Veeam in a Service Provider Model

[BackupDude]

Greetings,

First off, thank you for visiting this post. I am researching methods on how to modify our existing Veeam solution used to backup our VMWare environment to one that accepts and runs backup jobs for customers (in addition to continuing to backup our own environment) utilizing known best practices for security and performance. We have Veeam Cloud Provider status.

Current Veeam Solution
[*] Veeam 7.x Enterprise (upgrading to Plus)
[*] Veeam running on dedicated physical hardware
[*] EMC Data Domain used as backup repository
[*] On the same VLAN with vcenter, esxi hosts, and other dedicated hardware and VMs used to manage our VMware infrastructure
[*] 10GB backbone
[*] (2) Veeam proxies
[*] 100VMs currently in our environment

We inked a deal to provide a backup as a service (BaaS) to a client with 100VM across 4 locations with roughly 30TB of data. I am not concerned with the actual transporting of data across the WAN. I have spoken with Veeam engineers and received their blessing on the design. I am more concerned around how others segment their Veeam environment so that their customers can access(web portal, backup jobs) it but keep the repositories secure. Any thoughts or experience on the subject would be most appreciated.

Proposed Solution
[*] Creation of new DMZ VLAN with only the Veeam server and repository
[*] Customer(s) would need to establish a persistent site-to-site VPN to this VLAN (for each location)
[*] We would add the customers vCenter in Veeam
[*] Install a Veeam Proxy at each location
[*] Customer would used Veeam Enterprise Manager Portal to view jobs, kick off restores, and backups (they would be limited to their scope)
[*] Internally, I am still researching a way to provide this VLAN access to the internal network without comprising it.

[dellock6]

Hi Fabio,
this is a topic that requires a pretty long and extensive reply, so I'm going first of all to give you some hints to start.

You are talking about backups, so the target is your repositories. If you have permanent connections to your customers, you can configure the environment in order to have at your site the complete Veeam solution (console, EM, proxies, repositories), and only install proxies at your customer. In this way, you can manage and expose all the backup jobs of all your customers in your console (more on this later).
Then, you set up a backup job for every customer, with dynamic containers like vcenter itself, or resource pools or whatever, so they are free to modify their environment without you having to check if you are saving all the new VMs.
At your site, you create one or more repositories based on size and complexity of the environment, and every job saves backups in a different folder of the repository.

Since customers do not have the console at their site, and you are not going to give them access to it, you can be sure they cannot see backups of other customers.

For restores, you create different users in the enterprise manager, and assign them a "scope" as it's called in EM. The scope will limit the customer account to only see their own backups.

Seems by your name you're italian, I wrote a whitepaper for Veeam in italian about these and other topics, have a look, especially the section regarding the scope in enteprise manager:

http://www.veeam.com/it/wp-veeam-backup ... lloca.html

Luca.

[BackupDude]

Thanks Luca for your reply. I understand my post is rather complex. I have a good grasps at my objective. Just looking for any insight that might help me. BTW, thanks for the link although I'm not Italian.

[dellock6]

Oh, I tried
I hope google translate can help you get further info from the whitepaper. One day probably I will put my head down and translate it into english.

If you have any other question, please post a follow-up here

Luca.