Design review

[JHuston]

I'm going through a redesign of our backup infrastructure and wanted to bounce a design I was thinking about today off the community.

Current layout:
- Cisco S3260 running a REFS backed scale out repo at my main site. Main jobs go here. (REFS is awesome by the way!)
- NetApp AltaVault at my second site. Backup copy jobs are sent here for longer on prem retention as well as streamed out to BLOB storage for long term and off site storage.

Goals:
- Retire our NetApp AltaVault. It's end of life and no longer sold.
- Introduce a second REFS repo at my second site so I don't have to read the whole restore point from the source storage while doing backup copies. Something I currently have to do as I can't do synthetic fulls on the AltaVault. It's painful.
- Introduce some sort of air-gap type backup on prem to protect from malicious attacks and be able to provide faster restores VS pulling from BLOB in that type of scenario.

Proposed solution:
- Place another Cisco S3260 at my second site and do backup copies to it.
- Copy backups out to BLOB VIA features built into Veeam V10 when it releases. I did a demo with our SE and it looks like it will fill my needs just fine.
- Add a small HPE Store Once appliance or Exagrid and use the API from Veeam to do a more secure backup copy for a few days retention. This isn't true air-gap but seems pretty secure being it uses the API and nothing else but Veeam can see and or use it.
- My last option would be tape, don't really want to go back to that though...

Thoughts?

[HannesK]

Hello,
primary backup + copy job + copy to object storage + dedupe appliance... well, that's probably one of the most robust design I have seen over the last years

Best regards,
Hannes

[Steve-nIP]

I won't start slagging off StoreOnce openly here, it wouldn't be very professional. Go with ExaGrid. I've experience with both.
Also, what build of Windows Server are you using for your ReFS repos? That can be especially important as repo size and data size grows. There's a thread on this forum with people's experiences.
The S3260 is a fine box, and I can warmly recommend it. I prefer it over the HPE Apollo equivalent. I've experience with both of those, too.

I guess if you were going crazy, you could implement an ExaGrid behind a Cloud Connect server at your second site (of course out of domain with completely different credentials), with insider protection enabled. Pseudo-air-gapped, and the dedupe would keep the insider protection overhead in check.

[JHuston]

Thanks for the input. Backups are one of the things I invest heavily on and sell to the company as a NEED, not a nice to have. I'd hate to be stuck in the scenario where we've been compromised and the company faces financial repercussions just because they wouldn't allocate an extra $100K for me to setup a robust solution. I do cross site copies just in case, that's the reason for the two copy jobs.

I love my current S3260, it's running Windows server 2016. It has around 115TB backed by 256GB memory. Runs great so far, huge spae savings and synthetic fulls are amazingly fast due to fast clone.

The Exagrid behind a cloud connect server is actually a really good idea, I'm going to explore that! I bet that would expose the option of the recycle bin feature as well which is attractive.