier is a DD Operating System (DDOS) feature for moving data

from the active tier of a PowerProtect DD system to a low-cost, high-
capacity object storage in the public, private, or hybrid cloud for long-term
retention.
Cloud Tier is best suited for:
• Long-term storage of infrequently accessed data that is being held for

compliance, regulatory, and governance reasons.
• Data that is past its normal recovery window.
The system treats Cloud Tier as an additional storage tier and moves data
between tiers as necessary. The system maintains file system metadata
associated with cloud-stored data in local storage and also mirrors it to the
cloud. The metadata that resides in local storage facilitates operations
such as deduplication, cleaning, fast copy, and replication.
Supported Features
• DD Retention Lock
− Meets all the regulatory and compliance policies
• DD Encryption
− You can enable DD Encryption at three levels: System, Active Tier,
and cloud unit.
− DD Encryption of the Active Tier is only applicable if encryption is
enabled for the system.
− Cloud units have separate controls for enabling DD Encryption.
• DD Replicator
− Managed file replication and MTree replication are supported on
Cloud Tier enabled systems.
• DD VTL
− The cloud storage supports the use as a VTL vault.

Supported Cloud Providers
• Dell Elastic Cloud Storage (ECS)

• Amazon Web Services (AWS)
• Microsoft Azure
• Google Cloud Platform (GCP)
• Alibaba
• S3 Flexible provider

DD Secure Multi-Tenancy
The SMT feature of the DD Operating System (DDOS) allows enterprises

and service providers to deliver Data Protection-as-a-Service.
Overview
The DD Secure Multitenancy (SMT) feature enables the secure isolation

of many users and workloads on a shared PowerProtect DD system. As a
result, other tenants cannot see or be aware of the activities of one tenant.
This capability improves cost efficiencies through a shared infrastructure.
SMT provides each tenant with the same visibility, isolation, and control
that they would have with their own stand-alone Dell PowerProtect DD
system.
A tenant may be departments hosted onsite for an enterprise or large

enterprise. For example, Finance and Human Resources can share a
PowerProtect DD system. Each department would be unaware of the
presence of the other.
A tenant may be one or more remotely hosted applications. A service

provider might host the applications on behalf of a client.

Architecture
SMT provides a simple approach to setting up Tenants and Tenant Units,

using MTrees. You can use the Dell PowerProtect DD Management
Center (DDMC) or the DDOS command-line interface to configure SMT.
In this example, two companies Red and Blue share the same
PowerProtect DD system. Tenant units and individual data paths are
logically and securely isolated from each other and managed
independently. Tenant users can backup using their application servers to
a PowerProtect DD system storage in secure isolation from other tenants
on the PowerProtect DD system.
Tenant administrators can perform self-service fast copy operations within

their tenant units for data restores as needed. Tenant administrators can
monitor data capacity and associated alerts for capacity and stream use.
The administrator is responsible for the system monitors and manages all
tenants in the system, and has visibility across the entire system. The
administrator set capacity and stream quotas on the system for the
different tenant units, and report on tenant unit data.

Terminology
The terminology that SMT uses are in the following table:
Term Description
MTrees MTrees are logical partitions of the file

system and offer the highest degree of
management granularity, meaning users can
perform operations on a specific MTree
without affecting the entire file system.
MTrees are assigned to Tenant Units and
contain the individualized Tenant Units
settings for managing and monitoring SMT.
Multi-Tenancy Multi-Tenancy refers to the hosting of an IT

infrastructure by an internal IT department, or
an external service provider, for more than
one consumer or workloads simultaneously.
SMT enables Data Protection-as-a-Service.
Role-Based Access RBAC offers multiple roles with different

Control (RBAC) privilege levels, which combine to provide the
administrative isolation on a multi-tenant
protection system.

Storage Unit A Storage Unit is an MTree configured for the

DD Boost protocol. Data isolation is achieved
by creating a Storage Unit and assigning it to
a DD Boost user. The DD Boost protocol
permits access only to Storage Units
assigned to DD Boost users connected to the
system.
Tenant A Tenant is a consumer8 who maintains a

persistent presence in a hosted environment.
Tenant Self-Service Tenant Self-Service is a method of letting a

tenant log in to a protection system to
perform some basic services, view MTrees,
or storage units that belong to the tenant unit,
or change their own password.
Tenant Unit A Tenant Unit is the partition of a system that

serves as the unit of administrative isolation
between tenants. Tenant units that are
assigned to a tenant can be on the same or
different systems and are secured and
logically isolated from each other.
8 Business unit, department, or customer.

