What is the best way of protecting the Veeam Backup server?

[foggy]

This approach can also be used.

[ajped]

Hello,
In our infraestructure, all the Veeam roles are installed in the same computer.
I'm trying to secure the Veeam infrastructure.
Can I disable shared folders access to my Veeam Backup Server without problem?
Should I disjoin the server from the AD domain? If I would separate the Veeam Backup server from the domain, could I take backups and make restores from Exchange DAG or SQL Server without any problem or any extra requeriment?

Is there an official or best practices guide to secure a Veeam infraestructure?

Thank you!!!

[wishr]

Hi Antonio,

I'm moving your post to an existing thread that contains all the information. Please take a look.

Thanks

[acepero]

Good afternoon, I would like to know, if following good practices, it is necessary to make a backup of Veeam, and if so, what steps to follow:
Normal backup
Replica
Frequency of work
You can have more Backup jobs within the Job

Thanks in advance.

[Natalia Lupacheva]

Hi Alberto,

I have moved your post to an existing thread. You can take a look at all discussions about backup of Veeam VM itself.
I believe Configuration backup is what you are looking for.
Please refer to this description to get detailed recommendations for the newest versions.

Thanks!

[mporliod]

HI, does it make sense to back up the veeam server (if it's a virtual machine) and the proxies?
Is it technically possible?

[rennerstefan]

Hi massimiliano,

as for the Proxies it usually does not make sense as they don’t hold any data but only transfers it.
For the veeam backup server it depends on the load and the amount of processes you run but there are plenty of customers that backup the vbr vm itself or even replicate it.
It all depends on your availability needs for the vbr server.
Please also have a look at the veeam configuration backup as it is also a component in the availability of the veeam server: https://helpcenter.veeam.com/docs/backu ... ml?ver=110

Thanks

[rmuniz]

Hi guys,

Got a question and looking for a little guidance. We're a small company and we use Veeam for our backups and recovery. No problems there.

What I'm wanting to do is this. I'd like to replicate our Veeam server which is virtualized to another host. Setting up the replication isn't a big deal from within Veeam what I'm more interested in would be any issues with replicating the Veeam Server and then having it come back up. I'd set it to update once a day, and it would be turned on only if something were to happen to the current server. Anyone have any experience with that idea, know any pitfalls, and etc?

[HannesK]

Hello,
and welcome to the forums.

Yes, that idea is a recommended design. If you run the SQL database on the VBR server, then it's recommended to have a second VBR server that only does the replication of the production VBR server to avoid potential chicken-egg issues if the SQL database gets frozen during replication.

After failover, you need to rescan everything.

Best regards,
Hannes

[foggy]

Also please review other hints on protecting the Veeam B&R server, among which configuration backup is the most straightforward and recommended one. Thanks!

[L33T]

Hi,

Just working out if it`s possible to protect the Veeam backup server in some way when failing over to a replica cluster if the original datacentre is gone for good how do you orchestrate the failback if the original datacentre is rebuilt and the original Veeam backup server is lost? Can you run a reserve / secondary backup server at the DR end containing all the necessary information to trigger the failback or is it not possible in the scenario of a rebuilt site?

Just planning out the worse case scenario and how quickly I can get the cluster back to the original location if failed over. I have a pair of Nimble SANs (at each end) but I don`t think i can use any synchronous rep with Veeam and Hyper-V?

Sorry it might be a dumb question...

Cheers,

[HannesK]

Hello,
I added your question to the existing thread. For the backup server itself, there should be inspiration / pros & cons in this thread.

With any synchronous storage mirror, you only need to ensure that the storage failover works. From an application standpoint, everything looks the same (at least that's the design goal of geo-redundant storage). If I remember correctly, Nimble calls it "peer persistence". So if one box fails, then all VMs stay online with only a few seconds "stun" for the controller / storage failover (as long as the Hyper-V hosts still exist). But that's outside of Veeam.

Best regards,
Hannes

[L33T]

Hi,

I think that is applicable only to vmware NOT hyper-v unfortunately.

