New Veeam backup system - recommendations?

[BJG]

I've been asked to organise a replacement for our network's ancient and crumbling tape-based system.

 

We have about 20 virtual servers (mostly 2012 R2) hosted on 2019, running off a SAN showing 6TB usage. At the moment we're only backing up data, but we also want to start backing up VMs.

 

There's an existing plan to arrange for a company to install and configure Veeam with a new 8x6TB QNAP TS-1273AU-RP-8G NAS.

 

I'd be interested in any recommendations for companies to approach for a quote to help with this project, and any thoughts on how we should integrate Cloud backup, which isn't currently used but which I'm keen to introduce. (I've been looking at the suggestions in the Cloud Backup thread.) One of the concerns around that is whether the current broadband speed will be enough. I'm currently looking at 65Mb/s down, but only 20Mb/s up. I'm not sure what kind of speeds a Cloud system would need...presumably it's very efficient in only transferring what it needs in a compressed way. Any thoughts appreciated...

Edited February 4, 2022 by BJG

[TheRobins]

Hi

 

Can only recommend Veeam its great. You would really need to ensure that the QNAP is located in a different building than the servers as a minimum. If you have a fire or flood its all gone if the QNAP sits next to the servers.

 

Sounds like you are on an FTTC connection, with 6TB usage that will take a while to backup to cloud, and unless done in the holidays could effect your normal day usage. I had a similar situation a while ago and decided that we would only additionally cloud backup the SIMS and Finance software server. Saying that Veeam is very good on doing incremental backups which cut down on traffic being used. I did however do a full backup once a week on a weekend.

 

I would like to think that any consultant service on your project would look at your bandwidth and work a solution to your needs.

[psydii]

Veeam is excellent. We've recently started using immutable Backblaze B2 instead of tapes and are very happy with it. If were limited to your internet connection, I'd be tempted to restrict the B2 element to your DCs and your MIS.

 

For reference our DCs use: 2.7Gb/Day and our MIS uses: 60Gb/day (though I suspect this is to do with certain limitations we have around how the transaction logs ar managed). This would take (at least) 7 hrs and saturate your line, but you could enable throttling to maintain a workable line for other systems and processes to use and still have the job complete outside of school hours. https://helpcenter.veeam.com/docs/backup/hyperv/setting_network_traffic_throttling.html?ver=110

[CHiLL]

We've been using VEEAM since 2015 and it's been excellent. We've also used QNAP NAS devices (previous model had a motherboard failure, now currently running a TVS-1272XU-RP) and it's been one of those set it up and forget about it things.

[denzal2k4]

From experience don't rely on just an offsite NAS ours was not domain joined had seperate credentials and got encrypted with everything else, we have reinstated crumbly old tape backups, you need a reliable airgapped backup.

[CHiLL]

@denzal2k4 makes a good point. Our data storage/backup strategy is as follows:

 

Live production data on our HP MSA (with VSS enable in the virtual file servers)

VEEAM nightly backups from MSA to QNAP (with 30 day retention)

VEEAM backup copy job to NAS1 in another physical block. NAS scheduled to power on and off around the job schedule. Never on at the same time as NAS2. (2-copy retention)

VEEAM backup copy job to NAS2 in another physical block. NAS scheduled to power on and off around the job schedule. Never on at the same time as NAS1. (2-copy retention)

Bi-Monthly QNAP scheduled file copy to 12TB external HDD1, which is kept at my house

Bi-Monthly QNAP scheduled file copy to 12TB external HDD2, which is kept at my network manager's house

Periodic RClone job to Google

 

I do also have jobs for End of Term 1, End of Term 2 and End of Year, but these only backup server with staff/pupil data on them, such as file servers, SIMS, biometrics, etc.

 

- End of Term 1 & 2 are just for longer term data recover. They only keep one copy, just in case someone wants data back from six months ago, which isn't in VSS or VEEAM.

- End of Year is RCloned to Google and also a HDD, which is locked in a fire safe for data retention

[psydii]

@denzal2k4 makes a good point. Our data storage/backup strategy is as follows:

 

Live production data on our HP MSA (with VSS enable in the virtual file servers)

VEEAM nightly backups from MSA to QNAP (with 30 day retention)

VEEAM backup copy job to NAS1 in another physical block. NAS scheduled to power on and off around the job schedule. Never on at the same time as NAS2. (2-copy retention)

VEEAM backup copy job to NAS2 in another physical block. NAS scheduled to power on and off around the job schedule. Never on at the same time as NAS1. (2-copy retention)

Bi-Monthly QNAP scheduled file copy to 12TB external HDD1, which is kept at my house

Bi-Monthly QNAP scheduled file copy to 12TB external HDD2, which is kept at my network manager's house

Periodic RClone job to Google

 

I do also have jobs for End of Term 1, End of Term 2 and End of Year, but these only backup server with staff/pupil data on them, such as file servers, SIMS, biometrics, etc.

