Virtualized B&R server: How to store Veeam backup files

[omfk]

Hi all,

we will get both the production server and backup server as new hardware. The production server will use Hyper-V and there will be ~5 Windows-VM and ~5 Linux VM. All VMs will be rather small with one exception. The fileserver-VM will be ~10TB.
The backupserver is a seperate machine and Veeam will be located there in a VM. The question for myself ist the best option for storing the vib/vbk Files. The best practise as I understand it right now would be an additional Linux-Server and use this as hardened repository. That's definitely an upgrade for the near/mid future. For the time being I have to use the HDDs in the backup server itself.

Solution 1:
Hyper-V host with large VMDK file which hosts the Veeam VM (both the logic and the backup files)

Solution 2:
Hyper-V host with normal VMDK file which hosts the Veeam VM (only logic) and additional another share directly on the RAID on the host (Veeam VM needs then access to this share)

Which is the prefered one?

I also understood that the B&R VM shall not be part of the Domain. What about the host servers itself?

BR
Frank

[foggy]

Hi Frank, storing backups on the virtual disk is not the best practice, so option 2 is preferable here.

[HannesK]

Hello,
if only 1 and 2 are available, I would pick 1 for simplicity. There is also option 3... map a volume from the host directly into a VM (raw device mapping). That avoids the VHDX overhead and other downsides of virtual disks.

The recommendation "standalone" (actually it's "management domain", but that often does not exist) comes from the fact that customers are unable to protect their domains against attackers. If you are sure that your domain will not be hacked, then it's fine to have it inside the domain. With only one server, I would keep the Hyper-V host standalone to avoid any chicken-egg issues.

I recommend checking out the 3-2-1 rule as it sounds like you store the backups on the production host / storage.

Best regards,
Hannes

[omfk]

Hi Hannes,

is there a longer description for option 3? And maybe even the difference to option 1?

Of course I'm not sure that our domain will not be hacked:-( Not because I consider it unsafe but threats are everywhere.

Regarding the last comment: Production server and Backup server are two different machines.

@foggy: Thanks for the adivce against option2. I understand the issues.

BR
Frank

[HannesK]

Hello,
sorry, it's called passthrough disk in Hyper-V (Google gives me many how-to descriptions)

The difference is, that with passthrough disks, the file system is managed by the backup server. So only one file system can break. By using a virtual disk, there is the host file system plus the guest file system. So two file systems can break. Remember to use REFS

Best regards,
Hannes

[futureweb]

So to be sure, you recommend using Passthrough as Repository?
In other posts I read go for the vhdx, as with migration, you dont use block cloning and is less an hazzle.

But I got what you mean with the 2 file systems that could break.

[HannesK]

Hello,

you recommend using Passthrough as Repository?

No, not really I recommend a physical server as repository, because that removes all potential infrastructure / security issues at hypervisor level.

In the end, you have to decide on your own, which way you want to go

Best regards,
Hannes