1. Create a policy if you don’t have already and make sure that “Encryption” option in the Policy Attributes window is selected.

Encryption in Policy - Attributes window

2. Make sure that: Under NetBackup Management -> Host Properties -> Clients -> Client Properties -> Encryption window, “Encryption Permissions” is either “Allowed” or “Required“; “Enable Encryption” is selected.
You can change Encryption types according to your needs, Standard Encryption -> AES-128-CFB is the default.

Encryption configuration in Client Properties Window

3. On the client, create a keyfile with the following command (in this example netbackup is installed in C:Program FilesVeritasNetbackup directory), dc01 is the hostname of the client. You will be asked for a passphrase. Do not lose this passphrase or you may not be able to recover your files.

C:Program FilesVeritasNetbackupbinbpkeyutil -clients client_hostname

Creating a keyfile for encryption

You will see that keyfile.dat will be created inside C:Program FilesVeritasNetbackupvar directory.

keyfile.dat created by bpkeyutil

4. Start a manual backup and see if it works.

5. You can also test that, after deletion of the C:Program FilesVeritasNetbackupvarkeyfile.dat you can not backup nor restore your files. After re-creation of this file, you can backup and/or restore.

Restore without keyfile.dat

23:19:16 30.05.2009: Restore Started

23:19:23 (61.001) Restoring from image created 30.05.2009 23:13:32

23:19:32 (61.001) INF – TAR STARTED

23:19:33 (61.001) INF – Beginning restore from server w2003srv to client dc01.

23:19:39 (61.001) FTL – tar received an invalid archive

23:19:39 (61.001) INF – TAR EXITING WITH STATUS = 13

23:19:39 (61.001) INF – TAR RESTORED 0 OF 1 FILES SUCCESSFULLY

23:19:39 (61.001) INF – TAR KEPT 0 EXISTING FILES

23:19:39 (61.001) INF – TAR PARTIALLY RESTORED 0 FILES

23:19:39 (61.001) Status of restore from image created 30.05.2009 23:13:32 = file read failed

23:19:45 (61.xxx) INF – Status = the restore failed to recover the requested files.

Backup without keyfile.dat

30.05.2009 23:16:17 – started

30.05.2009 23:16:18 – estimated 192 kbytes needed

30.05.2009 23:16:18 – started process bpbrm (1364)

30.05.2009 23:16:26 – connecting

30.05.2009 23:16:27 – connected; connect time: 00:00:01

30.05.2009 23:16:31 – begin writing

30.05.2009 23:17:30 – Critical bpbrm(pid=1364) from client dc01: FTL – tar had an unexpected error

30.05.2009 23:17:34 – end writing; write time: 00:01:03

tar had an unexpected error(184)