Integrating Proxmox Virtual Environment (PVE) and Veeam Backup & Replication (VBR) is a significant step in optimizing backup and recovery policies. This article outlines the key steps to enable the plug-in of VBR, starting with the system architecture, installing and configuring the plug-in, and adding the Proxmox server to the VBR.
Note that the instructions are based on the Beta version of the plug-in, so there may be differences in the official version.
Rereading the article written a few months ago (available on this site at the following link), I believe that those considering virtualization as a commodity will choose PVE to quickly escape the uncertainty caused by Broadcom’s business choices.
Note 1: PVE is a Debian-based Linux distribution with Ubuntu kernel that allows virtual machines and containers to be deployed and managed.
Note 2: Proxmox is a European company based in Austria.
In this first article (of three) we will look at the basic steps to enable the plug-in that allows VBR to implement backup and recovery policies.
Ask your referring Veeam SE to test the Beta version.
Architecture:
Image 1 shows the operation diagram of the integration. The Plug-in is the component that enables communication between the Veeam Backup Server (VBR) and the Proxmox architecture.
Note 3: The Proxy role (referred to here as Worker) is responsible for collecting the data from the VMs to be protected and copying it to the Backup Repository.
The Backup process involves the triggering of snapshots, and the connection between the Proxmox server and VBR is via REST API.
Picture 1
Once the plug-in is installed on the VBR server, it is necessary:
From the console of VBR under Backup Infrastructure add the Proxmox server (images 2 and 3).
picture 2
Picture 3
2. The next images (4 through 9) show the simple steps to add the architecture PVE in the console of VBR.
Picture 4
Picture 5
Picture 6
Picture 7
Note 4: It is possible to select the storage where the snapshots will be saved.
Image 8
Image 9
When finished, you can immediately deploy the worker (proxy). The advantage is to speed up the backup process (image 10).
Image 10
Note 5: For those coming from the world VMware is exactly how to enable the virtual appliance transport method.
In this last step, it is possible to configure which host to deploy the worker, which storage to use (image 11), which resources to assign (image 12), and which networks to operate on (images 13, 14, and 15 ).
Image 11
Image 12
Image 13
Image 14
Image 15
After checking that all configurations meet the desired ones (image 16), clicking finish completes the setup.
Image 16
In the next article, we will see how to configure Backup jobs.
Imagine a disaster, in which the virtual infrastructure has to be restored from scratch.
All is lost except the backup files, which are still available on at least one repository, preferably immutable, on-premises or in the cloud.
To restore the environment you have five different options that are a function of how the Veeam Backup & Replication protection and resilience architecture is designed and implemented.
Note 1: Veeam Backup & Replication will hereafter be referred to as. VBR.
Scenario A (Restoration from scratch):
You have not made an application-aware backup of the server VBR.
You have not performed application aware replication of the server VBR.
Export of server DB configuration is not available VBR.
You want to restore production workloads immediately.
In this step, just clicking “next” to complete the operation is often sufficient.
Note 3: It is recommended that you use your license file (which can be downloaded from my.veeam.com) although the Community Edition (unlicensed) is often sufficient for most restores needed at this stage.
Step 2A: Add the production virtual infrastructure where you want to restore workloads protected by VBR.
How: after completing the first step, from the console of VBR add the virtual infrastructure (Menu: “Inventory” -> “Vmware vSphere“-> “Add Server“) (Image 2).
picture 2
The following steps depend on the type of Hypervisor (VMware vSphere, Microsoft Hyper-V, Nutanix AHV, …) but are always very simple.
Step 3A (optional): Add backup proxies.
Even if we are operating at the recovery level, improving the performance by adding backup proxies is always a good idea.
Step 4A: Adding Veeam backup repositories.
The last preparatory step before starting restores is to add the repositories with the backup data.
How: from the console, select “Backup Infrastructure,” “Backup Repository,” and then “Add Repository” (image 3).
Picture 3
Step 5A: Starting the restore
How: from the console of VBR select “Home,” “Backup,” “Disk imported,” the VM you want to restore, and right-click to start the restore process (Image 4).
Picture 4
Note 4: Recovery can be instantaneous. With this mode, VMs are started directly from the backup repository. In this option, the repository serves as the data store (for VMware the DataStore) for the virtual environment.
(Instant VM recovery was invented by Veeam more than a decade ago and has since improved its performance and flexibility.)
Now your production architecture is back up and running!
Note 5: There is also a command-line Extract option for Windows and Linux platforms.
