1
2
3
4
5
6
7
8

# Format disk with reflink support
sudo mkfs.xfs -m reflink=1 /dev/sdb
sudo mkdir -p /mnt/veeam
sudo mount /dev/sdb /mnt/veeam

# Create hardened backup user
sudo useradd -m -s /sbin/nologin veeamrepo
sudo chown veeamrepo: /mnt/veeam

• Use XFS with reflink for Veeam immutability
• Mount target to /mnt/veeam
• Configure in Veeam as “Hardened Repository”

1. Create a bucket with Object Lock enabled
2. Enable Versioning
3. Set default retention policy (e.g., 30 days)

1
2
3

# Example with MinIO Client
mc alias set minio https://minio.example.com minioadmin minioadmin
mc retention set --default GOVERNANCE 30d minio/veeam --insecure

• Use separate credentials for:

  • Backup console
  • Repositories
  • Hypervisors
  • S3 buckets

• Protect backup console with:

  • Multi-Factor Authentication (2FA)
  • Role-Based Access Control (RBAC)

• Isolate repository access with:

  • VLAN segmentation
  • Firewall rules
  • SSH key-only access

• Enable email notifications for job results and warnings
• Regularly review backup logs and audit access
• Apply Veeam updates and patches promptly
• Integrate with monitoring platforms (e.g., Zabbix, Icinga)

• Operating System: Windows Server 2016 or newer

• SQL Server: Use built-in SQL Express or an external instance

• Hardware:

  • 2+ vCPUs
  • 8+ GB RAM (16 GB recommended)
  • SSD for configuration and database preferred

1. Download Veeam B&R ISO

2. Mount ISO and run Setup.exe

3. Choose Backup & Replication

4. Follow the wizard and install:

   • Veeam Backup Service
   • Console
   • Explorers
   • Transport & Catalog Services

• Go to Backup Infrastructure > Managed Servers

• Add:

  • VMware vCenter Server
  • or Microsoft Hyper-V hosts

Use service accounts with minimal required permissions.

• Navigate to Backup Infrastructure > Backup Proxies

• Add Windows Server (VM or physical)

• Assign transport mode:

  • Direct SAN Access
  • Hot-Add (for VMware)
  • Network (NBD)

Supported types:

• ✅ Linux repo (XFS + reflink for immutability)
• ✅ Windows repo (ReFS for fast clone)
• ✅ NAS (SMB/NFS, no immutability)
• ✅ S3-compatible object storage

Use the appropriate wizard to configure credentials and paths.

1. Go to Home > Jobs > Backup Job (VMs)

2. Choose source: VMs, physical agents, or NAS

3. Select a repository (e.g., Hardened Linux, S3, iSCSI)

4. Set backup mode:

   • Incremental
   • Forever Forward Incremental

5. Define retention policy (e.g., 14 restore points)

6. (Optional) Enable:

   • Synthetic Full backups
   • Health Checks
   • Backup Copy

• Backup Copy Job

  • For offsite or secondary backup

• SureBackup Job

  • Automatically boots and verifies backups

• Replication Job

  • Creates hot standby VMs at DR location

• Enable email notifications
• Check job logs and statistics regularly
• Integrate with external monitoring (Zabbix, Icinga)

• Full VM restore
• File-level restore
• Application-item restore (Exchange, SQL, etc.)
• Instant VM Recovery

Schedule test restores at least once per month.

1
2
3
4
5
6
7

# Format the disk
sudo mkfs.xfs -m reflink=1 /dev/sdb
sudo mount /dev/sdb /mnt/veeam

# Create veeamrepo user
sudo useradd -m -s /sbin/nologin veeamrepo
sudo chown veeamrepo: /mnt/veeam

✅ Enable SSH key login ✅ Grant temporary sudo during setup 🔒 Disable password auth after configuration

• Go to Backup Infrastructure > Backup Repositories > Add Repository
• Choose Linux Hardened Repository
• Enter:
  • IP address
  • SSH credentials
  • Public key path
  • Set mount path (e.g. /mnt/veeam)
  • Enable Immutability (e.g., 30 days)

• Navigate to Home > Backup Copy > Backup Copy Job (VMs)
• Select the primary job as source
• Choose Hardened Linux Repository as target
• Set:
  • Immediate copy mode: ✅ (optional)
  • Copy every 12 h, retain 7 restore points

• Format the local NAS volume with ReFS 64 KB
• Add it to Veeam as a Direct Attached Repository
• Deploy MinIO:
  • Enable TLS, versioning, and Object Lock
  • Create the S3 bucket for backups
• Add the bucket to Veeam as an S3-Compatible Object Repository
• Enable immutability (e.g., 30 days Governance mode)

• Navigate to Backup Infrastructure > Scale-Out Repositories
• Click Add SOBR
• Set a name (e.g., SOBR-Primary-Remote)
• Add:
  • Local ReFS repo as the Performance Tier
  • MinIO S3 repo as the Capacity Tier
• Enable the following options:
  • ✅ Move backups older than 14 days to capacity
  • ✅ Copy backups as soon as they are created (optional)
  • ✅ Support immutability on capacity tier

• Open Veeam Backup & Replication Console
• Go to Backup Infrastructure > Backup Proxies
• Click Add Proxy
• Choose:
  • Platform: VMware vSphere or Microsoft Hyper-V
  • Server: Select existing Windows Server or deploy automatically

• Modes:

  • 🔄 Automatic – Veeam chooses the best mode
  • 📦 Direct SAN Access – best for fibre/iSCSI environments
  • 🔧 Virtual Appliance (Hot-Add) – efficient for virtual proxies
  • 🌐 Network (NBD/NFS) – fallback, least efficient

• Set maximum concurrent tasks based on CPU/RAM (e.g., 4–8)

• Use a dedicated Windows Server (physical or VM)
• Recommended resources:
  • 2+ vCPU
  • 4+ GB RAM
  • Fast disk (SSD/NVMe) for cache (e.g., 40–100 GB)

• Go to Backup Infrastructure > WAN Accelerators
• Click Add WAN Accelerator
• Select your Windows server
• Define:
  • Cache path (dedicated volume preferred)
  • Cache size (recommend 1–3% of protected data)
  • Max concurrent tasks

Repeat this step for both source and target sites.

• Edit or create a Backup Copy Job
• In the Data Transfer step:
  • Enable Use WAN Accelerators
  • Select:
    • Source WAN Accelerator (e.g., local site)
    • Target WAN Accelerator (e.g., remote site)
• Complete job configuration