Preventing local access to an offsite storage repository

[ivanjohnson]

Hi folks

I'm designing a backup system following the 3-2-1 model using Veeam Essentials. There will be a local storage repository for vm backups, and backup copies to a repository on a NAS at a remote site.

The additional requirement is that users (including admins) at the local site should not be able to modify or delete data at the remote site (i.e. the remote site would not be vulnerable to the source network being compromised).

Is the following a possible topology when using Backup and Replication essentials?

1. Local Site: Veeam Backup and Replication server (+ proxies as required) running simple Backup jobs to backup VMs from VMware to local storage repository on DAS. Local site has no access to the Remote site.
2. Remote Site: Remote Site has VPN access to the Local Site. An additional Veeam Backup and Replication Server at the Remote site uses a WAN accellerator pair to access storage repository at Local Site. Use Backup Copy jobs on the remote Veeam server to pull secondary backups from the storage repository on the Local Site and save them to a storage repository at the Remote Site.

i.e. Two installs of Veeam Backup and Replication Server, with one pulling Backup Copies from the other's storage repository.

Any suggestions or alternatives are much appreciated!

Thanks for your help, Ivan

[Shestakov]

Hi Ivan,
Your configuration looks great overall.

Is the following a possible topology when using Backup and Replication essentials?...
...An additional Veeam Backup and Replication Server at the Remote site uses a WAN accelerator pair to access storage repository at Local Site.

Note that WAN Acceleration is available only for Enterprise Plus license type. If you have one - it`s possible.

Besides simple denying and allowing access to the backup files you can assign different user roles.

Thank you.

[ivanjohnson]

Great - thanks for the confirmation.

Am I right in thinking that Veeam Backup Essentials includes WAN acceleration?

Cheers, Ivan

[foggy]

Ivan, keep in mind that to enable this setup you would need to rescan the repository on the remote site's Veeam B&R instance to import the backup chain, create a dummy backup job, and map it to the imported chain. Then this dummy job should be specified as the source for the backup copy job, otherwise imported backups cannot be used in the backup copy job. Automatic rescans will then import newly created restore points each 4 hours.

Also it is recommended to appropriately adjust jobs schedule/denied period to avoid file locks during their execution.

[ivanjohnson]

Thanks Foggy. I wasn't clear how the remote server would pick up the backup chains, and that makes it much clearer.

[Shestakov]

Am I right in thinking that Veeam Backup Essentials includes WAN acceleration?

There are 3 different editions of Veeam Backup Essentials and only one of them("Enterprise Plus"), includes Built-in WAN Acceleration. Please check the hyperlink.
Thanks.

[ivanjohnson]

All clear - thanks. Cheers, Ivan

[Shestakov]

You are welcome, Ivan.
Once you have a question, don`t hesitate to ask!