PowerProtect Data Manager 19.9 Google Cloud Platform Deployment Guide

Architecture overview

Access to PowerProtect Data Manager and DDVE is managed by a Virtual Private Cloud (VPC), virtual network service endpoints and their policies, and network and application firewall rules. DDVE uses buckets to store the backed-up data of virtual appliances and virtual machines in GCP.

For more information about this, see the following resources:

• Cloud storage documentation
• VPC overview
• VPC network overview
• Configuring Private Google Access
• Firewall rules
• Best practices

To deploy additional instances of DDVE to GCP outside of the PowerProtect Data Manager deployment process, see the PowerProtect DD Virtual Edition in Google Cloud Platform Installation and Administration Guide at Customer Support.

PowerProtect Data Manager deploys with a private IP address. For access from an external site, configure a VPN connection. For security considerations, deploy PowerProtect Data Manager and DDVE to a private subnet.

The following diagram represents the basic PowerProtect Data Manager architecture on GCP. The diagram shows a possible distribution of PowerProtect Data Manager and DDVE in one private subnet and application hosts in another subnet.

Sensitive PowerProtect Data Manager data, such as passwords, is encrypted and stored in a lockbox. The PowerProtect Data Manager Security Configuration Guide at Customer Support provides more information.

Control and data paths

The following diagram shows the transfer of data between PowerProtect Data Manager, DDVE, and application hosts. This network traffic composes the majority of data transferred in a Google cloud.

DDVE and replication of data between private subnets

The following diagram shows how data replicates between private subnets as well as the transfer of data during regular operations. The diagram also shows the application hosts distributed between public and private subnets.