Architecture across multiple sites

[bdoe]

I have used Veeam for years and am very familiar with it at a single site. In that scenario, I set up several backup proxies, but due to the single location bandwidth wasn't a concern, I just set up the proxies and let Veeam handle them as it wished. However, I am now operating it in multiple sites through the country. My original plan was VBR servers at each location, and VEM at a central location to manage licensing. This was to keep bandwidth down, allow each site to operate independently if needed, but keep them tied together.

Now I'm thinking I need to change it, and it is early enough I can do that. I'm thinking that if I run VBR in one central location (or even place it in a cloud location), I could then deploy a Windows backup proxy to each location. That proxy could also run a local repository, or have a hardened repository next to it, as well as host a tape drive if desired. If I'm understanding correctly, the VBR server would just tell the proxies what to do, it wouldn't do the processing or transmit data over the VPN. This sounds like less to maintain and more scalable.

The other question is, what does the VBR server need connectivity to? I am trying to keep the Veeam systems as isolated as possible. Would it need connectivity to the systems that need to be backed up? Or does only the proxy? It would be great if the VBR server could tell the proxy what to back up, and the proxy goes and finds it. That would result in far less connectivity required from VBR.

[HannesK]

Hello,
your general understanding is correct. When it comes to "isolation", then the main question is, whether there is a central VCenter. If yes, then the isolated backup server in a branch office cannot do much without VCenter. That's why many customers go for a central VBR server.

The ports list shows which connections are needed.

Best regards,
Hannes

[bdoe]

It's actually a mix of Hyper-V and VMware, though currently not a central vCenter. Each site will probably have its own (it's a long list of reasons).

Isolating would most likely be placed on a VLAN with no inbound access apart from what Veeam requires, and spanning the sites. The VBR server itself can get access to whatever it needs to, but if the proxy can get most of the rules that would be preferred. Though ultimately I suppose as long as the VBR server isn't doing the backup and transferring data, that's the most important part.