Benefits
Here are some benefits of DD secure multi-tenancy:
• Data access isolation9

− Allows providers to spread the capital expenditure and operational
expenditure of a protection storage infrastructure across multiple
tenants.
• Tenant Self-Service
− Tenants can access and performs some basic services only to their
assigned Tenant Units. This reduces the bottleneck of always
having to go through an administrator for basic tasks.
• Metering and Reporting
− Enable a provider to track usage on the shared PowerProtect DD

system.
9Data isolation is achieved by using separate DD Boost users for different

MTrees or by using the access mechanisms of NFS, CIFS, and DD VTL.

DD High Availability
PowerProtect DD High Availability (DD HA) uses dual Dell PowerProtect

DD nodes that are loosely coupled into a single highly available system.
DD HA reduces the downtime in the event of a failure.
DD HA uses:
• Dual head units.

• A single set of shared storage.
• Both head units and nodes that are configured in an active or passive
setup.
One of the nodes is active and running an instance of DD File System

(DDFS) handling all ingests, restores, replication, and cleaning. The
second node is a standby node and in normal operation remains almost
idle. If the active node experiences a fault, such as a DDFS panic, failover
occurs automatically, to the standby node.
DD HA is a feature that is aimed at environments that cannot tolerate

downtime. DD HA is supported on the following PowerProtect DD
systems: DD6900, DD9400, and DD9900.

DD Virtual Tape Library
Overview
DD Virtual Tape Library (DD VTL) is a disk-based backup system that

emulates the use of physical tapes. DD VTL enables backup applications
to connect to and manage a PowerProtect DD system storage using a
functionality almost identical to a physical tape library. DD VTL eliminates
the challenges of physical tape storage.
Virtual tape drives are accessible to the backup software in the same way
as physical tape drives.
DD VTL supports the simultaneous use of the tape library and file
system10 interfaces.
10 NFS, CIFS, and DD Boost.

Supported Features
• DD Replicator
− Pools and tapes can replicate to a remote PowerProtect DD system
for disaster recovery (DR).
• DD Retention Lock Governance software
− Protect data on tapes from modification.
• Cloud Tier
− Store the DD VTL vault in the cloud for long-term retention (LTR).
• DD High Availability (DD HA)
− DD HA systems are compatible with DD VTL. However, if a DD

VTL job is in progress during a failover, the job must restart
manually after the failover is complete.
Terminology
• Library: A library emulates a physical tape library with drives, changer,

cartridge access ports (CAPs), and cartridge slots (slots).
• Tape: A tape is represented as a file. You can import tapes from the
vault to a library and from a library to the vault. You can move tapes
within a library across drives, slots, and CAPs.
• Pool: A pool is a collection of tapes that maps to a directory on the file
system. Pools are used to replicate tapes to a destination. By default,
pools are created as MTree pools.
• Vault: The vault holds tapes that the library does not use.
Deep Dive: The latest information about specific supported

backup software and hardware configurations is available
on the E-Lab Interoperability Navigator.

Data Security
DD Encryption
When encryption is enabled on a protection system, the embedded key

manager is in effect by default. The embedded key manager provides the
encryption key to encrypt data coming into the system. A protection
system can use either the embedded key manager or an external key
manager.
PowerProtect DD system offers two types of encryption:
• Encryption of data at rest

− Protect user data if the protection system is stolen or if the physical
storage media is lost during transit, and eliminates accidental
exposure of a failed drive if it is replaced.
− As data enters the protection system, the stream is segmented,
fingerprinted, deduplicated, compressed, and encrypted using an

encryption key before being stored on disk or object storage for

cloud-based DDVE instances.
− When the file system is intentionally locked, an intruder who
circumvents network security controls and gains access to the
system is unable to read the file system without the proper
administrative control, passphrase, and cryptographic key.
• Encryption of data in-flight
− Encrypts data being transferred using DD Boost or DD Replicator

between two PowerProtect DD systems.
− Use OpenSSL AES 256-bit encryption to encapsulate the replicated
data over the wire.
− The system immediately removes the encryption encapsulation
layer when it lands on the destination system. You can also apply
DD Encryption to data within the payload.

