NDMP backup software solution from Bacula

Q: What's the difference between 2-way and 3-way NDMP?

With the 2-way, or Direct NDMP, the filer connects straight to the tape library or backup target, usually over Fibre Channel or SCSI, and the backup server sends the commands, but the data itself never leaves that direct connection. By comparison, with the 3-way, or Remote NDMP, the data travels over the network, typically Ethernet, to a separate backup server, which then writes it wherever it’s going, disk, tape, or cloud. This is the mode Bacula recommends for production deployments.

Home > Corporate Data Backup > Enterprise Data Backup Tools > NDMP backup

NDMP is a licence-free backup and recovery standard that’s built specifically for NAS files. Given that NAS boxes can’t recover from a disaster independently, major vendors like NetApp, EMC, HPE, along with Huawei, integrate the NDMP plugin natively into their hardware to extract data safely.

Unlike legacy protocols such as NFS and CIFS that force the backup server to scan every single file and access control list (ACL) one by one, Bacula’s NDMP plugin works with the Dump, Tar, or SMTAPE formats the filer streams to the backup target directly, which cuts out the file-by-file congestion.

Bacula’s NDMP plugin is run through the filer-to-server architecture wherein NDMP backups sit in the same schedules, the same Catalog, as well as the same job monitoring as everything else the admin already runs. As a result of this integration administrators no longer need to deploy or monitor a parallel system to their existing backup environment to catch failed NDMP jobs. This is especially critical for large organisations with massive NAS environments carrying millions of small files.

Request the Trial

Test Bacula effortlessly using specific scenarios.

Download Webinar

Get insights on the best backup and disaster recovery strategies.

Disaster Recovery
Guide & Plan

The disaster recovery guide and DR plan template from Bacula professionals.

Bacula Technology Whitepapers

Improve your backup strategy and reduce backup expenses.

Designing for Breach

How resilient organizations survive cyberattacks when defenses fail

Bacula’s NDMP Plugin Benefits

Super-Fast Backup and Recovery – Backup and recovery execution times drop significantly with Bacula’s NDMP plugin, which shortens backup window and leaves production systems uninterrupted.
Lower Resource Usage – NDMP operations consume less server resources, network bandwidth, and storage device capacity, so as to leave production workloads free from interference.
Reduced Storage Footprint – Total backup storage volume shrinks as a result of the NDMP plugin’s ability to analyse native NetApp Dump, EMC Unity DUMP, and universal Tar formats, which maximises deduplication ratios with Bacula’s Global Endpoint Deduplication.

Heterogeneous Environment Support – Administrators can configure and define backup policies across NAS devices from multiple vendors, including NetApp, HPE, EMC, and Huawei, under a single Bacula interface.
High-Performance Plugin Pairing – NDMP backup use in conjunction with Progressive Virtual Full and Global Endpoint Deduplication delivers excellent performance.

Download Trial View SAN/NAS backup solutions datasheet

Key Features of Bacula’s NDMP Plugin

Multi-Vendor NAS Consolidation – Instead of deploying a separate tool per platform, Bacula’s NDMP plugin backs up NetApp, EMC, HPE, and Huawei filers through the same shared policy. If you, for example, extend retention to a year on the NetApp side with separate tools, and forget to do the same on EMC, EMC will delete backups at six months.
Full, Incremental, and Incremental Forever –Three backup levels, with each answering how much of the filer is copied on a given run. The Full level copies everything on the filer; an Incremental copies only what’s changed since the last run; and Incremental Forever allows you to run one Full ever and every run after that is an incremental, indefinitely. Every one of the three grabs each file’s ACL automatically, right along with the file itself. Without that, restored files will lack their original access rules. For example, a finance folder restored without this could end up open to everyone or locked out entirely from the finance team, and someone would then have to rebuild permissions by hand, file by file.
Directory-Level Inclusion and Exclusion – The plugin can back up specific directories that are configured in its inclusion and exclusion settings, instead of backing up the entire NDMP volume by default. A filer that holds critical shared folders alongside disposable temp and cache directories doesn’t need every one of them backed up.

