Network for Proxy Server

[pronto]

Servus Community,

since we are using ESX vSphere Host version 7.0 we have Veeam Proxy Server installed on the hosts. We are currently undecided in which subnet the proxy should be located. The vSphere management interface is in the subnet 192.168.110.0/24 but all servers with large amounts of data, as well as the backup server (a physical machine) are in the subnet 192.168.111.0/24. Now we thought also the backup proxy server should be located in the same subnet that generates the highest load to avoid unnecessary routing through the firewall. Now when we run jobs in Veeam on these new ESX hosts, Veeam notes that the proxy server is on a different subnet than the management interface. Is this ok with our setup or should the backup proxy always be in the same subnet as the management interface?

Thx & Bye Tom

[Mildur]

Hi Pronto

since we are using ESX vSphere Host version 7.0 we have Veeam Proxy Server installed on the hosts.

Which transport mode are you using? Virtual proxy VMs are using per default virtual appliance transport mode (hot add).

With virtual appliance, the highest load against the production environment occurs when the proxy reads data from the production environment. VM Disks will be attached to the proxy VM. The proxy VM will read the data directly from the attached VM disks, not from the ESXi management interface. The proxies will transfer the data to the repository server. In that step you will see the highest network traffic generated by Veeam outside of the ESXI environment.

https://helpcenter.veeam.com/docs/backu ... ml?ver=120

Now when we run jobs in Veeam on these new ESX hosts, Veeam notes that the proxy server is on a different subnet than the management interface. Is this ok with our setup or should the backup proxy always be in the same subnet as the management interface?

I can only see this message when using network mode.

The vSphere management interface is in the subnet 192.168.110.0/24 but all servers with large amounts of data, as well as the backup server (a physical machine) are in the subnet 192.168.111.0/24.

If you want to segment the subnets, please have a look at our recommendation in the best practice guide:
https://bp.veeam.com/vbr/Security/Hardening_Zones.html

Make sure that your firewall supports the bandwidth required for Veeam Services.

Best,
Fabian

[pronto]

Servus Fabian,

thank you for your attention. We have now re-evaluated the setup with your information and concluded that the backup proxy is already best placed on the same subnet as the backup server. If the backup server and the backup are in the same subnet, nothing is routed and then nothing goes through the firewall. In which subnet the VMs are located is then no longer relevant. I had previously understood the topic, that backups and replications are always handled via the management interface.

As for the transport mode, I already assume that this is handled via hot add. Here are screenshots of two backups and one replication:

Backup within both Proxy and VM located in the same subnet:



Backup within VM and Backup Proxy in different subnets:



Replication between two ESX Hosts with a backup proxy only on the target host. The source host will be retired after the migration is comleted.



Thx & Bye Tom