Direct SAN Access and VNX5300

[vgeek]

Hi,

Our Veeam backup/proxy server connects to our VNX5300 via fiber. I am trying to figure out how to correctly present the LUNs to the backup server.

I did a test and presented a LUN to the backup server. The LUN is one of the data stores containing 3 VMs. The one thing that got me a bit concern and the reason to open this ticket, it’s the warning I received from the VNX when I try to add the LUN to the Storage Group where the backup server resides.
This was the message: “Adding a LUN to multiple storage groups is not a recommended configuration because this will allow multiple hosts to have simultaneous access to the LUN.”
I already have the LUNs assigned to an ESX Hosts SG.

EMC told me that I should not present the LUN to two different hosts unless they are on a cluster. However, on my test adding the LUN to the backup server storage group without initializing it and assigning letter to it, Veeam was able to see the LUN and back it up via Direct SAN Access mode.

EMC want me to engage professional service to assist me with this.

I know that if the LUNs are not initialized and if they don't have a letter assigned to them on Windows, the OS will not be able to write to them. I mentioned this to EMC and they said that I am right about that, but if something happens and they get initialized then both hosts could write to the LUN possibly causing data corruption.

Am I presenting the LUNs correctly? What are you doing to prevent multiple hosts from writing to a LUN other than being careful when accessing the disk manager?

EDIT:

I am trying to get people's recommendation on how they present a LUN to multiple hosts without causing data corruption. On my test, the LUN is assigned to a storage group where only the ESX cluster connects. I then assigned the same LUN to a storage group I created for the Veeam backup/proxy server. After doing this Veeam was able to find the LUN and use direct SAN access to backup.

Is this the proper way to accomplish this? Am I supposed to do something on the Windows server to prevent it from initializing the LUN and prevent it from assigning a letter to it?

[dellock6]

Hi Josue,
usually the best way to present LUNs to Veeam proxy is to place the read-only flag to the LUN itself. Since VDDK libraries cannot write back data to lun during restore, is considered a safe configuration. Sadly, not all storage arrays have the possibility to configure read-only access, and some of them only offer write access, or no access at all. If I remember correctly, VNX does not have read-only option.

Another possibility, is to configure read-only access into the FC fabric during zoning operations, I'm sure for example Cisco Directors can do it, but I'm almost sure also Brocade FC switches have those capabilities.

Anyway, even if the lun is writable, Veeam disables the automount feature of Windows when is installed, so the only real way of initializing the lun is an administrator going into the disk manager and accepting to initialize the new disks on purpose.

Finally, a note on EMC statements: even if those are "their" best practices, does not mean you can do in a different way if you need to, unless they claim the can avoid support assistance if you do that configuration. Could it be a good compromise to simply add the Veeam server to the ESXi SG? At the end, it's going to access those same luns...

Luca.

[SunriseFarms]

Hi Josue and Luca,
I cam across this post, and you are describing a setup very similar to what I am trying to achieve.
At the moment, I have the VNX5300 connected via fibre channel to a Cisco UCS blade chassis. My backup server is a stand-alone server, currently just utilizing 1G ethernet (4, bonded) to connect to vCenter to do backups. Obviously this causes a lot of network traffic, and is not particularly fast. Ideally I would like to back up direct from the SAN over FC.
So ... Would you be able to detail exactly how you got this set up and working? I will, of course, have to buy some FC cards for the backup server, but beyond that, I'm not sure. My VNX is licensed for block access at the moment - I assume that's all the licensing that I need? What about snapshot licensing, etc?
Any help would be greatly appreciated!
Tony

[vgeek]

Hi Tony,

Although I'm not sure the way I did it follows EMC/VMware/Veeam best practices, I was able to get the luns to show up in Windows correctly and Veeam to access the SAN by adding my backup server to the same storage group where my ESXi hosts reside. Since Veeam disables the automount feature I'm just careful not to initialize the luns from the disk manager. My vCenter server is a VM.
In the future I might pursuit the option of setting read-only access on the FC fabric but for now it is working fine.
I guess you can try the FC fabric read-only option once you add the FC HBA to your backup server.

Are you backing up to tape, disk, offsite replication?

[SunriseFarms]

I'm backing to disk, and replicating to a DR. vCenter is virtual, and my backup server is a physical server. So similar setup to you, I believe.
Thanks for the info!

[dellock6]

In general, when configuring DirectSAN, always think about the veeam proxy as an additional ESXi server: it needs to reach the storage array in the same way the ESXi servers do, so for FC it needs an FC card, and it should be connected and properly configured in the same fabric (zoning and masking in place).
The read-only configuration is a suggested additional configuration, but as Veeam do not uses automount, you're perfectly safe even without it.

Luca.