You are on page 1of 41

COMMVAULT PROPRIETARY AND CONFIDENTIAL INFORMATION- INTERNAL AND PARTNER UNDER NDA USE ONLY- DO NOT DISTRIBUTE

Consoles and Communications


COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Consoles and Communication

Consoles and
Communication
FOR SALES ENGINEERS
Presented by
COMMVAULT

Copyright © 2022 Commvault | All Rights Reserved

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

Notes:

Welcome to the “Consoles and Communication” module, presented by Commvault®.


For your information, a PDF version of this e-learning module can be downloaded by clicking on the
resources link in the top right-hand corner of the training window.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Learning Goals

Learning Goals

Learn Design

Understand types of Access and Learn which Access and Administration


Administration Consoles available technologies are required to meet the
demands of your solution
User Security and Role Based
Access
Determine options for placement
Gain knowledge of the security and of components
authentication methods and
communication protocols used
Understand network connectivity
and data encryption
Determine the requisite components to
assist with your design

Discover inherent features that support


full Multitenancy of a CommCell®
environment

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY. Copyright © 2022 Commvault | All Rights Reserved 2

Notes:

There are a few different ways to Access and Administer a Commvault® solution, depending, as
always, on the requirements of the customer. In this module you will understand these in more
detail. We will discuss the Consoles themselves and the fundamentals of security and
authentication methodologies. We will also discuss the requisite components and how these
components are tightly integrated to provide a functional solution. You will also discover how the
inherent features of the Commvault® platform can support a full multitenant design.
Following completion of this module you will be able to successfully perform a solution design that
incorporates the technologies required to meet the access and administrative requirements of the
customer. You will be capable of creating foundational designs, including where components should
be placed, and the flow of communication between them.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Administration Consoles Overview

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Notes:
There are 2 types of consoles used for Access and Administrations, namely the Command Center™
and CommCell® Console.
The CommCell® environment itself is a logical grouping of all Commvault® components that provides
common set of core functions namely data collection, data movement, data storage, data tracking,
and data analytics.
Among two different administration GUIs available for the management of a CommCell®
environment, there are no hard and fast rules to which one you must use, as both consoles can
perform most common administration tasks. Often it just comes down to user preference and level
of familiarity.
The Command Center™ which was developed more recently, is a modern web-based user interface
that provides a simplified, service-oriented approach to managing on-premises and cloud
infrastructures. Command Center™ is often the preferred administration interface for new
Commvault® users and those more accustomed to a sleek, modern, web-driven experience.
Prior to the release of Command Center™, the Java based CommCell® Console was the only
administrative GUI to configure and manage a Commvault® environment. It is still the preferred GUI
for many experienced Commvault® administrators and often used for low-level configuration and
certain specialist features such as Workflow automation.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Web Server

Functionality
Web Server • Processes requests from Command
Center™/Web Console

Web Based Applications • Web application server


• Communicates with CommServe® Server

WS

Requests
Search integration

Command Center™ • Compliance Search


• ContentStore Email Viewer

CommServe® and Web Server Design considerations


Web Console
• Start with one and scale based on load (based
on # concurrent users)
• Dedicated Web Server recommended for:
• Compliance search
• Access Archived email messages
https://documentation.commvault.com/
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY. Copyright © 2022 Commvault | All Rights Reserved 4

Notes:

A web server runs the web service that can process requests from one or more web-based
applications, such as the Commvault Command Center™ and the Web Console.
To simplify the visual representation of a web server in CommCell® environment, we will use the
Web Server component installed on same CommServe® machine. It communicates with the
CommServe® system to allow access to CommCell® and the end-user operations on the web.
In addition to compliance search, you can integrate Webserver to access your archived messages
from Microsoft Outlook using the plugin for ContentStore Email Viewer. We will soon discuss
eDiscovery and Compliance search solution in this module.
By default, the Web Server is installed with the CommServe® component. To design always start
with a single Web server. In the case where end user wants to perform compliance search, or
directly access archived email messages from within the ContentStore using Outlook Add-In,
dedicate a Web server for each use case to provide reliable performance. The search use cases are
discussed in further detail in a separate module.
For sizing, you can follow Hardware Specifications for webserver on
documentation.commvault.com.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Commvault Command Center

