Questions related to backup encryption in 9.5?

[cerberus]

Hello,

We are running Veeam BR 9/5 with latest Update 2. Our process is to B2D2T - reverse incremental nightly so that tapes being offloaded to tape are full backups.

Our tape library is a Dell ML6xxx with dual LTO7 drives - everything works well and tapes get about 300MB/s each during B2T stage and bottleneck is target.

I am looking to enable encryption (going to do some performance testing soon); I know we can enable encryption at the backup to disk job or the backup to tape job (mediapool).

Anyone out there using encryption already - what is your experience? Which is better in terms of performance?

When we're talking about hardware encryption on tapes, how does this work? Will Veeam query the tape hardware and figure out if it can leverage hardware encryption and fallback to software if it cannot? Or is there something we need to do on the tape library itself to leverage hardware encryption?

Is there a way (via command line or something) to test to see if Veeam will be able to leverage hardware encryption on the tapes without actually running a backup to tape job?

Thanks.

[veremin]

Anyone out there using encryption already - what is your experience?

If there is a need to encrypt source backup data, then, stick to backup job encryption. Otherwise, leverage the one available at media pool level.

When we're talking about hardware encryption on tapes, how does this work?

Backup server delegates encryption task to native device mechanisms. More information can be found here.

Will Veeam query the tape hardware and figure out if it can leverage hardware encryption and fallback to software if it cannot?

Correct.

Or is there something we need to do on the tape library itself to leverage hardware encryption?

Encryption needs to be enabled on device level.

Is there a way (via command line or something) to test to see if Veeam will be able to leverage hardware encryption on the tapes without actually running a backup to tape job?

Everything should work fine, as long as tape device supports encryption.

[f1ref0xy]

Hello!
I got another question about encryption - but not to tape - to disk.

I've read in another post veeam-backup-replication-f2/effects-of- ... 29021.html that when encryption to disk is enabled, deduplication is not perforemd.


Does this mean, if I enable backup job encryption, the backup-size on disk will be more than without?
Does something change on this topic since 2015 ?

I've done some tests about that topic:
Backup-Job with about 8 VMs (all Windows 2008 R2) - full backup:

1.) Backup with encryption to disk repository - per VM Backup Files
Disk Repository configured with "user per-VM Backup Files" - so deduplication will not be performed in my opinion.
Backup Size on Disk: ~+151GB

2.) Backup without encryption to disk repository - per VM Backup Files
same settings like above - Disk Repository configured with "user per-VM Backup Files" - so deduplication will not be performed in my opinion.
Backup Size on Disk: ~151GB

3.) Backup with encryption to disk repository - "default" repository settings (one chain)
one Backup File, Backup Size on Disk: ~151GB

4.) Backup without encryption to disk repository - "default" repositry settings (one chain)
one Backup FIle, Backup SIze on Disk: ~ 132 GB


Summary on my test szenario:
encrypted Backups are larger on default repositorys thant "normal" backups - because dedup is not performed.
when using method "per vm files" there is no difference, because of not performed deduplication by design of per vm files.

What you are thinking about that topic?

br
f1refoxy