Configuring Veeam Virtual Appliance Mode for VMware vSAN
When backing up VMware vSAN, data protection solutions can still take advantage of VMware vSphere Storage APIs – Data Protection as they do backing up virtual machines from any type of VMware storage as it is storage agnostic. There are some considerations to be made when thinking about backups of vSAN using data protection solutions such as Veeam to backup vSAN. Veeam has a backup proxy configuration called Virtual Appliance Mode. With Veeam Virtual Appliance Mode we can backup VMware vSAN virtual machines much more efficiently. Let’s take a look at configuring Veeam Virtual Appliance Mode for VMware vSAN as this is the recommended configuration for backing up virtual machines on vSAN using Veeam.
What is Veeam Virtual Appliance Mode?
Virtual Appliance mode is a configuration Veeam proxies that can be recommended in highly dynamic environments where maintaining Direct SAN Transport is difficult to do. The Virtual appliance mode reduces the administrative overhead of configuring LUN connections for direct SAN access and allows utilizing the VMware Hot-Add process. Basically, we provision VMs on the datastore that will act as proxies to provide Hot-add functionality for more efficient transfers.
As noted, if it doesn’t make sense to utilize Direct SAN Access mode, then Virtual Appliance Mode is the preferred way to setup your proxies. Important to note with VMware vSAN, Direct SAN Transport is not supported. This is due to VMware vSAN using modes that are not compatible with SAN transport and is disabled if the virtual disk library detects the presence of vSAN.
- The proxy requests from the ESXi host the location of the VM on the datastore
- The ESXi host locates the VM
- Veeam notifies vSphere to take a snapshot
- The VMDKS are hot-added to the virtual appliance
- Veeam reads the data from disks attached to the virtual appliance
- The disks are detached from the virtual appliance backup proxy and snapshot is removed
Configuring Veeam Virtual Appliance Mode for VMware vSAN
For VMware vSAN, per the Veeam vSAN KB, it is recommended to have a backup proxy running on each ESXi host in the environment that is running VMware vSAN. In my home lab environment, I setup (2) small footprint Windows Server 2016 servers that were to act as proxies for the two ESXi hosts running in my environment. As we know the objects for the virtual machine are spread across hosts. Veeam is able to determine the most appropriate proxy to use for hot-adding the disks to the proxy.
It is as simple as adding the Veeam Proxy to the two “appliance” Windows servers attached to the hosts. As you can see below, looking at the Backup Infrastructure reveals the new proxies configured.
Below are the actual virtual machines that are running in the vSphere inventory.
Running a backup job on a virtual machine that is attached to the first host in the cluster utilizes the VMware proxy that is residing on that particular host. We can see from the job history that it did correctly use the proxy.
Running a backup on another VM on the second host correctly utilizes the proxy residing on this host.
Making sure Veeam Proxies Stay on Correct Hosts
If you have a DRS enabled cluster which most do, there is a chance the virtual machines would get moved around depending on load on the cluster hosts. We need to provision DRS affinity rules to ensure the proxies are always housed on the appropriate hosts. To do that, we can easily create VM/Host Groups and attach those to each other in the order we want them.
Below we are creating the Host Group which will contain the host we want one of the proxies to run on.
Next, we create the VM Group containing the first host Veeam proxy. We do this for both hosts and proxy VMs.
Below, we see the Host Groups and VM Groups after creating for both hosts and both Veeam proxies.
Now, we create a VM/Host Rule which ties the appropriate VM Group to the appropriate Host Group.
We do this for the second host as well.
You should have a rule for each host that exists in your cluster. For me, I have a two-node vSAN cluster with a Witness appliance, so I have the two rules created below.
By configuring the above VM and host groups, along with the DRS rules, we can ensure the proxies are always running on the host they are covering for Veeam proxy functionality.
Thoughts
Veeam Backup & Replication provides great integration with VMware vSAN, including this intelligent utilization of the appropriate VMware proxy. Since VMware vSAN doesn’t offer Direct SAN support, we can utilize Hot-add functionality by provisioning a virtual appliance proxy for each ESXi host that is in the vSAN environment. Then by utilizing the DRS rules, we can make sure we assign a VMware proxy to a specific host and ensure DRS does not move the VM around in an inefficient way for vSAN backups. The entire process involved in configuring Veeam virtual appliance mode for VMware vSAN is very straightforward and ensures we can backup virtual machines running on VMware vSAN in the most efficient way possible.
