3-2-1 Backup - Should I have a local backup copy?

[GreenAlpha55]

I am installing a new implementation of Veeam B&R.

My current setup:
1.) 1 local Backup Job using NAS1 as a repository.
2.) 1 local Backup Copy Job using NAS1 as a repository.
3.) 1 offsite Backup Copy Job using NAS2 as a repository.

Is a local Backup Copy Job necessary?

In this setup, I have 4 copies of data if I include the production data. However, if I remove the local Backup Copy Job I will be losing all of my local archived backups. In this case, what happens if I need to restore from 2 months back and my only Backup Copy is offsite? My only options would be a painfully slow restore, restore at offsite location, or seed the data from my offsite location to my local location.

P.S. should a Backup Job and Backup Copy Job be on the same repository?

[DGrinev]

Hi GreenAlpha and welcome to the community!

Doing a copy job locally in the same repository isn't possible, since you cannot choose the same repository as source and target.
However, you can create another local repository for GFS restore points if that's what you need. Thanks!

[GreenAlpha55]

Hi DGrinev!

I currently have 2 repositories configured to the same NAS. \\nas1\backup and \\nas1\backupcopy.

Is it best practices to have a local backup copy? Or do most customers only use backup copy for offsite locations? I'm concerned that our nas1 is really chugging along because it is being used as the source and target.

I'm more or less, asking for guidance for what the best practice setup is.

Thank you!

[srdegeus]

The 3 in the rule does not mean 3 backups, it means your production data and 2 backups: how-to-follow-the-3-2-1-backup-rule-with-veeam-backup-replication

What I do miss in your scenario is the 2 different media, all your backups are on (the same) disk based media. In case of something like a cryptolocker all your disks (and backups) are unreadable. You should add a cloud or tape copy to your environment.

[DGrinev]

Retain backups all in one place isn't a good idea, as it becomes a single point of failure.
The backup copy job was designed to deliver the data on the block level into the secondary destination which in most cases is DR site.
I'd recommend you to visit best practices site developed by our technicians.

[GreenAlpha55]

The 3 in the rule does not mean 3 backups, it means your production data and 2 backups: how-to-follow-the-3-2-1-backup-rule-with-veeam-backup-replication

What I do miss in your scenario is the 2 different media, all your backups are on (the same) disk based media. In case of something like a cryptolocker all your disks (and backups) are unreadable. You should add a cloud or tape copy to your environment.

Gotcha on the 3-2-1 rule.

I'm confused though, all my backups are on 2 different NAS's (1 local, 1 offsite). So they're all on disk-based media, but on 2 geographically dispersed NAS's. If cryptolocker hist NAS1, then we would fallback to NAS2. Am i missing something?

Is there any reason to have tape back-up? I've been in the IT industry for 10 years and have never seen tape.

[GreenAlpha55]

Retain backups all in one place isn't a good idea, as it becomes a single point of failure.
The backup copy job was designed to deliver the data on the block level into the secondary destination which in most cases is DR site.
I'd recommend you to visit best practices site developed by our technicians.

There's no single point of failure since I have 2 geographically separate NAS's.

I've looked through the guides but I have not found any solid info on local backup copy's.

Let's think about this.........If I only have 1 backup copy job running at our DR/offsite location, and the DR site burns down, I'VE LOST ALL ARCHIVED BACKUPS that were created outside of the backup job (which does not do GFS).

Thinking out loud, It sounds like I need:

• 1 local repository for Backup Jobs (hardware1)
  1 local repository for Backup Copy Jobs (hardware2)
  1 DR repository for Backups Copy Jobs (hardware3)

[DGrinev]

Yes, you're safe with the second NAS outside of production area.
You're good to go with the local backup copy for GFS restore points.
Your understanding is right, ideally you should store all backups separately, but the local + remote copy is enough for the most cases. Thanks!

[srdegeus]

If cryptolocker hist NAS1, then we would fallback to NAS2. Am i missing something?

Depends, is the storage on both NAS accessible from the same network? (I would suppose so as the Backup Copy Job can access both.) In that case it doesn't matter that they are geographically dispersed if they are not 'air gapped'.

Is there any reason to have tape back-up?

Not necessarily saying that it needs to be tape, but it needs to be different media. Preferably 'read only' media where it is (almost) impossible to modify your backup set. Cloud based storage is also different media, especially if combined with a VTL.

I've been in the IT industry for 10 years and have never seen tape.

Not meant in a negative way, but this would mean that you have worked in a narrow part of the business that doesn't use tape. (Like most start-ups for example.)

From earlier this year: https://www.forbes.com/sites/tomcoughli ... ing-along/

The report showed a record 108,457 petabytes (PB) of total tape capacity (compressed) shipped in 2017, an increase of 12.9 percent over the previous year.

I am definitely not saying that you should start to use physical tapes but you should verify that at least one of your copies is 'offline'.

It doesn't stop at a cryptolocker, we should all remember https://myitforum.com/sccm-task-sequenc ... -commbank/

The Task Sequence contained automation to – here it comes – format the disks. Yes, the disks of some 9,000 PCs and 490 servers (including domain controllers) were formatted and wiped clean.

[GreenAlpha55]

This is some great insight srdegeus!

Both NAS's are accessible on the same network.

So what are the options to 'air-gap' the repositories?
What are the different media types available?
And could you give an example of read-only?

This is great stuff! Thank you!

[xudaiqing]

I use storage on the virtual host for Backup Jobs, local storage on veeam server (which is behind it's own firewall) for local Backup Copy Jobs.
I use vm in the cloud with daily snapshot for mostly air-gapped storage.

[ryan1cf]

For one of our clients we do this for them:
-local backup onsite
-cloud backup copy job to our Cloud Connect Server/Repo (same city)
-air gapped backup copy to 2 different ext hdd's locally that the client swaps once per week.

The air-gapped also gives the customer the advantage of having a longer retention period but also adds an added layer of protection from crypto that could potentially encrypt the local backups and or destroy the cloud backups. We've actually had a client this year where crypto hit the local repo and encrypted all their backups, we could have avoided this mishap by having the repo VM not on the domain.

If you don't like the swapping ext hdd's for air-gapped, I just read a great idea from Gostev about having a workstation/server power on once a week to allow a copy job to run to it then power that machine off after the copy completes. This gives that air-gapped protection as the machine isn't powered on all the time. I might actually implement this the next time a customer wants to do the air-gapped method.

[srdegeus]

...
So what are the options to 'air-gap' the repositories?
...

What we did is setup our own Cloud Connect for the Enterprise environment. This environment is completely separated from our internal network by a firewall and only the CloudConnect port is open (and RDS Gateway for management.)
The most important in this setup is that the storage cannot be accessed from anywhere else than from (within) the Cloud Connect network.
This Cloud Connect is in a different location than the offices connecting to it.

Not saying that our setup is the only alternative, but for us it was the better solution as we can set 'quotas' in Cloud Connect for the different offices (tenants.)

[mma]

Is there any reason to have tape back-up? I've been in the IT industry for 10 years and have never seen tape.

Wow, 10 Years. You must have seen everything except from tapes

Tape is:
- air gapped
- fast (really, tape is extremly fast)
- durable
- portable
- easy to handle
- veeery cheap per TB (think big!)
- it scales very well
- WORM!

Tape is not:
- ancient tech

[ysmark]

Hi, I'm trying to configure backup copy job to use retention weekly and monthly but job seem not start if I use same repository of backup.
It's obbligatory use different repository to use backup copy?
Thank you

[DGrinev]

Hi and welcome to the community!

Yes, you must choose a separate repository for the backup copy job.
Please review this thread for additional information. Thanks!