Comprehensive data protection for all workloads
Post Reply
ivanjohnson
Novice
Posts: 4
Liked: never
Joined: Feb 13, 2015 3:03 pm
Full Name: Ivan Johnson
Contact:

Preventing local access to an offsite storage repository

Post by ivanjohnson »

Hi folks

I'm designing a backup system following the 3-2-1 model using Veeam Essentials. There will be a local storage repository for vm backups, and backup copies to a repository on a NAS at a remote site.

The additional requirement is that users (including admins) at the local site should not be able to modify or delete data at the remote site (i.e. the remote site would not be vulnerable to the source network being compromised).

Is the following a possible topology when using Backup and Replication essentials?

1. Local Site: Veeam Backup and Replication server (+ proxies as required) running simple Backup jobs to backup VMs from VMware to local storage repository on DAS. Local site has no access to the Remote site.
2. Remote Site: Remote Site has VPN access to the Local Site. An additional Veeam Backup and Replication Server at the Remote site uses a WAN accellerator pair to access storage repository at Local Site. Use Backup Copy jobs on the remote Veeam server to pull secondary backups from the storage repository on the Local Site and save them to a storage repository at the Remote Site.

i.e. Two installs of Veeam Backup and Replication Server, with one pulling Backup Copies from the other's storage repository.

Any suggestions or alternatives are much appreciated!

Thanks for your help, Ivan
Shestakov
Veteran
Posts: 7328
Liked: 781 times
Joined: May 21, 2014 11:03 am
Full Name: Nikita Shestakov
Location: Prague
Contact:

Re: Preventing local access to an offsite storage repository

Post by Shestakov » 1 person likes this post

Hi Ivan,
Your configuration looks great overall.
ivanjohnson wrote:Is the following a possible topology when using Backup and Replication essentials?...
...An additional Veeam Backup and Replication Server at the Remote site uses a WAN accelerator pair to access storage repository at Local Site.
Note that WAN Acceleration is available only for Enterprise Plus license type. If you have one - it`s possible.

Besides simple denying and allowing access to the backup files you can assign different user roles.

Thank you.
ivanjohnson
Novice
Posts: 4
Liked: never
Joined: Feb 13, 2015 3:03 pm
Full Name: Ivan Johnson
Contact:

Re: Preventing local access to an offsite storage repository

Post by ivanjohnson »

Great - thanks for the confirmation.

Am I right in thinking that Veeam Backup Essentials includes WAN acceleration?

Cheers, Ivan
foggy
Veeam Software
Posts: 21069
Liked: 2115 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Preventing local access to an offsite storage repository

Post by foggy »

Ivan, keep in mind that to enable this setup you would need to rescan the repository on the remote site's Veeam B&R instance to import the backup chain, create a dummy backup job, and map it to the imported chain. Then this dummy job should be specified as the source for the backup copy job, otherwise imported backups cannot be used in the backup copy job. Automatic rescans will then import newly created restore points each 4 hours.

Also it is recommended to appropriately adjust jobs schedule/denied period to avoid file locks during their execution.
ivanjohnson
Novice
Posts: 4
Liked: never
Joined: Feb 13, 2015 3:03 pm
Full Name: Ivan Johnson
Contact:

Re: Preventing local access to an offsite storage repository

Post by ivanjohnson »

Thanks Foggy. I wasn't clear how the remote server would pick up the backup chains, and that makes it much clearer.
Shestakov
Veteran
Posts: 7328
Liked: 781 times
Joined: May 21, 2014 11:03 am
Full Name: Nikita Shestakov
Location: Prague
Contact:

Re: Preventing local access to an offsite storage repository

Post by Shestakov »

ivanjohnson wrote:Am I right in thinking that Veeam Backup Essentials includes WAN acceleration?
There are 3 different editions of Veeam Backup Essentials and only one of them("Enterprise Plus"), includes Built-in WAN Acceleration. Please check the hyperlink.
Thanks.
ivanjohnson
Novice
Posts: 4
Liked: never
Joined: Feb 13, 2015 3:03 pm
Full Name: Ivan Johnson
Contact:

Re: Preventing local access to an offsite storage repository

Post by ivanjohnson »

All clear - thanks. Cheers, Ivan
Shestakov
Veteran
Posts: 7328
Liked: 781 times
Joined: May 21, 2014 11:03 am
Full Name: Nikita Shestakov
Location: Prague
Contact:

Re: Preventing local access to an offsite storage repository

Post by Shestakov »

You are welcome, Ivan.
Once you have a question, don`t hesitate to ask!
Post Reply

Who is online

Users browsing this forum: Amazon [Bot], Ivan239, Semrush [Bot], uszy and 174 guests