Integration with VBR

[werner.vergauwen]

Hi

when setting up the integration between VBR and VBA the docs refer to granting the VBR access to Azure Services.
We have deployed VBR in a private VLAN, but able to reach an Azure subscription over ExpressRoute. In there we are trying to deploy VBA. VBR can perfectly talk to VBA without having to go over any internet path.

What I am trying to wrap my head around is why the VBR server needs access to Azure Services. The VBA should, for obvious reasons. And the VBR should be able to reach the VBA. But other than providing the possibility to deploy a VBA from VBR and keep it updated, I do not really see the need.

Can someone enlighten me as to why this is required or where I misread the docs?

thanks

[Vitaliy S.]

Hi Werner,

I believe this is needed because VBR can deploy VB from the UI, so without this access, the deployment would just fail. For day-to-day operation, this is not needed.

Thanks!

[werner.vergauwen]

Hi Vitaly

That is indeed how I interpreted it too.
Does this mean that if I deploy the VBA "manually" and connect VBR to it, this is not needed at all?
That said, the wizard does seem to nudge me towards opening up those ports.

[Vitaliy S.]

Let me check it with the QA team and I will report back.

[Vitaliy S.]

Hi Werner,

Access to Azure resources is required to detect the correct address of the appliance (in day-to-day activity), plus this is also needed during the appliance upgrade procedure.

Hope it helps!

[werner.vergauwen]

Ouch, that is unfortunate. Especially in the light of hardening the VBR server. We have isolated it in its own VLAN to make the attack surface as small as possible. But now we have to open it up to the internet no less!
Is there a possibility to work around this? Are there any plans to change this flow? I am thinking of sidecar design patterns or inversing the flow by having the VBA reach out to the VBR.

Anyway, thanks for your effort already.

[Vitaliy S.]

Hi Werner,

Not aware of any workarounds for now, unless you deploy the VBR to the cloud But thanks for your feedback, we will see what we can do down the road.

[werner.vergauwen]

Well, I think that is exactly what we will be doing: we are going to deploy a VBR in the same subnet as the VBA to allow it to talk, but more important to report back to VeeamOne on prem. Because as we found out VeeamOne cannot report on the VBA either.
Having that single pane of glass is one of the requirements. We wil be using Veeam EnterpriseManager to link the 2 VBRs together.

Thanks for the insights.

[wishr]

Hi Werner,

VONE requires VBA to be integrated with VBR since VBA data is pulled from the VBR server.

Thanks

[Vitaliy S.]

Pretty sure Veeam ONE can talk with VBR via ExpressRoute, so it should be all good.