NIDS HyperV to wasabi

[maface99]

Hello,

I am seeing the following entry on our firewall NIDS "ET INFO Commonly Abused File Sharing Domain (wasabisys .com)" coming from wasabi to our hyper server. My Veeam backup server is copying backup jobs to wasabi so I believe that is what the NIDS is seeing but it seems a little strange that the source is the actual Hyper-V server and not the backup server. Does any one have any thoughts?

Thank you,

Marc

[HannesK]

Hello,
if your backup jobs are targeting Wasabi and no gateway server is set in the Wasabi repository settings, then the traffic goes directly from the Hyper-V on-host proxy to Wasabi (assuming that you don't use off-host proxy).

Best regards
Hannes

[Andreas Neufert]

Hi Marc,
thanks for reaching out here.

In general there are 2 datamover services involved when we write Hyper-V backups to the Object Repositories.
1) A source Data Mover that is in your case the OnHost Proxy
2) A second Data Mover that is the system that interacts with your Wasabi Storage.
In several configurations the first server where a source data mover server is started is used to reach out to the storage directly.
You can define a gateway server to enforce the usage of a specific server for the communication. It is described here: https://helpcenter.veeam.com/docs/vbr/u ... tml?ver=13

[maface99]

Thanks Andreas and HannesK!

[Andreas Neufert]

I updated my entry.