Restoring stuff through guest interaction proxy

[hyvokar]

Hi!


I'm in a situation where a strict security policy limits network connections from backup server to VMs being backed up.
With your support's (and forum) help I've now set up guest interaction proxy and AAIP backup works finally fine.


However, I seem not be able to restore stuff trough that same proxy which kinda defeats the whole purpose of having that proxy in first place...

My network setup is:

VBR connects to the network where our vmware production cluster is. It also connects to network called "veeam". VMs being backed up are connected to "VM-LAN". Proxy server on VM-LAN also connects to "Backup" network. There is a router between "veeeam" and "Backup" networks, which handles all the traffic. There is a static route from VBR to GuestInterAction Proxy and vice versa.


Is there a way to use guest interaction proxy to help restotore stuff to for example AD or to Exchange?

[Andreas Neufert]

AD and Exchange objects are restored from the client. Install a B&R Client on the Guest interaction proxy.

[hyvokar]

Hi!
Is the client same thing as B&R console?

[Gostev]

Yes.

[hyvokar]

Thank you Andreas and Gostev, the restoring works perfectly now in our small scale test.

However, I'd be very happy chappy to see the restore process working straight from vbr server trough guest interaction proxy in future releases. We currently have hundreds of networks in our vmware cluster and installing consoles to every single network/customer and keeping them up to date will be highly challenging.

[hyvokar]

Hi!

While this was already working on our test environment, it for some reason does not work any more.
I can restore stuff on the proxy only, but not on the other VMs on the network. The issue started after I installed Enterprise Manager (not sure if it's related).

Logs on the proxy/consolse server says:
[21.07.2016 11:01:46] Error Failed to connect to guest agent. Errors:
[21.07.2016 11:01:46] Error 'Cannot connect to the host's administrative share. Host: [10.9.8.11]. Account: [savt\veeam].
[21.07.2016 11:01:46] Error Win32 error:The network name cannot be found.

There is no AV or Firewall on the 10.9.8.11
Any idea how to resolve this? I can try uninstalling Enterprise Manager since it cannot perform desired tasks in this scenario.

[foggy]

Make sure you're actually able to open administrative share on this guest from the console.

[hyvokar]

Hi!

Tested, and I can connect to \\savtex01\admin$

Since I have two nics on proxy VM, is it possible that it tries to use wrong nic to connect internal network?

[foggy]

Do you have preferred networks configured?

[hyvokar]

Hi!

Probably not. Where I can do that?

[veremin]

Here. Thanks.

[hyvokar]

I'm not quite sure which network should I prefer. Should I enter a different network from all our customers there? Does it matter, that VBR server probably dont know these network? I'm tying to do the restore from the console, which is in customer's network.

Or is there anyone I can disguss with my setup in more detail, to get this working?

[foggy]

You can contact support for assistance in configuration. Basically, you need to specify network that you want to be used for actual restore traffic.

[hyvokar]

I have contacted your support, and really wouldnt like to go down on that road again. What they basically told me, was to use wrong proxy during the restore process and then they told me that it's impossible to do the restore the way I want (which actually was working before).

[foggy]

If you feel the case wasn't treated properly, you can always provide your feedback to a manager, the corresponding option is available right on the support portal.

[hyvokar]

Haven't heard of support for some time, so I went ahead and removed the Enterprise Manager. Restore directly to customers network (without preferred networks) is now working again. Cannot confirm, that it's because of EM, but that's only change made in the system.

[foggy]

Have you installed EM on the backup server or guest interaction proxy?

[hyvokar]

backup server

[foggy]

Not sure how this can affect restores... Could you please check whether the machine with console installed is specified as a mount host for the corresponding repository?

[hyvokar]

No it isnt. I cannot use that server as a mount server, since mount server has to have a network connection to vcenter. I'm using backup server as a mount server.

[billcouper]

Is this still a requirement? Installing a VBR console on every guest interaction proxy just to be able to do restores? This is a great joke.
As hyvokar pointed out, this basically defeats the purpose of the guest interaction proxy, for us at least.
For a hosting provider, it is impractical to install VBR consoles inside every customer environment.

edit: on second thought, this is actually FAR WORSE than first thought.... this means that firewall ports need to be open from customer environment to our Veeam server?????? this is completely unacceptable and is totally rubbish imo... a large part of putting in a guest interaction proxy is to get the application-level restores... which now can't be done because of SECURITAH!

[hyvokar]

Hi,
yes, this was/is a major design flaw what comes to hosting services.
I resigned ~2years ago, so I'm not sure how things are handled nowadays, but back then we made a ton of scripts (two for each customer) which would open and close the ports on the windows firewall that was needed when we needed to do a restore. Major PITA.

[foggy]

Guest interaction proxy cannot be used for restores. In case you cannot have mount server in the VM network, restore can be performed over VIX.

[Gostev]

All, we're looking at enabling restores through guest interaction proxies (short-term roadmap). Thanks!

[hyvokar]

Too late for me, but probably very useful for others

[Steve-nIP]

How's this working out? This is a 100% required feature in VBR.
It seems crazy that I can run an SQL transaction log backup through the Guest Interaction Proxy, but then restore of it is impossible...

[foggy]

Hi Steve, nothing particular to share at the moment.

[Steve-nIP]

Any news on this? I'm guessing not, but it really is something that crops up all the time for us. Restoring files through an intermediate server to access a remote network. It's time-consuming to restore files to some temporary location, only to then have to copy them again. With SQL transaction logs, forget it.. I still don't get why we can back them up, but not restore them (as I posted some time ago).

Opening all the ports necessary to mount backups directly on a customer's hosted VM from our Veeam servers would be totally unacceptable (as would be necessary if we installed a VBR console on a customer VM).

[foggy]

Hi Steve, thanks for the reasoning, we do have a requirement logged for this but I cannot provide any particular ETA at the moment.

[Steve-nIP]

Is this ever going to be implemented? It's actually a really large issue, and we have a genuine business need for it.