SureBackup - VBR Network and Production LAN

[NorthGuard]

For some reason, I am wholly unable to wrap my mind around this configuration. Here is my setup:

VBR SERVER AND STORAGE:
192.168.75.x

PRODUCTION LAN: ( where the business network/server lives )
192.168.50.x

There are no vLANs; instead, the VBR network is physically separated at the firewall and access policies are used to only allow Veeam-specific ports to pass between the 2 networks.

So given that setup, I have tried to configure SureBackup. Using the simple setup, I get an error: [192.168.50.x] Cannot detect IP address

I am guessing this is because Veeam has no idea there is a 192.168.50.x network. But I also am not sure how I make Veeam aware of that fact.

When I switch to Advanced mode on the vLab setup, I only have a single network to choose from on the Isolated Networks page - my VBR network.

Any advice or suggestions would be much appreciated

[Mildur]

Hello NorthGuard

The Veeam backup server will power on a proxy appliance. The proxy appliance machine is connected to your LAN and an isolated network. All tested VMs will only be powered on in the isolated network. They keep their original IP address from the subnet 192.168.50.x.

I am guessing this is because Veeam has no idea there is a 192.168.50.x network. But I also am not sure how I make Veeam aware of that fact.

When you start the SureBackup Job, Veeam will create a temporary route for the masquerade address on the backup server which allows us to connect to the isolated network over the proxy appliance IP address in your LAN.
To make it as easy as possible, the IP address of the virtual lab appliance should be in the same subnet as the backup server: VBR SERVER AND STORAGE. In such scenario, the SureBackup traffic will flow from from the backup server to the proxy appliance. The proxy appliance has a network interface in the isolated network. Traffic will not pass any firewall.

When I switch to Advanced mode on the vLab setup, I only have a single network to choose from on the Isolated Networks page - my VBR network.

All networks must be available when you click Add. You can add any network from your hypervisor hosts.

Any advice or suggestions would be much appreciated

In your case with two networks, you should use Advanced single-host (manual configuration).

1. Connect your proxy appliance to the VBR SERVER AND STORAGE network with an Ip address from the subnet: 192.168.75.x
2. Choose Advanced single-host (manual configuration)
3. Add your production LAN in the step "Isolated Networks" to the network mapping table. VLAN ID can be anything. It doesn't need to be configured on any switches.
4. In the step network settings add the step "Network Settings", add your isolated network and configure the IP address/Mask with the same value as the original gateway ip address of your PRODUCTION LAN. This IP address will be assigned to the proxy address in the isolated network. It doesn't affect your production LAN.
In the same step, configure a masquerade network address. The masquerade address needs to be a subnet which is not currently used in your network. We will use it for the temporary route to access the machines through the proxy appliance running in the isolated network.

If it's still not working, feel free to open a support case. The logs will tell us why it doesn't work in your environemnt,


Best,
Fabian

[NorthGuard]

Update - the other added detail is that the machine being backed up is an Agent-based backup and apparently SureBackup can't work with Agent-based backups when the Agent lives on another network?!?!?