Home / Reference / NDMP on ONTAP

NDMP Backup & Restore on ONTAP

Network Data Management Protocol (NDMP) allows Data Management Applications (DMAs like Commvault, Veeam, NetBackup, and IBM Spectrum Protect) to backup and restore NAS volume contents directly to tape, VTL, or disk without traversing a client filesystem. This guide explains scoping modes, Cluster-Aware Backup (CAB), credential generation, network routing, and session troubleshooting in ONTAP 9.

NDMP Architecture & Topologies

NDMP separates the control path from the data path during backups. The DMA (backup server) orchestrates the session via TCP port 10000, instructing the ONTAP NDMP service where to read data and where to stream the resulting backup stream.

2-Way (Direct Tape / VTL): The tape drive or virtual tape library is directly attached via Fibre Channel or SAS to the ONTAP node hosting the data aggregate. The data stream moves directly over FC/SAS to tape without touching the IP network.
3-Way (Remote / Network): The ONTAP storage node reads the data volume and streams the payload over an IP network connection to a separate NDMP tape server (media agent) or disk target. The DMA coordinates both endpoints.

Node-Scoped vs SVM-Scoped NDMP

ONTAP 9 supports two distinct operational modes for NDMP. In modern environments, SVM-scoped mode is the standard best practice:

Feature	Node-Scoped NDMP	SVM-Scoped NDMP (Recommended)
Scope	Cluster/Node level (legacy 7-Mode parity)	Scoped strictly to individual Storage Virtual Machines (SVMs)
Cluster-Aware Backup (CAB)	No	Yes (automatic volume locality negotiation)
Authentication	Per-node root or dedicated NDMP user	SVM-specific local users or cluster admin
Data LIF Usage	Node management LIFs / intercluster	SVM data LIFs with `data-backup` service policy
Multi-tenancy	Poor (global cluster visibility)	Strict multi-tenant boundary per SVM

Cluster-Aware Backup (CAB) Explained

In a clustered ONTAP system, volumes can reside on any node and can move seamlessly via Volume Move. Cluster-Aware Backup (CAB) extension allows DMAs to query the cluster topology dynamically. When a backup starts, the DMA queries the SVM's CAB interface, discovers which node owns the active aggregate/volume, and establishes the NDMP data connection directly to the optimal node LIF, avoiding cross-cluster intercluster interconnect bottlenecks.

Step-by-Step Configuration Runbook

1. Enable SVM-scoped NDMP mode

cluster::> system services ndmp node-scope-mode status
cluster::> system services ndmp node-scope-mode off

2. Enable NDMP on the target SVM

cluster::> vserver services ndmp on -vserver svm_nfs
cluster::> vserver services ndmp show -vserver svm_nfs

3. Generate NDMP user password

NDMP uses a dedicated authentication hashing mechanism. Generate a password for the backup user:

cluster::> vserver services ndmp generate-password -vserver svm_nfs -user backup_admin
Generated password for user 'backup_admin': x9kL#mP2$qR8vN1

4. Verify service policy on SVM Data LIFs

Ensure the data LIFs assigned to the SVM include the data-backup or management-ndmp service policy to accept TCP port 10000 connections:

cluster::> network interface show -vserver svm_nfs -fields service-policy
cluster::> network interface service-policy show -policy default-data-files

Dump vs SMTape Engines

NDMP Dump: File-by-file backup engine. Supports granular single-file restores and DAR (Direct Access Recovery). Ideal for standard file shares.
SMTape (SnapMirror to Tape): Block-level replication engine to tape. Streams raw volume blocks instead of walking the directory tree. Far faster for volumes with tens of millions of small files, but restores are typically volume-level.

Active Sessions & Troubleshooting

# Check active NDMP backup/restore sessions
cluster::> vserver services ndmp status -vserver svm_nfs

# View detailed active session logs
cluster::> vserver services ndmp probe -vserver svm_nfs

# Terminate a hung or stalled NDMP session
cluster::> vserver services ndmp kill -vserver svm_nfs -session-id 12

Common issues include:

Connection Refused (Port 10000): Verify NDMP service is enabled (vserver services ndmp show) and firewall policies allow TCP/10000 on the target LIF.
Authentication Failures: Confirm password was generated using generate-password and that the user has appropriate SVM admin privileges.
DAR Failures: Ensure DMA enables Direct Access Recovery index tracking during the full backup phase.

Security & Port Requirements

Port 10000 TCP: Primary NDMP control connection. Restrict access strictly to authorized DMA media agents via network firewall/ACLs.
Data Ports (10001-10020 TCP): Dynamic data connection ports negotiated during 3-way backups.
Encrypted Transport: Where supported by the DMA, enable TLS encryption on the NDMP control channel.

ONTAP Backup & Recovery Overview — SnapVault, SnapProtect, and cloud backup workflows
SVM Administration — Storage Virtual Machine scoping and LIF configuration
SnapMirror replication — Array-to-array block replication
Backup & Restore Troubleshooting — Resolving backup stalls and snapshot lockups