Use Cases for AirGap for Dell

Introduction

AirGap supports several concrete scenarios for protecting and recovering data. This page walks through the primary use cases: isolating backup data from ransomware, recovering a subset of vaulted data, performing a full reverse-replication recovery, and using the vault cluster itself as a rapid-recovery ("Emergency Operations Mode") DR runbook.

note

This page also carries the detailed recovery-runbook content migrated from the legacy AirGap guide's "Recovery Scenarios" chapter, since the current documentation structure does not yet have a more specific home for full disaster-recovery runbooks. If a dedicated Disaster Recovery / Recovery Scenarios page is created in the future, this content should move there.

Ransomware Recovery and Air-Gapped Backup Isolation

AirGap's core use case is protecting a copy of your data from a ransomware event or unauthorized access that has already compromised your production environment. Because the vault copy is:

• Replicated on a longer interval than DR (allowing time to detect a compromise before it reaches the vault),
• Locked read-only/immutable by SyncIQ (so it cannot be encrypted or deleted, even by a compromised root account), and
• Network-isolated except during a narrow, scheduled replication window,

it remains usable as a clean recovery source even if production, backup infrastructure, and a DR copy are all affected. Best practice is to always enable the Pause data replication when active Ransomware events detected option on each AirGap policy, so a scheduled sync is automatically skipped if Ransomware Defender (or Easy Auditor) has unresolved active alarms — preventing compromised data from ever being copied into the vault.

Before starting any recovery from the vault, confirm that the environment has been fully cleared of active threats (including supporting infrastructure like AD and DNS). Do not begin a vault recovery while a threat may still be present, since this risks compromising the last clean copy of your data.

Partial Recovery of Vaulted Data

Use this scenario when only a subset of data needs to be recovered — for example, a specific path affected by an issue on production, while the rest of production is healthy.

Method 1: SMB share (Windows Explorer)

1. Physically connect the vault PowerScale's management interface to the vault Ethernet switch's management VLAN or port.
2. Log in to the vault cluster's WebUI and enable the SMB protocol.
3. Create an SMB share on the path containing the data you need. Since the vault cluster has no AD provider, authenticate using a local user (for example, the admin account).
4. Copy the data from the share to production using Windows Explorer. The data remains read-only/immutable throughout, since it is still locked by SyncIQ.
5. When the restore is complete: delete the SMB share, disable the SMB protocol, and disconnect the management interface.

Method 2: SCP in-band copy

Best for a longer-running restore of a specific path, when SSH is available on the vault cluster (note: SSH may have been disabled as part of vault hardening, which would block this method).

1. SSH to the production cluster.

2. Open the AirGap using the Ransomware Defender CLI timed-open command, for a duration long enough to complete the copy.

3. Copy data over the in-band replication network:

   scp -rp <user>@x.x.x.x:/ifs/data/yyy/* /ifs/data/ccc

   Where x.x.x.x is an IP address in the vault replication pool, yyy is the source path on the vault, and ccc is the destination path on production. -rp performs a recursive copy while preserving timestamps.

4. Monitor the copy until it completes; the AirGap automatically closes once the timer expires.

Complete Recovery via Reverse Replication

Use this scenario only as a recovery of last resort, when the production cluster and its own snapshots offer no viable restore option, and the vault copy has been determined to be the best available copy of the data. Superna strongly recommends opening a support case and a Dell SR to review this procedure with support before proceeding.

important

This procedure is data-impacting and irreversible once started. Resync Prep makes the production data read-only, blocking all I/O, until the process is completed. Confirm that all data protected by the AirGap policy actually needs to be restored before beginning.

1. Disable the AirGap SyncIQ policies from replicating (via the AirGap CLI).
2. Open the AirGap for a generous number of hours — long enough that it cannot close mid-copy (for example, 1000 hours as a safe estimate).
3. Run SyncIQ resync prep on the production cluster's AirGap policies (repeat per policy if there are multiple). Verify the job completes using the SyncIQ jobs view.
4. SSH to the vault PowerScale using an IP in the vault replication pool.
5. List the SyncIQ policies on the vault cluster — resync prep should have created a <AirGap policy name>_mirror policy for each AirGap policy. (If no mirror policy appears, open a Dell SR for SyncIQ assistance.)
6. Run each <AirGap policy name>_mirror policy to reverse-replicate data from the vault back to production. Monitor progress with the SyncIQ jobs view.
7. Once the sync job(s) complete, exit the vault SSH session (verify you are back on the production cluster prompt).
8. Run Allow Writes on each AirGap SyncIQ policy path on production, to make the restored data writable and accessible to users and applications again.
9. Recovery is complete. Open a support case before re-configuring AirGap policies to re-protect production — a full re-sync into the vault may be the best path forward.