Deduplication-Ready Native Formats – The plugin parses each vendor’s native NDMP format to find file boundaries inside that stream. It reads NetApp’s Dump, EMC’s Unity DUMP, and the vendor-neutral Tar directly, in order to keep deduplication ratios high and reduce storage costs.
Single Item Restore – Bacula’s NDMP plugin locates individual files inside the dump through an automatically generated history (HIST) file. This capability, which legacy backup tools lack, allows the plugin to bypass a full-volume restore and recover an individual item such as an accidentally deleted file.
Agentless Data Routing (3-Way NDMP) – Agentless Data Routing is a remote orchestration feature wherein the Bacula Director triggers the backup over the network to keep the NAS itself untouched by third-party code. It works by instructing the NAS to send its stream straight to a tape drive on another device (3-way).

Choosing a Backup Target for Your NDMP Backups

The NDMP plugin writes backups to tape, disk, or cloud storage, and the right choice comes down to how fast you need the data back versus how much you’re willing to pay to keep it that way. All three can run in the same backup strategy at once, tape for long-term archiving, disk for same-day recovery, cloud for offsite redundancy, rather than forcing a single choice across the environment.

Backup Target	Cost per Gigabyte	Restore Speed	Best Suited For
Tape	Lowest of the three	Slower to access, but a single file can be pulled without restoring the entire tape	Long-term archiving, offsite storage in secure or audited facilities; moving petabytes of data at low transport cost
Disk	Higher than tape, especially once power and operating costs are factored in	Fastest of the three; already online	Daily recovery needs; multi-site replication for disaster recovery and business continuity
Cloud	Varies by provider; storage and data-access costs are often billed separately	Comparable to tape in that data has to move back to the primary site before it’s usable	Offsite storage with on-demand scaling; cloud-native disaster recovery paths

Beyond the target, NDMP defines three ways to move data from the filer to that target, and Bacula recommends one of them specifically for production use.

Filer-to-Filer – Two filers exchange data directly, one connected to the NAS, and the other connected to the tape library. Backups then flow from the first filer to the second, and to the storage medium after that. Multiple source filers can feed the same tape library this way, so that the library’s resources can be used more efficiently.
Local Backup – The tape library connects directly to the NAS (typically over Fibre Channel or SCSI, with no third party in the connection). Through this direct link, data moves fastest. That said, backup traffic travels over the SAN, which can slow down other clients using that same connection.
Remote Backup (Filer-to-Server) – A backup server sits between the filer and the target storage. A backup server sits between the filer and the target storage. Here, data moves from the filer to the backup server, then on to the destination, tape, disk, or cloud, depending on what’s configured. Backup traffic moves onto its own network path, typically Ethernet, instead of competing with production traffic on the SAN. A single backup server can support multiple filers this way, in order to simplify management as the environment grows. This is the architecture Bacula recommends for production NDMP deployments, and it’s the mode the NDMP plugin uses by default.

NDMP Backup Software Capabilities in Full

Backup Capabilities

Three Native NDMP Formats, Plus SMTAPE – NDMP reads NetApp’s native Dump format, EMC’s Unity DUMP format, and the vendor-neutral Tar format directly. SMTAPE, NetApp’s raw binary format, is also supported and favoured for its relatively fast backup speed.
Directory-Level Inclusion and Exclusion – You can scope a backup job down to specific directories on an NDMP volume, instead of backing up the whole volume by default, through its inclusion and exclusion options.
Extended Incremental Limits on NetApp – Between a Full or Differential backup, native dump format restore accuracy stays intact for up to eight incremental jobs. Past that ceiling, files still restore correctly, but the reconstructed file system no longer matches its state at the final incremental. NetApp environments raise the ceiling to 32 with the max_level parameter, or bypass it entirely through the BASE_DATE incremental-forever strategy using use_base_date.

Platform and Version Support

Supported NAS Vendors – The plugin backs up filers from NetApp, HPE, EMC, and Huawei, among others.
NetApp DataONTAP, Tested Specifically – Bacula has tested the plugin against NetApp DataONTAP versions 8.x and 9.x.
Native Format Support by Vendor – Bacula reads NetApp’s native Dump format and EMC’s Unity DUMP format directly, plus the vendor-neutral Tar format supported across many NAS platforms. Vendors outside NetApp and EMC can use Aligned Volumes instead, which can give good deduplication results with the appropriate storage system.

