Copy Job Offsite

[jamerson]

Hi guys,
i hope someone can advies how to configure this. we have a customer with 10TB data which is backing up everyday ( twice a day).
we want to run a copy job daily after the daily backup to a office 2 storage ( Server 2022 shared Folder ).
because of the speed between the Office 1 and Office 2 want not kill the bandwish between the offices.
both offices are connected with VPN over 200/200MB fiber.
on the job i has choose the next :
Job = Periodic Copy ( Pruning ) Copy everyday.
From backup and ive choose the servers
Retention policies 2 restore points.


is this the right way of doing this?

any advies is appreciated it.

[Mildur]

A periodic copy job with a daily interval only copies 1 restore point per day. I suggest using a immediate backup copy job to copy both backups. This will make sure that the backups will be copied directly after they were created.

The retention policy should be set to the amount of restore points you want to keep in the remote office.

If the office 2 storage is a windows server 2022, I recommend to use it as a windows repository. Using it as a shared folder (SMB?) sounds wrong to me.

Ir you use it as a windows repository, you can use network traffic rules to limit the bandwidth. This allows you to not overuse the VPN for the backup copy:
https://helpcenter.veeam.com/docs/backu ... ml?ver=110

Thanks
Fabian

[jamerson]

@mildur i apprecaite your answer.
when you say "If the office 2 storage is a windows server 2022, I recommend to use it as a windows repository. Using it as a shared folder (SMB?) sounds wrong to me "
what do you mean with using the server 2022 to be used as repository on the remote site?

i have added the remote site share folder as a repository to the veeam as a Refs shared forlder.

thank you for your answer

[Mildur]

Hi Julien
You're welcome.

You can add storage from a windows server with two options as a VBR repository:
- Direct attached
- Network attached storage
https://helpcenter.veeam.com/docs/backu ... ml?ver=110

When you are talking about "to a office 2 storage ( Server 2022 shared Folder )" I assumed you have added the folder as a network attached storage repository. This will be mostly SMB in case of a windows server.

If you have the backup storage on a windows server, you should choose "direct attached storage". We will install a data mover on the windows server and write directly to the file system. This gives you more stability and better performance for backup copy jobs.
Tasks like synthentic fulls or health checks can be done within the server 2022. You can also use the network traffic rules to limit the bandwidth between the data mover on the proxy server and this repository data mover.

If you choose "network attached storage", a gateway server (the proxy or backup server) will access the shared folder per SMB protocol. Meaning that health checks and synthetic full backups will be processed by the gateway server in your primary location. The amount of data from an entire full backup has to be transferred to the gateway server each time while synthentic fulls or health checks are running.

Thanks
Fabian

[jamerson]

Hi Fabian thank you for your answer.
I have added the Repository as Network attached storage ( SMB).
if i understand it correctly even the server is remote i can chose the option "Direct attached storage ' which will works faster than each times to use the proxy ?

[Mildur]

Yes. You should choose direct attached storage then.
The data mover on the proxy (for backup jobs) or data mover on the repository server (for backup copy jobs) will transfer only incremental data to the data mover on the remote server.
This will optimize the processing of your jobs to the remote location.

Thanks
Fabian

[jamerson]

Thank you so much Fabian,
Can i do this also if we have a Synology storage external ?
i appreciate your answers.

[Mildur]

Can you explain the design on the remote site?
I understand that you have a Synology and a windows server 2022.
How is the Synology connected to the windows server?

Thanks
Fabian

[jamerson]

Hi Fabian,

sorry for the confusion.
we have site 1 and site 2 and site 3
those sites are connecting with each others using VPN. site 1 /2 /3 works remotely on the site 1 servers.
on site 1 server we have internal backup which works fine. nowe we have site 2 ( server 2022) and site 3 NAS ( not yet configured ).
we want to do a daily copy job ( if it the right way of doing things ) to site 2 Server 2022 shared folder.
the idea behind with site 1 works fine to site 2 we want to do a new copy job to copy to site 3 nas shared folder on NAS.

thank you

[Mildur]

Thanks for explaining. The best working design with your storage I see would be:

- Site 2: configured as „direct attached storage“
- Site 3: You will most likely see performance issues using the Synology as a „network attached storage“ without having a gateway server at this site. Only windows and linux servers can be added as „direct attached storage“. And you will not be able to use our FastClone technology.

May I ask, are this your only backup copies? Site 2 and Site 3 doesn‘t have immutable storage. Meaning an attacker can delete all your backups if he has access to the backup console. If site 1 also doesn‘t provide immutable backups, I suggest to skip site 3 and use immutable object storage for the third copy.

Best
Fabian Kessler

[jamerson]

Hi Fabian,

the VEEAM server is protected with MFA and is not a part of Domain. also its nest in a different VLAN which is protected from the production VLAN
we are going to buy V12 when its arrives for the MFA console access as well.
i think this more secure ?

[jamerson]

its been running for over 3 days to copy the job and it succecefully.
does it means each weekens will the copy job copy those 8TB over or only the incrementele job ?

[Mildur]

the VEEAM server is protected with MFA and is not a part of Domain. also its nest in a different VLAN which is protected from the production VLAN
we are going to buy V12 when its arrives for the MFA console access as well.
i think this more secure?

MFA for RDP and local console is a good protection. But it only protects your environment against outsiders.
There is always a really small chance that the attack can happen from inside your company. A rogue admin or simply an unwanted miss configuration by the backup admin. Immutability would also protect you against these threats.

its been running for over 3 days to copy the job and it successfully.
does it means each weekend will the copy job copy those 8TB over or only the incremental job?

No, default setting is to only copy changes (incremental backups). For periodic copy jobs active fulls (copy entire full) could be activated:
Read the entire restore point from source instead of synthesizing it from increments
https://helpcenter.veeam.com/docs/backu ... ml?ver=110

Best regards
Fabian

[jamerson]

Thank you Fabian.
keeping the settings default "copy changes ( incremental backups ) would do for offsite backup? copy active fulls is not really need ?

Thank you

[Mildur]

- Synthetic full backup reuses already stored blocks from previous backup files.
- Active Fulls allows you to create independent backup files.

With synthetic full backups and using FastClone (on ReFS or XFS repositories) you can save a lot of disk space. Active Full backups won't benefit from this feature.

It's a decision your company needs to make. Do you trust your backup storage to store all backup files with dependency on data blocks from previous backups or do you want to have independent full backup files. With general purpose servers (enterprise grade raid controller and direct attached disks), I would only create synthetic fulls.

Note: For your network attached repositories, we recommend creating active fulls. Or data will be transferred two times over your network when the copy job creates a synthetic full.
The gateway server needs to read all previous restore points and create a new synthetic full:
1. Copy Job copies incremental data to the second location
2. Synthetic Full:
a) Gateway Server reads all required data over network from SMB repository
b) Gateway Server build a new VBK file
c) Gateway Server stores new VBK file over network to the SMB repository

Active Full would look like:
a) Gateway Server stores new VBK file over network to the SMB repository

Best regards
Fabian