Offsite Backup Copy in a weekly schedule

[mikhael]

Good day.

In this scenario:
- no WAN acceleration available (essential enterprise / no plus)
- customer with only 14 VMs on two vSphere hosts (low performance hardware)
- one Backup Copy Job created for each offsite backup in DIRECT TRANSFER
- initial active full already seeded/mapped with manual transport/usb disk
- 8 Mbit/sec WAN available only for 4 hours every 24h
- Backup Copy Jobs run daily starting with 5 minutes delay, in sequence and all before the defined data transfer window

having one Backup Copy Job for each VM, which is the best way to giving priority and distribute them on a weekly schedule ?

example:
- VM1 and VM2 (the most mission critical VMs) every night
- VM3 only on Monday night
- VM4 and VM5 every Thuesday and Friday night
- ...etc till VM14

We can reach the target just changing the defined data transfer windows for each job negating days and leaving daily run for all VMs ?
A better solution exists ?

Second question:
closing the access to the offsite storage using IPsec time based firewall rules at destination (further ramsonware defense), Veeam One reports "Backup Performance Data Collection Failure" during the storage unavailable window (20 hours a day),

to avoid veeam one daily warning/resolve repetition messages we just trim the relative rule or some other considerations are to be taken in account ?
...or closing the firewall is not recommended ?

tks.

[foggy]

Hi Michele, for the first question, I suggest switching to weekly (7 days) copy intervals for the less critical VMs. Thanks!

[mikhael]

Tks Alexander.

I'm making some configuration tests in order to join this target.

About the firewall IPsec config which negates access to the offsite repo, based on time rules, at the moment I see only:
1) veeam one alarm "Backup Performance Data Collection Failure" (which can be trimmed by veeamone rule config)
2) host discovery failures during periodic scans by Veeam B&R server

Is there a chance to modify the options of the point 2) ?

[foggy]

I believe, to prevent discovery failures, you just need to carefully configure the firewall, please see the list of the ports used by Veeam B&R components. I also recommend reviewing this thread for a deep conversation on ransomware protection - it's not only about firewall!

[mikhael]

I had already read both and for this reason I intend to completely isolate the offsite repository via the firewall. The firewall doors you mentioned are only open during the night offsite transfer hours. I was asking about [host discovery] errors that are generated during the isolated hours. The Veeam One warnings (Backup performance data collection failure) are customizable, but the "host discovery" errors trigger by the Veeam Backup server, seems they cannot be trained for the case of intentionally disconnected storage.

[foggy]

Right, I don't think you can suppress those.