Huawei · Communication matrix

OceanProtect X series backup appliance

Every network connection the appliance needs in the FusionCompute (LAN-based) backup scenario — 25 flows drawn by the plane they run on, then listed in full with protocol, authentication and encryption.

Scenario

Scenario: FusionCompute (LAN-based)
Flows: 25
Listening ports: 21 distinct
Applies to: OceanProtect DataBackup 1.3.0 and later

Arrows point from the side that opens the connection to the side that listens; each label carries the listening port and what it is for. The appliance only ever initiates outward to infrastructure services and the remote appliance (top), to the ProtectAgent for job delivery and installation, and to the target VM during a file-level restore — everything else is opened towards it. The ProtectAgent host and the NFS client are one and the same machine in this scenario, so they are drawn as a single box — and that host itself runs as a VM on the platform, inside the dashed boundary. The file-level restore path is drawn to that same box; its real destination is whichever VM on the platform is being restored into. Switching the scenario above changes only one connection — the one from that host to the platform it protects.

Management & O&M plane — 6 flows
Backup & recovery path — 13 flows
External infrastructure services — 6 flows

What the client asks the platform for

A zoom-in on the single API line in the map above.

Keystone is only the front door: the client authenticates there once, then spends that token on Nova, Cinder and Neutron. The backup data itself never crosses this path — Cinder snapshots the protected volumes, and the copy is read from a temporary volume attached to the client.

How a backup actually runs

Six steps, from the OpenStack data protection guide (V200R001C33).

Six steps as documented for OpenStack (V200R001C33) — confirm the FusionCompute wording before quoting it.

Backup service process: the OceanProtect appliance creates a file system and starts the job; the client snapshots the cloud disks through the OpenStack API and creates a snapshot volume; the appliance reads that volume into the file system and takes a file system snapshot; the client then removes the volume and snapshots. — Backup service process, as drawn in the OpenStack data protection guide (V200R001C33). The numbers match the steps below.

1
OceanProtect
The data protection engine creates the target file system on the OceanProtect and tells the client to start the job.
2
Client
The client asks Cinder to snapshot the instance’s volumes, then create a new volume from those snapshots — this is the 443 API path, authenticated through Keystone and calling Nova and Cinder.
3
Client
That temporary volume is attached to the client instance and mounted there, so the data is read without touching the running production instance.
4
OceanProtect
The OceanProtect reads the attached volume and writes it into the file system over the backup path. Data is read in fixed-size blocks and hashed; on an incremental backup a block is written only when its hash differs from the one already recorded.
5
OceanProtect
When the backup completes, the OceanProtect takes a file system snapshot. That snapshot is the restore point.
6
Client
The client unmounts and detaches the temporary volume, then deletes it along with the volume snapshots it created in step 2.

Steps 2 and 6 run over the platform API connection; steps 3 to 5 run over the backup path between the client host and the appliance. That split is why both sets of ports have to be open.

Saying it the way the platform team says it

The guide uses cloud-vendor wording; these are the words an OpenStack operator uses.

In the product documentation	On the platform	Why it matters
Cloud server / cloud host	Instance	A Nova server. “Cloud host” is not a word the platform team uses.
Cloud disk	Volume	A Cinder volume. Every disk-level statement in the guide is really about volumes.
Cloud disk snapshot	Volume snapshot	A Cinder snapshot, which the backup then turns into a temporary volume.
Local disk	Ephemeral disk	Not backed up — worth stating plainly, because instances booted from ephemeral storage are out of scope.
Shared disk	Multi-attach volume	Also out of scope.
Bare metal server (BMS)	Bare metal node (Ironic)	Cannot be backed up at all.
System disk	Root volume	File-level restore needs it in the copy.
Keystone V3 address	Public identity v3 endpoint	What openstack endpoint list returns for the public interface.
Domain, project	Same words	Keystone domain and project carry their usual meaning here.

Before you register OpenStack

Getting the Keystone V3 address on the community version.

Log in to the management page of the OpenStack community version.
In the navigation tree on the left, choose Admin › System › System Information.
On the Services tab, read the value of Public for the keystone service.

