SureBackup Design Question

VMware specific discussions

SureBackup Design Question

Veeam Logoby vertices » Wed Nov 21, 2012 5:49 pm 1 person likes this post

So we have been using VBR for a while now. Getting around to setting up SureBackup.

We have 2 sites, with a tunnel between, vSphere infrastructure in both, a beefy physical server for Veeam in each. The southern site is a full VBR server, the northern is a backup proxy and repository.
Now we used to have 2 full VBR servers in order to do backups at the northern site, but pull replicas to the southern. Then Veeam came out with proxies and repositories and it was great. We rebuilt around this architecture and it’s been serving us great. The VBR in the southern site controlled all backup and replication jobs, running backups up north, and pulling replicas to the south, as well as running some backups in the south.

Now we get to SureBackup. We have this wonderful Virtual Lab. One of its interface IPs is the same as the production gateway. This obviously causes issues with routing outside its subnet. We added routes and everything manually to the routers on both sides for the masquerade subnet, but I really didn’t see how this would work at all as this would require the virtual lab to route to the production gateway, which is the exact same IP assigned to one of its interfaces.

So we call up support and sure enough, they say that your Virtual Lab must be in the same subnet as the VBR server if you want to run any tests beyond vmware tools heartbeat. This is absolutely bizarre to me. I mean Veeam puts all this effort into proxies and repositories so that we can have a distributed architecture and control it nicely from a single interface. Then they just completely bypass this in their design of SureBackup.

All Veeam has to do is build the testing agents into the proxy agent. Then the proxy agents, just as they do for backups, do the work, and send the results to the VBR server. This would solve this entire problem. Support told us that if we wanted to do what we are doing we have to go back to having 2 VBR servers which to me is ludicrous.

Does anyone have an answer as to why the ping and script checks run directly from the VBR server and not from a local proxy? I just can’t fathom why this design decision was made as it effectively negates the benefits of having proxies and repositories available.
vertices
Enthusiast
 
Posts: 33
Liked: 2 times
Joined: Tue Oct 05, 2010 3:27 pm
Full Name: Rob Miller

Re: SureBackup Design Question

Veeam Logoby habibalby » Thu Nov 22, 2012 6:40 am

habibalby
Expert
 
Posts: 350
Liked: 23 times
Joined: Mon Jul 18, 2011 9:30 am
Location: Bahrain
Full Name: Hussain Al Sayed

Re: SureBackup Design Question

Veeam Logoby vertices » Thu Nov 22, 2012 1:45 pm 1 person likes this post

Thanks but all that does is reconfirm my feelings that this was a huge oversight. The job of testing (and static routes) should have been placed on an agent. Either a separate proxy or build it into the backup proxy agent.

We are left with an inability to use SureBackup fully because we followed Veeams design of using backup proxies.

If anyone has successfully accomplished running a Virtual Lab, that the VBR server can access for ping and script tests, where the Virtual Lab resides on a different network from the VBR server I'd love to hear how you accomplished this.
vertices
Enthusiast
 
Posts: 33
Liked: 2 times
Joined: Tue Oct 05, 2010 3:27 pm
Full Name: Rob Miller

Re: SureBackup Design Question

Veeam Logoby foggy » Fri Nov 23, 2012 4:08 pm

vertices wrote:One of its interface IPs is the same as the production gateway. This obviously causes issues with routing outside its subnet.

Might be a silly question, but do you assign the production gateway IP to an internal proxy appliance interface (the one that belongs to the isolated virtual lab)? Could you please describe your network topology in more detail, providing addresses used for all the involved computers.

Also, please review this post, might be useful.
foggy
Veeam Software
 
Posts: 14752
Liked: 1083 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson

Re: SureBackup Design Question

Veeam Logoby vertices » Sun Nov 25, 2012 11:22 pm

foggy wrote:Might be a silly question, but do you assign the production gateway IP to an internal proxy appliance interface (the one that belongs to the isolated virtual lab)?


Yes I do. And we have 2 sites with SureBackup jobs in each. The site with the VBR server works fine, the other does not.

I’ve also seen the post. Support tells me directly that it won’t work as long as the VBR is in a different subnet from the VBR server. So not sure how much this is going to help but here goes:

Let’s use this:

VPN between 2 sites:

Site 1:
Production Gateway LAN IP: 10.1.1.1
Veeam 1: Physical full Veeam Server including proxy and repository 10.1.1.80
Virtual Lab at 10.1.1.82 with an interface configured as 10.1.1.1, Masquerade network 10.255.1.x



Site 2:
Production Gateway LAN IP: 10.1.6.1
Veeam 2: Physical Server acting as Veeam Proxy and Repository 10.1.6.80
vCenter at 10.1.6.81
Virtual Lab at 10.1.6.82 with an interface configured as 10.1.6.1, Masquerade network 10.255.2.x


Veeam 1 controls backup jobs in both sites, using the proxy as well as the repository that is local to the job. Veeam 1 also uses the proxy at Veeam 2 to pull replicas from Site 2 to Site 1. There are proper routes on the firewalls at each location. Each firewall has a route to 10.255.2.x pointing to 10.1.6.82.

