Best practice for Veeam Backup on a single-host Hyper-V ?

[Periquillo]

Hello.

For a new project in a client we are setting up a single Hyper-V host where it is expected 6 virtual machines will live.

VMs 1, 2 and 3 will exist in VLAN-1 separted from VMs 4, 5 and 6, which will exist in VLAN-2.

There will also be VLAN-3 for the backup's network traffic to a Synology NAS, and VLAN-4 just to manage the Hyper-V host.

This is and sketch of the set up:



The backups will be done with Veeam Backup & Recovery 9.5.

My question is: where would it be best to install VBR - in its own VM, or directly on the Hyper-V host?

Should I access the Synology NAS vía SMB, or vía iSCSI?

I would prefer to install VBR in its own VM, so that the Hyper-V host stays as pristine as possible; will that option make it harder to set up and manage VBR?

If I install VBR in its own VM, would I need to connect that VM to VLAN-1 and VLAN-2 in order to "reach" the VMs to be backed up?

PS: I am a long time Backup Exec user, but I'm new to Veeam, and by perusing the Veeam literature it seems VBR uses a "infraestructure" different from BE...

[DGrinev]

Hi and welcome to the community!

You can install backup server in the VM, however, the most part of the components for the processing will be deployed directly to the source host (on-host backup). There is a way to offload the host by deploying off-host backup proxy to separate physical machine with Hyper-V role enabled.

will that option make it harder to set up and manage VBR?

Not at all.

Should I access the Synology NAS vía SMB, or vía iSCSI?

The recommended approach is to use iSCSi.
Please review this existing thread for additional information.

would I need to connect that VM to VLAN-1 and VLAN-2 in order to "reach" the VMs to be backed up?

Yes, network connection is required for the backup server if you want to use AAIP. Thanks!

[Periquillo]

Hi and welcome to the community!

You can install backup server in the VM, however, the most part of the components for the processing will be deployed directly to the source host (on-host backup). There is a way to offload the host by deploying off-host backup proxy to separate physical machine with Hyper-V role enabled.

The physical machines budgeted for this project are three: two Big Workstations which will directly manage a plethora of medical equipment, and one physical Server with Hyper-V where several VMs will live (database server, calculus server, etc.). There will be no more physical machines in this project, and therefore any scenario/architecture for Veeam Backup and Replication which demands additional physical machines is not to be considered for this project (for each physical machine has to be audited and certified previously to being put into production, and that auditing and certification process is extremely expensive on a per-physical machine count).

This means that if the "off-host backup proxy" for VBR needs additional physical servers, we cannot go that route.

(quote="Periquillo")would I need to connect that VM to VLAN-1 and VLAN-2 in order to "reach" the VMs to be backed up?(/quote)
Yes, network connection is required for the backup server if you want to use AAIP. Thanks!

Hmm, the database engine in the database server's VMs in this project will be PostgreSQL (running on Windows Server), and I don't know whether it provides a VSS-Writer which would allow for "transactionally consistent backups". I think that "crash-consistent backups" would suffice for this project (the VBR backup here is meant to protect the VMs as a whole, not to protect individual point-in-time-transactions, as the medical software has its own internal checks for that).

So, if I don't need AAIP -- if I install VBR on a VM, could I avoid having to conect the VBR VM to VLAN-1 and VLAN-2? I'm asking because I want the environment to be as simple as possible provided it meets the requirements...

I would like to set up a VM with VBR connected only to VLAN-3 and VLAN-4, and somehow be able to tell that VM to tell the Hyper-V host "I want to backup all the VMs you have" and then the backup data ends up in the Synology NAS. It will be much easier to pass auditing and certification if the VM with VBR does not need to be connected to VLAN-1 and VLAN-2.

[DGrinev]

So, if I don't need AAIP -- if I install VBR on a VM, could I avoid having to conect the VBR VM to VLAN-1 and VLAN-2?

Yes, you will be able to backup VMs in a crash-consistent manner without establishing connection between the backup server and guest OSes.
Also, crash-consistent backup method would allow you to avoid any downtime of a VM. Thanks!