Data Sanitization
To comply with the National Institute of Systems and Technology (NIST),

system sanitization, also called data shredding, must be performed when
classified or sensitive data is written to any system that is not approved to
store such data.
NIST defines two different levels of cleaning depending on the sensitivity

of the data to be removed from the PowerProtect DD system:
• Level 1 cleaning that meets many situations, requires that the data to
be removed be written over at least one time.
• Level 2 cleaning requires that the entire storage must be sanitized
using Dell Professional Services Secure Data erasure practice.
When an incident occurs, the system administrator must take immediate

action to thoroughly eradicate the data that was accidentally written to
restore the storage device to a state as if the event never occurred.
Sanitization on the PowerProtect system meets the requirements of Level

1 cleaning and is completed by performing the system sanitize
start command.

Cyber Recovery
Cyber Recovery solution with PowerProtect DD series appliances

minimizes the impact of a cyberattack and other sophisticated threats and
provides a higher likelihood of success in the recovery of business-critical
systems.
The Cyber Recovery software runs in a secure, air-gapped vault

environment. The Cyber Recovery vault (CR Vault) is physically isolated
from an unsecured system or network. It provides management tools and
technology to automate the creation of restore points that are used for
recovery or security analytics. The software is built on a secure
microservices architecture.
A primary storage system replicates the data over an air-gapped link to

the Cyber Recovery environment. You can analyze the data that is in the
CR Vault and check for signs of tampering. If the copied data is deemed to
be good, it is saved as an independent full backup copy that can be
restored if needed. If this data must be restored, data can be sent out of
the Cyber Recovery environment and back to the production environment.
With the Cyber Recovery software, you can create, run, and monitor
policies that protect your data.

System Access Features
System access management features allow you to control system access

to users in a local database or in a network directory.
You can configure the DD Operating System (DDOS) for user access to
the PowerProtect DD system for administrative tasks using FTP, FTPS,
HTTP, HTTPS, SSH, SCP, and Telnet protocols. SSH and HTTPS are
active by default.
Role-based access control (RBAC) is an authentication policy that controls

which DD System Manager controls and CLI commands a user can
access on a system.

The following roles are available for administering and managing DDOS:
Role Description
admin Users with this role can configure and monitor the entire
system. Some features and commands require the approval of
a security role user.
limited- Users with this role can configure and monitor the system with
admin some limitations. A user with this role cannot perform data
deletion operations, edit the registry, or enter bash or SE mode.
user Users with this role can monitor systems, change their own
password, and cannot change the system configuration.
security Users with this role can manage other security officers and
officer authorize procedures that require security officer approval. The
security role is provided to comply with the Write Once Read
Many (WORM) regulation. As a result of compliance
regulations, most command options for administering sensitive
operations, such as DD Encryption, DD Retention Lock
Compliance, and archiving now require security officer
approval.
backup- Users with this role can perform all tasks that are permitted for
operator user role users, create snapshots for MTrees, import, export,
and move tapes between elements in a virtual tape library, and
copy tapes across pools. They can also add and delete SSH
public keys for nonpassword required log-ins; add, delete, reset,
and view CLI command aliases, synchronize modified files, and
wait for replication to complete on the destination systems.
none The none role is for DD Boost authentication and tenant-unit

users only. A user with the none role can log in to a protection
system and can change their own password. They cannot
monitor, manage, or configure the primary system.
tenant- Users with this role can configure and monitor a specific tenant
admin unit.

tenant- Users with this role can monitor a specific tenant unit, change
user the user password, and view the tenant unit status. A tenant-
user cannot change the tenant unit configuration.
Deep Dive: For more information about the system access

management features, see the Dell DDOS Administration
Guide at the Dell Support website.

Secure Connect Gateway
Secure Connect Gateway (SCG) is an IP-based automated connect home

and remote support solution that creates both a unified architecture and a
common point of access for remote support activities that are performed
on the product. SCG is the replacement solution to the legacy remote IT
monitoring and support software solution Secure Remote Services (SRS).
The SCG IP Solution does the following:
• Provides continuous monitoring, diagnosis, and repair of minor

hardware issues.
• Uses the most advanced encryption, authentication, audit, and
authorization for ultrahigh security remote support.
• Addresses compliance with corporate and governmental regulations by
providing logs of all access events.
• Provides easy integration and configuration with the storage
management network and firewalls.
• Provides maximum information infrastructure protection. IP-based
sessions enable fast information transfer and resolution.
• Consolidates remote support for the information with the SCG Client.
• Provides remote access to the disaster recovery site and makes
recovery from unplanned events seamless.

• Protects information in motion or at rest. AES 256 encryption during

information transfer protects the information.
• Reduces costs and data center clutter and accelerates time to
resolution.

