Backing up shares on NetApp with Veeam – Best practices and user experience

PREAMBLE: In this period I'm trying to write my articles using the STAR model (Situation, Task, Action, Result) to make sure they're technically accurate and clear.

I'll never get tired to say this: protecting company data is the most important thing for any business, and we need to go beyond traditional virtual machines or transactional databases to include unstructured data on NAS infrastructures.

1. Situation

Our customer wants a strong and permanent backup system for a lot of unstructured data:

• Data Source: NetApp ONTAP (version 9.14.1P5).
• Data involved: There's about 11 TB spread across 25 NFS shares.
• Critical info: We've got Oracle database dumps (done with RMAN) and PostgreSQL (via script).
• Final destination: The backup had to be efficient, and the backup copy had to be replicated to Azure Blob Storage (not immediatly but the solution had to be natively prepared).

2. Task

To do this, our job was to come up with a high-performance backup solution using Veeam Backup & Replication v.12.3 that could:

• Share-level backups of the 25 NFS directories using the NAS Filer feature.
• Use the integration with the NetApp APIs to make sure you read data consistently via snapshots.
• Make immutable the main backup in a Linux Hardened Repository, so it's ready for replication to Object Storage later on.
• Reduce the impact on the NetApp system as low as possible.
• Optimise space and network traffic with deduplication and compression.

3. Action

To achieve these objectives, we have developed a solution based on four components:

*Due to version 12.3, the cache repository must reside on a Windows system, so the proxy file was created with a Windows Server 2022 image.

Technical Requirements

1. User on Netapp

We'll create a dedicated user (veeamsvc) on NetApp with specific CDOT (CDOT NAS Backup Integration) permissions (least privilege principle). We added granular privileges following the instructions in the official Veeam documentation:  https://helpcenter.veeam.com/docs/backup/vsphere/required_permissions.html?ver=120#storage-systems-snapshot-integration

2. Snapshot directory configuration

To prevent the volume snapshots having issues, you just need to make sure their folders are visible from the Netapp management console. Here's the screen where you set the flag.

Otherwise, when the storage is discovered, this warning message will appear

3. Veeam and Netapp connectivity

Below the right configuration for connectivity between VBR and Netapp, as from Veeam Help Centre  https://helpcenter.veeam.com/docs/backup/storage/ports.html?ver=120#netapp

4. General purpose backup proxy creation

Once you've got VM up and running with the hardware and software prerequisites we mentioned, you just need to add the new proxy for NAS backup.

Then, from Backup Infrastructure, right-click on Backup Proxies and select Add proxy...

On the next screen click on General-purpose backup proxy

You can see this screen

After insert the Windows hostname, we leave Traffic Rules screen by default then click on Apply

then click Next and Finish.

Netapp Ontap implementing and configuring

1. Veeam configuration: we added the NetApp ONTAP as a "File Server" on Veeam console. After this we added as Unstructured Data Source, where we leave default settings for I/O Control in order not to overload the NAS.

NetApp ONTAP integration in Veeam finished succesfully using a NetApp ONTAP "File Server".

Let's now look at the individual steps:

Add the Netapp NAS to the Veeam console. Under Storage Infrastructure, click Add Storage

Click in Netapp

Select ONTAP

Now configuration wizard starts, we add hostname and set the flag on NAS Filer thenk click on Next:

Added the right credentials using HTTPS protocol and 443 port then click on Next.

In this moment connection to the Ontap starts

Accept a non trusted certification connection and click on Continue

Saving storage starts

At the end, SMB and NFS protocols have been selected in the NAS Filer screen.

Select the volume you want to backup

Click on Add and select the desired volume (our choiice was nfs_backup_db)

AFter click on OK we can see the result. Select the proxy to use then Next.

Leave the tick box checked “Run the storage infrastructure rescan when I click Finish” and rescan started

At the endd, on Storage Infrastructure menù it's possible to see our ONTAP

Adding the cache repository

As I said before, cache repo is a temporary storage area on the File Proxy, used to store file metadata and Change Tracking information. From Backup Infrastructure panel, right-click on Backup Repository and select Add.

Click on Direct attached storage

Click on Microsoft Windows

Insert repository name then click Next

Here can choice the location and clicking on Browse, once you have found and selected the 100GB cache disk. Click Populate to check available space

Click on Advanced to verify settings as below image

Select the mount server, in our situation is the VBR server.

Click on Next

Click Apply and waiting the end of the configurations, and finally our cache repository appeared

Adding Unstructured Data Source

Now we can add NAS Filer. From Inventory menu select Unstructured Data, click on Add Unstructured data Source.

in next windows click on NAS Filer

From the drop-down menu, select the NAS device you added earlier. Tick the account box and select the veeamsvc account already entered.

Leave default settings for I/O Control so as not to increase the number of parallel processes and thus overload the Netapp. Click su Apply.

Click on Finish. Then NAS Filers under Unstructured Data appear

2. Creation NAS backup Job : A single backup job has been created:

   • Method: Share level backup.

   • Retention: 28 restore point.

   • Filter: Settings on Exclude Masks to exclude unneeded file (ex. *.dmp) and snapshot path.

Let's take a look at the backup job settings. From the Jobs menu, right-click on Backup – File share to open a window showing the name of the backup job.

On the Objects screen, click Add to add the shares you want to protect.

We chose nfs_backup_db share click on OK

If you select the share and click on Filters, you can choose which items to include or exclude during the backup on the relevant screen.

For the first test, we picked files with the .veeam extension (made ad hoc) in the include masks and, in the exclude masks, the paths relating to snapshots and also files with the *.dmp extension.

NOTE: Exclude Masks take priority over Included Masks.

Using Linux Hardened as backup repository, 28 RP as retention then clicking on Advanced we checked these settings:

Continue until the job configuration is complete without changing anything. It is now ready to be launched.

Proactive Advice: We suggested that the customer switch from dump backups to using the dedicated Veeam RMAN plug-in to make things more consistent and optimise future Oracle backups.

4. Result

Post-implementation testing and validation confirmed the complete success of the project:

• Restore Validation: We did some granular restore tests, which let us recover individual files, so we know the solution works.
• Objective Achieved: The architecture turned out to be pretty solid, flexible, and fast, totally meeting our storage needs and performance expectations. The current level of protection against ransomware is guaranteed by immutability.

I hope this article helps anyone who needs to set up a backup of unstructured data, especially NAS Filer.

See you next time!