Backing up CIFS shares from NetApp

[HenryA]

Hello everyone.

I have been combing all the documentation that will help my use case. We have a new VB&R 12.1 server up and running, but we have not added any data sources yet.

We have two NetApp clusters, one Production and one DR. We have a bunch of Snapvaults going over from Prod to DR. We have two SVM's specifically for CIFS Shares (all our Windows Shares are located on these 2 SVM's). And we have all the Volumes we use for CIFS data SnapVaulted to the DR NetApp. We don't have any CIFS shares mapped on the DR NetApp, because that's just the backup of the Prod site (we map CIFS shares to DR site in cases we need to restore data, but normally there are no CIFS on DR site). However, because it's a SnapVault relationship, we have data on the DR site that we need to backup to another destination (In our case, a Wasabi S3 bucket)

Questions:

1. Our export rules right now are simple: both SVM's simply have default rule with client match of 0.0.0.0 and RO/RW both set to any. If I understand the documentation properly, I can safely uncheck "Map Export Rules automatically", since the default rule is already allowing everything. There should be no need for Veeam to edit rules?

2. If we do select yes to "Map Export Rules", will it simply add a temp export rule to that restore, without fiddling with the "default" rule? We're thinking for safety, don't enable Map Export Rules, since the RO/RW any will already allow this? I'm not too clear on this one. We plan on restoring any needed restores on a separate Windows server anyway. We don't want Veeam creating any new shares or export rules.

3. For the meantime, we are only going to use VB&R to backup CIFS shares. In the future, we may also back up VM's from our vSphere environment, but not for now. If I am reading the documentation correctly, Any CIFS Share we need to back up, needs to have the Snapshot folder visible enabled? So if we have Shares that don't have the Snapshot folder enabled, VB&R won't be able to back these up?

4. How can we backup our DR Volumes if there aren't any CIFS shares set up?

5. I don't think it's too useful for us to set up Cdot Integrated Access? Instead, it seems we are on with SVM Only integrated access? We have two SVM's with CIFS data, so I'm guessing this means we have to create two separate accounts per SVM with the necessary access rules? As per this doc: https://helpcenter.veeam.com/docs/backu ... ntegration

For now these are the immediate questions I have regarding this process. Any insight would definitely be appreciated.

[Andreas Neufert]

Hi Henry
1. Yes

2. If you have 0.0.0.0 (ALL) then you do not need to enable the checkbox. If you enable we would create an own rule for our servers.

3. Correct, however you can define as well an "alternative path" for backup
that can be used to read from other places the snapshoted data. You can create for example with a pre script a snapshot, replicate it with SnapMirror/SnapVault to the secondary systems, share it there and use it only for backup. Restore in this case would be done to production.

4. See 3.

5. I can not follow 100% so please allow me to try here. You can setup a user for the SVM for the SVM only backup processing. No second user needed. If you later want to backup as well with our VMware integration, then you need to give this user the other VMware specific rights as you can add the same SVM only once. If you use separate SVMs for VMware you can setup specific users and add each SVM with another user.

[HenryA]

Hello Andreas.

I appreciate your detailed info. So if I understand correctly, the best way to backup CIFS shares is to create a script (let's say a NetApp PowerShell script) that:

• Creates a Flexclone of the volume

• Creates a Share to the data to be backed up

(Allows Veeam to do the backup)
Then engage another script that:

• Removes the Share

• Removes the Flexclone

Is that the gist of it?

For my question about Cdot vs SVM, Let's say we have 5 different SVM's, but only 2 of them are CIFS servers. If I give Veeam Cdot access, it will allow Veeam to see everything (including the 3 SVM's we don't want to backup or touch). If I give it SVM access, then it looks like I have to add a NetApp account with the SVM permissions required by Veeam for SVM access for each SVM (meaning 2 separate NetApp accounts so each has SVM access.

I hope that clears up my questions a bit more.

[rennerstefan]

Hi Henry,

you don't need a script for that.
We will take care of the snapshot creation for your CIFS data and access the snapshot via the integration we have.
Please check out this: https://helpcenter.veeam.com/docs/backu ... ml?ver=120
and this: https://helpcenter.veeam.com/docs/backu ... ml?ver=120

Reg. your other question you talk about CDOT scope or SVM scope.
Yes, if you provide CDOT scope, it will just work across all SVMs.
If you provide SVM level access you need to create one account per SVM and add every SVM to our interface.

Thanks

[HenryA]

Hi Stefan.

Ok, we've been having a bunch of issues with our firewall, but I think we finally got this resolved, so I'm hoping I will be able to test this out today.

If I understand what you're saying, I could add our DR site NetApp cluster, which has Snapmirrored Volumes of the Production ones serving CIFS data (but we don't have any CIFS shares on the DR site). Soooooo.............Veeam should be able to clone the snapshots from those DR volumes, expose the snapshot folder, and backup without further setup once the NetApp DR cluster is added to the source servers, and NAS Filer is added as well?

