Feature Request / Netapp Tamperproof Snapshots

[MatzeB]

Hello everybody,

for a long time, Netapp has offered a so-called SnapLock license (WORM mode), which was not very useful for integration into backup products, since it was a classic WORM file share. This is probably the reason why SnapLock in Veeam is an unsupported Netapp feature. Since Ontap 9.12.1 there are so called Tamperproof Snapshots, which are protected against deletion. However, this still requires the SnapLock license which the wide range of customers does not have.

This will now change dramatically. Netapp is releasing Ontap One which includes the SnapLock license for ALL customers who had a Premium Bundle, and that is almost all of them. This allows the majority of customers to use Tamperproof Snapshots now.

So I would like to see support for Tamperproof Ontap Snapshots in Veeam as well.

Are there any plans to implement this?

Regards
Matze

[foggy]

Hi Matthias, we're definitely looking in the direction of storage snapshots immutability. Thanks for your feedback!

[MatzeB]

Thanks for the feedback, that sounds good. Any more details or planned release on the topic? I've been asked several times about this.

[foggy]

No, no other details we could share at this point.

[kais3n]

+1 from my side.

[andreashochstein]

+1 from my side.

[sandsturm]

+1 from my side. I'm really waiting for this to be released

[ChristophWeber]

+1 from my side

[OG1]

+1 from my side

[hnhn99]

+1 from my side

[acw.calvinwong]

Have this been supported yet?
I am trying to check if we can set the snapshot retention period directly on veeam.

https://docs.netapp.com/us-en/ontap/sna ... ing-policy

[Mildur]

Hi Calvin

No change in v12.1, but we count your request as +1.

Best,
Fabian

[erbruening]

Hi Fabian,

+10 from a VCSP Partner
We have many customers using Veeam and storing Veeam backup data on NetApp FAS Systems.
It would be a big add value and helps to protect backup data against ransomware, if Veeam could handle the usage of Tamperproof Snapshots.

Regards
Eric

[david.sole]

Hi Team,

Interested too on this featrure.

+1

Thanks,

[FrancWest]

Me too! And also support by VBR when automatic tamperproof snapshots are enabled on the storage system. See veeam-backup-replication-f2/netapp-tamp ... 92089.html

[andreas.zeiler]

Hello,

we are already using these tamperproof snapshots. Not on the primary repository (ReFS64), but we are replicating backups to a NetApp FAS cifs share, added as cifs repository.
A veeam copy job sends daily updates to this repository (the latest backups from the primary repository).
Since the "original" cifs data can be changed, no problem here in merging backup files, deleting outdated files etc. on the cifs share.
In the background, a daily snapshot of this cifs repository is taken some time after the copy job has finished. This snapshot is tamperproof protected for 7 days.

If there is a ransomware attack, it could cripple=change the data in the cifs repository (new writes), but cannot change the original blocks protected by the tamperproof snapshots. With one click, you would be able to revert to the unchanged backup files.

There is one thing that must be kept in mind: If backup data blocks are automatically deleted when the configured retention period is over, the data still covers disk space due to the latest snapshot, for (here in my example) 7 days. So you might need some more disk space in your volume.
If you are sure to detect the attack immediately, you might reduce the protection for the tamperproof snapshots to a lower number of days.

Kind Regards,
Andi

[MatzeB]

Hi Andi,
I think the majority here (like me) are talking about tamper proof snapshots on the primary datastore, NOT on the Veeam repository. And this support is unfortunately not available today.
In Veeam, file based repositories like CIFS or NFS are not optimal. If you want a high level of protection here, I recommend a Linux hardened repository with dedicated block storage.

matze