Storeonce replication backup copy Encryption

[Hirosh]

Hi Guys,

i have few questions about Storeonce catalyst copy replication in Veeam:

1. when we are replicate backup , is there a in-flight encryption setting that we can use to encrypt data between proxies?
2.if we are using storeonce encryption at source, when we replicate backup, would it replicate the encrypted backup or it would decrypt it then sends the backup?


regards,
LB.

[haslund]

To help answer question 1) You can use the 'Encrypt network traffic' to ensure traffic between subnets is encrypted: https://helpcenter.veeam.com/docs/backu ... ml?ver=120.

[Hirosh]

Hi Haslund,

i believe this is applicable for replication over iscsi/ethernet. in our situation we are using catalyst over fc to add the catalyst store in Veeam and use catalyst copy over fc to replicate between two storeonce appliances.

regards,
LB.

[foggy]

Hi Hirosh,

1. In-flight encryption for Catalyst Copy is configured on the StoreOnce itself, requires a separate license and is totally out of Veeam B&R's control. I'm also not sure it applies to FC traffic, you better ask HPE directly.

2. Veeam B&R's Catalyst Copy-based backup copy job simply copies what is on the source repository regardless of the encryption status. If you have encrypted backups stored there (which is btw not recommended, as it severely affects the deduplication ratio - encrypted data could easily eat up to 10-15x more capacity than it would without encryption with retention long enough), the job will copy those encrypted backups to target 1:1.

3. (not asked but answered) There's no in-flight encryption between the target gateway and target StoreOnce at the moment.

Thanks!

[Hirosh]

hi foggy,


1. point noted thankyou.

2.ok this is abit concerning. Since data is deduplicated first, then encrypted, i was under the impression that we would use 10-15% more capacity rather than 10-15x . since it is mentioned if we enable encryption on the catalyst store it can not be disabled, I just want to confirm that if we enable encryption we would use 10-15 times more capacity? that seems little unrealistic, don't you think so?

3.thank you.

[foggy]

Since data is deduplicated first, then encrypted

I apologize, seems you're talking about hardware encryption on StoreOnce itself, not the Veeam B&R encryption that I was talking about. My answer was re: Veeam B&R encryption that you can enable in the regular backup or backup copy job targeting StoreOnce. In this case, the backups land on StoreOnce already encrypted - that's why it is not recommended as they can hardly be deduplicated. With StoreOnce encryption at rest, this is not the case, of course, and space consumption doesn't change that much. Hardware encryption is transparent to Veeam B&R and I believe that Catalyst Copy jobs decrypt the data prior to transfer as it is a Catalyst Store-specific setting (and target Store might have encryption disabled).

[Hirosh]

@foggy points noted ,thanks.