Version differences aside: if the Public value does not end with /v3, add /v3 to the end of it to get the Keystone V3 address. If it already ends with /v3, the Public value is the Keystone V3 address.

OpenStack Horizon, Admin, System, System Information page. On the Services tab the keystone row shows its identity service endpoints, with the Public endpoint highlighted. — The Public endpoint of the keystone row on the Services tab is the address to take.

Client host prerequisites

Checks to run on the Linux host before the ProtectAgent is installed.

Where it goes: deploy the client as an instance in the same Keystone domain as the instances to be backed up or restored.

Requirement	Why	Dependency package	Automatic push install	Manual install
Port 22 with sshd and sftp	Automatic push installation connects over port 22 and uses the sshd and sftp services. Check the host before installing.	No	Manually configured	N/A
Nginx port open in the host firewall	The Nginx listening port carries traffic between the OceanProtect and the client host. With the host firewall on, allow input and output on that port.	No	Manually configured	Manually configured
NFS installed	Needed when the NFS protocol carries data between the client host and the OceanProtect.	Yes	Configured on the GUI	Manually configured
Haveged or rng-tools	Below 100 OS entropy, true random numbers come slowly. Haveged is advised on a VM, a cloud host, an Arm server or any server with no hardware random number generator; rng-tools on the rest.	Yes	Configured on the GUI	Manually configured
Command line tools	perl and one of awk / gawk / nawk, plus the net-tools and iproute packages.	Yes	Configured on the GUI	Manually configured
Compression tools	Automatic push: tar 1.22 or later. Manual install: unzip for a ZIP package, tar 1.22 or later for a TAR package.	Yes	Configured on the GUI	Manually configured

Full port list

Plane	Source	Destination	Port (listening)	Protocol	Authentication	Encryption	Purpose	Feature scenario
Management & O&M	DeviceManager Web client	Storage controller	8088	TCP	Username and password	TLS	DeviceManager web service for system management and maintenance.	System management - basics
Management & O&M	Web client	Storage controller	25080	TCP	Username and password	TLS	OceanProtect WebUI on the management network plane.	System management - basics
Management & O&M	External system (SmartKit / DME / NMS)	Storage controller	25081	TCP	Username and password	TLS	RESTful API invoked by third-party network management systems.	System management - basics
Management & O&M	Any host	Storage controller	22	TCP	Username and password	SSH	SSH login to the storage CLI for O&M channel management.	System management - basics
Management & O&M	Any host	Storage controller	22	TCP	Username and password	SSH	Remote power-on after the system has been properly powered off.	System management - basics
Management & O&M	Any host	Disk enclosure	22	TCP	Username and password	SSH	SSH login to the disk enclosure CLI.	System management - basics
Backup & recovery path	Client host (independent deployment)	FusionCompute VRM node	7443 ◆	TCP	Username and password	TLS	Client connects to the FusionCompute platform to back up and restore VMs.	Basic protection service - basics
Backup & recovery path	Client host (independent deployment)	OpenStack controller node — Keystone V3 address	443 (default) · per-service (community edition) ◆	TCP	Username and password	TLS	Client invokes the OpenStack service APIs for interconnection, backup and restoration.	Basic protection service - basics
Backup & recovery path	Client host	Storage controller	30065	TCP	Certificate authentication	TLS	Carries backup and restoration service signaling from the ProtectAgent.	Basic protection service - basics
Backup & recovery path	Client host	Storage controller	25082	TCP	Certificate authentication	TLS	ProtectAgent registration, heartbeat and status reporting on the service plane.	System management - basics
Backup & recovery path	Storage controller	Client host	59520–59559	TCP	Certificate authentication	TLS	Appliance delivers backup and restoration jobs to the external ProtectAgent.	System management - basics
Backup & recovery path	Storage controller	Linux and other UNIX hosts / client host	22	TCP	Username and password	None	Management channel used to install the ProtectAgent client.	System management - basics
Backup & recovery path	Storage controller	Target VM for restoration	22 (Linux SSH) · 138, 445 (Windows SMB)	TCP	Username and password	None	File-level restoration from a copy to the selected target VM.	Basic protection service - basics
Backup & recovery path	NFS client / client host	Storage controller	2049	TCP	NIS / LDAP / username and password	None	NFS read and write operations — live mount and instant recovery.	Basic protection service - basics
Backup & recovery path	NFS client / client host	Storage controller	2050	TCP/UDP	NIS / LDAP / username and password	None	Mount port for NFS shares (service network ports only).	Basic protection service - basics
Backup & recovery path	NFS client / client host	Storage controller	2051	TCP/UDP	NIS / LDAP / username and password	None	NSM — client instructs the server to clear lock resources.	Basic protection service - basics
Backup & recovery path	NFS client / client host	Storage controller	2052	TCP/UDP	NIS / LDAP / username and password	None	NLM — file lock and unlock.	Basic protection service - basics
Backup & recovery path	NFS client / client host	Storage controller	111	TCP/UDP	None	None	RPC registration service lookup (portmapper).	Basic protection service - basics
Backup & recovery path	NFS client / client host	Storage controller	53	UDP	None	None	Built-in DNS load balancing for the NAS service IP. Disabled by default.	Basic protection service - basics
Backup & recovery path	NFS client / client host	Storage controller	762 / 2053–2059	UDP	None	None	Rquota — queries and manages NFS service quotas.	Basic protection service - basics
External services	Storage controller	NTP server (external)	123	TCP/UDP	None	None	Time synchronization once an NTP server is set on the management plane.	System management - basics
External services	Storage controller	Third-party CA server	8443 ◆	TCP	Certificate authentication	TLS	One-click certificate update against a third-party CA.	System management - basics
External services	Storage controller	External CA server	1024–65535	HTTP/TCP	Certificate	TLS	Automatic certificate update.	System management - basics
External services	Storage controller	AD domain server (external)	88	TCP	NTLM / Kerberos	None	Kerberos authentication once a Kerberos server is set on the service network.	Basic protection service - backup channel encryption
External services	Storage controller	AD domain server (external)	464	TCP/UDP	NTLM / Kerberos	None	AD domain authentication.	Basic protection service - backup channel encryption
External services	Storage controller	External storage — remote OceanProtect appliance	8088	TCP	Username and password	TLS	Connects an external storage unit (a second OceanProtect appliance or other target) for backup, restoration, archiving and replication.	System management - basics

