Veeam design components

[wiz2k10]

Hi all,

I need to have feedback about the "best practices" or your experience about Veeam components on the network.
I plan to make a big change about my Veeam infrastructure and I wonder how to put my components on the network so that are as secure as possible.

Today, I have 2 sites, 6 ESXi by site, 2 veeam proxies by site, 1 repository by site, 1 veeam server replicated to second site.
Only repositories are on a separated vlan but is not filtered, proxies and vbr server are on another same vlan.

I have two ideas :

1. Separate all components, enable filtering inter-vlan and open ports needed between alls components
2. Gather all the components in the same isolated vlan and open the ports of the VBR Veeam console from one server and to the vCenter / ESX

What is the best way to protect my repositories and all other veeam components ? How is it in your company ?

Thank you for your attention,

Have a nice day,

M.

[PetrM]

Hi Maxime!

I'd suggest to take a look at these security considerations on our help center.
It's recommended to isolate network to transport data between backup infrastructure components and the idea 2 matches this recommendation, at least as far as I understand so far...
I'm not sure about the idea 1 because it seems that it does the same trick (isolation of backup infrastructure components) but looks to be more complicated.

Thanks!

[wiz2k10]

Thank you Petr, I was not aware of this document, I will be inspired.

Bye.