Huawei Storage Block configuration for immutable backups

[staybb]

Hi all,

we have a new Huawei OceanStor 5600 storage for our Veeam Backup repo.

We can configure the storage for block storage.
You can see the configuration for block for the storage here:

https://support.huawei.com/enterprise/e ... 7C22462063

My questions is, is it possible to use immutable backups in Veeam v11 for this storage when its configured in block mode?

I have read it here, that veeam v11 supports now block storage devices for immutable backups too.
https://www.reddit.com/r/Veeam/comments ... epository/

Thanks and regards

[Andreas Neufert]

Hello staybb,

Our hardened Repository is based on a XFS filesystem feature and is as well compatible with block storage systems.
However the full idea of this hardened repository is that no one can delete the data. In case of storage systems you need to think about the following:
1. Implement a direct connection between storage and your hardened repository phyiscial server (if possible by the storage vendor).
2. Do not connect any other storage connection. After configuration disconnect the management cables. In most cases the storage vendors allow monitoring over fibre channel by the host servers. Check this option with Huawei. If this is not possible implement an own management system and firewall this system so that you can only login locally on the storage console and the storage management system can only send alerts by mail/snmp without connections from outside to this system allowed (do not allow management connections).

[staybb]

Hello Andreas,

Thanks for you detailed answer.

In Advance a further question. Is it possible to use immutable backups when I make a copy backup job of the finished backujobs in Veeam?
Because we have a Storage at our customers on-side, and that backup is a normal backup2disk backup to a normal ISCI storage target without blocksystem.

So we want to copy that backup to our repo and there the backupfiles should encrypted with the immutable function. Is that possible?

[Andreas Neufert]

Yes, you can use target encryption and transport encryption. With and without our WAN acceleration (if you have smaller WAN link). As well target can be immutable.
You would need routet networks between your environment and the customers environment (per direct link or VPN).