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Notes:
The Commvault Command Center™ is a simple, modern HTML-5 based UI for administration tasks.
It provides default configuration values and streamlines procedures for routine data protection and
recovery tasks. The intuitive interface is targeted at backup admins, operators, solution owners,
service providers, and tenant users to name but a few.
Command Center™ provides a Guided Setup, whereby admins can configure various Commvault®
solutions from a wizard-driven interface. Guided setup is divided into four tabs that align with
Commvault’s product offerings. Clicking on any of these tabs allows the admin to easily configure
solutions in that product category. If customer has acquired Metallic SaaS backup and recovery
solution, you can associate Metallic account from the services page for a "single pane of glass"
experience.
Command Center™ also features a global search bar that lets users search for CommCell® entities
and navigation items using natural language, quickly and efficiently.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

As previously mentioned, Command Center™ utilizes Plans, which are used to define what to back
up, where to back up to, how often to backup, and how long to keep the data for. In Command
Center™, there are predefined plan types that include the data protection parameters that apply to
the type of data you want to protect.
In Command Center™ you can configure both deduplicated and non deduplicated storage for tape,
cloud, and disk (including Commvault HyperScale™ and Commvault Distributed Storage Clusters).
Finally, the Command Center™ provides Dashboards. Dashboards are previews of the most critical
information related to entities in the environment – such as SLA percentage, capacity usage, and
backup strikes. A number of other Dashboard views are available, for more information on these
views or any other functionality related to the Command Center™ please visit the Commvault®
Documentation Website at documentation.commvault.com.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Commvault Center – Multi-Tenant Environment

Command Center™ – Multi-Tenant Environment

CS A SLA 1
Control Plane
Tenant Admin
Tenant User Tenant User

• Authentication schemes
• Active Directory
• SAML (ADFS, Okta, SFDC, etc.)
Operator
VSA VSA • OIDC (OpenID Connect)
VSA MSP • OAuth 2.0 for Google accounts
MA MA MA • Local CommCell® - level user
Data Plane
A SLA 2
• Users are identified based upon:
A Tenant Admin Tenant User Tenant User
• Email address (preferred primary ID)
MSP Admin BaaS • COMPANY\user
• On boarding workflow
• Create tenant object
• Authentication code
• Tenant user • Replaces tenant password
• Two default user groups • Mass distribution, silent installation
SLA 3
• Client computer group A

Identity Provider Universal Database Tenant Admin Tenant User Tenant User
(IdP) (UDB) • Other default objects
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY. Copyright © 2022 Commvault | All Rights Reserved 6

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Notes:

In a multi-tenant environment, the command center is utilized by the MSP administrator to mirror
real-world organizations by setting up logically separate companies within a single instance of the
Commvault® software. For each company, the MSP administrator can assign separate Service Level
Agreements (SLAs) so that the agreed upon level of data protection is offered to each tenant.
Defining a tenant or a company as it is known in Command Center™, creates a single security object
from which Commvault® can derive tenant users and user groups, in addition it allows the system to
track security through role-based access and record tenant specific metadata and customization
choices.
The Multi Tenancy system has several different levels of access, there is the MSP Admin, which has
full access to all operations and infrastructure controls. Then there is the Tenant Admin, who has a
more restricted view of the infrastructure but can still control operations and tenant user on
boarding within their own tenancy. The Tenant user, which is restricted to only specific server

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

instances and Device admin controls. and finally, the tenant operator, a global user who can
manage defined entities across multiple specified tenants through a single Command Center™ view.
Commvault® supports a few authentication schemes, but the most popular and recommended
approach is to consume SAML as it can reduce demands upon infrastructure in comparison to
direct Active Directory integration.
This transfers the responsibility of identifying a user to the Identity Provider and allows the
Commvault® components to be deployed in an isolated domain with no trust relationships.
Another useful feature is that an authentication code can be generated for installation from within
the company properties This auth code can be used by the tenant, instead of a specific username
and password. The client is then automatically registered under the defined tenant based on the
identification of that auth code. This can be useful for mass distribution or silent installation of the
software install package for end users.

