Planning Your Deployment

A Cygna Forest Recovery deployment is small: one Manager, one storage machine, and an agent on each domain controller. The decisions you make before installing matter, though, because they decide whether your backups stay out of an attacker's reach and whether the product still works when the directory does not. This chapter covers those decisions and the requirements behind them.

For a description of each component, see Components and Architecture.

Machines you need

Manager machine—A Windows Server machine that is not joined to any domain. It runs the Manager service, the console, and the cdr command-line tool.
Storage machine—A Windows Server machine that is not joined to any domain, with a volume large enough for your backups. It runs the storage agent and holds the vault, your Windows Server installation media, and the recovery images.
Domain controllers—Every domain controller you protect runs the DC agent.
Operator workstations—Any machine with a current web browser that can reach the Manager.
Isolated Recovery Host (optional)—A Hyper-V host that is not joined to any domain, on which test restores of your backups run. A dedicated machine is recommended. For sizing, see System Requirements. Without one, everything else works and backups are shown as not verified.
Candidate machines (optional)—Machines that can receive a recovered domain controller when the original cannot start. You can prepare these in advance or when you need them.

Keep the Manager and storage machine out of the domain

Neither the Manager machine nor the storage machine may be joined to a domain. This is the basis of the product's protection:

An attacker who controls the directory gains no rights on either machine, because no domain account has any.
Both machines keep working, and you can sign in to the console, while every domain controller is offline.

Manage both machines with local accounts that are not used anywhere else, and keep the number of people who can sign in to them small. Avoid management tools that would give someone with domain rights a path to them.

Never use a domain controller

A domain controller is always a domain member, so it can never be the Manager machine or the storage machine. Running everything on one domain controller is not a supported arrangement, even for testing.

Separate or shared Manager and storage machine

Separate machines are recommended. You can run the Manager and the storage agent on one machine if you need to save a server; this is supported.

The choice is about how much an attacker gains from one compromised machine. With separate machines, the Manager has no way to delete or read stored backups: it has no access to the vault at all. On a shared machine, anyone who gains control of the Manager is already on the machine that holds the backups. If you share a machine, protect it as carefully as you would protect the vault on its own.

Where to put the Isolated Recovery Host

If you use an Isolated Recovery Host, give it a machine of its own. The rules for the Manager and the storage machine apply to it too: it must not be joined to a domain, and it can never be a domain controller or share a machine with one. Its disks briefly hold copies of the directory database during each test restore.

Installing the host agent on the storage machine or the Manager machine is supported, but it has costs:

A restored domain controller runs on that machine. If code in a restored backup ever escaped its virtual machine, it would land on the machine that holds every backup, or beside the Manager's certificate authority key and database.
On the storage machine, test restores compete with backups for disk and network.
If the shared machine is itself a virtual machine, Hyper-V needs nested virtualization.
The agent does not restart a shared machine to finish installing Hyper-V; you restart it yourself.

Place the host on the same network as the Manager and the storage machine. Test restore virtual machines reach both through the host while they restore, so the storage machine must accept SMB from the host's address. The restored systems themselves run on a private network that reaches nothing. For the setup, see Setting Up an Isolated Recovery Host.

Keep the host on current Windows updates for as long as you use it. A host that is behind on updates can fail to start a restored domain controller that is more current than the host.

Moving a machine later

A trial is often set up on temporary machines and moved into production afterward. Plan for the difference between the two machines that can move:

Storage machine—Restore points do not move. Replacing the storage machine ends every restore point on the old one, and backups start again from zero on the new one, where every domain controller with a backup policy is backed up at once. It needs both a System Admin and a Backup Operator, or one operator holding both roles. If you can, put the storage machine where it will stay from the start.
Isolated Recovery Host—Nothing is lost. Approve the new host, drain the old one, and remove it. Any number of approved hosts can share the test restores.

For the procedures, see Moving the Storage Machine or an Isolated Recovery Host.

Give both machines fixed IP addresses

Give the Manager machine and the storage machine static IP addresses, or DHCP reservations that never change. Agents are configured with the Manager's IP address when you install them, and the storage agent gives domain controllers its own IP address as the staging location. Neither is updated automatically if the address changes. If an address changes, agents keep connecting to the old one and backups fail until the agents are reconfigured.

IP addresses are used instead of names because neither machine is in the domain's DNS, because DNS may be down when you need to recover, and because a name can be redirected to another machine.

If the storage machine has more than one network address, set the address that domain controllers should use with the Advertised host setting on the Storage agents tab of the Configuration screen. For details, see Settings Reference.

Network placement and isolation

Place the Manager and storage machine where they are reachable from every domain controller you protect, but not from the rest of your network more than necessary:

Every domain controller must reach the Manager on TCP 5211 and the storage machine on TCP 445.
Operator workstations must reach the Manager on TCP 5210, and optionally on TCP 80 for the redirect to HTTPS.
Nothing else needs to reach the storage machine. Limit inbound SMB on it to the networks your domain controllers and recovery targets use.

Plan for recovery as well as daily operation. During a forest recovery, you isolate the domain controllers being recovered from the rest of the network. The Manager and storage machine must stay reachable from those domain controllers throughout, and from the operator workstation you will use. A candidate machine needs the same access as the domain controller it replaces.

For the complete list of connections, see Ports and Protocols.

Scale

One Manager and one storage machine serve the whole deployment.

As the environment grows, the main constraints are the size of the storage volume and how many backups run at the same time. Every backup is a full copy, so storage grows with the number of domain controllers you back up and the number of versions you keep for each. You don't have to back up every domain controller: a few per domain can be restored and the others rebuilt during a recovery. To decide which ones to back up, see Choosing Which Domain Controllers to Back Up. The Maximum concurrent backups setting limits how many backups run at once. To work out the storage you need, see Sizing Backup Storage.

Deployment checklist

Use this checklist to prepare before you install.

Choose the Manager machine and the storage machine. Confirm that neither is domain-joined and neither is a domain controller.
Assign fixed IP addresses to both machines.
Confirm that every machine meets the System Requirements, including the Windows Server Backup feature on each domain controller.
Run cdr repository estimate and provision a storage volume of at least the recommended size. See Sizing Backup Storage. Plan to turn on BitLocker for it. See Encrypting the vault volume.
Open the network paths listed in Ports and Protocols.
Choose an enrollment token: a long random secret that you will give to the Manager installer and to every agent installer. See Certificates and Trust.
Decide how you will install the DC agent: from the console, with cdr agent deploy, or with your own software distribution tools. Prepare the accounts and target settings described in Accounts and Permissions.
Collect Windows Server installation media (ISO files) that match the build, edition, installation type, and architecture of your domain controllers. The storage agent builds recovery images from them.
Decide where you will store, offline, the secrets created during setup: the break-glass account password, the recovery passphrase, the enrollment token, and the storage volume's BitLocker recovery key. See Manager Day-One Checklist.
If you want backups verified by test restores, choose a machine for the Isolated Recovery Host that meets the Isolated Recovery Host (optional) requirements, and a private network prefix for its recovery network that is not used anywhere else.
Plan who needs operator accounts and which roles they need. See Managing Operators and Roles.

Install the Manager and sign in to the console for the first time, then install the storage agent, and then the DC agents. If you use an Isolated Recovery Host, set it up last, once backups and recovery images exist. For the steps, see Installing and Setting Up.