Veeam and iSCSI CHAP?

[HendersonD]

One of the suggestions to increase security in our environment is to use Mutual or Bi-directional CHAP for iSCSI traffic. We have seven ESXi 6.7 Update 1 hosts, a Nimble storage array, and Veeam for backup and replication. We do have a separate non-routable vlan for all storage traffic. For backup Veeam uses DirectSAN for source and destination. For replication Veeam uses DirectSAN on the source side but writes through the management interface (network mode) on the destination side.

If we do setup CHAP for our hosts and our storage, how does Veeam fit into the picture? I am assuming Veeam would need to use CHAP as well to talk to our Nimble storage arrays

[HannesK]

Hello,
how you implement storage access is independent from Veeam. Just make sure the LUNs are available (offline) in Windows disk management like today.

If it does not work right after the changes, please do a rescan on the Windows machine running the proxy (in backup infrastructure -> managed servers -> windows)

Best regards,
Hannes

[HendersonD]

Backup via storage snapshots is not supported using Veeam. Since we have a separate non-routable vlan for storage and we like Nimble integration with Veeam, we have decided against using CHAP

[HannesK]

ah okay - I understood your post that you are using DirectSAN mode without storage snapshots.