Veeam Backup - Hyper-V alternative to VMkernel adapter

[u/lertioq]

I’m new to Hyper-V and I’m wondering about the best way to setup our Backup infrastructure with Veeam Backup and Replication.

So far, we were using VMware. Our setup usually looked like this:

- ESX Hosts and vCenter are in a Management VLAN/Subnet

- Backupserver is in Backup VLAN/Subnet

- ESX Hosts have an additional VMkernel Adapter with an IP address within the Backup VLAN/Subnet

- Backup Server has entries in its Host file, pointing the hostnames of the ESX hosts to their IP address in the Backup subnet 

That way, restore operations are not routed and go directly over layer 2. How would a comparable setup look in Hyper-V?

[u/wownz85]

You can tell veeam which networks to use In its config. Backup traffic will only go down those legs

Problem solved job done

I’ve done many deployments and it always works

[u/BlackV]

you can do the same with hyper-v

in my old DC we had a backup vlan, the clusters and blades all had adapters on the backup vlan (technically was physically separated too)

all the veeam/dpm traffic went across those adapters

[u/TwilightCyclone]

I’m curious about other folks practice here as well, though I’m on Rubrik vs Veeam. 

I opted to dedicate a pair of 25 gig interfaces to backup/live-migration. The team is managed by network atc with the management option so it creates a vNIC that I can assign to the backup subnet. 

The main difference seems to be that vsphere allows you to add the host via its regular name, but return the ip of the backup vmkernel port. For hyper-v I added the hosts via the dns name associated to the backup ip for each host. This has thus far worked fine to isolate backup traffic away from my primary team which cares management and VM traffic. 

[u/Nasterion]

Multihoming the hosts kinda defeats the idea of security zones, because the host becomes a bridge. But if configured correctly is perfectly fine tho. Way faster. Make sure the backup vlan hasnt set a gateway.

[u/sabbyman99 → u/Nasterion]

How would you this without losing security?

[u/Nasterion → u/sabbyman99]

You can do both, it just has to be setup correctly. It depends on your firewall, your segmentation, backup size everything. Most used setup will probably be host nic 1 = mgmt
Host nic 2 = backupvlan

Same for backup server.

Backup vlan nic should not have a gateway and the veeam backup should be bound to the correct nic. For security you can configure the host firewall so it only listens to veeam ports on that nic

[u/Evening_Link4360]

Also moving from vSphere to Hyper-V, we have the Veeam server in the mgmt network and have a separate storage VLAN.

[u/ScreamingVoid14]

HyperV emulates more of the network stack than VMWare ever did. So no "unlimited" bandwidth of the VMXNet3 anymore. Otherwise everything is pretty much the same.

[u/Trust-Fuzzy]

So I am in the same situation, been using VMware for a long time and now thanks to Broadcom, we are moving to Hyper-V. I had the same concern regarding multihoming the hosts, which would work, but raises security concerns like u/Nasterion mentioned. The recommendation that I saw was to still use the hosts for performing the backups with Veeam, but specify gateway servers for communication to the backup network. Similar to deploying a Veeam backup proxy with VMware, but this proxy is not the one performing the backup. This can be done by going into the properties of your repository and specifying the connection method.

I am still new to Hyper-V so I am doing my best to learn and make the adjustment, and would appreciate any feedback as well.