Everything in Site 1 in regards to the SureBackup jobs running there works perfectly. This is expected as Veeam support says that the Virtual Lab must be in the same subnet as the full VBR server. SureBackup jobs in Site 2 fail on ping or script tests. Support tells us this is due to the VBR server in Site 1 not being able to reach the masquerade network in Site 2. Well we have routes so that isn’t the issue.

However look at the Virtual Lab in Site 2. It has an interface configured as 10.1.6.1 which is the same as the production gateway in Site 2. This is so VMs will still have access to the assigned gateway. So of course it can’t route traffic to Site 1 as that would require the Virtual Lab to route traffic to an IP that is the same as one of its interfaces.

This design makes sense and I can see why Support says it won’t work. What I am saying is that if the ping and script tests ran from a proxy, such as Veeam 2 in the above example, then the testing source would be in the same subnet as the Virtual Lab, thus negating this issue. The proxy on Veeam 2 would perform the testing to the Virtual Lab in Site 2, then send the results back to Veeam 1 in Site 1. Essentially the exact same design as how backup proxies work, but for testing instead.

Unless I am completely missing something here, it would seem that Support is correct, and the only real way to resolve this issue is for Veeam to introduce additional functionality to the proxy, or an additional agent altogether.
vertices
Enthusiast
 
Posts: 33
Liked: 2 times
Joined: Tue Oct 05, 2010 3:27 pm
Full Name: Rob Miller

Re: SureBackup Design Question

Veeam Logoby vertices » Tue Nov 27, 2012 5:51 pm

So in addition to all the other problems, Our VBR server in Site 1 can't ping the Virtual Lab appliance in Site 2 until we login to the Virtual Lab appliance in Site 2 and ping the VBR server in site 1. Then both can ping each other. So even if we had routing working perfectly and none of the problem's I've outlined above existed, we still have this very basic issue of jobs failing until someone manually logs into the virtual appliance and pings the Veeam server. Then they the jobs can progress. After some time, or after a reboot of the Virtual Appliance, it fails again until someone logs into it and pings the VBR server.

This is identical to the problem at the end of the thread that foggy listed. Note that that person didn't get an answer either.

viewtopic.php?f=24&t=12464&p=56333&hilit=Virtual+Lab+different+network#p56333
vertices
Enthusiast
 
Posts: 33
Liked: 2 times
Joined: Tue Oct 05, 2010 3:27 pm
Full Name: Rob Miller

Re: SureBackup Design Question

Veeam Logoby rkovhaev » Tue Nov 27, 2012 5:59 pm

Hi,
Please correct me if I got it wrong, on site1 you have VBR server with SB jobs configured to run on site1 and site2
So, in this case, on firewall on site1 you need to have 2 static routes:
10.255.1.x has to point to 10.1.1.82
10.255.2.x has to point to 10.1.6.82
and on site2 firewall must be able to route back to 10.1.1.0/24

If this is all done, then I suggest running tcpdump on VBR server and tcpdump on proxy appliance and analyzing the traffic flow.
Also please let me know your support case number.

vertices wrote:So in addition to all the other problems, Our VBR server in Site 1 can't ping the Virtual Lab appliance in Site 2 until we login to the Virtual Lab appliance in Site 2 and ping the VBR server in site 1. Then both can ping each other. So even if we had routing working perfectly and none of the problem's I've outlined above existed, we still have this very basic issue of jobs failing until someone manually logs into the virtual appliance and pings the Veeam server. Then they the jobs can progress. After some time, or after a reboot of the Virtual Appliance, it fails again until someone logs into it and pings the VBR server.

