Hardened Repository - Immutability Question

[jdodd6]

The description for immutability within the Hardened Repository settings in Veeam is confusing me. It reads:

"Protects backups from modification or deletion by ransomware, malicious insiders and hackers. GFS backups are made immutable for the entire duration of their retention policy."

Does this statement mean that only GFS full backups become immutable when placed on the hardened repository? Or are all backups, incremental and full, immutable when placed on the hardened repository?

[tyler.jurgens]

GFS backups are immutable for the length of their GFS policy.

Incremental backups are immutable for the period you have set on your repository itself. Eg: If you set the repository with 30 days of immutability, your incrementals and non GFS full backups will be immutable for 30 days + block generation (up to 10 extra days).

[jdodd6]

Thanks Tyler. But am I correct in that you must use GFS backups in order to use a Hardened repository's immutability feature?

For instance, I would like to create a weekly immutable backup with 30 days retention with a copy job. To achieve this, I have set the immutability on the repository to be 30 days, the retention of the weekly copy job to be 30 days, and the weekly GFS Full backup to be kept for 4 weeks. Is this not the correct way to align immutability for a weekly copy job to a hardened repository?

[Gostev]

No, GFS backups are NOT required to use hardened repository's immutability feature. However, most customers do because GFS backups are typical retention requirements of most business and they do not consume any extra disk space on hardened repository because we leverage block cloning to create them. So basically there are no reasons not to use them.

And as Tyler already mentioned, we make them immutable for the entire duration of the retention policy, so you don't have to worry about "aligning" immutability to your retention policy, or think about all this at all.

[jdodd6]

Hi Gostev,

Thank you for the information. However, it would seem that whenever I try and create a Backup Copy job that targets the Linux Hardened Immutable repo, I receive a pop-up warning that says "Immutable backups feature requires the GFS retention policy enabled in the Backup Copy job settings." But this pop-up does not happen if I am creating a normal Backup job that targets the repo.

[Gostev]

This is because unlike primary backup jobs, Backup Copy jobs do not have a notion of periodic fulls, which are the base requirement for immutability. Enabling GFS is thus the only option to ensure you have a full backup created periodically.

Without periodic fulls, you would be doing "forever incremental" backup which requires updating existing backups in-place to process retention policy, while this is obviously impossible if the backups are immutable.