Configure OCI Private Endpoints for Air Gap Protect storage

Use OCI Private Endpoints to enable private connectivity between your environment and OCI Object Storage used for Air Gap Protect.

Using OCI Private Endpoints ensures that data traffic remains within the Oracle Cloud Infrastructure network, reducing exposure to the public internet while supporting secure connectivity to Commvault-managed storage.

Requirements

Before configuring an OCI Private Endpoint, obtain the following information from Commvault Support:

• Namespace

• Compartment OCID

• Bucket name

• Tenancy OCID

Create a private endpoint

Create an Object Storage Private Endpoint in your OCI tenancy:

1. Log on to the Oracle Cloud Infrastructure Console.

2. Create a new Object Storage Private Endpoint.

3. Select the Virtual Cloud Network (VCN) that will host the private endpoint.

4. Select the subnet for the private endpoint.

5. Configure the required access targets using the Namespace, Compartment OCID, Bucket name, and Tenancy OCID provided by Commvault.

For information about creating Object Storage Private Endpoints, see the Oracle Cloud Infrastructure documentation.

Configure network access

Ensure that your network configuration allows communication with the private endpoint.

Verify the following:

• HTTPS (TCP port 443) is allowed to the private endpoint.

• Network Security Groups (NSGs) and Security Lists permit the required traffic.

• Route tables are configured correctly.

• The private endpoint FQDN resolves to the assigned private IP address.

For more information, see the Oracle Cloud Infrastructure networking documentation.

Configure DNS

Configure your DNS environment so that systems accessing the storage resolve the private endpoint FQDN instead of the public Object Storage endpoint.

Verify that:

• The private endpoint FQDN resolves correctly from all MediaAgents.

• DNS changes have propagated before validating connectivity.

Update the storage device

After you configure the OCI private endpoint, update the Air Gap Protect cloud access path to use the private endpoint FQDN instead of the public OCI Object Storage endpoint.

You'll first collect the storage device information from Command Center, use those values to create an XML request, and then apply the change from the CommServe server.

Get the cloud access path information

1. Log on to Command Center.

2. Go to Storage > Air Gap Protect, and then select the Air Gap Protect storage.

3. On the Backup Locations tab, select the backup location associated with the cloud access path that you want to update.

4. In the Container section, select the required bucket.

5. In the Cloud access path section, click the link under the Container column.

   The Edit cloud access path dialog box appears.

6. Click Equivalent API, and then copy the API content.

   The response contains information similar to the following:

   {
     "infoList": [
       {
         "mountPathId": 0,
         "opType": 2,
         "deviceId": 6,
         "accessType": 14,
         "protocolType": 6,
         "numWriters": -1,
         "enabled": 1,
         "accessible": true,
         "deviceControllerId": 8,
         "mediaAgent": {
           "id": 7,
           "name": "ocivm001"
         },
         "userName": "objectstorage.us-ashburn-1.oraclecloud.com@2//|-|CVCREDID",
         "path": "dsia2011usasxxxxxxxxxxx",
         "savedCredential": {
           "credentialId": 11,
           "credentialName": "xyz"
         }
       }
     ],
     "mountpathId": 6,
     "region": {}
   }
   

7. Record the following values from the Equivalent API response:

   XML value	Equivalent API value	Example
   MOUNTPATHID	mountpathId	6
   DEVICECONTROLLERID	deviceControllerId	8
   DEVICEID	deviceId	6
   BUCKETNAME	path	dsia2011usasxxxxxxxxxxx
   MEDIAAGENTID	mediaAgent.id	7
   MEDIAAGENT-NAME	mediaAgent.name	ocivm001
   CREDENTIALID	savedCredential.credentialId	11

   You'll also need the FQDN of the OCI private endpoint when you create the XML request.

Create the XML request

1. Create a file named MMDevicePathInfoReq.xml.

2. Create the following XML content:

   <EVGui_MMDevicePathInfoReq mountpathId="$[MOUNTPATHID]">
     <infoList
       accessType="14"
       accessible="1"
       deviceControllerId="$[DEVICECONTROLLERID]"
       deviceId="$[DEVICEID]"
       enabled="1"
       numWriters="-1"
       opType="2"
       path="$[BUCKETNAME]"
       userName="$[PRIVATE-ENDPOINT-FQDN]//|-|__CVCREDID__">
       <mediaAgent
         id="$[MEDIAAGENTID]"
         name="$[MEDIAAGENT-NAME]"/>
       <savedCredential
         credentialId="$[CREDENTIALID]"
         credentialName=""/>
     </infoList>
   </EVGui_MMDevicePathInfoReq>
   

3. Replace the variables with the values that you obtained from the Equivalent API response.

   For PRIVATE-ENDPOINT-FQDN, specify the FQDN assigned to your OCI private endpoint.

   For example:

   AGP-PrivateEndpoint-xxxx.private.objectstorage.us-ashburn-1.oci.customer-oci.com//|-|CVCREDID
   

Configure the additional setting

Before you apply the XML request, configure the AllowAGPDCEdit additional setting on the CommServe.

Use the following values:

Apply the private endpoint configuration

1. Copy MMDevicePathInfoReq.xml to the CommServe server.

2. From a command prompt on the CommServe server, go to the Commvault software installation directory.

3. Run qlogin.

4. Run the following command:

   qoperation execute -af $[PathToXMLFile]\MMDevicePathInfoReq.xml
   

5. After the command completes, delete the AllowAGPDCEdit additional setting.

Validate connectivity

After completing the configuration, verify the following:

• The private endpoint FQDN resolves to a private IP address.

• HTTPS connectivity over TCP port 443 is successful.

• MediaAgents can access the bucket through the private endpoint.

• Backup and restore operations complete successfully.