The VxRail cluster was included in this design to provide a virtual infrastructure for recovery and restoration. A two-node VxRail cluster may be used but note that this configuration does not scale. For scalability, we recommend starting with a three-node minimum VxRail cluster. Due to VxRail requirements, the first three nodes of a VxRail cluster must be the same node type and configuration. In this lab environment, the VxRail E560H node was used, however, any supported VxRail configuration may be implemented to support this use case.

Note the following factors when considering scalability of a VxRail cluster in the Cyber Recovery vault environment:

• Cyber Recovery vault DD quantity and connectivity model (10 GbE compared to 25 GbE compared to 100 GbE)
• Production DD quantity and connectivity model (10 GbE compared to 25 GbE compared to 100 GbE)
• VxRail node type and connectivity model (10 GbE compared to 25 GbE and two uplinks compared to four uplinks)
• Quantity of Cyber Recovery network switches (one compared to two)

Table 1.      Example environment #1

This example environment consumes 34 out of the 96 10/25 GbE switchports available, leaving 62 switchports available. Considering that each VxRail E560H node consumes five switchports, this VxRail cluster can scale by an additional 12 VxRail nodes.   

This example consists of VxRail nodes with four uplinks per node, however VxRail nodes can be supported with as few as two uplinks. This configuration changes the required number of switchports for each node from five (four uplinks and one iDRAC) to three (two uplinks and one iDRAC). 

The following table shows a configuration similar to the first example, except that the VxRail nodes are configured with two 25 GbE uplinks instead of four 10 GbE uplinks. The available switchport interfaces increase to 68. This increase might not seem significant, however, the VxRail nodes now only require three switchport interfaces and the VxRail cluster can scale out to 22 additional nodes.

Table 2.      Example environment #2

Data protection of the Cyber Recovery vault environment

Protect against failures of the Cyber Recovery virtual appliance, the VxRail vCenter Server Appliance, and Platform Services Controller. These systems can be manually configured to perform backups using their native backup utilities.

The backups for each of these systems are directed to and stored on the Cyber Recovery vault DD MTree NFS shares as listed in the following table:

Table 3.      Backup information

Note: This table provides example data and recommended values. Create the MTrees and NFS shares manually on the Cyber Recovery vault DD system. The frequency and retention period for the backups may be adjusted to individual business needs or preferences.

Additional security options and considerations include:

• When configuring a Cyber Recovery environment, you must engage a DPS SE and the BRDC to size and ensure maximum security of the Cyber Recovery vault environment properly. 
• Engage a DPS SE early for proper discovery of the front-end data sizing for Cyber Recovery solutions. Possible design changes might have to be considered for the DPS backup application and CyberSense sizing requirements. 
• Use of a firewall to secure the management network between the customer network and the Cyber Recovery vault network.
• Use a VPN to secure management communication to and from the vault.
• Use a jump server to mask the Cyber Recovery vault from the production system and provide a mechanism to access hosts in the Cyber Recovery vault.
• Use a data diode to provide secure one-way communication out of the Cyber Recovery vault.
• Use an in-vault patch panel to physically disconnect the network between the Cyber Recovery vault and the production system.
• Install the Cyber Recovery vault in a dedicated room or cage with physical access controls such as key access and video surveillance at entry points.
• Provide access to Cyber Recovery software only by physical access through a dedicated keyboard and mouse.