Rapid Recovery / Emergency Operations Mode (DR Runbook)

This is Superna's fastest recovery option: rather than copying data back to production, the vault cluster itself temporarily becomes the production file-serving cluster. Superna recommends building a Cyber Recovery RunBook (see Design Guide) with these steps pre-adapted to your environment, since much of the configuration below can be pre-staged in advance to save time during an actual event. A well-documented process can support full data recovery and user/application access within a few hours.

Benefits:

• Eliminates the data-copy step entirely by converting the vault into the file-serving device — the fastest recovery option available.
• With a DR license on the vault, Eyeglass DR can also sync production shares, exports, and quotas to the vault, so data-access security matches production.
• Supports immutable, locked data with data-integrity guarantees during the copy phase, and multiple recovery time points via versioning.

High-level steps:

1. Vault cluster physical steps — connect Ethernet cables from each vault node to the production network, on the correct ports/VLANs.
2. Configuration data sync (Eyeglass):
   • SSH to Eyeglass and open the AirGap for 1 hour.
   • Physically connect the vault PowerScale management interface to the network.
   • Disable the AirGap SyncIQ policies on the production cluster.
   • Add the vault PowerScale to Eyeglass as a Network Element (requires a DR license for the vault) and wait for inventory to complete.
   • In the AirGap icon, use Migrate Configuration to copy shares/exports/quotas configuration from the source Access Zone/path to the vault.
3. Data write access — under SyncIQ > Local Targets, use Allow Writes on each AirGap policy path so the locked vault copy becomes writable.
4. Authentication providers, Access Zones, IP pools:
   • Verify Access Zones exist on the vault cluster.
   • Recreate the IP pools that existed on production (SmartConnect names, node assignments, IP ranges — reusing production ranges requires first removing those interfaces from the production cluster's pools to avoid conflicts).
   • Assign the correct Access Zone to each IP pool.
   • Update DNS SmartConnect delegations to point at the vault cluster.
   • In Active Directory, delete the production cluster's AD computer object (removing its SPNs) so the vault cluster can register the same SmartConnect name SPNs against its own computer object.
   • Add the required AD provider(s) to the vault cluster and to each Access Zone (AD provider listed first in each zone's authentication order).
5. Test data access — test IP-based SMB and NFS mounts first, then SmartConnect name-based access. Involve AD, DNS, network, and NAS administrators.
6. Recovery complete — this configuration is temporary, intended to restore critical application access at (typically) lower throughput while the original production cluster is assessed and fully recovered.

Additional Recovery and Operational Scenarios

The following scenarios, drawn from Superna's AirGap FAQ, describe how customers commonly access and validate vaulted data outside of a full recovery event:

• Vault access for maintenance: inline SSH access through the production cluster is the recommended way to reach the vault for maintenance, using a command that opens the AirGap and auto-closes it after a set number of minutes. A physical management interface can optionally be connected for GUI access, but requires physical presence to connect/disconnect and is not the primary recommended method.
• Testing data recovery:
  • In-vault test: use the Open AirGap CLI command to SSH to the vault cluster, then use scp to copy files to production — see the SCP method above.
  • External test (recommended quarterly): connect the vault's management interface, create a read-only SMB test share, verify the data reads correctly, then delete the share and disconnect the interface. This test requires no downtime, since vault replication continues normally while the source cluster remains in full production.
• Recovery runbook ownership: this guide documents the high-level steps for each scenario; most day-to-day AirGap tasks are automated and do not require a dedicated runbook for routine operation. Superna's professional services team can assist with design, implementation, and operational runbook creation for your specific environment.

See Also

• Design Guide – Deployment topology, the Cyber Recovery RunBook concept, and the DR-path-overlap rule referenced above.
• Installation Guide – Deploy and configure AirGap before these scenarios apply.
• Troubleshooting – Emergency stop and maintenance-window commands used during these scenarios.