We have already discussed Plans, however in the context of multitenancy, Service Plans bridge the
gap between a service catalogue on paper and the technical configuration of that service within
Commvault®.
Onboarding a tenant utilizes a pre-built workflow that captures details about the tenant and the
admin, it will create the tenant object, the first tenant user, two default user groups, client
computer group and a number of other default objects.
Commvault® also supports a number of customizations for a multi-tenant CommCell® environment
through Command Center™.
• can customize what users see in the navigation menu and set the initial landing page that
users see when they first log on.
• You can customize the way the Command Center™ looks. For example, you can add a logo and
change the color of the interface.
• Finally, you can customize the email messages that are sent to users from the software. For
example, you can create a custom email template when you add a new tenant to the
environment and then add your company logo and your contact information as a header and
footer.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Command Center – Authentication and SSO

Command Center™ - Authentication and SSO


Service Provider (SP) – Webconsole
Identity Provider (IdP) – OKTA, ADFS, Azure AD

User connects to
SP to access SP delegates
application authentication to IdP
SSO Login Attempt

company1.domain.com company2.domain.com IdP validates user


company3.domain.com
User gets access to
application from SP

Service Provider
(SP)

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY. Copyright © 2022 Commvault | All Rights Reserved 7

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Notes:

You can register domain controller in the Command Center™, such as Active Directory with LDAP for
example.
When the Single Sign On feature is enabled for an Active Directory domain controller, the logon
screen is bypassed, and the user is authenticated without entering any logon credentials.
You can also configure Command Center™ and Webconsole with third-party identity providers such
as Okta, Azure, OneLogin, and ADFS, so that users can be authenticated using SAML protocol.
When the single sign on feature is enabled using SAML authentication method, the user logon
session to access Command Center™ redirects to the Web Console in conjunction to the
authentication service provided by identity provider.
As mentioned earlier, Commvault® supports a number of authentication schemes, but the most
popular approach is to consume SAML as it can reduce demands upon infrastructure in comparison
to direct Active Directory integration.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Two-Factor Authentication

Two-Factor Authentication

Username

*************

_ _ _ _ _ _ CommCell® Company User Group

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY. Copyright © 2022 Commvault | All Rights Reserved 8

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Notes:

For many organizations, passwords alone do not provide enough security to protect their
environment from unauthorized access. Customers can add an extra level of security to their
CommCell® login requirements with Two-Factor Authentication, which can be enabled at the
CommCell® level, the company level, or the user group level.
When Two-Factor Authentication is activated, users must provide a 6-digit PIN along with their
password in order to access the CommCell®. Users can obtain a PIN through Email, popular pin
generating mobile apps, or the Desktop Application.
After Two-Factor Authentication is enabled on the CommCell®, a password and a PIN are required
to access the CommCell® through these interfaces, Commvault Command Center™, CommCell®
Console, Web Console, and Command Line.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Web Console

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Notes:
The Commvault® Web Console is the primary access application for End users supported by most
Popular Internet Browsers. The console is a self-service application that allows users to perform
data management operations such as backup, restore, download and so on. The Web Console
package also includes the Command Center™.
The Web Console module is effectively stateless, communication occurs from the Web Console or
Command Center™ to the Web Server over port 81 by default, using the REST API.
Here is a simple design process. Start with a single server running the Web Console package. For
environments with multiple security domains, use one Web Console server per domain.
Multiple Web Console nodes can also be deployed in multiple places, for example the internal
management network, or in the case of a multitenant environment, the tenant may deploy a node
on-premises, or in a DMZ between themselves and the MSP.
Finally, you should specify a domain name space for the Web Console, so that the number of hosts
can be scaled based on the demand. In large environments or when performance and availability
are more critical, it is recommended to deploy the Web Consoles behind Appliance-level Load
Balancers. This helps distribute the load and provide high availability if a server becomes
unavailable. More information can be found on documentation.commvault.com

