NAS on an isolated VLAN - impossible?

[cookie-monster]

I was asked recently to make our backup storage NAS more secure. One of the things I did was to put the NAS in a VLAN that only our physical Veeam server could access. First my test backup failed then it worked. Let me explain.

Our physical Veeam server has two nics. One is connected to the production network and the other to our NAS in it's own VLAN. The NAS and one server nic are in their own VLAN which has no access to the production network. Virtual vproxy servers have no direct access to this VLAN.

It was my expectation that the vproxy running on the Veeam server would act as a go-between for the virtual vproxies and the isolated NAS. I was disappointed when my first test backup failed indicating that the "network path was not found". A quick call to Veeam (case #03759982) where the tech told me that what I was attempting would not work. vProxies need direct access to the NAS they said.

The next day just for laughs I tried it again. I made sure that the gateway server setting was my Veeam BR server and to my delight the backup worked. Another call to Veeam where the tech again assured me that this should not work as configured.

I hate to look a gift horse in the mouth but I'm also reluctant to leave an unsupported configuration in place either.

Has anyone else tried this configuration? What was your experience?

[PetrM]

Hi Derek!

As far as I understand everything is going smooth after assigning gateway role to your physical Veeam server, right?

I would say that the cause of failures was automatic selection of gateway server:
the virtual proxy was selected as gateway server and backups were failed because the proxy didn't have access to the NAS.

Thanks!