iSCSI Setup and Optimizing

[bhwong]

Are the assumption of veeam server setup configuration performance on backup and restore below accurate? (1 is fastest, 5 is slowest)

1. Physical Veeam Server connect directly into iSCSI SAN storage
2. Virtual Veeam Server connect directly into iSCSI SAN network
3. Physical Veeam Server connect to VM network
4. Virtual Veeam Server connect to VM network on same ESXi host as VMs that are going to be backed up
5. Virtual Veeam Server connect to VM network on difference ESXi hosts as VMs that are going to be backup up

I don't feel safe setting up iSCSI connection for Windows to connect directly into our Equal Logic SAN storage as there is a risk of allowing Windows to write NTFS formatted data into VMFS partitions. Any assurance or protection we can implement for such setup to prevent this from happening?

One way I can think of, is to setup iSCSI connection from Windows to access SAN storage as read-only. Unfortunately, Equal Logic can only be configured as read-only or write-read for all connections. It can't have difference access rights for individual iSCSI connection. Is this the same for other iSCSI SAN storage too?

[Dima P.]

Hello,
Thank you for your post!

(1 is fastest, 5 is slowest)
1. Physical Veeam Server connect directly into iSCSI SAN storage
2. Virtual Veeam Server connect directly into iSCSI SAN network
3. Physical Veeam Server connect to VM network
4. Virtual Veeam Server connect to VM network on same ESXi host as VMs that are going to be backed up
5. Virtual Veeam Server connect to VM network on difference ESXi hosts as VMs that are going to be backup up

This assumption seems to be logically correct, even I do not have the exact metrics.

Is this the same for other iSCSI SAN storage too?

As far as I am concerned, different vendors provide different granular set up - but the basic set of permissions is always the same: read only/read-write/root.
Also I suggest looking in to this tread as this might be the place of interest: Improving direct-from-SAN backup speed with iSCSI SAN

Please let me know if you still have any questions.
Thank you.

[Dima P.]

On short but important update regarding NTFS into VMFS partitions: Disks shouldn't be initialized.

For the best practices you may refer to Configuring new VEEAM Backup Server for direct SAN acces thread.

Thank you.

[Starman]

I just set this up myself to our new Dell Equalogic 6100. Its very simple, on your Veeam virtual machine just use the windows iscsi initiator to point to the Equalogic then connect all of your volumes to it. In windows server storage manager just switch them to "online" (don't assign drive letters or format!!!!). Veeam will then switch to direct SAN mode and back up your virtual machines strait from the Equalogic with no problem. This is very simple to do, no worries.

On install Veeam shuts off auto-initialize. Its important to note, even if you don't use direct SAN Veeam will use hot-add and the same thing happens any ways.

[Dima P.]

Todd, Highly appreciate your feedback!

[bhwong]

Hi Starman,

Did you add a second NIC in your Veeam VM to have a direct physical connection to your iSCSI network and SAN storage for better performance? Or you simply make use of it's existing VM network and access your SAN storage thru this link instead?

[bhwong]

Thanks d.popov! That's a huge disaster just waiting to happen... especially if we hired a new IT support staff who is not familiar with this! Or even old staff who might have forgotten about the previous setup!

[bhwong]

btw, according to Equal Logic staff, Veeam as a VM setup should have better performance over Veeam as a physical setup if both do not have direct iSCSI access. This is because Veeam running as a VM under the ESXi host can make use of VAAI API to get direct access into Equal Logic from the ESXi host, but the physical setup will have no way to do this.

[Starman]

Hi Starman,

Did you add a second NIC in your Veeam VM to have a direct physical connection to your iSCSI network and SAN storage for better performance? Or you simply make use of it's existing VM network and access your SAN storage thru this link instead?

Yes, in VMware all you have to do is add a VM group that using the same virtual switch that has all of your iSCSI connections to the Equalogic. Then just add a second nic in that VMgroup for Veeam. Dont forget to set Jumbo frames throughout it all.

[Vitaliy S.]

according to Equal Logic staff, Veeam as a VM setup should have better performance over Veeam as a physical setup if both do not have direct iSCSI access. This is because Veeam running as a VM under the ESXi host can make use of VAAI API to get direct access into Equal Logic from the ESXi host, but the physical setup will have no way to do this.

Yes, this is correct. It is called Virtual Appliance (HotAdd) backup mode, and this mode indeed has a better performance rate compared to the network processing mode.

[yizhar]

Hi.

I had a similar dilemma with our new HP 3PAR 7200.
This machine has FC connections and not ISCSI but the ACL problem is similar.
Before that I had an HP P4300G2 (Lefthand) which was able to present RO to the backup server so no problem then.

The 3PAR is also not capable of presenting the VMFS volume as RW for VMware hosts, and at the same time as RO for Windows backup server.
After some testing (just created a test volume to play with), I found that there is not much to worry -
I presented the volume to backup server and it appeared as offline (as it should be - no need to put it online).
I have checked what happens if I (or another administrator) tries to bring it online in disk management, and found that it didn't bread anything.
http://3parug.com/viewtopic.php?f=18&t=318

So - I agree that there is a risk in presenting the volume to Windows Backup server, but it will catch you only if you (or another admin) does something really unaccountable such as :
brining disk online
AND ALSO - deleting the VMFS partition or something like that.

So after the test I have decided to go with SAN mode on all production VMFS volumes, even without the safety of RO ACL on the volume.

Bye
Yizhar