Data path of backup copy from VDC Vault

[cobran]

Hello,

We are planning a backup solution for our customer. Their VM workloads are hosted on Azure VMware Service (AVS) within the Azure network. We propose using Veeam Backup and Replication (VBR) for their backup needs.

The short-term retention backups (30 days) will be stored to VDC Vault, while the long-term retention backups (12 months and 7 years) will be managed by Veeam backup copy jobs.
The long-term retention data will be stored on a Hardened Linux XFS repository located on the customer's on-premises network.

For backup and restore operations between AVS and VDC Vault, there will be no egress charges.
However, for backup copy jobs, if data from the VDC Vault traverses the internal ExpressRoute network to reach the on-premises infrastructure, egress charges will apply — which we aim to avoid.



I would like to confirm the following assumptions regarding the configuration of "Direct" connection mode when adding the VDC Vault repository to the VBR infrastructure:

1. For backup and restore operations between AVS and VDC Vault, I assume the VMware proxy will act as both source and target data mover, directly reading/writing data to/from VDC Vault over a direct internet connection?

2. For backup copy operations from VDC Vault to the Hardened Linux repository on-premises, not sure if the Linux repository will act as the source data mover, reading backup data directly from VDC Vault over a direct internet connection and writing data on it's XFS file system?


Thank you in advance for your support.

Best regards,
John

[Mildur]

Hello John

I moved your topic to our object storage subforum, because your question is valid for all types of object storage repositories, not only VDC Vault.
Unfortunately I can't see/access your screenshots on your OneDrive without sign in.

1.) Correct. VmWare Proxies will be used as gateway servers to write backups to the object storage repository.

2.) With "direct connection", the mount server of that Object Storage repository will be used as a gateway server to read objects from the object storage in a backup copy job. If the mount server is not reachable, the backup server will take over.

Gateway Server selection policies are documented in our hepcenter.

Best,
Fabian

[veremin]

Also, ff you have an Azure subscription, it might make sense to deploy an Azure IaaS VM closer to the region where your vault is located and use it as a gateway server. Thanks!

[cobran]

Hello,

Please find links below for the high-level diagrams.


https://1drv.ms/i/c/410e6608997c0fca/ET ... w?e=nA091M

https://1drv.ms/i/c/410e6608997c0fca/ER ... A?e=zVzlf2

Thanks,
John

[cobran]

Hello,
I'm trying to summarize information that I have gathered ATM:

By specifying “Direct” connection mode, and an On-premises Windows server as mount server in VDC Vault REPO:

1. AVS Backup / Restore from / to VDCV:
a. VM Backup traffic will go through VMWare proxy on AVS when it’s specified as backup proxy in the backup job. There will be no egress charges.
b. VM restore traffic will go through VMWare proxy on AVS when it’s specified as proxy in the restore wizard. There will be no egress charges.
c. Guest Files / Application item restore from VDC Vault will be handled by on-premises mount server, which has already specified in VDC Vault REPO.
Data restore traffic will be sent through Express Route (round trip traffic); Egress charges for data restore will apply.

2. Backup Copy (from VDCV) to on-premises Linux REPO:
a. The specified on-premises mount server will be used as a gateway server to read objects storage in a backup copy job.
If default route to internet is configured for the mount server, backup copy source data from VDC Vault will be sent through internet to the on-premises server directly. There will be a small amount of egress charges only (i.e.: Management / handshake traffic, etc.).
b. If the specified mount server is not reachable (e.g.: become unavailable, network outage, etc.), the backup server on AVS will take over, data from VDC Vault will be sent through internet to Veeam Backup server and then route through express route. Egress charges for backup copy will apply.

3. AVS Restore from on-premises Linux REPO:
VM restore traffic will go through on-premises mount server if it’s specified as proxy in the restore wizard. There will be a small amount of egress charges only (i.e.: flow control / handshake traffic).

Thanks,
John

[cobran]

Also, ff you have an Azure subscription, it might make sense to deploy an Azure IaaS VM closer to the region where your vault is located and use it as a gateway server. Thanks!

Hello Veremin,
I have shared diagrams of the solution from the previous post.
Can I assume the on-premise Windows server can be mount server of both VDCV REPO and the Linux REPO at the same time?

Thanks,
John

[pybfr]

John, if you're are using Vault as a primary backup location and are making backup copies from it, make sure you are on Advanced tier since Foundation has a fair use policy on egress you will probably exceed in your context.