Offsite replication to a DR ESXi box....

[mmonroe]

Hello,

We are installing Veeam in our datacenter on the VMware vSphere farm and SAN. We will be doing backups to a Veeam VM that is also on the SAN.

Some thoughts...

I am thinking of building a small licensed ESXi server with some large 2tb drives and a good bit of memory. I would like to locate this box offsite and do Veeam replication of the primary datacenters VM's to it each night. In a diaster, the core VM's could be started up on this box and limp along while we replicated from this ESXi box to the replacement datacenter hardware.

Basically, this small diaster recovery ESXi box would be our offisite VM repository.

How are most people do this type of replication to an offsite server like this? VPN tunnels? I am trying to think through the technical aspects of how you securely and safely get these two boxes to talk to each other. What kind of considerations need to be handled with regards to the colocation facility and the DR ESXi server?

Thoughts? Ideas?

All feedback is greatly appreciated...

Mark

[Vitaliy S.]

Hi Mark,

We have many topics on the forums covering the same questions, please have a look at those. Here are the most relevant ones:
The real world use of Veeam Replication
DR help & next version of Veeam Questions

If you have any more questions not covered in those posts, please feel free to ask.

Hope it helps! Thank you!

[Gostev]

I believe Mark looks to hear about security aspect of organizing such communication. I don't recall any existing discussions focused on this. I hope other customers can post and share their experience on this. In Veeam, we use VPN tunnel for connectivity between the two major offices. Right now, we are in the process of evaluating WAN accelerator as we are looking to improve the performance.

[Frosty]

At my last workplace, we had a VLAN (not a VPN) provided by our ISP to our DR site. Being a VLAN, it was very secure. I've experienced problems in the past with reliability of VPNs and so don't really trust them these days. A VLAN seems to me to be a more robust and elegant solution. It was only low bandwidth (about 2Mb/sec), so we never got as far as trying out VM replication. But I did install a stand-alone server down there which was a DC, plus we had a small 16GB RAM VMware host deployed (though not running) for recovery of backups in the event of a DR situation. That seemed to work well for us, as a small organisation.

[tsightler]

Not to nitpick, but, based on your point of view, a VLAN is either "very secure" or "completely insecure". A VLAN generally offers no encryption so your data is completely visible to anyone with access to the network equipment between you and your datacenter. For a provider network this might be secure, or it might not, but it's difficult to know. VLAN's are not generally considered a security construct as, not only is the data not encrypted, but VLAN tags can be quite easily forged since there's no authentication.