SOBR Capacity Tier Offload data flow?

[ConradGoodman]

I am in the mid phase of planning our SOBR deployment with capacity tier.

Currently, we have 2 data-centres in different regions.

In each data-centre, we have 1 Veeam B&R server. We backup to disk on the Veeam backup server for 7 recovery points for all VMs and SQL data.

We then use a copy backup job, the destination is a backup repository with the storage attatched to the partner datacentre's Veeam B&R server.

It is my intention to modify this backup copy job, so it points to an SOBR, obviously from a management perspective this exists on the local Veeam B&R server, but its extent is the existing repository in the partner site. The capacity tier of this SOBR will be Amazon S3 Object storage.

I need to fully understand how veeam will move this data around, because for example:

Datacenter 1 (DC1)

1 x Veeam B&R Server

1 Local Repository using Veeam Server 'D:\DC1 Local Repository'
1 SOBR using extent on DC2 Veeam Server 'D:\DC1 Remote Repository'; Capacity Tier in Amazon AWS Bucket.

Am I right in thinking that my copy backup job will copy the latest recovery point over our inter-site link from DC1-Veeam Server to DC2-Veeam server, and then offload to capacity tier directly from the veeam server in DC2 to AWS?

It's confusing, because obviously the Veeam B&R server is in DC1, but has an SOBR with ONLY an extent in DC2, and capacity tier in AWS. I don't want for example the capacity tier offload to come via DC1.

Here is a rough and ready diagram of how I think the data gets moved, please confirm.

[oleg.feoktistov]

Hi Conrad,

Am I right in thinking that my copy backup job will copy the latest recovery point over our inter-site link from DC1-Veeam Server to DC2-Veeam server, and then offload to capacity tier directly from the veeam server in DC2 to AWS?

Yes, if SOBR extent in DC-2 has direct access to the internet. But if, as shown on your diagram, data offload is planned to be performed via https proxy, it is better to choose it explicitly as your S3 Object Storage gateway.

Thanks,
Oleg

[ConradGoodman]

Oleg, what do you mean to choose it as the S3 object storage gateway? It is only possible to choose a Windows Veeam Server as such a role?

The HTTPS proxy is a linux appliance, and so I believe I have to use WinHTTP proxy on the veeam server in DC2? https://www.veeam.com/kb3090

If I understand correctly, the only limitation here is that I can't use this configuration for Linux extents that don't have direct internet, but they would be compatible with a Veeam Gateway server instead?

[dalbertson]

@ConradGoodman Oleg is talking about the gateway server setting in the object repo setup.

https://helpcenter.veeam.com/docs/backu ... ml?ver=100

[ConradGoodman]

@dalbertson I get that, but in my diagram it is just an HTTPS proxy appliance, not a Veeam gateway server.

Therefore I would not be able to "choose it explicitly as your S3 Object Storage gateway"

Further more can you clarify by using the configuration in my diagram with an HTTPS proxy and not a veeam gateway server, if I had Linux extents in the SOBR without direct access to the internet, they would not be able to offload to S3?

[dalbertson]

You would choose the gateway server at the remote side. then the traffic would flow out via that server. If you dont have or cant select one from that side, then you would add one

https://helpcenter.veeam.com/docs/backu ... ml?ver=100

[ConradGoodman]

Yes OK, but this is only needed for Linux extents correct?

In my lab I have an SOBR using DAS Windows storage and it offloads to S3 via my proxy appliance using WinHTTP proxy as per veeam kb: https://www.veeam.com/kb3090

Is there ANY advantage to building a veeam gateway server in each DC? We don't currently have these, and it would consume a Windows License in each site, plus a vCPU and RAM. Not desirable when we already have our own Linux HTTPS proxies.

[dalbertson]

The advantage would be traffic flowing out to s3 via that server.....you could also leverage the current veeam server you have at each site as it doesn't necessarily have to be a dedicated server.

[ConradGoodman]

Maybe I'm not making myself clear.

The SOBR extent for DC1 offsite, is on DC2 Veeam server.

In DC2, there is a pre-existing HTTPS proxy.

If i use https://www.veeam.com/kb3090 WinHTTP Proxy on the DC2 veeam server hosting the extent, data will flow out to S3 via that site anyway - correct?

So in this scenario there is little advantage to running a veeam gateway server, that requires extra licenses and resources

Except for the scenario of linux extents, please confirm if you know or if you don't let someone else answer.

[oleg.feoktistov]

Conrad,

I was just talking about adding your https proxy appliance as a gateway server managed by VBR.
The KB is also applicable. It's just that no one other than the machine this SOBR extent resides on will know about this routing.
So, if you are to add more extents, explicit WinHTTP proxy config is to be set on each of them instead of just using
gateway server record VBR console knows about.

Thanks,
Oleg

[ConradGoodman]

OIeg,

How am I to do that?

https://helpcenter.veeam.com/docs/backu ... ml?ver=100

"Gateway Servers Deployment

The role of a gateway server can be assigned to a Microsoft Windows machine added to the backup infrastructure. To configure a gateway server, you must first add a machine that you plan to use as a gateway server to the backup infrastructure using the New Windows Server wizard. After that, you must go through the Add New Backup Repository wizard and define gateway server settings. You can select a gateway server explicitly or instruct Veeam Backup & Replication to select it automatically."

The documentation says it is a veeam role that gets installed on a Windows server - how is it possbile to use my exsting proxy appliance as a gateway server managed by VBR? please clarify steps to achieve this.

[oleg.feoktistov]

I just tested SOBR offload through debian machine chosen as a gateway for my S3 Minio storage and it has succeeded.
Try adding your linux appliance as a managed server and see if it is available as a gateway in object storage config @dalbertson mentioned earlier above. See if offload works with it chosen and kindly share the results.
Thanks!

[ConradGoodman]

I cannot, as it is not a standard Linux OS per se, and doesn't have port 22/ssh. Its a Sophos Web Proxy Appliance.

Cheers

C

[oleg.feoktistov]

Then the KB is the way.