DD Storage Migration
Overview
DD Storage Migration is a licensed feature that supports the replacement

of existing storage enclosures with new enclosures that may offer higher
performance, higher capacity, and a smaller footprint.
With new enclosures, you can migrate the data from the older enclosures
to the new enclosures while the system continues to support other
processes such as data access, expansion, cleaning, and replication.
The storage migration does require system resources, but you can control
this with throttle settings that give the migration a relatively higher or lower
priority. You can also suspend a migration to make more resources
available to other processes, then resume the migration when resource
demand is lower.
Storage Migration Process
The migration copy process occurs at the shelf level, and not at the logical
data level. As a result, all disk sectors on the source shelf are accessed
and copied over regardless of whether there is data on them.
Important: Because the dataset is divided between the

source and destination enclosures during migration, you
cannot cancel a migration process. Once the migration
process starts, the migration must be complete. If a failure,
such as a faulty disk drive, interrupts the migration, address
the issue and resume the migration.

Minimally Disruptive Upgrade
The minimally disruptive upgrade (MDU) feature lets you upgrade specific
software components or apply bug fixes without perform a system reboot.
The MDU feature can prevent significant downtime during software

upgrades. An MDU disrupts only those services that depend on the
component being upgraded.
Not all software components qualify for an MDU. A DD Operation System

software (DDOS) upgrade uses a large RPM upgrade bundle, which
performs upgrade actions for all the components of the DDOS.
Important: Contact Dell support to determine if an MDU is

available for a specific issue at the Dell Support website.

PowerProtect DD Management Overview
Command Line Interface
The command-line interface (CLI) is a text-driven interface that you can

use to manage a PowerProtect DD system.
You can access the command-line interface through a serial console or

connect via an Ethernet connection using SSH, Telnet, serial over LAN
(SOL), or the Intelligent Platform Management Interface (IPMI).
Direct Access
You can perform the initial installation and configuration of the DD

Operation System (DDOS) through a serial connection or directly
attaching a keyboard and monitor to the PowerProtect DD system.

When you complete the initial configuration connect to the system using
the default administrator username and password:
• The default administrator name is sysadmin.

• The initial password for the sysadmin user on a physical PowerProtect
DD system is the system serial number.
• The initial password for the sysadmin user on a PowerProtect DD
Virtual Edition (DDVE) instance is:
− The instant ID for Amazon Web Services (AWS) or Google Cloud

Platform (GCP)
− changeme for Azure and noncloud deployment
Remote Access
After the initial configuration is done, you can use SSH or Telnet if it is
enabled, the Intelligent Platform Management Interface (IPMI), or SOL
utilities to access the PowerProtect DD system remotely using CLI
commands.
PowerProtect DD systems support remote power management using the

Dell Remote Access Controller (iDRAC). iDRAC enables remote
monitoring of the boot sequence using SOL.
Power management through iDRAC supports the following:
• Powering on the PowerProtect DD system after power outage

• Power cycling the PowerProtect DD system after a DDOS crash

• Powering off the systems that are not in use currently to save power
• Obtaining the power status of the PowerProtect DD appliance
SOL supports the following console activities:
• Running diagnostics
• Installing, upgrading, or reconfiguring DDOS
• Accessing the BIOS
• Viewing Power On Self-Test (POST) and boot messages
Deep Dive: For more information about DDOS commands,

see the DDOS Command Reference Guide at the Dell
Support Website.

DD System Manager
Overview
The DD System Manager (DDSM) is a browser-based user interface for

managing a PowerProtect DD system.
DDSM provides:
• A single consolidated management interface for configuring,

managing, and monitoring a single PowerProtect DD system from any
location.
• Real-time graphs and tables to monitor the status of the PowerProtect
DD system hardware components and configured features.
DDSM Interface
The DDSM provides common elements on most pages to navigate

through the configuration and display options, and context-sensitive help.
The primary DDSM page elements are:
1. The banner displays buttons for Refresh, Information, Help, and User
Settings.
2. The navigation panel in on the left side and displays the highest level
menu selections that you can use to identify the system component or
task that you want to manage.
3. The work area displays information and controls related to the selected
item in the Navigation panel and is where you find system status
information and configure a system.

Deep Dive: For more information about DDSM, see the

DDOS Administration Guide at the Dell Support Website.

