Veeam Hardened Repository 13 Manual Offline Update

[mark.tagle]

Hi Veeam R&D Team,

I would like to request a feature for manual offline updates for the Veeam Hardened Repository.

Our client infrastructures operate in restricted environments with no internet connectivity. I recently attempted an offline upgrade using VeeamInfrastructureAppliance_13.0.1.2067_20260310.iso and boot it to VHR Server from version 13.0.1.106 to 13.0.1.2067, but encountered errors during the process see below.

I hope the development team will consider a streamlined offline update path to simplify maintenance for high-security environments that cannot provide internet access to Hardened Repository servers.

Code: Select all

[DiskLayout.HardenedRepoUpgradeLayoutGenerator] [ERROR] - Could not find system device with LV 'root'
[DiskLayout.DiskLayoutGeneral] [ERROR] - Error: Could not find system device with LV 'root'

tail: '/tmp/program.log' has appeared: following new file
00:53:23,558 INF program: Running... ipmitool event file /tmp/tmp6gb0cm48
00:53:24,189 INF program: 0 | Pre-Init | 0000000000 | OS Boot | Installation started | Asserted
00:53:24,190 DBG program: Return code: 0
00:53:26,533 INF program: Running... losetup --list
00:53:26,599 INF program: Running... /sbin/auditd
00:53:26,616 DBG program: Return code: 0
00:53:26,619 INF program: Running... dbus-daemon --print-address --syslog --config-file=/usr/share/anaconda/dbus/anaconda-bus.conf
00:53:33,058 INF program: Running... /usr/bin/bash /tmp/ks-script-tksp_j9_9
00:53:34,084 INF program: Initializing machine ID from D-Bus machine ID.
00:53:34,084 INF program: /run/install/repo/scripts/
00:53:34,085 INF program: Warning: Unable to open /dev/sr0 read-write (Read-only file system). /dev/sr0 has been opened read-only.
00:53:34,085 INF program: PV /dev/sdb1  VG datavol    lvm2 [109.14 TiB / 0    free]
00:53:34,085 INF program: PV /dev/sda4  VG systemvol  lvm2 [<739.68 GiB / 0    free]
00:53:34,085 INF program: Total: 2 [109.86 TiB] / in use: 2 [109.86 TiB] / in no VG: 0 [0   ]
00:53:34,086 INF program: Found volume group "datavol" using metadata type lvm2
00:53:34,086 INF program: Found volume group "systemvol" using metadata type lvm2
00:53:34,086 INF program: ACTIVE            '/dev/datavol/veeamrepo' [109.14 TiB] inherit
00:53:34,086 INF program: ACTIVE            '/dev/systemvol/veeamdata' [<486.68 GiB] inherit
00:53:34,086 INF program: ACTIVE            '/dev/systemvol/audit' [10.00 GiB] inherit
00:53:34,086 INF program: ACTIVE            '/dev/systemvol/varlog' [100.00 GiB] inherit
00:53:34,087 INF program: ACTIVE            '/dev/systemvol/tmp' [20.00 GiB] inherit
00:53:34,087 INF program: ACTIVE            '/dev/systemvol/vartmp' [3.00 GiB] inherit
00:53:34,087 INF program: ACTIVE            '/dev/systemvol/var' [50.00 GiB] inherit
00:53:34,087 INF program: ACTIVE            '/dev/systemvol/home' [20.00 GiB] inherit
00:53:34,087 INF program: ACTIVE            '/dev/systemvol/system' [50.00 GiB] inherit
00:53:34,087 INF program: 1 logical volume(s) in volume group "datavol" now active
00:53:34,087 INF program: 8 logical volume(s) in volume group "systemvol" now active
00:53:34,088 INF program: [2026-03-25 00:53:34,039] [DiskLayout.HardenedRepoUpgradeLayoutGenerator] [ERROR] - Could not find system device with LV 'root'
00:53:34,088 INF program: [2026-03-25 00:53:34,039] [DiskLayout.DiskLayoutGeneral] [ERROR] - Error: Could not find system device with LV 'root'
00:53:34,088 INF program: [2026-03-25 00:53:34,039] [DiskLayout.DiskLayoutGeneral] [WARNING] - Logs are stored in /tmp
00:53:34,088 INF program: /
00:53:34,088 DBG program: Return code: 0
00:53:34,181 INF program: Running... ipmitool event file /tmp/tmptbdech9k
00:53:34,294 INF program: 0 | Pre-Init | 1000000000 | OS Boot | Installation aborted | Asserted
00:53:34,295 DBG program: Return code: 0

[Mildur]

Hi mrktgle,

The ISOs can only be used for new deployments or repair scenarios, not for an in-place upgrade.

Code: Select all

I hope the development team will consider a streamlined offline update path to simplify maintenance for high-security environments that cannot provide internet access to Hardened Repository servers.

We do have an option today. You can configure a local mirror of repository.veeam.com/vsa within your network, then configure your Infrastructure Appliance to use that mirrored repository instead of accessing the original one over the internet.

One of our partners and Veeam Vanguard, @petesteven, wrote a great How To guide in our Community Hub.

Best,
Fabian

[mark.tagle]

Hi Mildur,

Thank you for the clarification regarding the ISO limitations for in-place upgrades.

While the local mirror of repository.veeam.com/vsa is a viable workaround, maintaining a mirror server still adds significant overhead in high-security, air-gapped, or port-restricted environments. In these scenarios, the ability to upload a single, verified patch bundle directly via the Web UI (Port 10443) would be a game-changer.

It would eliminate the need for:

Complex internal routing to a local mirror.

Maintaining additional infrastructure just for repository updates.

Troubleshooting sync issues between the mirror and the source.

I'll definitely look into the guide by @petesteven for the local mirror setup, but I would like to double down on the request for a streamlined offline update path. Having a "manual upload" option for patches within the Infrastructure Appliance UI would simplify compliance and maintenance for security-conscious administrators significantly.

[bcampbell]

I want to second this "offline" bundle option. We are a completely air gapped environment. I'm trying to move our environment to the VSA and I cannot for the life of me keep up or figure out how I'm going to keep all these things updated with a mirror repository. Let alone the compliance I have to follow to make it all work.

[pesos]

I'm confused - if the iso cannot be used for an in-place upgrade, what is the upgrade option when you boot from the iso for?

Recently updated our win b&r server to latest 13.1 build and as it updated all our infrastructure, I noticed that for the HR it said that an OS update was needed, so I assumed that's what this option does. How do we update the OS?

Thank you.

[Mildur]

Hi John,

The upgrade option lets you upgrade a hardened repository deployed using Veeam Hardened Repository ISO v2 to Veeam Infrastructure Appliance. Please see the procedure in the Veeam Help Center.

Offline bundles are being considered for a future release. But currently, a connection to the Veeam update servers is required. If the appliances cannot access the internet directly, you can configure a mirrored repository (Help Center) as a workaround.

Best,
Fabian

[pesos]

Thanks Fabian! How do we trigger an online OS update of a VIA-based HR (we don't require offline)?

[Mildur]

Hi John,

The operating system should have been upgraded automatically from Rocky Linux 9.2 to Rocky Linux 9.6 during the upgrade from Veeam Backup & Replication 13.0 to 13.1.

If not, first check whether any infrastructure components are awaiting an upgrade. Then check for pending updates in Veeam Updater.

If the operating system remains on Rocky Linux 9.2, I recommend opening a support case.

Best,
Fabian