Bacula Enterprise Cybersecurity Features

NDMP backups run as standard Bacula jobs. They inherit every protection below automatically, the same as every other job type in a Bacula Enterprise deployment.

Architecture and Access Control

Isolated Component Architecture – Bacula separates its operations into discrete daemons: Director, Storage, File Daemon, and Console. The File Daemon runs on the systems being backed up, including NAS filers through this plugin. It has no interface to the backup storage repository itself, so that a compromised source system cannot reach the backups stored behind it.
Restricted File Daemon Privileges – Administrators can limit exactly which directories a client can back up from, restore to, and run scripts in, through the AllowedBackupDirectories, AllowedRestoreDirectories, and AllowedScriptDirectories directives. The File Daemon can also run in read-only mode, in order to prevent any unauthorised modification from that system.
Role-Based Access Control – Bacula supports granular ACLs to scope exactly what a console user can touch: JobACL for which jobs they can view or run, CommandACL for which bconsole commands they’re allowed to execute, PoolACL for which storage pools they can access, and ScheduleACL for which backup schedules they can see or change.
Multi-Factor Authentication – Console access supports TOTP-based MFA, compliant with RFC 6238, alongside standard password and TLS authentication. Web GUI access separately supports one-time password authentication, including biometric smartphone options.

Immutability and Data Integrity

Append-Only and Immutable Volumes – Bacula sets an Append-Only attribute on file-based volumes during their first backup job, in order to prevent data loss from overwriting. Once a volume’s marked Full, an Immutable flag can prevent it from being relabelled or reused until its protection period elapses.
Enterprise Storage Immutability Integration – Bacula integrates with immutability features on NetApp SnapLock, DataDomain RetentionLock, and HPE StoreOnce Immutability, alongside native WORM tape support and cloud object lock on AWS S3, Azure, and Google Cloud Storage.
Verify Jobs and Hash-Based Integrity Checking – Bacula can compute MD5, SHA1, SHA256, or SHA512 signatures of file data and compare a volume’s current state against its Catalog record, in order to detect silent corruption or unauthorised modification after the fact.

Encryption

Encrypted Communications – CRAM-MD5 authentication runs between every Bacula daemon, and TLS encryption is configurable across all network communications.
FIPS 140-3 Compliance – Bacula Enterprise adds FIPS 140-3 cybersecurity compliance through its Cryptographic Module, OpenSSL-FIPS, certified across multiple platforms, and applicable to every Bacula component.
Data-at-Rest Encryption – The Storage Daemon can encrypt an entire storage target globally, independent of the data source, or encryption can run on a client-by-client basis instead.

Threat Detection

BGuardian – An automated security analysis module that checks configuration strength, encryption usage, backup poisoning patterns, and dozens of other hardening indicators across the environment, generating reports and persistent alerts as issues are found.
Malware and Antivirus Scanning – Bacula’s Antivirus Plugin integrates ClamAV to scan backed-up data post-backup, and Verify jobs can check files for malware during backup, restore, and verify operations.

What Every Bacula Enterprise Deployment Includes

The NDMP plugin runs inside Bacula Enterprise, and every installation inherits a full set of platform-wide backup and recovery capabilities that extend well beyond what the plugin itself provides. The features below are not specific to NDMP because they apply across every Bacula Enterprise deployment, regardless of environment or workload.

Backup Storage and Cost Control

Bacula Enterprise gives administrators direct control over storage costs through data reduction and flexible destination routing.