PowerProtect DD Management Center
Overview
The PowerProtect DD Management Center (DDMC) is a scalable virtual

system-based solution for centralized management of multiple
PowerProtect DD systems from a single user interface.
DDMC:
• Provides current and historical data for all managed PowerProtect DD

systems.
• Manages up to 150 PowerProtect DD systems.
• Can perform upgrades on groups of PowerProtect DD systems
simultaneously.
• Projects system capacity and availability, capacity threshold health,
and compression factor.
• Monitors storage on multiple systems with Secure Multitenancy, DD
Boost backup, and replication.
• Balances storage usage and performance by using the Smart Scale
migration feature.
DDMC Interface
The PowerProtect DD Management Center (DDMC) is composed of

various page elements.
The primary DDMC page elements are:
1. The banner display buttons for Alerts, Settings, Refresh, Help, and User
Settings.
2. The Navigation panel on the left side displays the highest level menu
selections that you can use to identify the system component or task
that you want to manage.
3. The work area displays information and controls related to the selected
item in the navigation panel and is where you find system status
information and configure systems.

Deep Dive: For more information about DDMC, see the Dell
PowerProtect DD Management Center Installation and
Administration Guide at the Dell Support Website.

Simulation Activity: Exploring DD System Manager
Simulation Activity: Exploring DD System Manager
The Online Course Contains an Interaction Here.
In the simulation, the learner explore the DD System Manager (DDSM)

user interface.
Simulation Activity Wrap Up
Notes

Smart Scale
Smart Scale
Overview
Smart Scale allows you to manage up to 32 PowerProtect DD series

appliances in a single system pool under a unified namespace driving
down management complexity while increasing storage efficiency.

Smart Scale
Smart Scale:
• Manages, protects, and recovers data efficiently.

• Deploys on the PowerProtect DD Management Center (DDMC).
• Runs on the DD9900, DD9400, DD6900, DD6400, and DDVE on-
premises.
A logical system pool creates a layer between client protection policies

and the destination of the protected data to help manage capacity
changes and storage unit placement without requiring modifications to the
protection infrastructure.
Smart Scale introduces a mobile storage unit (MSU). One of the

PowerProtect DD systems in a system pool host the MSU.
You can migrate an MSU from one PowerProtect DD system to another

for a more efficient balance of storage usage and performance within the
environment.
Deep Dive: For more details about Smart Scale, see the
Dell PowerProtect DD Management Center Installation and
Administration Guide on the Dell Support website.

ext3
The ext3, or third extended file system, is a journaled file system that the
Linux kernel commonly uses. A journaling file system keeps track of
changes that are not yet committed to the file system.
Mobile Storage Unit

A Mobile Storage Unit (MSU) is a DD Boost storage unit that is hosted on
one of the PowerProtect DD systems in a system pool. DD Boost clients
access the mobile storage unit through its specified networks.
RAID 6
A Redundant Array of Independent Disks or RAID is a read-and-writing
technology that can reduce the chance of data loss for multiple drives.
RAID 6 is the sixth iteration of storage protocols that are designed for a
multidisk arrangement. It is a data-striping process that uses two disks as
a backup.
Representational State Transfer

Representational State Transfer (REST) is an architectural style for an
application program interface (API) that uses HTTP requests to access
and use data.

SEC 17a-4f
The US Securities and Exchange Commission (SEC) is an independent
agency of the US federal government and the primary overseer and
regulator of US securities markets. It wields enforcement authority over
federal securities laws, proposes new securities rules, and oversees
market regulation of the securities industry.
The SEC defines rigorous and explicit requirements for regulated entities
that elect to retain books and records on electronic storage media.
Section 17a-4f rule is focused on ensuring that records are retained in a

manner that allows faithful reproduction of the original.
Storage Pool RAID

A storage pool is a collection of one or more drives that can be protected
by RAID. A redundant array of independent disks (RAID) is a data storage
virtualization technology that combines multiple physical disk drive
components into one or more logical units for the purposes of data
redundancy, performance improvement, or both.
System Pool
A System Pool is a defined set of PowerProtect DD systems for
organization management. Examples of this are workload types, like
backups for Oracle, VM, and others. The DDMC manages these
PowerProtect DD systems and balances client workloads that access the
hosted mobile storage units. A system pool resides in a data center.

Workload
A workload may consist of a business unit, department, or tenant.
Write Once Read Many

The Write Once Read Many (WORM) regulation requires electronically
stored corporate data to be kept in an unaltered, original state for
purposes such as e-discovery, auditing, and logging.

Dell PowerProtect DD Concepts and Features - Participant Guide

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Dell PowerProtect DD Concepts and Features - Participant Guide

Uploaded by

Copyright:

Available Formats

DELL POWERPROTECT

Architecture and Technology Overview 27

DD Operating System Features and Capabilities 37

© Copyright 2023 Dell Inc Page 2

PowerProtect DD Management Overview 64