Application-aware image processing on disconnected networks

[aantoniani]

Hi colleagues, I am looking for advice/suggestions.
Here is a quick description of my setup: Veeam server and Hyper-V hosts are on 10.0.0.0/24 (called the LAN network). A group of Windows VMs are on 10.200.0.0/16 (called the NET1 network), they run their own separate Windows domain and have no connectivity with the 10.0.0.0/24 network.
We need to have application-aware image processing (Exchange in running on those VMs), but there is no connectivity from the Hyper-V hosts (acting as backup proxy) to the NET1 network and I receive an error

Code: Select all

Unable to subscribe to guest processing components: Failed to connect to guest agent. Errors: 'Cannot connect to the host's administrative share. Host:  [10.200.1.25]. Account: [NET1\veeam]. Win32 error:The network path was not found. Code: 53'

What solutions would you implement? I can only think of creating a VM to act as backup proxy, with one NIC on the 10.0.0.0/24 network and one on the 10.200.0.0/16 network, but I would prefer to have the Hyper-V hosts do the proxy, as they are far more powerful, under light load when the backup runs and they would host the VM that acts as proxy anyway.
I can connect a NIC of the Veeam server to the NET1 network, is there a way to have the Hyper-V host act as proxy, but start guest component processing from the Veeam server?

Thanks in advance, Alessandro

[Vitaliy S.]

Hi Alessandro,

In order to use application-aware image processing your backup server should have a network access to the backed up VMs, as Veeam backup console manages this process, not proxy servers.

Thanks!

[aantoniani]

You are correct, I have added a NIC on the NET1 network to the backup server and processing has completed successfully.
Thanks for your help!

[JSi]

Hi all,

I have similar problem and configuration, but I can`t use this workaround with separate NIC to project networks (because of security and a limit 12 NIC per VM). However we`re using NAT so there is a firewalled path to that networks. Problem is that backup server takes internal IP of VM and there is of course no route to that IP.
Is there a way how to resolve this?
Is there a way how to permanently inject required veeam components to selected vms (sql, exchange)?

Thanks for any advice.

[Vitaliy S.]

Backup server interacts with the IP address returned by Hyper-V Integration Services. Also even if you inject the run-time process you will still have to reach these VMs via network to instruct VSS writers inside the Guest OS on what to do to have application consistent backups. If you could create routing to external IP addresses of these VMs from the backup server (either through hosts file or something else, not sure), then it would work.

Let's see what our community members can suggest on this.

[JSi]

Base on this manual (http://helpcenter.veeam.com/backup/70/h ... ackup.html) I thought that it is not necessary for vss to have network interaction with backuped vm, because of hyper-v integration component.
It`s somewhat misleading then.

[Vitaliy S.]

Jan, I will pass this info to our tech writers team, thanks for the feedback!

[JSi]

I was not successful to find some solution for this. It`s a pity because Microsoft DPM is able to do this. So in my point of view it is a drawback with using agentless approach. Or it is better to say that drawback is the inability to instruct Veeam to use alternative way to vm`s admin share or invoke a session in direction from vm to backup server (because veeam is not exactly agentless).
Vitaliy, thank you for your interest. Is it possible to find out if such feature could be in some next releases?

[Vitaliy S.]

Hi Jan,

I believe DPM can handle this because it installs agents inside the Guest OS to freeze all applications in consistent state before taking a snapshot.

So there is absolutely no network access to protected VMs in your VI, even when changing the routing table in the hosts file of the backup server?

Network-less access should be possible once Microsoft introduces this capability as a feature of Integration Services (VMware has this already in VMware Tools), but thanks for the feedback!

Thanks!

[laurencebullivant]

Is there any progress on this as this will be a show stopper for us. (we run lots of overlapping subnets).

According to the release notes from Server 2012 R2 the ability to copy files into the virtual machine through the integration tools exists now.

http://technet.microsoft.com/en-us/libr ... ntegration

Copy-VMFile allows files to be copied into the vm.

[Vitaliy S.]

No updates on this, thanks for the link though. We will investigate this method more closely, but it seems like you can only copy files, but not execute them.

[laurencebullivant]

That might be the case. Maybe you can copy files into the admin$ share using this command? Either way it is worth looking into.

[Vitaliy S.]