This is identical to the problem at the end of the thread that foggy listed. Note that that person didn't get an answer either.

viewtopic.php?f=24&t=12464&p=56333&hilit=Virtual+Lab+different+network#p56333


This one is recently discovered issue with appliance not sending ARP/RARP requests upon initial boot. I am working on getting a new appliance.
rkovhaev
Veeam Software
 
Posts: 33
Liked: 12 times
Joined: Mon May 17, 2010 6:49 pm
Location: hockey night in canada
Full Name: Rustam

Re: SureBackup Design Question

Veeam Logoby dood » Wed Feb 06, 2013 5:19 pm

rkovhaev wrote:
vertices wrote:So in addition to all the other problems, Our VBR server in Site 1 can't ping the Virtual Lab appliance in Site 2 until we login to the Virtual Lab appliance in Site 2 and ping the VBR server in site 1. Then both can ping each other. So even if we had routing working perfectly and none of the problem's I've outlined above existed, we still have this very basic issue of jobs failing until someone manually logs into the virtual appliance and pings the Veeam server. Then they the jobs can progress. After some time, or after a reboot of the Virtual Appliance, it fails again until someone logs into it and pings the VBR server.

This is identical to the problem at the end of the thread that foggy listed. Note that that person didn't get an answer either.

viewtopic.php?f=24&t=12464&p=56333&hilit=Virtual+Lab+different+network#p56333


This one is recently discovered issue with appliance not sending ARP/RARP requests upon initial boot. I am working on getting a new appliance.


Does anyone find a solution for this issue ?
It seems i get the same one on the VBR 6.5.
(Case #00178159)
dood
Influencer
 
Posts: 23
Liked: 4 times
Joined: Mon Aug 23, 2010 12:32 pm

Re: SureBackup Design Question

Veeam Logoby foggy » Thu Feb 07, 2013 11:08 am

Seems that our support has custom appliance build for this issue. Please continue working with them to get it and test in your environment.
foggy
Veeam Software
 
Posts: 14752
Liked: 1083 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson

Re: SureBackup Design Question

Veeam Logoby dood » Thu Feb 07, 2013 3:56 pm 2 people like this post

Yes, support gave me a customized appliance (drv-va.iso).
When the iso file replaced, don't forget to edit the existing virtual lab and apply settings to reload this iso file ;)
dood
Influencer
 
Posts: 23
Liked: 4 times
Joined: Mon Aug 23, 2010 12:32 pm

Re: SureBackup Design Question

Veeam Logoby dellock6 » Tue May 07, 2013 1:59 pm

Hi,
we hit the same exact issue at a customer today, once we login into the VLAB appliance and we run several pings, finally VLAB and Veeam server start pinging each other, and the surebackup jobs completes the "starting virtual lab routing engine" step.

We already opened a ticket to eventually obtain the modified iso, but there is any chance the new iso will be integrated in a future patch of 6.5, or will it be release inside v7?

Thanks,
Luca.
Luca Dell'Oca
EMEA Cloud Architect @ Veeam Software

@dellock6
http://www.virtualtothecore.com
vExpert 2011-2012-2013-2014-2015-2016
Veeam VMCE #1
dellock6
Veeam Software
 
Posts: 5052
Liked: 1333 times
Joined: Sun Jul 26, 2009 3:39 pm
Location: Varese, Italy
Full Name: Luca Dell'Oca

Re: SureBackup Design Question

Veeam Logoby foggy » Tue May 14, 2013 1:28 pm

Good chances that it will be included in v7.
foggy
Veeam Software
 
Posts: 14752
Liked: 1083 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson

Re: SureBackup Design Question

Veeam Logoby glupano » Fri May 31, 2013 2:21 am

Man!!!!! I have been playing around with that for hours. Could not work out what was happening. I could ping the LAB VM from everything on my production network EXCEPT the VBR server. Logged into the lab linux console and pinged successfully from there then all of a sudden it starts responding from the VBR server. Weird

Thanks for that
glupano
Lurker
 
Posts: 1
Liked: never
Joined: Fri May 31, 2013 2:18 am
Full Name: Gary L

Re: SureBackup Design Question

Veeam Logoby aslastenkin » Tue Jul 23, 2013 7:06 am

dood wrote:Yes, support gave me a customized appliance (drv-va.iso).
When the iso file replaced, don't forget to edit the existing virtual lab and apply settings to reload this iso file ;)

The same issue! Unfortunately our support ended one month ago and we cannot open the case. Could you please provide custom ISO?
aslastenkin
Lurker
 
Posts: 2
Liked: never
Joined: Tue Jul 23, 2013 6:50 am
Full Name: Anton Slastenkin

Re: SureBackup Design Question

Veeam Logoby foggy » Tue Jul 23, 2013 9:47 am

Anton, I apologize for being obvious, but you're asking for support while your support has already expired. The proper way in your situation will be to renew your maintenance and request the custom ISO via support service. Thanks.
foggy
Veeam Software
 
Posts: 14752
Liked: 1083 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson

Next

Return to VMware vSphere



Who is online

Users browsing this forum: No registered users and 18 guests