Help using the vCenter API for backups and restore

[AOIHiofeoisdeoi]

I've learned today that Veeam should not be reading or writing directly to the LUN that ESXi is using.
We had a major outage because a LUN became inaccessible when ESXI/Veeam together apparently got in the way.

I did some research and found out that you should be backing up and/or restoring backups through vCenter APIs, or the Veeam agent on an installed VM.

I think vCenter APIs should be the more valid option.. I'm using 3x ESXI Host version 6.7 and a shared storage (SAN) connected to it.

Is there any novice friendly documentation on how I reconfigure veeam, so it doesnt directly use the LUN and instead uses the vCenter API?

Thanks for any help!!

[HannesK]

Hello,
and welcome to the forums.

Veeam is only using VMware APIs. Accessing LUNs directly would not make any sense for any backup software, because VMFS is a VMware file system, that only VMware can read / write to.

and a shared storage (SAN) connected to it.

How does your backup infrastructure look like? A physical backup server that has access to the SAN via fibre channel / iSCSI? If yes, did somebody on the backup server take the offline LUNs online (in Windows disk management) and destroyed VMFS by doing that? That's outside Veeam. That's Windows. Veeam deactivates auto mounting of other volumes, but if an administrator mounts it (bring online) manually, we cannot do anything against that.

I always recommend to start with the quick start guide

Transport modes can be limited in the proxy settings. Network mode or Virtual Appliance (only for VMs) would be the alternative.

Additionally, zoning / masking must be removed, because a Windows admin can always access the VMFS volumes directly.

Best regards,
Hannes

[Andreas Neufert]

If you have added vCenter to Veeam then we use the vCenter APIs of cause. Backups can NOT be transported through vcenter.
There are many backup methods available. All of them use to some extent the VMware VDDK kit that all backup vendors have to integrate into their products. Depending on the backup method selected or automatically chosen the backup is read then. See Hannes comments and links.

[AOIHiofeoisdeoi]

Hello,
and welcome to the forums.

Veeam is only using VMware APIs. Accessing LUNs directly would not make any sense for any backup software, because VMFS is a VMware file system, that only VMware can read / write to.


How does your backup infrastructure look like? A physical backup server that has access to the SAN via fibre channel / iSCSI? If yes, did somebody on the backup server take the offline LUNs online (in Windows disk management) and destroyed VMFS by doing that? That's outside Veeam. That's Windows. Veeam deactivates auto mounting of other volumes, but if an administrator mounts it (bring online) manually, we cannot do anything against that.

I always recommend to start with the quick start guide

Transport modes can be limited in the proxy settings. Network mode or Virtual Appliance (only for VMs) would be the alternative.

Additionally, zoning / masking must be removed, because a Windows admin can always access the VMFS volumes directly.

Best regards,
Hannes

I found out today that the SAN is directly connected to Veeam via Veeam's "Direct SAN mode".

But I think the motto that there should not be two systems that have write access to a LUN is still valid.

I didn't find anything in the documentation - does the Veeam Direct SAN mode need read-only access?

Is it even possible to write recoveries to a LUN via Direct SAN mode or is that probably already done via vCenter as proxy?

And the outage was at midnight, no chance it was a human error.
Access is via iSCSI.


(Yup I'm a noob in veeam but I need to get this running without any outages in the future)

[Andreas Neufert]

Please read through this one:
https://helpcenter.veeam.com/docs/backu ... ml?ver=110

Direct SAN works very stable at many customer environments. The only thing you can not do is to enable the volume in the windows storage manager as it would mean that windows signature is written and you can not access it from VMware anymore (open a VMware support ticket for this). The access to the VMFS volume from the Veeam Proxy is performed by a piece of software that backup vendors integrate with called VDDK kit. It coordinates with the vcenter the read access (backup) and if write access (restore). The write access is not that fast as it will ask the vcenter to reserve a specific block for restore access then write it and ask for the next one.

[Andreas Neufert]

Please check as well the best practices for DirectSAN:
https://bp.veeam.com/vbr/3_Build_struct ... ical-proxy