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Web Console Interface

Web Console
Interface

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY. Copyright © 2022 Commvault | All Rights Reserved 10

Notes:

The Web Console provides several self-service web applications for End users.
The most widely adopted is the “my data” application that lets users Backup, restore, download,
and search data for computers that they own including virtual machines. In addition, users can
browse their email folders, preview, and download messages, and search across those messages.
The My Data application also includes access to protected SharePoint documents and Collaborative
Share repository data. The My Data application is considered the primary interface for end users
who are not performing administrative functions.
The Web Console interface also provides access to several other applications, such as Reporting,
Download Center, Analytics, VM Administration such as VM Provisioning, Virtual Labs, Forms and
more.
In addition, with open access to Internet, Commvault® Store can be accessed from the WebConsole.
The Web Console can be completely customized to make certain applications visible to users, or
not. In addition, user permissions are required to access an application or feature. Consequently,
the Web Console interface provides a flexible solution for end user data management allowing
specific web apps to be assigned to certain types of user, based on their individual requirements.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

REST API

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Notes:
With the rise of service-based IT management and administration, there is higher demand for an
open-standards based approach to software development and integration. Commvault® has made a
significant investment in developing and documenting its rich developer toolset. Employing an API
first methodology helps drive a service-orientated and application focus, enabling automated and
streamlined service delivery. The Command Center™ is the best example of this approach in
practice.
Commvault® REST APIs represent operations that are performed in the CommCell® Console. The
REST APIs can be used to create custom interfaces that focus on specific operations that
organizations might require. The REST APIs are implemented on the HTTP protocol, so they can be
used with preferred programming languages and tools. Responses to these API requests are served
either in XML or JSON formats.
A popular use case is the ServiceNow integration for Commvault®. The Commvault® ServiceNow
application uses REST API calls to interact with the CommServe®. This enables users to perform data
management tasks in Commvault® from the ServiceNow cloud portal. Users can install packages on
physical or virtual clients, backup and restore VMs and files, monitor schedules and jobs, and access
Service Level Agreement (SLA) reports for Commvault®. This integration also includes the ability to
use Commvault® Workflows to create incidents using ServiceNow APIs.
Another use case is the automation of Splunk forwarder plugin installation on Clients associated
with CommCell® Console. Having this plugin installed on clients helps to monitor Commvault job
status, duration, and logs.
You can always refer to API documentation page “api.commvault.com” which has the entire list of
predefined Commvault® API requests which can be populated and tested in Postman environment.
There are many examples of custom solutions or outcomes driven using an API approach, to get
started, please refer to the developer tools section on the Commvault® documentation website.
Here you will find a REST API reference guide and information on how to access the Commvault® API
explorer. You will also find useful information on getting started using REST API with other popular
programming languages.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

User Security

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Notes:
Considering understanding the basics of how user authentication and security work in the
Commvault® architecture will help you design better solutions.
Roles
Commvault® uses role-based security for users who perform any type of administrative function
through either the Command Center™ or Java based CommCell® Console.
A role is a collection of permissions that defines the level of access granted to a user or a user
group. Permissions allow users to perform tasks such as performing backup, restore, and
administrative operations.
Users and User Groups
All users who perform functions within the CommCell® environment must have a local CommCell
user account, or an external user account through a registered domain.
An Entity is a logical or physical component, for example, a client or a storage policy, that a user can
access based on their role.
You must create a security association between users or user groups, a role, and entities.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Data Governance and Compliance Search

Notes:
Data governance and compliance is another mission-critical business need that is addressed by
three distinct solutions Commvault® File Storage Optimization, Commvault® Data Governance,
and Commvault® eDiscovery & Compliance.
Each of these products work independently of Commvault® backup (and each other) but all fully
integrate and align to Intelligent Data Services Platform.
These solutions share common user interface Commvault Command Center™ which gives you a
single user interface experience.
We will cover these solutions in more detail in a separate module but for now the key take-away
here is that this interface provides you the ability to:

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

• Analyze unstructured data and optimize for volume, availability, performance, and risk.
• Identify where sensitive data is located and a quick means of remediation (moving, deleting or
archiving).
• Collect electronic stored information from backup copies and add these to legal holds.