Step 2B: Start Extract, select the backup of the VBR, and once the files of the VM-VBR are copied them to your preferred VMware datastore.
Now from the vCenter register the VM you just copied.
(Image 6)
Note 6: A command-line extract option is available for Windows and Linux platforms.
Note 7: It is possible to automate and simplify copying to the VMware Datastore by publishing an NFS network share as mentioned in the following article:
Step 3D: Realize the management operations of VBR as per Step 5A.
Note 8: It is always a good idea to save the Backup server configuration.
Final Note: The advice is to strive to be able to use all the strategies described in this article so that if one is not available, a second one can be used.
In the previous article, we saw how to operate on backup jobs to obtain Fulls that can be used to create a GFS retention policy when the destination of the jobs is a tape.
In this second article, we find out how a similar result can be achieved by copying tapes.
Note1: A second tape library must be present in the DataCenter to pursue this protection process.
Note2: The most common use case for Copy-Tape is to migrate data contained on tapes from an old technology (LT06) to a new one (LTO9), since the new technology would not be able to natively read the data contained on the old tapes.
There are two steps that will enable us to achieve our goal:
Step 1: Creation of a tape pool afferent to the second library.
Step 2: Tape copy job.
Stage 1
The creation of the Media Pool (image 1), will need to be customized by setting:
The use of a new tape for each copy session (image 2).
Setting a retention that for that tape group coincides with that required by the GFS policy (image 3).
Picture 1
picture 2
Picture 3
Note3: A 4-week retention was set in Image 3, which addresses the need to keep the full weekly for 1 month.
Note4: Image 4 highlights the possibility of implementing a Vault policy for tape storage.
Picture 4
PHASE 2
From the VBR GUI by selecting the tape to be copied with the right mouse button (image 5), the copy command can be initiated.
Picture 5
The simple next steps shown by images 6,7,8 and 9 show how to complete the copying operation.
Picture 6
Picture 7
Image 8
Image 9
Latest notes:
Documentation to refer to in order to know how many resources it is essential to allocate to the various components is available at the following link.
My lab has an Ubuntu 22.04.4 LTS server on which Veeam’s Salesforce environment protection software (Veeam Backup for Salesforce) is installed.
During the monthly operation of updating the operating system, some errors appeared that did not allow me to complete the operation.
The ‘output of the “sudo apt update” command, showed three errors highlighted in image 1 with the blue, green, and redarrows.
Picture 1
1. The first, (blue arrow) indicated that the digital signature linked to the Veeam repository (“https://repository.veeam.com/apt stable/amd64/ In Release”) was no longer valid.
2. The second (green arrow) indicated that the digital signature had also expired for the Ubuntu-security site (“http://security.ubuntu.com/ubuntu bionic-security InRelease”).
3. The third error (actually a warning, red arrow), indicated that the key management methodology named“apt-key” is deprecated recommending the ‘use of a more secure method named “trusted.gpg.d”.
—
Browsing the Internet, I found the solutions that met my needs:
1. The KB2654 on the Veeam website shows how to import a new key. The only real caution is to run the command as the root user (see image 2).
picture 2
2. As shown in ‘image 3, simply request a key update by entering the required identifier at the end of the command in the output of image 1 (green arrow).
image 3
Note 1: apt-key is a comado used to manage a gpg key fob for secure apt. The keychain is stored in the file ‘/etc/apt/trusted.gpg’ (not to be confused with the related but not very interesting /etc/apt/trustdb.gpg). The command apt-key can display the keys in the keyring and add or remove keys.
3. The last line of image 4 shows the command that addresses the security warning. It involves copying the keychain (trusted.gpg) inside the trusted.gpg.d folder.
Picture 4
In the article“Handeling the apt-key deprecation” you will find all the details that illustrate the security benefits of the new approach.
Many customers and partners ask whether it is possible to implement a GFS (Grandfather – Father – Son) type of protection policy when the data to be protected pertains to a NAS (Network network-attached storage) and the destination is a tape library.
Such automation with the current version of Veeam Backup & Replication(VBR) 12.1 is not yet available, something that is already possible when the data source is a backup of VMs and Physical Servers.
In this first article, I will help you achieve that goal by taking advantage of VBR ‘s great flexibility in creating backup jobs.
Note1: In the next one I will illustrate how to make GFS copies by exploiting a little-known feature of VBR , the Tape Copy.
Flexibility of Backup Jobs:
a.VBR manages tapes using an architecture that is based on:
Media Pool(MP) are the logical containers of the tapes and can pertain to one or more Backup jobs (in our scenario we will create one MP per Job).