I`ll have a dig through the thread, lots of good ideas, thanks.

Cheers,

[HannesK]

backup from storage snapshots and snapshot integration are VMware-only feature, yes. But the general concept of peer persistence also works with Hyper-V according to the HPE paper.

[brock]

EDIT MOD: split from veeam-backup-replication-f2/immutable-b ... 76960.html

HannesK, I have come across an issue with doing a VM Replica of the B&R Server. Backup jobs from that server are no longer able to "Hotadd", and instead fail over to "network mode". This has an EXTREME impact on the time to complete a backup. This article references the issue and recommends to either stop replicating the B&R server or to replicate it to a standalone ESXi host outside of your vCenter environment:

https://www.veeam.com/kb2159?ad=in-text-link

This is definitely a major caveat to Replicating the B&R server. Any thoughts on the best way to get around this?

[HannesK]

Hello Brock,
please ask different topics in separate forum threads (or add them to existing threads like this one).

Yes, backing up the backup server by itself is a bad idea. It was not even supported in some versions. Now it's only "not recommended". Please see my answer above on that

Best regards,
Hannes

[mporliod]

Hello I have a question, I have a host with disks on board with my production VMs and the Veeam server inside.
The machines on this host are replicated to a second host with its own disks on board.
If I have a fault on the production host where the veeam server is also located, how do I manage the failover and failback?


thank !

[foggy]

Hi Massimiliano, please see above - you can import Veeam B&R configuration backup into a fresh Veeam B&R installation and start failover there.

[veremin]

Also, you can simply power on replica machines, using vSphere client.

However, we specifically recommend running backup server in DR site to avoid similar cases (when backup server becomes unavailable at the time of DR). If something happens with production environment, you will be able to execute required procedures (failover, failback) from remote site smoothly.

Thanks!

[mporliod]

but if i turn on the machines directly on the second site via vsphere client, when i restore the primary site i can do the failback via the veeam console? brings me to the primary site the data that has been changed?

[foggy]

No, failback isn't possible in the case of manual start via vSphere Client. You would have to replicate VMs back mapping them to the original ones.

[mporliod]

if I had Veeam Backup Enterprise Manager even the absence of the veeam server is he able to manage failover or failback?

[foggy]

No, as it still communicates with the backup server for management operations.

[hoon0715]

Hello, all.

I inevitably installed the Veeam server together on the operating server. (Because of Windows license)
This server is less critical, but that doesn't mean it doesn't need a backup.

So I ended up having to back up the Veeam server itself.
Is there a chance of problems with Veeam B&R and running services during a backup?

Thanks in advance for your answer!

Best regards.

[HannesK]

Hello,
I merged your question into one of the existing threads.

Yes, you can (not recommended), but the problems with the services you mentioned can happen, yes.

Best regards,
Hannes

[real_tarantoga]

Hello world !
Following the recommendations for securing the backup server, I uninstall veeam explorers and management console after actualization.
But so many components have been added over the years that I'm no longer sure which explorers, plug-ins or other components can and should be removed.

Is there an update on this list?
https://bp.veeam.com/security/Design-an ... ction.html

Thank You!
Stefan

[ziceman]

For an SMB with a VMWare Essentials setup running on DELL RX740xd servers, we had setup VB&R on a separate, bare-metal, Business Grade DELL Win10 Workstation with a dual Raid Mirror data partition. Veeam is running on the primary SSD. The VM backups are stored on the RAID1 array along with the Veeam config. The data array is copied to an external HD and also stored online with Backblaze.

We have several of these workstations on hand to switch out if necessary.

I was thinking we could create two Veeam Srv workstations on-prem that replicate each other for additional protection and resiliency. Based on this long thread, I am seeing that this is not very hard to do. It seems the Veeam config backup can be used to restore the primary at anytime, but I would like to have the process auto / daily. If the Veeam primary is restored, how would the VM backup files be copied over?

I realize this is a poor man's implementation, but we are looking as small organizations with limited funds and infrastructure. Looking for workable arrangement that would provide a reasonable expectation being of protected.