Tape linked to hardened repository

[Maga84]

Good morning, I wanted to know if it's possible to link a tape directly to a hardened repository. I've already checked the feasibility of the connection and its visibility by Veeam Backup & Replication, and it appears correctly. I wanted to confirm whether, in accordance with security best practices, it's possible to link it to the additional modules that Veeam needs to add to the machine.

Thank you!

[david.domask]

Hi Fabio,

I've moved your topic to our Tape Forum as it's more about supported tape servers than general question.

Please see our User Guide page on Tape Servers:

The tape server role requires root access rights. For this reason, Veeam Software Appliance, Veeam Infrastructure Appliance and hardened repository cannot be used as the tape server.

So you will not be able to apply the tape server role to a Hardened Repository server, you will need to configure a self-managed tape server.

[Maga84]

Thanks, David, for both moving the topic and replying. I hadn't seen the link to the guide you provided; I'd completely missed the need for root access for the tape server.

Thanks again!

[MLang]

Hi folks.

Is the Veeam Infrastructure Appliance supported as a Tape Server in v13? I know there is no explicit role for it, but can I basically use the VIA as a basis and install the appropriate drivers needed for the tape library etc.?

Regards, Marc

[david.domask]

Hi Marc,

I've moved your post to an existing topic on the same subject.

The Veeam Infrastructure Appliance current cannot host the Tape server role; self-managed tape servers (Linux or Windows) will be required.

See our Support Statement on the Veeam Appliances, installation of additional software / drivers is not supported.

[MLang]

Thanks for the clarification.

[david.domask]

Hi eldxmgw, welcome to the forums.

I've merged your topic with an existing topic on the subject.

Your point is understood, however please see the posts above regarding the the Veeam Appliances and tape devices -- we're aware of the request to remove this restriction, but at this time a self-managed tape server will still be required.

[david.domask]

You're welcome Lolek.

Right now nothing to share, the restriction on tape server roles with the Veeam Appliances will remain for now.

However, we are always receptive to feedback, and will certainly consider yours in our discussions.

I will add one small bit of explanation on how we're positioning the appliances, as while I understand your position, the appliances are meant as a "zero-configuration secured appliance" -- the secured part is a cornerstone of how the Veeam Software Appliance / Infrastructure Appliance were designed and their intended purpose, hence why something potentially needing root and / or installing additional software to the appliance is so heavily regulated.

But your use case of an all-in-one setup that includes tape-out is understood, and as noted will consider this feedback moving forward.

[DaStivi]

Hello,
I recently noticed that when a VSA is installed on a server that has additional data disks, the installation process also creates a Hardened Repository on that extra disk.

My assumption was that a hardened repository cannot run any additional services. However, in this "all‑in‑one" setup it seems to work without issues.

This made me wonder: Would it also be possible—and supported—to attach a tape library to such a VSA and use it from the same server?
If this is technically possible and officially supported, it would open up a great scenario for small and medium customers! i where in the assumption, for some reason, the VSA is only the VBR without the possibility of a repository, especially not a hardened one!

Thanks in advance for any clarification.

[david.domask]

Hi DaStivi,

I merged your topic with an existing topic on the same subject.

Please see my answers above, currently you cannot use the Tape Server role on the Veeam Software or Infrastructure appliances.

[DaStivi]

hi, ok thank for pointing me to the tape server requiremnts.. my other question still remains, is it even supported to use the VSA as a all-in-one with some big hardened repo? i really thought this shouldn't be possible...

[Mildur]

Yes, but we don't call it "hardened repository".

From our Whats New guide page 4:
https://www.veeam.com/veeam_backup_13_whats_new__wn.pdf

While the built-in repository does not provide the same level of resiliency against cyber-attacks as Veeam
Hardened Repository due to the added attack surface of the entire VSA code base, making backups
immutable still offers major benefits by protecting them against accidental or malicious deletion.
But for ultimate protection, Veeam recommends separating management server and backup storage by using
Veeam Data Cloud Vault or deploying standalone hardened repositories — which V13 makes it a breeze
to do thanks to Veeam Infrastructure Appliance described in the next chapter!

[david.domask]

All-in-one is supported Just with some considerations as the appliance is locked down quite heavily. And see Fabian's (Mildur's) note above my post regarding the terminology for "hardened"

13.1 will give a lot more love to the "all-in-one" scenario, though the tape server limitation will NOT be removed. But we will introduce the ability to better manage the VSA internal storage on 13.1.

So all-in-one without tape should be quite fine.