Veeam DMZ best practices

[ief]

I have a dedicated DMZ environment with the following dedicated components:
- 2 ESXi servers (cluster)
- vCenter server
- VM's with DMZ services
- HP VSA storage as shared storage

I can Install Veeam in the LAN and open only the ports needed or install Veeam in the DMZ. What are the best practices or can be advised?

Pro's and Con's LAN
- The backup data is in the LAN +
- No extra Veeam installation is needed +
- Less secure -

Pro's and Con's DMZ
- Secure +
- Management overhead -

[Dima P.]

Hello Ivo,
Are you planning to use this instance of B&R for backing up 'demilitarized' VMs only?

[dellock6]

As Dmitry pointed out, it all comes down if you have "only" this environment, or it's part of a bigger VMware+Veeam deployment. In second case, I would personally add a dedicated proxy as a VM in DMZ, and open just the minimum needed ports for Veeam console to connect to the DMZ vCenter for control. Connections to ESXi and storage will be done by the local proxy, and you can configure jobs to use specifically that proxy instead of leaving the default automatic selection.