Just confirmed - it's all about just copying files, no ability to execute the process.

[Gostev]

I've been pushing the Hyper-V product team at Microsoft for this feature for over 2 years now! You guys should help me and push them from your side too

[JSi]

Whom exactly to push?
Is this feature really so uninteresting for others that there is nearly no interest to implement it?

[Vitaliy S.]

I believe Anton is asking to push Microsoft for that, you can start giving this feedback to your local Microsoft reps and I guess you can do that through their communities too.

[samh22a]

This is also a very important feature for us.

We're using network virtualization, so our veeam VM will never have network connectivity to all subnets.

I'll make sure to bug my MS contact about this.

Thanks

[Jonathan]

We're currently installing a new Hyper-V cluster (2012 R2) and Veeam Backup server (v8). The Hyper-V hosts and backup server are in separate networks from the virtual machines. No routing between these network is in place, so there completely separated. My question is this: does Veeam Application Aware Processing (and Guest file system indexing) require a direct network connection to the virtual machine? If so, between the vm and the backup server or the Hyper-V host?

Off topic: the processing rates are INSANE!

[foggy]

Yes, network connection is required for the backup server if you want to use AAIP. There's no equivalent of VMware Tools in Hyper-V that could allow interaction with the guest OS in the absence of direct network connectivity.

[Jonathan]

Thanks, foggy.

That's what caused the confusion. We lived in the vSphere since the dark ages.

[Josef.G]

Hi
I have two domains on two separate networks.
Prod 172.10.0.x/24
Fabric 10.0.0.x/24

In Fabric we have our Hyper-V hosts.
In Prod we have the production domain containing AD, Exchange, SQL, Fileserver and so on.

For both political and safety reason there is NO network connectivity between the networks.

Is it possible to use Guest Processing in this setup?

If not. What is the different between app aware and not app aware backups?

Regards
Josef

[Vitaliy S.]

Hi Josef,

Network connection to the backed up VMs is required as opposed to VMware infrastructure.

Please take a look at these links for more info regarding differences in processing modes > Transaction Consistency and Application-Aware Image Processing.

Thanks!

[JSi]

Hello everybody,

we finaly solved this problem in following way:
we are using vyos (former vyatta) for NAT 1:1 to our project networks. Veeam is trying to use vm private ip (acquired from vm tools) instead of internal ip. to solve this, we put persistent route to project isolated network, to backup servers routing table. gateway is set to some NAT address from project network.
Example: VM internal NAT ip address 172.16.1.2/private ip 10.16.1.2, backup server static route 10.16.1.0 mask 255.255.255.0 gw 172.16.1.2 if 172.16.8.50 .

This is probably only feature/bug of vyos but who cares .

[Nilsn]

Hello all.
Sat down and tried to get AAIP working against a Hyper-v after a lot of time i found this thread to find out IP access is needed.
Its a major drawback, especially since we are going to run virtualnetworks that are real hard to get access to from the hosts/veeam servers (Multi-tenant cloud solution)

The manual on the functionality is extremely missleading (as mentioned before in this thread) http://helpcenter.veeam.com/backup/80/h ... ackup.html
Still not updated with information that IP communication is done.

Please let me know if anything have changed regarding this.

Veeam:
What can we tell Microsoft to change in the Integrations Services to be able to do this without any IP communication ?

[alanbolte]

Nilsn,

The page you're looking at describes a process which does not require network communication and is used either with AAIP or with what we call Hyper-V Quiescence; the latter produces a transactionally-consistent backup, but is not configurable like AAIP, makes application-level restores a little more complicated, and may not be suitable for some SQL servers. Think of AAIP's injection of a process over the network as a hack to do what the Hyper-V backup API otherwise does not normally allow backup products to do. I suppose we could add a warning somewhere else, but the requirement is described in the used ports section of the system requirements. You can make specific suggestions to the documentation team using the 'send feedback' links on each user guide page.

Implementation would at the very least require ways to send and receive files, install/uninstall a service, start/stop that service, all with permissions from a particular account. A method of communicating more efficient than sending and receiving files wouldn't hurt. That, or a significant expansion of the Hyper-V backup API to allow collection of file indexes and arbitrary data about arbitrary in-guest applications without installing a service. I'm not on the dev team so I may be missing one or two things.