Media Set(MS) identifies the restore points present on the tape (in our scenario we will create one MS per Backup job per single tape).
b. The proposed solution is to create weekly, monthly, and annual backup jobs in full mode. These backups should be created on a specific date and the backups should reside on tape pools created for the purpose.
Let’s see step by step how to proceed:
c.Creation ofweekly and monthlyMedia Pools(MP).
Picture 1
From image 2 it is important to note that a new tape will be used for each backup session.
picture 2
Image 3 shows how to set the retention, which in this scenario is 4 weeks.
Picture 3
For the Monthly MP, the same procedure is used, changing the retention to 12 months (see images 4,5,6).
Picture 4
Picture 5
Image 6 shows that the retention for Full Months is 12 months.
Picture 6
d. Creating Backup Jobs
Picture 7
image 8
Image 9 highlights the scheduling of the Backup job.
The assumption is to make n full backup jobs for each GFS policy.
Our example scenario shows the first week’s job (blue arrow) with weekly retention (green arrow). For the second, third, and subsequent week, we will proceed in a completely similar way, replacing the value first with second, third, etc. under “Run the full backup automatically.”
Image 9
Image 10 highlights (orange arrow) that no incremental backups will be initiated.
image 10
The same steps must be implemented to create monthly type GFS backups, in the example I set the backup job start on the 4th Saturday of the month (image 12 – blue arrow).
Image 11
Image 12
Image 13
Note 2:
Licensing counts licenses per individual Backup job (verision 12.1).
Conduct tests to make sure the scenario matches your needs. Get help from Veeam support.
In the next article, we will see how to use the Tape Copy feature.
An article devoted to how you can delegate restores with Veeam Backup & Replication (VBR).
The case study is related to the protection of files in shared folders, but can be extended to many of the objects protected with VBR. (see image 7)
—
Image 1 shows the three shared network folders (SHARE-A, SHARE-B, SHARE-C) that are used as the source of the files to be protected.
Picture 1
In the scenario, it is assumed that for each individual shared folder, only a specific user can proceed with the recovery tasks.
Image 2 highlights the creation of three Domain users, ShareA, ShareB, ShareC.
picture 2
Files pertaining to a specific shared folder will be restorable by the user with the identical ending letter in the name. For example, files pertaining to SHARE-A will be restorable by the ShareA user.
( Editor’s note: For simplicity of exposition, the letter X will replace one of the three letters of the alphabet A-B-C)
A Backup job named “BkF-Share-X” was created for each shared folder.
Image 3 shows that the “BKF-Share-A” job (orange arrow) protects the entire SHARE-A (Blue arrow).
Picture 3
Image 4 highlights the “configuration” menu from the Enterprise Manager.
Administration credentials are required at this configuration stage.
Picture 4
From the submenu role (image 5 – orange arrow) the three previously created users (ShareX) are added (green arrow) and assigned the role of Restore Operator (blue arrow).
Picture 5
Image 6 shows the delegation options.
The ShareA user (green arrow) is assigned the ability to restore all VBR-protected objects via the “Choose” button (orange arrow); in the restore options, only in-place restoration can be allowed (blue arrow).
The next images (7-8) show how to make the choice of objects to be displayed during the restoration delegation operations.
Picture 6
image 7
Image 8
Image 9 illustrates and confirms that when logged in from the Enterprise Manager with ShareX user credentials (Blue arrow), only files in the corresponding shared folder (orange arrow) are visible and restorable.
Image 9
Final Note:
User management is configurable through AD groups.
It is possible to temporarily enable and disable file restoration to a single user or groups of users.
Licensing counts the amount of data protected for each individual Backup job. (The NAS Pack is intended to meet the needs of large amounts of data).
Picture 1
picture 2
Picture 3
Picture 4
Picture 5
Picture 6
Picture 7
Image 8
Image 9
Image 10
Image 11
Image 12
Image 13
Image 14
Image 15
Image 16
Picture 1
picture 2
Picture 3
Picture 4
Picture 5
(Image 6)
Picture 7
Image 8
Image 9
Image 10
Image 11
Picture 1
picture 2
Picture 3
Picture 4
Picture 5
Picture 6
Picture 7
Image 8
Image 9
Picture 1
picture 2
image 3
Picture 4
Picture 1
picture 2
Picture 3
Picture 4
Picture 5
Picture 6
Picture 7
image 8
Image 9
image 10
Image 11
Image 12
Image 13
picture 2
Picture 3
Picture 4
Picture 5
Picture 6
image 7
Image 8
Image 9