SureBackup in HyperV with many vlans on one single vSwitch

[tinto1970]

Hi folks, a customer using Hyper-V has this configuration on their vSwitches:

- VM servers on different VLANs/Subnets

- A vSwitch for the host, with uplinks to the physical switches that evidently connect to trunk ports

- VLAN tags are applied on Hyper-V

see: -> https://drive.google.com/file/d/1N7SMef ... sp=sharing

I’m running into difficulties because the VirtualLab appliance can only have one vNIC on the isolated Lab vSwitch, so… I could group the VMs on the various VLANs into separate Application Groups, each with its own dedicated appliance and a separate SureBackup job.

But, as you can imagine, if I need to run a SureBackup of an “WebSite” Application Group on 10.1.10.x, and it needs DNS/DC services from 10.1.1.x to function and be properly tested, that’s a problem—because even if I power on all the relevant VMs on the same isolated vSwitch, they won’t be able to communicate with each other.

I don’t know if this Hyper-V configuration is recommended, but it seems unfriendly to Veeam/SureBackup. Have you ever encountered this situation? Is there something I'm missing, a workaround or something to avoid redefining Hyper-V networking on production?

[ibarizz]

Hello!
I was thinking... adding a virtual router inside the Lab to enable cross-VLAN communication (without touching production) would maybe fit in the case?
I mean, setting up a pfSense in the SureBackup Lab with multiple interfaces, each mapped to a VLAN, then configure inter-VLAN routing by assigning IPs to each VLAN interface and enabling firewall rules to allow traffic between them. Set the VirtualLab appliance and VMs to use the virtual router as the default gateway. You might have to ensure DNS and other critical services are reachable across VLANs of course and with this you allow communication between VLANs without modifying the production network.
It's kinda messy... but it could work for you specific scenario.

If not, just create separate VirtualLab appliances and test each VLAN separately.
I would avoid at any cost making VLAN changed at prod level #IMO.

[tinto1970]

thank you ibarizz, yes at the moment I see it as the only viable solution

- one VirtualLab/appliance for every VLAN
- one router (pfsense?) with one leg in every isolated VirtualLab vSwitch. not connected to any production network to avoid conflicts in case of mistakes

and then configure the surebackup job/verifications accordingly

[tinto1970]

i opened Case # 07651132 because I don't understand this manual page:

https://helpcenter.veeam.com/docs/backu ... ml?ver=120

here the proxy appliance is connected to 2 isolated virtual switches, but I cannot undestand how to do it: in the settings of the appliance i cannot connect it to 2 isolated virtual switches.... it let me choose... only one ?

[mkeating44]

This is a pretty standard Hyper-V configuration, and the Advanced Single Host configuration for the virtual lab would be the answer and what I use: https://helpcenter.veeam.com/docs/backu ... ml?ver=120

If you allow routing between the networks, you can place all your VMs with different VLANs (and subnets) into a job that uses the Lab and they will communicate without issue. This creates multiple private vSwitches on your target host. I have a Lab with nearly 20 VLANs/subnets on without issue, and we have multiple labs across the hosts.

If you don't want multiple vSwitches there's no real way around it.