NVP: FLR or Instant Access Restore fails "Failed to log in to Data Domain service"

The NetWorker VMware Protection (NVP) integration is configured with the vProxy Appliance. The file level recovery (FLR) or instant access (IA) recovery of a virtual machine fails, indicating that it is unable to authenticate with the Data Domain. The Recovery configuration window in the NetWorker Management Console (NMC) and the recovery log shows:      

Virtual machine recovery failed: vProxy recovery failed with error message: Session "efc196c5-263c-446a-94bc-72f1a62687e1" failed. Error: Unable to create NFS export at '[DATA_DOMAIN]:/data/col1/[NETWORKER_SERVER]/Recover-[VPROXY]-efc196c5-263c-446a-94bc-72f1a62687e1': Unable to run SSH command, error Unable to make ssh connection to '[DATA_DOMAIN]', error ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain.

Error may also appear as:      

Unable to create NFS export at 'DD_NAME:/data/col1/NSR_NAME/FLR-VPRXY_NAME-SESSION-ID': Unable to create NFS export.  A 'POST' method to DataDomain at 'https://DD_NAME:3009/rest/v2.0/dd-systems/0/protocols/nfs/exports' responded with code 403:  Error from DataDomain: 'User not authorized to execute this command: Possible reasons are user doesn't have enough permissions, user permissions have changed or session has expired. Please relogin!, code 5321'

Unable to create NFS export at 'DD_NAME:/data/col1/NSR_NAME/FLR-VPRXY_NAME-SESSION-ID': Unable to login while creating NFS export at 'DD_NAME:/data/col1/NSR_NAME/FLR-VPRXY_NAME-SESSION-ID': Failed to login to DataDomain service at 'https://DD_NAME:3009/rest/v1.0/auth'.  A 'POST' method to DataDomain at 'https://DD_NAME:3009/rest/v1.0/auth' responded with code 400:  Error from DataDomain: '**** Value of "password" is empty or invalid., code 5437'

FLR (and Instant Access Restore) requires DD management credentials in the NetWorker 'Data Domain Systems' resources. The credentials entered are incorrect, missing, or the account specified does not have the correct role.

Update the Management user password:      

1. Connect to the Data Domain web management interface: https://DD_HOSTNAME/ddem
2. Log in with the sysadmin user or other management user account.
3. Go to Administration -> Access -> Local Users.
4. Ensure that the account used by NetWorker for the "management user" has "admin" rights on the Data Domain:

5. Connect to the NetWorker server from the NMC or NetWorker Web User Interface (NWUI) as the NetWorker Administrator.
6. Access the Data Domain Systems.

• • NMC: Devices -> Data Domain Systems
  • NWUI: Devices and Media -> Data Domain Systems

7. Open the Data Domain properties.
8. Enter the management user and password:

9. Click Save.
10. Perform the FLR (or Instant Access Restore) operation again after setting the DD management credentials.

During FLR (Or IA restore), the vProxy connects to the DD using SSH. The "management user" specified creates an NFS export on the data domain. The NFS export is mounted in VMware as an NFS datastore. The NFS export is used to recover the VM data. VM backups and other restore methods do not operate the same way, so this issue only appears during FLR or IA restore operations.