Limits worth checking before you commit

From the OpenStack data protection guide (V200R001C33).

From the OpenStack data protection guide (V200R001C33) — the FusionCompute figures may differ.

What can be protected

Instances only — bare metal nodes (Ironic) cannot be backed up.
Cinder volumes only — ephemeral (local) disks and multi-attach (shared) volumes cannot be backed up.
The instance must be ACTIVE, SHUTOFF or SUSPENDED.
Crash-consistent backup only. Application-consistent backup is not supported.
Backup granularity is the whole instance or selected volumes; restore is at instance, volume or file level.

Space and job behaviour

A backup creates a temporary volume, so free space in the Cinder backend during the job must exceed the size of the volume being backed up.
Snapshot-consistent backup and linked-clone volumes need the instance’s volumes on one OceanStor Dorado 6.1.6SPH6 or later, with FusionSphere OpenStack 24.1 or later.
One backup job per resource at a time, and backup and restore cannot run together on the same resource.
After a restore to the original location, the next backup is a full backup.
Before restoring, free space at the target must exceed the size of the copy.

Indexing and file-level restore

Index cap per copy: 20 million files on X3000/X6000, 50 million on X8000/X8100/X9000/X9100, 30 million on E6000.
At most 200,000 files per restore job.
Linux ext2/3/4 and XFS; Windows NTFS, FAT and FAT32. ReFS, swap partitions and encrypted disks cannot be parsed.
The copy must include the root volume, and only a single-OS copy can be parsed.
Mount information must be in fstab; VIRTIO disks parse only when it is written as a UUID.
File names must be UTF-8 and shorter than 256 bytes.
Supported guests: Linux, Windows 10 or earlier, Windows Server 2022 or earlier.