 

- End of Term 1 & 2 are just for longer term data recover. They only keep one copy, just in case someone wants data back from six months ago, which isn't in VSS or VEEAM.

- End of Year is RCloned to Google and also a HDD, which is locked in a fire safe for data retention

 

That's good and all, but is the distance between the HDD1 and HDD2 locations greater than the emp/blast radius of a typical thermonuclear warhead targeted at your area of the country?

Edited February 4, 2022 by psydii

[CHiLL]

That's good and all, but is the distance between the HDD1 and HDD2 locations greater than the emp/blast radius of a typical thermonuclear warhead targeted at your area of the country?

With the ever developing situation in Ukraine, maybe I need to reevaluate my backup strategy! So I'll buy a bunker in the highlands of Scotland.

[psydii]

Remember to take the disks with you, not just your family.

[browolf]

Our original Veeam system was setup by ApexNS. It backed up VMs to a synology NAS in a different building. Now we also have a datto 1U server that does hourly incremental backups during the day and send them to the cloud every night. It can boot up the servers on itself or in the cloud and keeps a years worth of backups

[smarties11]

Have you considered Altaro? It does block level deduplication (so the same block is never backed up twice, including across VMs) and the compression/deduplication it can achieve is astonishing. I have a 4TB data centre, and I'm only using 4.7TB on my backup NAS, that is including 90 day retention period on critical data, 60 on the rest, and then monthly archival of critical data for 1 year (I set this solution up in October so am currently at 4 months on this part)

 

A slow Internet connection shouldn't be the end of the world - Altaro on uploads new/changed blocks so once you've done your first offsite job to the cloud, future ones are much smaller.

 

Consider external SSDs in USB3 caddies for fast, air gapped backups.

 

See my thread on a backup strategy and the eventual solution here -> http://www.edugeek.net/forums/security/223075-backup-strategy.html

Edited February 4, 2022 by smarties11

[MartinT]

We use VEEAM for backing up 40 VMs running Server 2012 R2 up to Server 2019 under VMware 6.7.

 

It goes: VMs backed up to local VEEAM server, Nightly copy backup to QNAP in Junior School (across the premises), 2nd nightly copy backup to CT cloud service (with air-gap included), 3rd weekly copy backup to 12TB disk caddies kept in our cars.

 

After an attack in 2021 we're not taking any chances any more.

[MrEprise]

I find Veeam so easy to set up and use (in fact had to restore some files today - so simple) that I wonder why I had to suffer Backup Exec for so many years in my last school!

 

Hang on, no I remember. My NM's Line Manager (who oversaw our department) said it was the Industry Standard so we had to use it, even after going to a presentation/seminar one year showing how much better Veeam was over the competition. We brought all the info back from that, showed him all of it and he still wasn't convinced!

[BJG]

...just started looking at this again and trying to get my head round the licensing options. Do people generally go for perpetual or subscription...? A company we approached suggested we look at one of these two:

 

Veeam Backup Essentials Universal Subscription License

Includes Enterprise Plus Edition features. 1 Year Subscription Upfront Billing & Production (24/7) Support. Veeam Backup Essentials Universal Subscription n/a Subscription Upfront Billing New License (Qty 4)

 

Veeam Backup Essentials Standard

1 year of Basic Support is included. 2 socket pack. Veeam Backup Essentials Standard Perpetual New License (Qty 3)

 

I realise it depends on the particular hardware/VM/data requirements we have here; just trying to get a clearer idea of the alternatives at the mo. (Around 20 virtual servers running on a couple of hosts, each Intel Xeon Gold 5218 @ 2.3GHz with 2 processors.)

Edited April 11, 2022 by BJG

[CHiLL]

...just started looking at this again and trying to get my head around the licensing options. Do people generally go for perpetual or subscription...? A company we approached suggested we look at one of these two options:

 

Veeam Backup Essentials Universal Subscription License

Includes Enterprise Plus Edition features. 1 Year Subscription Upfront Billing & Production (24/7) Support. Veeam

Backup Essentials Universal Subscription n/a Subscription Upfront Billing New License

(Qty 4, cheaper option)

 

 

Veeam Backup Essentials Standard

1 year of Basic Support is included. 2 socket pack. Veeam Backup Essentials Standard Perpetual New License

(Qty 3, more xpensive option)

 

I realise it depends on the particular hardware and requirements we have here, which I rough summarised in the first post; just trying to get a clearer idea of the alternatives at the mo.

