Veeam Backup and Replication + Synology (File System)

[NemanjaJanicic]

Is there any best practices when implementing these two into work?

Currently we have it setup as a SMB share folders and Veeam is sending backups to it.
I did a little bit of research and saw that people are using ISCSI and connecting Synology drive to Windows Server and using it like that. As I can see they are using ReFS File System.

What would be the best optimization when we have Veeam + Synology in our Environment.
Veeam B&R and our main Synology are located in the same location within same subnet.

After that main Backup is done we have a Backup Copy Job trough IPSec to our Branch Office where we also have Synology NAS with SMB share.


With ISCSI I saw that people are using FastClone and I’m not familiar with it at all. What is the use of it?


Any advices are welcomed

[Mildur]

Hello Nemanja

FastClone is a feature which leverages block cloning from the filesystem.
It allows us to create space less and faster synthetic full backups.

Synthetic Full backups normally copy unchanged blocks from previous restore points to create a new full backup file. With block cloning, we don't need to copy them. We just can create a reference. No additional space required, and no copying blocks around. Fast and space less. The only space required is for the changed data.

Synology can be used as a FastClone target with iSCSI and ReFS. Make sure, that your model is listed as a supported device by Microsoft:
https://learn.microsoft.com/en-us/windo ... eployments

After that main Backup is done we have a Backup Copy Job trough IPSec to our Branch Office where we also have Synology NAS with SMB share.

For such scenario, we recommend to have a gateway server in the branch office. Using a gateway server in the main office for SMB storage in the branch office may lead to performance issues with synthetic fulll backups and health checks.

My last recommendation, did you have another storage technology than Synology NAS?
I'm asking because I don't see any air-gapped or immutable backup storage in your design.
Having access to your backup server and an attacker can delete any backup. There is no protection against deletion.
I suggest to consider using Object Storage for an immutable backup copy. Or Tape, as an air-gapped backup solution. You may also copy your backups to a Veeam service provider.

Best,
Fabian

[NemanjaJanicic]

Hello Fabian,

Sorry for late reply, was not checking the forum.
We don't have anything beside Synology.
We have a smaller Synology NAS that we would like to use as air-gapped / immutable backups.
Will probably use it as Linux Hardened Repository to achieve immutable backups.

I have the plan to use Synology NAS connected via iSCSI to the Windows Server VM and then connected as backup repository to Veeam via network.
That is for the main site and for Backup Copy Job i would use the same but implement WAN Accelerators in High Bandwidth Mode.

What is the case with using Proxies, where do I need them or do I need them at all?

[Mildur]

Hi Nemanja

Proxies are used for backup jobs.
A proxy reads the data from the production environment, processes it and then sends it to the repository server.
https://helpcenter.veeam.com/docs/backu ... ml?ver=120

We have a smaller Synology NAS that we would like to use as air-gapped / immutable backups.
Will probably use it as Linux Hardened Repository to achieve immutable backups.

Please be aware of additional risk coming with such configuration. You can use the Synology with iSCSI and a Linux vm/server as a Hardened Repository. But someone can just delete the iSCSI LUN on the Synology and the backups are gone. The Synology does not check for immutable files on the filesystem.

Best,
Fabian

[BackupBytesTim]

If it's relevant, depending on your Synology model, you can run a virtual machine on your Synology NAS, which could run Linux or Windows and then remove the need for another physical server to do so. See here: https://www.synology.com/en-us/dsm/feat ... ne_manager

And here for the list of supported models: https://www.synology.com/en-us/dsm/pack ... ualization

Note the above comment about someone can still just delete the entire volume or virtual disk would still apply. But you'd be able to take advantage of block cloning and if your configuration is then secured properly could provide a security benefit as well, though I'm not sure it should be considered "hardened" since the Synology NASes do not typically have physical access, so all access is going to be remote of some sort.