[rennerstefan]

Sorry I missed the part with the DR side. Didn't fully get that you want to run the backup only from here.
No, in that case we will not create the shares but you would first need to make sure the shares exist on the DR site so we can access them for backup.
As Andreas explained above the shares need to be visible as otherwise we won't be able to access them.

I would recommend to run a test with a primary and secondary test SVM so you can check how it can work in your environment.
Depending on how the DR systems are visible a script might be needed (sorry again for not catching that).

Let us know after your firewall and access issues are solved how it works for you.

[HenryA]

Hi Stefan.

So as long as there's a CIFS share on the volume (or qtree), Veeam will clone the snapshot, assign "make snapshot folder visible", backup the data, and then delete the cloned snapshot?

[HenryA]

Update: We finally got the FW issue resolved and I have now added some test Wasabi accounts and buckets.

So next steps are to start actually setting up the Storage Infrastructure (NetApp clusters), then add them as Unstructured Data (NAS Filer) sources, and then we should be able to see all the Shares to create backup jobs?

[rennerstefan]

yes that is what you should try. add the NetApp cluster as NAS filer (via NetApp Integration in VBR) and check what you will be able to see. Again, for your secondary, you will need to check if there are shares and if we can access the .snapshot folders (i'm not sure if we can create a backup snapshot there as its a mirror) and unfortunately can't test it in my lab atm.
looking forward to hear back.

[HenryA]

Hello all.

I finally got some setup done on this. Here's the steps I did:

1. Created an account on NetApp cluster as required by this doc: https://helpcenter.veeam.com/docs/backu ... tegration- (I created a NetApp account with a Role containing only the applications as per this doc): name of account: veeambr

2. Added the NetApp to the Storage Infrastructure as per this doc: https://helpcenter.veeam.com/docs/backu ... ml?ver=120 (I used "veeambr" as an the account when it requested me)

3. Added the NetApp as a "NAS Filer" as per this doc: https://helpcenter.veeam.com/docs/backu ... ml?ver=120 (I was unsure what account to use here, I suspected it needed an AD Account to access the CIFS server, but I tried "veeambr" first). It succeeded......but......

4. Create a test backup job: Added a NetApp CIFS share from the new NetApp Filer source. Confirmed share had ~snapshot folder visible. Tried to backup share.....kept getting error "NASMaster.CreateBackupProcessor: Access Denied".

5. So then I edited the "NAS Filer" object under "Unstructured Data" and replaced the "veeambr" account with an AD Admin account with full control access to the test share (let's say HenryA, visible in our AD, and has Full Control permission to the share: this worked, it successfully backed up the share.


Is this the right process? What exactly is the advantage of doing it this way vs just adding SMB shares directly from the CIFS Server (just add the UNC path and backup). Specifically, am I using the correct process for password on the "NAS Filer" object?

[rennerstefan]

Hi Henry,

thanks for sharing and glad it works.
Of course the user used to access the file share will require access rights so it sounds good to me.
On your step 3) you are right, its usually not the same account as with 2) but an account that has the required access rights.
2) is for us to connect to the NetApp APIs, 3) is for us to access the data, two different roles and use cases.

The advantage is that we handle the snapshot creation for the NAS backup and use the snapshot as a source.
Indeed, you could also just add the main share, but in that case, you would get issues, especially around open files, as it is the live file system.
Using the storage integration is addressing this as an example.

Btw. one question from my side: did you do this now on your primary or the secondary system?

Thanks

[HenryA]

Hi Stefan.

I did it on our secondary system. I haven't touched primary system yet, and yes you are correct, I saw the Veeam create the temp snapshots while doing the backups.

Biggest hurdle now is to figure out how to backup all the volumes we have that don't have CIFS or NFS mounts attached. Can we add temp ones to backup and them remove them? I think Veeam will want to have a permanent connection to any backups it's protecting, correct?

[rennerstefan]

A permanent connection is not required. It is only needed during backup/restore activities.
Not sure I understand your other question with "temp ones". Why not keep them available but only allow access with the user Veeam accesses it?

[HenryA]

Our DR site has a lot of NetApp volumes that were migrated from an older non-NetApp storage. These are just sitting there for compliance reasons, and if/when we need something out of them, we just create a temp CIFS share and get the data we need, then remove the share.

So the questions:

1. Can we add the shares to the volumes we need backed up, then once backup is complete, remove the share from the NetApp side? This is data that is not going to change, or have anything else added to it. Basically, once we back it up, we can just not run that backup job again (no need to). Will there be issues if Veeam B&R can't see the share anymore though?

2. If we need to restore, and assuming #1 is possible, then I'm also assuming VB&R will mount the CIFS share automatically when we try to restore a file?