Question about connectivity to ESXi Hosts

[BackupDude]

Greetings,

I am at the end of pilot with Veeam B&R 7.x and I need some clarification on the connectivity requirements between Veeam and ESXi hosts. Lets say Veeam is running as a VM along with a separate proxy VM in Site A with vcenter 5.5. I have Site B which is completely separate network and has its own ESXi hosts and vcenter 5.5. The two networks are connected via a site-to-site VPN connection. Veeam has been setup to communicate with Site B's vCenter. Using Veeam, I deploy a Veeam proxy on a VM running in Site B. No troubles thus far.

A single backup job has been created in Veeam to backup two VMs at Site B. Since Site B has a Veeam proxy, it attempts to hot add the drives for the VM's being backed up. Based on my research/testing, the Veeam proxy will access the vmdx files directly through the hypervisor and then push the data back to our Veeam proxy at SiteA and then the same Veeam Proxy at Site A will stream the data to the backup repository,

Questions
[*] Does Veeam need to communicate directly to the ESXi hosts at any point during the job?
[*] If the hot add fails and reverts to network mode, does the traffic still go through Site B's proxy for delivery to Site A's proxy?

Any Advice is greatly appreciated

[Vitaliy S.]

Hello Fabio,

the Veeam proxy will access the vmdx files directly through the hypervisor and then push the data back to our Veeam proxy at SiteA and then the same Veeam Proxy at Site A will stream the data to the backup repository.

Backup job should not use proxy server in Site A if it has access to proxy VM located in site B. Are you positive that your backup job uses Proxy B and Proxy A at the same time and then sends data to the repository? BTW, where is your repository located? Site A? Site B?

1. Yes, Veeam proxy server should have access to the ESXi server all the time.

2. If hotadd fails, then Veeam backup server should pick the proxy server which is located closer to your source VMs and start transferring data via network mode. If your proxy and repository are located in the same site (let's say it is site B), then the traffic will not go to site A at all.

Thank you!

[BackupDude]

Thanks Vitaliy,

The repository will be located at Site A. Site B will not have any local repository. All data will be sent across the WAN back to Site A. In addition, Site A proxies will not have access to the ESXi hosts at Site B since they reside on a separate network and vcenter.

[Vitaliy S.]

Ok, then you will not need a second backup proxy to have access to hosts in site B. Moreover, you will not need this proxy at all, as all the job will be performed by the proxy on site B.

[BackupDude]

Vitalliy,

Thanks again for your comments. I have an additional question. I am slightly confused on the transport of data over the WAN using backup proxies. According to Veeam_Backup_7_userguide_vmware.pdf on page 33 illustrates how offsite backup to a smb share would work. I apologize for not including this information in my original post. I have a data domain designated as a backup repository. This backup repository will NOT be directly accessible from Site B's network due to security reasons. My plans based on page 33 information was to deploy a backup proxy in Site A and B.

During a backup job, Site B's proxy will perform its duty and then stream the data to Site A's proxy which will have access via second network adapter to the backup repository. Can you confirm if this type of backup strategy is sound? and do you foresee any issues that might arise?

[Vitaliy S.]

Fabio,

CIFS share is a different story, you're correct.

This backup repository will NOT be directly accessible from Site B's network due to security reasons. My plans based on page 33 information was to deploy a backup proxy in Site A and B.

In this case you would need to specify your proxy on site A as a "proxying" server for this backup job. In this case data will be streamed from site B to site A and then to the repository. The only issue I foresee is possible job failures if proxy A becomes not available.

Thanks!

[BackupDude]

Wonderful. I would give you a gold star Vitaliy if one existed here. Thank you

[Vitaliy S.]

Glad that my answers were helpful, good luck with your pilot installation. If you have any other questions, let us know.

[BackupDude]

Vitaliy,

I was reviewing my previous question and still not clear on one thing. Does the Veeam server need connectivity back to the ESXi hosts or just the backup proxies at Site B? According to some of the documentation, It states the Veeam backup server needing access to TCP port 902 on the ESXi hosts. I wasnt sure if this was only required if the Veeam server itself was acting as a backup proxy. In my situation, the Veeam server will NOT act as proxy in the environment.

[Vitaliy S.]

Fabio,

Backup server should have access to ESXi hosts as well. Please check out this existing thread for additional details > Off-site Replication connections

Hope this helps!