Veeam B&R with Wasabi S3 questions

[HenryA]

Good day everyone.

We have a Veeam M365 server already backing up M365 data to a Wasabi S3 bucket. We have a service account set up on Wasabi, and its access key, and a specific bucket to backup M365.

We are setting up a new Backup and Replication server, which we plan to use to backup mostly CIFS shares, but also some NetApp volumes. Questions:

1. Do we have to setup a new Wasabi service account within the Wasabi console to do this? Meaning: create account --> create access keys. It would mean we have 2 accounts with 2 access keys. I am 90% sure we don't need to do this, and can simply share the M365 account. But even then, would it be a good idea to create a new account specifically for VB&R with its own access key?

2. Once we have the repository setup, the idea would be to create 2 buckets, one for CIFS backups, and one for NetApp volume backups. Can we share the newly created account and access key (if we even need to create one at all)?

I've been scouring the internet for an answer to these questions, and so far no luck. I was hoping someone here might have the answer. I appreciate it in advance!

[Mildur]

Hello Henry

1. Do we have to setup a new Wasabi service account within the Wasabi console to do this? Meaning: create account --> create access keys. It would mean we have 2 accounts with 2 access keys. I am 90% sure we don't need to do this, and can simply share the M365 account. But even then, would it be a good idea to create a new account specifically for VB&R with its own access key?

You can use the same access key. Personally I would use different keys and buckets for each application. Why?
If one of my backup server get hacked, an attacker has access to VB365 and VBR backups when a single access key was used.
But with different keys limited to access dedicated buckets, my VBR backups would still be safe when my VB365 got attacked.

You can segment access even more by using different Wasabi Accounts if you like todo that.

2. Once we have the repository setup, the idea would be to create 2 buckets, one for CIFS backups, and one for NetApp volume backups. Can we share the newly created account and access key (if we even need to create one at all)?

May I ask what you mean by "NetApp volume backups". Veeam Backup & Replication does not protect NetApp volumes. The backup server can orchestrate volume snapshots. But I don't think you have meant such snapshot jobs. Are you talking about VM Backup jobs to backup the vSphere or HyperV VMs on that NetApp Volume.

I would use two buckets as well. One for CIFS and one for the assumedly VM workloads.
Makes it easier to clean the bucket when you don't need it anymore and to know how miuch storage each workload has used on Wasabi.

Best,
Fabian

[HenryA]

Thanks Fabian.

I'm not 100% sure how the Veeam B&R works with backing up NetApp data. I assumed it was similar to how a Snapmirror works, where it will take a snapshot of the volume and replicate it across to the destination. So this is what I mean by "volume backup". Please forgive me if I misunderstood how Veeam B&R works. Once I have this server set up, I will hopefully be able to understand it better.

As I understand right now, once we create the proper NetApp account, and configure Veeam to see all the NetApp CIFS/NFS/LUN's, etc, we can then select individual items to backup? Let's say I want to back up a bunch of CIFS shares. On a NetApp, the CIFS share is basically just a pointer to a Qtree on a Volume. Is Veeam able to resolve CIFS shares directly from the NetApp, and back them up as such?

So far I have tested doing individual CIFS Share backups using UNC paths (which just link the source to the CIFS Server on the NetApp, but thru Active Directory DNS services).

I do have another question regarding connectivity to the Wasabi buckets. We also run a Veeam M365 server, and that one is also connected to Wasabi S3. In M365, we could set up an internet proxy that allows us to access the Wasabi buckets. I cannot find a similar option in Veeam B&R 12. Is there no way to assign an internet proxy to the Veeam B&R server itself, or to the VSphere backup proxy? In the Backup Proxy, there is an option to add network settings, but it doesn't look like somewhere I could add the internet proxy, which required AD credentials to connect. Does that mean we need to give the Windows VM that is hosting the Veeam B&R internet access? Or am I missing some detail somewhere?

Appreciate your time

[ybarrap2003]

@HenryA if you have not added a NetApp storage system to Veeam you can follow this link - https://helpcenter.veeam.com/docs/backu ... ml?ver=120 once you configure your protocols you can start creating your backups i.e. VMware, CIFS etc. We do invoke SnapMirror if it already configured. We can create CIFS/NFS backups once the storage is added. Please see Veeam documentation for more details - https://helpcenter.veeam.com/docs/backu ... pp&ver=120

[HenryA]

@ybarrap2003, thank you for the link!

Any suggestions on the internet proxy question? I'd like to confirm if there are setting within Veeam B&R to access the internet, or if it just relies on the Windows Guest VM that's hosting it for internet access.

[ybarrap2003]

You are welcome, @HenryA you are correct. This has to be setup in the VM or physical server you are using. The VBR server just uses the network you have available .

[HenryA]

Ok thank you, that's exactly what I needed to know.

[ybarrap2003]

@HenryA sounds good. I hope your able to sort it out .

[HenryA]

Hello friends. I figured I'd ask in this same thread instead of creating a new one.

I have been trying to connect a Wasabi account to the Veeam B&R server with no success. When I try to add the Wasabi account as a backup repository, it keeps on giving me the following error:

"Veeam Backup and Replication failed to retrieve certificate from s3.ca-central-1.wasabisys.com"

I am trying to setup the Wasabi S3 account exactly as this doc explains: https://docs.wasabi.com/docs/using-veea ... -to-wasabi

But no luck. Thinking it could have been an internet access issue on the Windows host, I installed the "Wasabi Explorer" app on the Windows host, and used the Account/Access Key/Secret Key I had created on Wasabi, and lo and behold, it works! I can see the buckets.

So either I am missing something in the Veeam B&R config, or something is wrong with the Veeam B&R install? I'm guessing I'm probably missing something important somewhere.

FYI, we have a separate Veeam M365 server, and I added a new Repo onto that one using the exact same Wasabi credentials, and it was successful on the M365 server, so it's only on the new B&R server that I am missing something.

[MarkBoothmaa]

do you have any firewalls in place that are doing ssl decryption/inspection as that's a good place to start looking.