Help to improve our backup structure

[sergio.rey]

Hi all!, our enterprise started with a little cloud infrastructure, but it's still growing and growing and now we have more than 80 virtual machines and we need to improve our Veeam B&R resources to get the better RPO as possible.

I'll try to explain our structure: we have 3 ESXi servers, it contains the VM and a vCenter to manage it. One of this VM has a Veeam B&R installation and it runs all the Veeam roles (Console, Gateway, Proxy, etc.). This VM has assigned 6 cores and 32GB of RAM and a W.Server 2019 OS.

Our repository is a Synology NAS connected via SMB shared folder.

Can you help us understand what we have to do to get a better configuration?.

Thank you!

[Dream_On]

You could separate proxy server into a separate VM or better two VM's. Then you can lower CPU/RAM for your VBR server, as proxy servers will do all work. Youi will need to edit every job and re-point to a different proxy server.
You can also use iSCSI to connect a volume to your VBR server or a separate repository server, format is as Re-FS and then you can use synthetic full backups, done very fast. Also, repository server with iSCSI attached volume will be faster and more reliable then SMB.
Cheers,
Vlad

[Mildur]

Hi Sergio

To add to Vladimir's suggestions (thank you), do you have any immutable or air gapped storage in your backup design?
Having a second backup copy which is protected against attackers is important. For your environment it could be object storage, a physical hardened repository or a Veeam cloud connect service provider.

Please also consider to not run the backup server in a VM on the same infrastructure you are trying to protect. If the attacker gets access of your vCenter admin, he can simply delete all production VMs and then reset the backup servers admin password and delete or encrypt all your non-immutable backups.

Best,
Fabian

[sergio.rey]

Hi!,
thank you for your advices!, what is the VM-Proxies recommended ratio?, and how much resources we have to assign to it?.

"Please also consider to not run the backup server in a VM on the same infrastructure you are trying to protect. If the attacker gets access of your vCenter admin, he can simply delete all production VMs and then reset the backup servers admin password and delete or encrypt all your non-immutable backups."

We will think of it, thank you for the suggestion!

I forgot to ask another doubt, what about the repository concurrent tasks limit?, we have to limit it, we have to disable it...

have a nice day!
Sergio