You can always go to documentation.commvault.com to learn more about Commvault® packages


and licensing needed to make each of these product line operates in the environment of the
customer.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Consoles – Communication & Connectivity

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Notes:
Connectivity, and network routes are far more complex topics and outside the scope of this training.
However, this section will provide you with a conceptual overview of the connectivity requirements
for the various access console components and basic deployment scenarios we have just discussed.
The stand-alone version of the CommCell® Console can be run locally from the CommServe®
computer, this can also be accessed using Microsoft Remote Desktop Connection with RDP port
open on the CommServe® machine.
You can also connect directly to a CommServe® from a remote machine using CommCell® Console by
adding third-party port mapping rule through a firewall. The default port 8401 must be open for this
to work.
Some customers may still be using the bootstrap JAR file to access the CommCell® Console from a
remote location. For this to work, you must have ports 80 and 8401 open at destination.
Next the Web Console and Commvault Command Center™. You can access them using URLs from
the CommServe® machine or through remote machine.
The Web Console requires a Web Server to be installed. This can be on the same server as the
webconsole or on a separate computer. But it is important to note, that they are installed by default
with a CommServe® server.
By default, the Web Console and Command Center™ URL uses HTTP, although you can also use
HTTPS if you want to configure secure access.
It is common for the Web Server and Web Console to be separated by a firewall, with the latter
being deployed inside a perimeter network or DMZ to provide global access for external users, or
tenants in an MSP scenario.
The Web Server is the web service that process requests from one or more web-based applications
and communicates with the CommServe® system to provide access to CommCell® and end-user
operations on the web.
Consequently, you must configure third-party port mapping to open connections to the Web Server
through the Web Console computer, the default Commvault® Firewall tunnel uses port 8403.
Remember to consult the Commvault® documentation for more detailed information on network
connectivity.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Networking & Data Encryption

Networking &
Data Encryption

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY. Copyright © 2022 Commvault | All Rights Reserved 15

Notes:

In this final section we will discuss key networking and data encryption concepts.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Network Routes

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Notes:

Commvault® software uses predefined network ports to handle communication and data transfer.
Some ports are static, and some are dynamic. Rather than the network team opening up a large set
of ports on the corporate firewall, Commvault® software has a set of configurable network routes in
place.
CommCell® components separated by any kind of physical or software-based firewall must be
configured to reach each other through the firewall using network routes. Once configured, they
can communicate to perform data management operations like backup, browse, and restore. For
example, if a client needs to communicate with a CommServe® server through a firewall and back
up data to a MediaAgent through a firewall, all three components (CommServe® server, MediaAgent
and client) require configured network routes. Commvault® software uses port 8403 by default, for
firewall communications and provides Authentication and HTTPS encryption in the tunnels for
enhanced security.
There are three network restriction types to remember, when explaining network routes.
A direct connection (with port restrictions) is a setup in which at least one computer in a pair of
communicating computers can establish a one-to-one connection towards the other on specific
ports.
Port Forwarding Gateway – Consider the case of the CommServe® and MediaAgent being located
inside a company’s internal network, with the entire network being exposed to the outside world
through a single IP address. Typically, this IP address belongs to a firewall or gateway that works as a
network address translation (NAT) device for connections from the internal network to the outside.
Finally, The Commvault® network gateway, is a special configuration where a dedicated Commvault®
agent is placed in a perimeter network or DMZ, and the firewalls are configured to allow
connections (from inside and outside networks) into the perimeter network. The network gateway
authenticates, encrypts, and allows the tunnel connections it accepts to connect the clients
operating outside the private network to clients operating inside it. You will see this type of
configuration in several other examples throughout this training. You can also find the latest sizing
information including system specifications for the Commvault® network gateway at
documentation.commvault.com

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Commvault® also provides a Simplified setup for network routes using Predefined Network
Topologies. Network topologies Simplifies administration by establishing connectivity between
multiple clients and proxies using groups.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Dedicated Backup Network

Dedicated Backup Network

Data Interface Pair (DIP)

