Create a Protection Group

When you create a protection group, you configure all the settings needed to enable successful disaster and ransomware recovery.

When you create a protection group, you select a snapshot frequency, choose whether to quiesce VMs before taking snapshots, define group membership (VMs) using dynamic queries, set the snapshot schedule, and configure the snapshot retention policy.

Note: When defining protection group membership, ensure that you use unique membership criteria across protected sites. Protection group membership queries should not allow the same VM to belong to multiple protection groups and different recovery plans across multiple protected sites.

When you save the protection group, it begins taking snapshots of group members according to its snapshot schedule, with each snapshot replicating to a cloud file system. You can then use snapshots in recovery plans for disaster recovery and ransomware recovery operations.

A protection group only supports one snapshot type: standard-frequency OR high-frequency. You cannot mix snapshot frequency types in a protection group. Once a VM has a high-frequency snapshot taken of it, all subsequent snapshots for that VM are high-frequency.

Note: Do not configure a protection group for any VMs that reside on a shared disk in a shared disk cluster.

Before you can create a protection group, you must first:

• Deploy a cloud file system.
• Set up a protected site.
• Deploy the DRaaS Connector.

Procedure

1. From the left navigation, select Protection groups.
2. From the upper-right, click the Create protection group button.
3. In the Create protection group for site dialog box, under Protection group name enter a name for the group.
4. Next, select a protected site and a vCenter instance you want to take snapshots from.
5. After you select a protected site and vCenter, the protection group automatically checks the protected site for compatibility with the high-frequency snapshot feature. The compatibility check has three possible outcomes:
   • If the protected site vCenter and hosts are compatible, then the Use high-frequency snapshots option is selected and you can start defining protection group membership (step 6).
   • If the protected site vCenter and hosts are not compatible, then this protection group cannot take high-frequency snapshots. In this case, you can leave the high-frequency snapshot option deselected. Or, you can upgrade the vCenter Server and ESXi hosts on the protected site.
   • If the protected site you select is "mixed," it means some hosts are compatible with high-frequency snapshots and some are not. In this case, you can run a host compatibility check to find hosts and VMs that are not compatible.
6. Next, to use quiesced snapshots, select the Quiesce option. If you are not sure if your protected site supports quiescing, run a quiesce compatibility check.
7. Next, define the dynamic membership of the protection group using VM name patterns, tags and/or VM folders in a vCenter query. The protection groups will contain all VMs that match the queries.
8. Under Group membership, click the VM name pattern, Tags, or Folder buttons.
9. For a VM name pattern query, enter a VM name pattern that is evaluated before a snapshot is taken. You can also enter a name pattern in the query in the Excluding text box for exclusion. (If there is already one vCenter query, then from the Add vCenter query drop-down menu select VM name pattern.)
10. For a folder query, click the Select folders button. In the vCenter folders dialog box, search the list of folders in your vCenter and click one to add it. (If there is already one vCenter query, then use the Add vCenter query drop-down menu and select Folders.) Folder selection does not include sub folders, so you must select subfolders specifically. 
    Note: Protection groups do not support folder-based snapshots for VMs that are a part of vApp.
11. For a tag query, click the Tags button. In the vSphere tags dialog box, select tags to define protection group membership. Any VMs with selected tags are included in the protection group snapshots. Click OK when you finish.
12. Click Preview VMs to see VMs that match the queries.
13. Click Next.
14. To set the snapshot schedule, click New Schedule.
15. On the Schedule page, edit the snapshot schedule. A protection group can have a maximum of 10 schedules associated with it. Select snapshot frequency based on the following intervals:
    • Standard-frequency snapshots allow you to set snapshots schedules as frequently as every 4, 6, 8, or 12 hours, daily, weekly, or monthly.
    • With high-frequency snapshots, you can set snapshots schedules every 15 minutes, 30 minutes, or hourly, every 2, 4, 8, and 12 hours, and daily, weekly, or monthly.
    • If you have selected the Quiesce option for the protection group, select to quiesce at least one of the schedules by selecting the option under the schedule. If the protection group is configured for quiescing, then you must configure at least one schedule with the quiesce option selected.
    • Enabling quiescing for high-frequency snapshots on a schedule of every 30 minutes or less can affect VM performance.
    Note: Protection group snapshots can exhibit errors if your environment is running other VM backup software that runs at the same time as the VMware Live Cyber Recovery snapshot schedule. If a VM is currently being backed up by VMware Live Cyber Recovery by a protection group snapshot, and the same VM is also being backed up by other software that uses vSphere Storage APIs for Data Protection (VADP), the snapshot is still taken, but that VM is not included in the snapshot.
16. Next, set the snapshot retention for this protection group. You can select any number and then select the duration (hours, days, weeks, months, years).
    For effective ransomware recovery, create a snapshot retention schedule that is at least 90 days. A 60 day retention schedule might result in higher storage capacity consumption.
17. Optionally, you can add a custom name for the snapshot schedule. Click once in the default schedule name field above the schedule, type a custom a name, and then press Enter on your keyboard.
18. When you have finished adding snapshot schedules and retention, click Finish. When the protection group appears in the Protection groups list, you can add it to a DR Plan for testing and execution.

What to do next

After you create a protection group, you can now check the protection group's health status and make sure the replication schedule is active.