Backup copy job from Azure to Vault

[dhayes16]

Greetings everyone. So we have an on-prem VBR 12.3 backing up local on-prem servers. We also have a site to site VPN tunnel to Azure with an Azure veeam appliance deployed to backup several Azure hosted VM's backing up to immutable blob in the cloud. This is all managed via the on-prem VBR server. It has been working well for over a year. We recently added a VDC veeam vault to add a secondary backup target for the Azure VM's. We successfully added the vault and created the vault in VBR. I created a backup copy job on the VBR server with the azure backup policy as the object and the veeam vault as the target. Seemed logical. However, when I ran the backup it swallowed up the internet pipe since it looked like it was pulling the backup down from azure and pushing it back up to veeam vault. I disabled the backup copy job to stop the job. Obviously I configured something wrong to create this hairpin situation but I have gone through countless documents to find out how to properly configure this including using the AI intelligence agent within veeam. The intelligent agent tells me to do things that simply do not apply (buttons and options are not there, etc). For instance, setting the backup job to select "infrastructure" for the object but that option is not there. Also, other documents say to configure everything in the Veeam appliance gui and not VBR console. Should I configure this all in the GUI and NOT VBR?

Now, I did read where I could spin up a small linux server in Azure to serve as a gateway server but I was hoping to not have to do that and need to manage another server. I was also thinking of possibly using the veeam appliance itself to be the data mover, etc but the instructions to do this did not seem to be applicable. Some instructions said to add the veeam appliance to managed servers but it is already there and can not be configured anywhere as a data mover within VBR.

So I guess I am looking for best practice to do this. I want this entire backup copy process to stay in Azure to minimize egress fees.

Thanks for any input and have a great week!
Dave

[Mildur]

Hi Dave,

There’s no direct Backup Copy from the Azure appliance to VDC Vault.
Backup Copy uses a Gateway Server to read from the source, and later write the backups to the target. So the best approach is to deploy a Linux VM as the Gateway Server within Azure.

Alternatively, you can use VDC Vault as the primary repository and Azure Archive Storage from your tenant as the archive storage in the backup policy. This setup removes the need for a Gateway Server, as all operations are handled by the Azure appliance and its workers.

The intelligent agent tells me to do things that simply do not apply (buttons and options are not there, etc). For instance, setting the backup job to select "infrastructure" for the object but that option is not there. Also, other documents say to configure everything in the Veeam appliance gui and not VBR console. Should I configure this all in the GUI and NOT VBR?

If you notice any incorrect guidance, please use the Feedback option in the Veeam Intelligence Chat Box. That will help us to improve the answers provided by the AI chat.

Thank you,
Fabian

[dhayes16]

Thank you Fabian for the reply...I like the idea of switching things up and have the Veeam vault as the primary repo. Also, I did read the article on archiving as well. I suspect I would do that right within the tenant but I need to research on how to create archive tiers within Azure.

So to proceed is it recommended that I edit the existing DAILY backup policy that has been running for over a year and re-point the repo to the VDC vault OR create a new daily backup policy to point it there? I am thinking the latter makes more sense. If so I do NOT see the VDC Vault in the veeam azure gui. It IS in the VBR on-prem as a Backup Repositories. Should I create the repo in the Veeam Azure GUI separately? I suppose I am just trying to understand the purpose of the on-prem VBR with managing these jobs and resources.

I will go through the AI agent and update it with issues I find.

As always thank you Fabian. Very much appreciate the insight.

Dave

[Mildur]

Hi Dave

You’re welcome.

I assume you are still on Azure v8, please follow this KB to add VDC Vault as a repository: https://www.veeam.com/kb4736

On the newest release v8.1 (with Veeam Backup & Replication v13.0.1), you will find a dedicated wizard.

We will release soon the first patch for Veeam Backup & Replication V13.0.1. I recommend to consider an upgrade of your backup server and Veeam Backup for Azure appliance.

So to proceed is it recommended that I edit the existing DAILY backup policy that has been running for over a year and re-point the repo to the VDC vault OR create a new daily backup policy to point it there? I am thinking the latter makes more sense.

I would create a new backup policy and disable the old policy.

Best,
Fabian

[dhayes16]

Again Thank you Fabian. Unfortunately for this one particular customer we can not get to VBR 13 quite yet since they have an old 2012 R2 server still hanging out there. We will be moving those contents to sharepoint very soon and will then get to 13. Yes we are on veeam azure 8.0 at the moment. I am loving the linux appliance.

I have a couple other questions:
#1) When a backup policy is created there is the option for snapshots. This may sound odd but where are those snapshots created if I have VDC Vault set as the primary target? From what I understand they can consume a lot of storage and I believe it is recommended to keep that number low. Right now our backup repo is over 7TB and the VM's we are backing up are only around 1.2TB total. When we point this to the new repo on vault I want to make sure we properly configure our retention to optimize storage. The primary repo on vault will be for recovery purposes and the archive will be just that..An Archive.

#2) When we stopped that copy job it ended up storing about .11 GB in the vault. I would like to delete that since if we change our plans here those objects will not longer be valid. I know I need to wait out the immutability but once that happens what is the best way to delete that data? Via VBR?

Again Thanks!
Dave

[Mildur]

Hi Dave

I am loving the linux appliance.

Thank you, great to hear

1.) Snapshots are mandatory for "backups". The policy first creates a snapshot of your VMs in your Azure tenant. If you enable backups in the policy, our workers will read data from the snapshot and offload it as a "backup" to the repository (Azure Blob or VDC Vault).
You can keep the snapshot retention short while keeping backups (and archives) for much longer time.

2.) Removing it from Veeam Backup & Replication does not delete the Storage Vault in VDC. You can contact our customer support team when you’re ready to remove the entire Storage Vault and its data. The process is documented in our Help Center.

I also recommend creating a dedicated Storage Vault for the Azure appliance — don’t use the same one for both Veeam Backup & Replication and Veeam Backup for Azure.

One additional consideration is the edition of VDC Vault. Since backup data is copied from VDC Vault to Azure Archive Storage, you’ll see 100% egress traffic for the initial copy and afterwards new and changed backup data blocks. Only VDC Vault Advanced provides unlimited read/restore (Edition Comparison), while VDC Vault Foundation offers only Fair Use limits.

Best,
Fabian

[dhayes16]

Thanks again for the information. We have a VDC Vault Advanced so we should be ok on the egress. I just think we will need more than 1TB. We also intend to try to leverage surebackup with the veeam VDC vault which was a driving factor for advanced. We just need to figure out the compute we will need to make that happen.

So far all is working well.

Much appreciated Fabian
Dave