Block-Level Deduplication – Any data block that appears more than once across the backup catalogue’s written to storage only once. Storage consumption drops without any change to backup policy or schedule.
Adaptive Compression – Compression algorithms are configurable per job. Administrators tune compression based on data type and available resources.
Multiple Storage Target Types – Backups write to local disk, NAS, SAN, tape libraries, cloud object storage including S3, Azure, and Google Cloud, or any combination within a single policy.
S3-Compatible Object Storage – Bacula connects to any S3-compatible provider for long-term retention without vendor lock-in.
Tiered Storage Workflows – Backup data can be configured to move across storage tiers automatically as it ages. Frequently accessed recovery points stay on fast storage and older data shifts to lower-cost destinations.
Incremental Forever – After an initial full backup, every subsequent job captures only what has changed. Recurring full backup windows are no longer necessary.
Bandwidth-Conscious Transfers – Only modified data crosses the network between backup runs. Production network load stays low without manual throttling or scheduling workarounds.

Backup Security and Compliance

Security and regulatory compliance are built into every layer of the platform, from data transport and storage encryption to access control and audit logging.

AES-256 Encryption – AES-256 encryption covers the full data path from source client to final storage destination. Key management is also configurable to fit organisational security policies.
Immutable Backup Copies – WORM-compatible storage locks backup data against modification or deletion once written. Ransomware and insider threats have no path to the recovery point.
Granular Access Controls – User permissions scope to specific jobs, restore workflows, and management functions. Each administrator accesses only what their role requires.
Complete Activity Auditing – Every backup, restore, and configuration change is logged with user identity and timestamp. Compliance and security teams get a full, unbroken audit trail.
Regulatory Framework Support – Platform controls map to GDPR, HIPAA, and SOC 2 requirements through encryption, configurable retention policies, and detailed audit logs.
Privacy-Preserving Architectures – Zero-knowledge deployment encrypts the data so that even the administrator running the backup can’t read it. They can manage the backup, but they can’t see the files themselves.

Backup Management and Administration

Two complementary interfaces and a full suite of management tools provide visibility and control across all backup operations.

Dual Interface – BWeb provides a graphical console for day-to-day job management and monitoring. Bconsole (user agent) gives operators full command-line control for scripting, automation, and advanced configuration.
Scalability Without Limits – The same platform architecture manages environments from a handful of servers to deployments numbering in the thousands, all under a single management plane.
Automatic Resource Discovery – The platform scans infrastructure to identify and catalogue backup targets automatically. Protection coverage stays current as the environment grows.
Detailed Reporting – Scheduled reports cover job outcomes, capacity trends, compliance status, and operational performance on a defined cadence.
External System Integration – Bacula connects to monitoring tools, IT ticketing systems, and directory services, without any mandatory custom development.

Multi-Environment Backup Coverage

Physical servers, virtual machines, containers, and cloud infrastructure all fall within a single unified backup strategy.

Multi-Platform Virtualisation – Native integration for VMware vSphere, Hyper-V, KVM, Red Hat Virtualization, Xen, Azure VM, Proxmox, and Nutanix AHV with consistent policy application across all platforms.
Physical and Virtual Convergence – Physical servers, workstations, and virtual machines are protected through the same management interface with unified backup policies.
Container and Cloud-Native Support – Full protection for Docker, Kubernetes, and OpenShift environments with persistent volume backups and application-consistent snapshots.
Multi-Cloud Storage Integration – Native support for public, private, and hybrid cloud storage including S3, S3-IA, Azure, Google Cloud, Oracle Cloud, and Glacier interfaces with Minimal Restore Cost (MRC) functionality.
Database and Application Integration – Hot backup support for Oracle, SQL Server, MySQL, PostgreSQL, SAP HANA, and other mission-critical applications with full transactional consistency.

Predictable Backup Licensing

Bacula Enterprise software licensing is linked to environment size, not data volume. Therefore, growth in the NAS filers you back up will not increase licensing costs.

Volume-Independent Licensing – Growing backup capacity does not increase licence fees. Data protection costs stay flat as data volumes expand.
Predictable Cost Structure – A fixed pricing model lets teams plan infrastructure budgets without accounting for variable costs tied to storage growth or workload changes.
Workload-Agnostic Pricing – Database sizes, server counts, and storage volumes have no effect on licensing costs.
Large-Scale Cost Benefits – Organisations protecting large or rapidly growing NAS environments pay the same licence fee regardless of how much data they add. The cost advantage over capacity-priced competitors grows as data volumes increase.

Recovery and Business Continuity

Bacula Enterprise offers recovery paths for all restore scenarios, from a single database restore to a full site rebuild.