Client Group MediaAgent Group

Subnet Annotation Subnet Annotation


10.1.7.0/24 192.168.2.0/24

Primary Network

Backup Network

Data Interface Pair (DIP)

Wildcards Wildcards
10.1.7.* 192.168.2.*
*.client.prod.com *.ma.prod.com

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY. Copyright © 2022 Commvault | All Rights Reserved 17

Notes:

Many customers will want to configure a dedicated backup network in their environment to
improve performance by routing high-volume backup traffic through a separate network interface.
Commvault® software provides this functionality through what is known as a “Data Interface Pair”
or DIP for short. A data interface pair defines an exclusive network route between two host
computers. A Data interface pair requires that both host computers in the pair have a separate
network interface that was not used during the software installation process.
An environment may have many clients and MediaAgents that require a data interface pair
configuration. To save the administrator time and effort, DIPs can be configured using client and
media agent groups. Any new clients or media agent added to either group will be assigned the DIP
parameters automatically. Additionally, wildcard or subnet DIPS can be created, whereby the rules
are automatically checked against the known interfaces, to select the appropriate IP or hostname to
use for backups.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Data Encryption

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Notes:

Commvault® encryption provides security by design, with the ability to encrypt data both for
transmission over non-secure networks and for storage on media.
Customers can choose between two ways that Commvault offers to encrypt data. Software
encryption is the first and hardware encryption is the second.
All client agents support software encryption, which makes it possible to encrypt data during a
backup job, an auxiliary copy or secondary copy job, or a data replication job.
The software encryption uses various algorithms with different key lengths. All algorithms meet the
U.S. National Institute of Standards and Technology (NIST) Advanced Encryption standard. Please
consult Commvault’s documentation for the most up to date list of supported algorithms and their
key lengths.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Hardware encryption, on the other hand, is supported by MediaAgents and lets you encrypt data
on tape drives that are connected to a MediaAgent that have built-in encryption capabilities.
Commvault also supports third-party hardware encryption with their own key management.
With any of the encryption methods, keys are always stored in the CommServe database and used
for encryption and decryption of data. Optionally, you can store keys on the media. In most cases of
hardware encryption, where the customer owns the hardware and a vendor license is applied to the
library for key management, the hardware library generates and stores the encryption keys per
media, and the hardware drive encrypts the data.
Finally, you can now protect Commvault® software encryption keys with third-party key
management solutions from SafeNet, Vormetric, AWS, Azure, and more, before storing the keys in
the CommServe® database. Please consult Commvault’s documentation for the most up to date list
of our current supported solutions.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Wrap-up

Wrap-up

• Types of Access and Administration Consoles available

• User Security and Role Based Access

• Security and authentication methods and communication protocols used

• Inherent features that support full Multitenancy of a CommCell® environment

• Network connectivity and data encryption

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY. Copyright © 2022 Commvault | All Rights Reserved 19

Notes:

In this module we covered the different ways to Access and Administer a Commvault® solution. We
discussed the Consoles themselves and the fundamentals of security and authentication
methodologies. We then discussed the requisite components and how these components are
tightly integrated to provide a functional solution. You then heard how the inherent features of the
Commvault® platform can support a full multitenant design and some of the key features around
this configuration.
You learned about networking fundamentals, to understand how Commvault® handles
communication and data transfer, including network routes and dedicated backup networks using
data interface pairs. We then finished with discussing options for data encryption.

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.
COMMVAULT PROPRIETARY/CONFIDENTIAL – FOR COMMVAULT PARTNERS UNDER NDA USE – NOT TO BE FURTHER DISTRIBUTED

Thank You

Copyright © 2022 Commvault | All Rights Reserved 20

commvault.com | 888.746.3849
©1999-2023 Commvault Systems, Inc. All rights reserved. Commvault, Commvault and logo, the “C hexagon” logo, and “Be ready” are trademarks or registered
trademarks of Commvault Systems, Inc. A complete list of trademarks owned by Commvault can be found here. All other third party brands, product names, and
trademarks are the property of and used to identify the products or services of their respective owners. All specifications are subject to change without notice.

You might also like