We originally bought a perpetual license with maintenance support in 2015 and had it until 2018, where we didn't renew the maintenance. With the vulnerabilities discovered in VEEAM earlier this year, we decided to try and renew the maintenance agreement, so we can update to v11 (was on 9.5). We had three options; the new VUL subscription model, renew our old traditional perpetual license, or purchase a new traditional perpetual license.

 

While the VUL was cheaper, we decided to to go down the perpetual route again, with the the plan of not renewing the maintenance after next year and keeping it on v11 for the next few years. Our main issue with the VUL was that VEEAM is completely unusable if you don't renew the VUL, whereas the perpetual is. With the perpetual license, it was actually cheaper to buy a new perpetual license than the renew the existing license, because they were trying to backdate support during the years we didn't have an active maintenance agreement, on top of the cost of the renewed license.

[slugshead]

It's so simple to setup, do it yourself, but get two NAS units instead of the one.

 

Primary close to servers on fast link and secondary target in another building Follow the veeam wizard and it just works

[Steve21]

...just started looking at this again and trying to get my head round the licensing options. Do people generally go for perpetual or subscription...? A company we approached suggested we look at one of these two:

 

Veeam Backup Essentials Universal Subscription License

Includes Enterprise Plus Edition features. 1 Year Subscription Upfront Billing & Production (24/7) Support. Veeam Backup Essentials Universal Subscription n/a Subscription Upfront Billing New License (Qty 4)

 

Veeam Backup Essentials Standard

1 year of Basic Support is included. 2 socket pack. Veeam Backup Essentials Standard Perpetual New License (Qty 3)

 

I realise it depends on the particular hardware/VM/data requirements we have here; just trying to get a clearer idea of the alternatives at the mo. (Around 20 virtual servers running on a couple of hosts, each Intel Xeon Gold 5218 @ 2.3GHz with 2 processors.)

 

I’d say they have the licensing wrong for you for a start

 

VUL are per VM so if you only have 4 it would only cover 4 VMs

 

Compared to 6 sockets on the 2nd option

 

But personally always go for sockets, they’re much better value normally, so much so that Veeam are stopping selling new socket licenses on July 1st and only supply VUL (both are supported still just not new sales). And if you suddenly want to add 10 more VMs you’re fully licensed compared to paying for more VULs

 

Steve

[CHiLL]

I’d say they have the licensing wrong for you for a start

 

VUL are per VM so if you only have 4 it would only cover 4 VMs

 

Compared to 6 sockets on the 2nd option

 

But personally always go for sockets, they’re much better value normally, so much so that Veeam are stopping selling new socket licenses on July 1st and only supply VUL (both are supported still just not new sales). And if you suddenly want to add 10 more VMs you’re fully licensed compared to paying for more VULs

 

Steve

I think 1 VUL license covers 5 workloads (5 VMs, or 4 VMs and a physical server, etc). So if you have 17 VMs, you need to buy 4 VUL licenses.

 

I didn't know the rest of that, which is more reason to buy a perpetual license while you can.

[Steve21]

I think 1 VUL license covers 5 workloads (5 VMs, or 4 VMs and a physical server, etc). So if you have 17 VMs, you need to buy 4 VUL licenses.

 

I didn't know the rest of that, which is more reason to buy a perpetual license while you can.

 

They’re sold in increments of 5 but it’s one item covered, they have a nice calculator to check https://www.veeam.com/pricing-calculator

 

 

The number of licenses generally needed equates to the number of workloads you are looking to protect. Most workloads require just one license instance. An exception is when you’re protecting workstations or endpoints, where one license will protect three workstations. One VUL license will also protect 500GB of NAS file capacity, or two licenses per TB. The best way to see how many licenses you need is with our license configurator. Select the product, enter your workloads and your term of your choice.

 

Steve

[nicholab]

Does anyone drop network connections to their nas during the day? Or rotate NAS networks connection?

[smarties11]

Does anyone drop network connections to their nas during the day? Or rotate NAS networks connection?

 

No, we just have our backup share on the NAS set so that it can only be accessed and written to by a single account, and the only place that account is used is in the backup software (Altaro for us). So a hacker would need to extract the credentials somehow from the software itself.

 

On top of that we also keep cold backups on an SSD rotation which is rotated weekly.

 

No need for any fancy scripts to disable ports etc, you can guarantee they'll let you down when you're doing an urgent restore!