62176: Acronis Cyber Protect Cloud, Acronis Cyber Backup: how to set up a limited vSphere account

次の言語でも参照できます：

use Google Translate

次の製品に該当します: 

Last update: 03-09-2020

Scenario

You have a VMware vSphere infrastructure and protect it with Acronis Cyber Backup software. To ensure successful operation of Acronis software, please make sure that the vSphere account used by Acronis Cyber Backup matches these requirements in terms of available vSphere permissions for this account. However not only the vSphere permissions are important, but also the vSphere objects where these permissions are applied to and whether the permissions propagation is enabled or not.

For example, "Restore into new VM" operation requires different privileges than backup (especially in a multi-tenant vCenter environment) and you still need to Propagate permissions to some extent. The solution section describes how to ensure successful restore with minimal permission propagation.

Solution

Set up a limited vSphere account and apply permissions for this account to these vSphere objects:
 

  • On vCenter level - "Propagate" not enabled
  • On DataCenter level - "Propagate" not enabled
  • On vSphere cluster - "Propagate" not enabled
    If VMs on root cluster level need to be managed, then "Propagate" must be enabled. Otherwise, make sure to apply permissions to the child Resource Pool inside the cluster that will be used as target for VM recovery).
  • On Datastore level - "Propagate" not enabled
  • On ESXi host level - "Propagate" enabled
  • On vSwitch/dvSwitch level - "Propagate" enabled

To set up a new user account:

  1. In vSphere Web Client, navigate to Administration ->Single Sign-On -> Users and Groups.
  2. On the Users tab, click the New User icon to add a new user.
  3. Type a user name and password for the new user.
  4. Specify the email address for the new user.
  5. Select the type of permissions the user is granted.

To set up a new role in vCenter:

  1. In vSphere Web Client, select Home, click Administration, and click Roles.
  2. Click the Create role action (+) icon.
  3. Type a name (for example, BackupRestoreRole) for the new role.
  4. Select these privileges for the role and click OK.

To apply permissions:

  1. In VMware vSphere console, connect to the relevant vCenter.
  2. Right-click this vCenter and click Add Permission.
  3. Add the newly created user, assign it with BackupRestoreRole and leave the Propagate to children check-box unchecked.
  4. Right-click the child data center. Repeat steps 2-3.
  5. Right-click the child cluster. Repeat steps 2-3.
  6. Right-click the ESXi host that will host the recovered machine(s). Click Add Permission. Add the newly created user, assign it with BackupRestoreRole and mark the Propagate to children check-box.
  7. Right-click the Resource pool that will be used as target for VM recovery. Click Add Permission. Add the newly created user, assign it with BackupRestoreRole and mark the Propagate to children check-box.
  8. Switch to Datastores view and right-click the relevant datastore which will be used as target for VM recovery. Repeat steps 2-3.
  9. Right-click the relevant vSwitch/dvSwitch it and click Add Permission. Add the newly created user, assign it with BackupRestoreRole and mark the Propagate to children check-box.
  10. Specify this newly created user for connection to vCenter in Acronis Cyber Backup software by changing this user if you have Agent for VMware already registered (or deploy new agent using the prepared vSphere account):