Hardened repository implementation question

[stre1026]

Hi All -

I'm trying to figure out the best way to implement an immutable backup repository in my environment. We currently run backups of our vSphere environment nightly (about 5 TBs of data) to a local NAS and then we run copy jobs to copy those backups to an offsite NAS over MPLS. We're concerned about the increasing ransom attacks and we are looking into implementing a hardened repository to protect us in case something were to happen to the backups on either one of our NAS devices or the VMware environment. At this point, our infrastructure is entirely virtual, including the Veeam server. This new server would of course be physical. I'd like to keep everything the same as far as our current backup strategy but just add a immutable backup repository to the mix if possible. The challenge is we can only afford to lose a day's worth of work like most orgs. What would the best way to do this? I'm thinking maybe another backup copy job and set the immutable repository as the destination?

I'm open to all suggestions!

Thanks,

[Gostev]

Hello, yes the Backup Copy job in the immediate copy mode should do the trick here! Thanks.

[stre1026]

Thanks Gostev. Are NLSAS drives Ok for this sort of scenario?

[Gostev]

Well... it depends on the number of spindles and on the RAID level
Although in general, secondary repositories don't need to be fast.

[stre1026]

Fair enough!

[MCH_helferlein]

Is it possible to use a hardened linux repository only for a backup copy repository actually?

So the primary backup storage is a normal veeam repository and only the backup copy one will be hardened?

[Mildur]

Of course. This is possible.

[MCH_helferlein]

Great thanks.

We are just planning a new infrastructure and I kinda would like to set it up like this:

- DC1 and DC2 local normal unhardened Veeam Repos just for fast restore and few restorepoints. More restore points will be archived to cloud blob storage by SOBR.
- DC3 hardened Linux Repos in a SOBR, also with cloud blob storage.
- DC4 Tape backup with backup to tape jobs from the restore points in the hardened Linux Repository in DC3

Do you know if backup from hardened Repos to tape jobs are also supported?

Thank you again.

[Mildur]

- DC4 Tape backup with backup to tape jobs from the restore points in the hardened Linux Repository in DC3

Do you know if backup from hardened Repos to tape jobs are also supported?

As long the files are on a performance extend, they can be written to tape with a backup to tape Job.
As soon there are moved to the blob storage (capacity tier), you can't get them to a tape the easy way.

A linux hardened repo is a normal disk based repository (Direct attached storage) with a immutable flag.
Backup Copy and Backup to Tape will work without any issue, like for any other "Direct attached storage" Backup Repo.

[MCH_helferlein]

Ok great, thanks.
Direct attached may be also some Storages with expansions shelves over external SAS connects, right?

[Mildur]

Direct attached may be also some Storages with expansions shelves over external SAS connects, right?

Yes. This SAS expansions shelves needs to be mounted to a linux server and the linux server needs to manage the filesystem (XFS for reflink/FASTClone support), if you want to use immutability.

Other examples of Direct Attached Backup Repos are:
- iscsi mounted LUN to a Linux or Windows Server
- FC mounted LUN to a Linux or Windows Server
- local disks directly connected to the raid controller of the Linux/windows Server.

[MCH_helferlein]

One more thing

If I install a linux on the master controller of the storage shelf, can I decide which attached LUNs can be used as hardened storages?
Perhaps I would like to use a part of the whole storage shelf as a normal unhardened repository as Veeam Fileshare repository.

[Mildur]

If I install a linux on the master controller of the storage shelf, can I decide which attached LUNs can be used as hardened storages?
Perhaps I would like to use a part of the whole storage shelf as a normal unhardened repository as Veeam Fileshare repository.

If this "linux master controller" is a standard linux environment, where you can install and configure anything you want , then it should be possible.
Use a NFS Server deamon for NFS Fileshare to Veeam, use XFS filesystem with reflink enabled for FASTClone.

But I don't see any advantages for you. If you want to use FAST Clone, you cannot use a Fileshare Repo.
If that would be my environment, I would go fully linux hardened repo with that storage.