Adding Copy to existing backup chain

[B.F.]

Howdy

Currently we have various normal backup jobs that backup our vm's to a repository. We recently got a Hardened Repository. What I was planning on doing was have our backups first land on the immutable and then have a copy job duplicate it over to the normal repository that we currently have.

Questions:
Since the normal repository already have backup chains, would it be possible to have the copy job that comes from the immutable re-use the chain that's already on the normal repository?

Is there a better way to use the 2 repositories than what I suggested?

Thanks!

[Mildur]

Hello B.F.

Backup and backup copy chains are not compatible with each other. It is not possible to associate a backup job with a backup copy job chain and vice versa.

May I ask, what type of repository is your primary one today? Windows? SMB Share?

Best,
Fabian

[B.F.]

Hey Fabian,

Thanks for letting know the unfortunate news.

Our primary repository back end is a Synology box that is connected via iSCSI in vSphere. We then have a 2019 Windows Server that's a Repository Server in Veeam where it has a ReFS volume (vmdk) that's on the Synology. The backup job uses the configured Backup Repository's drive letter for the 2019 backup server. ReFS block cloning is utilized to keep the amount of disk spaced used down.

Thanks

[Mildur]

Thank you for sharing.

Our primary repository back end is a Synology box that is connected via iSCSI in vSphere. We then have a 2019 Windows Server that's a Repository Server in Veeam where it has a ReFS volume (vmdk) that's on the Synology.

I would definitely consider to use a physical server with locally attached disks for your primary backups. The challenge with your design is, that in case you have issues with your vSphere server, you also won't be able to start any restore. The process would look like:
1) Rebuilding vSphere host
2) Reconnect Synology
3) Deploy a new windows server and attach the backup vmdk
4) start restoring.

A lot of time wasted until you can restore your production workloads.

What I would do:
1) Deploy the new hardened repository (use a physical server with locally attached disks. A VM with VMDK won't give you a real protection against ransomware)
2) Use VeeaMover to move all backup files FastClone aware from your windows repository to the hardened repository: https://helpcenter.veeam.com/docs/backu ... ml?ver=120
3) Remove the Backup VMDK from your windows repository and disconnect your Synology iSCSI LUN from the vsphere host
4) Connect a new iSCSI LUN from the Synology directly to the virtual windows repository server
5) Create a backup copy job to copy backups from the hardened repository to the iSCSI LUN on the windows repository.

Please note, your virtual windows repository server still doesn't provide you with a real protection if it runs on the same virtual host as your production workload. Or even in the same site.
But connecting the iSCSI LUN directly to the VM is a better option than connecting it to the vSphere Host and using a VMDK by the VM.

I recommend considering a backup copy to the internet (Object Storage or Cloud Connect provider) if you cannot provide a second side for your backups.

Best,
Fabian

[B.F.]

Thanks for the details.

I'm not too familiar with attaching an iSCSI device directly to a windows system. I knew it existed but haven't messed to much with it. So I played around with it and our Synology. A few more questions do come up that may or may not matter.

1. When selecting a volume file system on the Synology, does it matter in this case using Btrfs vs ext4? (It states Btrfs is recommended). Looks like when I connect up the Windows server, I format the newly added LUN anyway to whatever I want within the Windows OS.

2. Is thick or thin provisioning preferred when creating the LUN in the Synology?

Thanks again!

[B.F.]

Update:
One thing I didn't mention is that our iSCSI network is separate from the normal network. Meaning that the iSCSI used in vSphere are on a separate isolated 10gb switches. They are not reachable via any server or client. vSphere hosts are the only ones configured to use those ranges. The Synology is configured to use both regular 1gb network (for management) and also the 10gb iSCSI network.

Using your solution does work however it is going over the 1gb link. If I would want to connect a windows server into the iSCSI 10gb network, I would need to configure the ESXi hosts so that it is a presentable option when configuring the VM network adapters. Would this then break the isolation? The vSphere hosts are able to connect to the 10gb iSCSI network via the Storage Adapter settings.

Unless I'm looking at this wrong, if we want to keep the isolation, we'll need to keep the current configuration.

[B.F.]

After re-reading your suggestions @Mildur, I might have misread it.

In your suggestion using a physical server, it feels that perhaps we should make the Veeam server a physical server (currently it's a VM) and then have it directly connected to the Synology LUN?

Thanks

[Mildur]

Hi B.F.

1. When selecting a volume file system on the Synology, does it matter in this case using Btrfs vs ext4?

I personally use Btrfs with Synology.

2. Is thick or thin provisioning preferred when creating the LUN in the Synology?

I prefer THICK with NAS, because it occupies the storage from the beginning. With THIN, the LUN grows on the Synology while you add new backups to it. With THIN provision, there is also the risk to overprovision your Synology storage. Example:
You have a 4TB synology. You create a 5TB thin lun. You can create it. But after you have stored 4TB of backups, the iSCSI LUN will fail because there is no more storage left on the Synology.

Using your solution does work however it is going over the 1gb link. If I would want to connect a windows server into the iSCSI 10gb network, I would need to configure the ESXi hosts so that it is a presentable option when configuring the VM network adapters. Would this then break the isolation? The vSphere hosts are able to connect to the 10gb iSCSI network via the Storage Adapter settings.

The network must be reachable, correct. If you can't change the design, then keep the design with Synology connected to the ESXI host and the VMDK for the backup server.

In your suggestion using a physical server, it feels that perhaps we should make the Veeam server a physical server (currently it's a VM) and then have it directly connected to the Synology LUN?

I had three recomendations:
Recommendation 1.) Get a physical server with local disks for your hardened repository --> If you bought a physical server for your hardened repository, then you are on the right way
Recommendation 2.) Connect your iSCSI LUN from your Synology directly to the virtual Windows VM --> Preferred way to store backup files on a iSCSI LUN. Connecting to the ESXI host and use a VMDK works, but introduces a lot of pain when you loose your ESXI host.
Recommendation 3.) Copy your backups to object storage or a Cloud Connect Provider --> If you have only one datacenter, consider a backup copy somewhere to the internet. Just in case your building burns down, earth quake or something else.

Best,
Fabian