System-Level Bare Metal Restore – Bacula Enterprise recovers a complete server from scratch including the operating system, applications, configuration, and data without requiring a prior manual installation.
Cross-Platform Data Movement – Backup data can be recovered to a different operating system than its source. Teams have options when like-for-like hardware’s unavailable or a migration is underway.
Geographic Backup Replication – Backup sets are copied to geographically separate storage locations. A site-wide outage does not take recovery points down with it.
Frequent Backup Scheduling – The potential data loss window shrinks to minutes.
Automated Restore Validation – Recoverability is confirmed through automated testing without administrator involvement or a separate validation process.

NDMP Backup Format Comparison: DUMP/TAR vs. SMTAPE

Bacula’s NDMP plugin supports both DUMP/TAR and SMTAPE backup formats. The former is the more flexible of the two as, unlike SMTAPE, it supports file-level restore and exclusion and inclusion filtering at the object level, in addition to incremental backups and ACL preservation. This format is the right backup choice for environments that require granular data management and frequent incremental backups.

By contrast, SMTAPE is a block-level format that is native to NetApp. It captures a full volume snapshot, and is the right choice for environments where a fast, complete volume recovery takes priority over granular file-level control.

Feature \ Format	DUMP/TAR	SMTAPE
Incremental backup	Yes	Yes
Exclusion/Inclusion	Yes	No
ACL	Yes	Yes
File Level Restore	Yes	No

Frequently Asked Questions

What is NDMP and why do NAS devices need it?

Network Data Management Protocol (NDMP) is an open standard that’s built to back up Network Attached Storage devices. Given that a regular backup agent can’t just run inside a proprietary NAS operating system like NetApp’s ONTAP or Dell’s PowerScale, there’s no room for it in there. What NDMP does is get around that by giving backup software a standard way to tell the NAS what to do, without needing an agent installed on the NAS itself.

How does NDMP differ from backing up over NFS or CIFS?

NFS and CIFS make the backup server open every folder, read every file, and check every ACL, one at a time, over the network. When the file count climbs into the millions, that process eats RAM and runs the backup past its window. NDMP has the NAS filer package its own data internally instead, in a format like Dump, Tar, or SMTAPE, and send the finished stream straight to the backup target, so that no outside process can touch the filesystem at all.

What’s the difference between 2-way and 3-way NDMP?

With the 2-way, or Direct NDMP, the filer connects straight to the tape library or backup target, usually over Fibre Channel or SCSI, and the backup server sends the commands, but the data itself never leaves that direct connection. By comparison, with the 3-way, or Remote NDMP, the data travels over the network, typically Ethernet, to a separate backup server, which then writes it wherever it’s going, disk, tape, or cloud. This is the mode Bacula recommends for production deployments.

Does NDMP support incremental and differential backups?

Yes, with a slight asterisk. It’s the filer that does the actual change-tracking, not the backup software itself. NAS operating systems use dump levels, 0 through 9, to detect what’s changed since the last run. The backup software’s job here is simply to receive the stream and log whichever level it belongs to.

Can you restore a single file from an NDMP backup, or only the whole volume?

Yes. Bacula’s plugin does this through an automatically generated history file, called HIST, built during the backup itself with no separate setting to turn on beforehand. Restoring one file still triggers a full internal read of the dump to locate it. On a small dump that’s nothing. That said, on a multi-terabyte one, that read takes much longer,, even though what you get back on disk is just the one file you specifically requested.

Is NDMP secure?

Yes, in the sense that Bacula contains the risk even when the filer doesn’t. The File Daemon receiving the NDMP stream has no interface to the backup storage itself, so even a compromised filer can’t reach the backups sitting behind it. CRAM-MD5 authentication and configurable TLS encrypt every connection between Bacula’s own daemons, and BGuardian scans the environment for weak configurations, an unencrypted NDMP channel included, and detects the risk before it has a chance to evolve.

(77 votes, average: 5.00 out of 5)

NDMP Backup and Recovery Software Solution

Back Up and Recover Millions of NAS Files Across Every Major Vendor, Without the Slowdown