Protecting modern workloads requires efficiency, security, and rapid recovery. HPE StoreOnce plays an important role in the Veeam ecosystem as a purpose-built backup appliance that delivers high performance, global deduplication, and immutability for enterprise environments. While HPE Storage Servers have long been popular with Veeam architects, StoreOnce remains a strong option for customers who want a scalable appliance with aggressive data reduction for a Veeam repository.
This blog takes a practical look at how StoreOnce fits into a Veeam-powered data protection strategy. We’ll explore how it supports the 3-2-1-1-0 best-practice model, how Catalyst integration and source-side deduplication reduce infrastructure load, and how Catalyst Copy and Cloud Bank Storage extend protection off-site and into the cloud. We’ll also examine immutability and dual authorization, highlight the performance gains introduced in Gen4+ systems, and look ahead to what’s coming with Gen5.
For Veeam users, StoreOnce provides a purpose-built, deduplicated repository that keeps backups compact, immutable, and high-performance. With global deduplication across all workloads, StoreOnce reduces storage requirements, shortens backup windows, and accelerates recovery while fully supporting Veeam features such as SureBackup, Secure Restore, and Instant VM Recovery.
Architecture, Core Features, and Ransomware Resilience
Where StoreOnce Fits in the 3-2-1-1-0 Strategy
StoreOnce anchors the immutable and off-site tiers of the 3-2-1-1-0 model and, in many deployments, also serves as a primary backup repository. While Veeam traditionally positions deduplication appliances as a secondary tier in a scale-out architecture, HPE’s guidance for the Gen4+ StoreOnce 5260 and 5660 models differs. These higher-performance systems use flash-accelerated metadata and a more modern hardware platform to support demanding ingest and recovery operations.
According to HPE’s internal testing, together with the results of their Veeam Ready Repository validation, HPE considers these Gen4+ systems capable of sustaining the I/O performance typically expected of a primary backup repository. Based on that data, HPE recommends using these systems as a primary target when customers want a hardware-optimized, globally deduplicated repository that supports both instant recovery and long-term retention within the same architecture.
Customers typically combine:
- Fast on-prem Catalyst repositories for daily backups
- Secondary StoreOnce systems for DR replication
- Cloud Bank Storage for long-term deduplicated retention in AWS, Azure, or Scality
Catalyst Integration and Source-Side Deduplication
Catalyst communicates directly between the Veeam Gateway and StoreOnce to identify unique data before transmission. This source-side deduplication reduces bandwidth requirements, shortens backup windows, and lowers storage consumption, all while keeping advanced restore operations fully supported.
With per-VM backup files, StoreOnce performs global deduplication across all jobs and VMs within a Catalyst Store. This increases space efficiency significantly and reduces the cost per protected terabyte compared to standard file-based repositories.
Catalyst Copy and Cloud Bank Storage
StoreOnce supports Veeam-managed, storage-based replication through Catalyst Copy, offering efficient, deduplicated replication that Veeam can schedule and orchestrate without involving proxies or rehydrating data.
Benefits include:
- Highly efficient data transfer of incremental backups across the WAN
- Full visibility of replicated restore points in the Veeam console
- Replication continues even if a backup job overlaps a backup copy job (though best practice is to keep backup and copy windows separate)
- Encryption in-flight and at rest handled natively by StoreOnce; Veeam encryption should be avoided because it disables deduplication
For hybrid DR and long-term retention, Cloud Bank Storage (CBS) extends the same deduplication chain into object storage. This, in turn, can yield the same storage efficiency and cost savings in cloud storage compared to traditional S3 tiering.
Cloud Bank keeps data deduplicated end-to-end and ensures immutability is enforced at the StoreOnce layer. Credentials for backend S3/object targets remain isolated to StoreOnce and are never exposed to external systems.
Immutability and Dual Authorization
StoreOnce 4.3.x and later include multiple security layers designed to protect backup data:
- ISV-managed immutability enforces Catalyst object retention (7–9999 days) without the ability to shorten retention.
- Dual Authorization requires a secondary approval user for destructive or sensitive operations, preventing a compromised admin account from deleting backup data.
With MFA and a hardened Linux OS (no shell access, minimal attack surface), StoreOnce provides an operational “air-gap-like” layer of protection for Veeam environments.
Performance, Validation, and Optimization
Flash-Accelerated Architecture
Gen4+ StoreOnce systems use SSDs for metadata operations, the portion of I/O that represents roughly 75% of backup activity. This architectural enhancement delivers:
- Up to 20× faster IOPS for Instant VM Recovery and granular file- and item-level restores
- Faster virtual synthetic fulls
- More responsive housekeeping and replication workflows
Catalyst OS Performance Improvements
StoreOnce 4.3.x introduced major performance upgrades tuned for Veeam workloads:
- Fixed-Block Chunking, delivering up to 4.8× faster per-stream throughput
- Reduced random read latency, enabling near-raw-disk Instant VM Recovery speeds
- Adaptive housekeeping with no blackout windows
- New deduplication engine with improved database efficiency
- Significantly faster synthetic fulls (2–3× improvements)
These enhancements enable sustained 100–400 MB/s per stream at large scale, while single-stream performance in testing often exceeds 1 GB/s, depending on workload and hardware configuration.
Veeam Ready Repository Validation and StoreOnce Evolution
The StoreOnce 5260 and 5660 Gen4+ systems have passed Veeam Ready – Repository validation. This confirms their ability to deliver consistent performance under real-world ingest and restore workloads, including Instant VM Recovery, SureBackup, and DataLabs testing.
These results form the basis for HPE’s recommendation that the Gen4+ systems can serve as primary repositories. The same architectural approach also underpins the upcoming Gen5 StoreOnce systems arriving in 2026, which will extend throughput and scalability while maintaining compatibility with existing Catalyst configurations.
Best-Practice Configuration Highlights
A condensed set of best practices for reliable, high-performance Veeam + StoreOnce deployments:
Catalyst Stores & Repositories
- Keep each Catalyst Store below ~200 TB physical (~3 PB logical at typical dedupe ratios)
- Use Low Bandwidth Mode (source-side dedupe) for multi-stream jobs
- Enable Fixed-Block Chunking
- Prefer IP (Ethernet) over Fibre Channel for simplicity and performance
- Repository settings:
- Decompress before storing
- Align backup blocks
- Use per-machine backup files
- Disable inline dedupe and Veeam encryption
Job and Proxy Optimization
- Run the Veeam Proxy and Catalyst Gateway on the same server
- Use HP Static High-Performance Mode in BIOS on physical proxies
- Multiple concurrent VMs/streams improve aggregate throughput
Capacity Management
- Keep utilization below 90–95%
- Ensure at least one weekly GFS restore point to maintain efficient space usage
Learn More and References
Veeam Backup & Replication and HPE StoreOnce together create an efficient, resilient platform for enterprise data protection. StoreOnce minimizes storage consumption with global deduplication and fixed-block alignment while flash-accelerated metadata ensures fast restores and instant recovery performance. Combined with Catalyst Copy and Cloud Bank Storage, customers can extend protection off-site without rehydrating data or increasing operational overhead.
With ISV-managed immutability, dual authorization, and hardened platform security, StoreOnce offers strong defense against ransomware and accidental deletion. Veeam Ready validation demonstrates the platform’s proven performance under real-world conditions, and the upcoming Gen5 release will build on this foundation with even higher scalability and throughput. StoreOnce remains a strong, recovery-ready option for customers who want efficient, immutable, enterprise-class backup storage.
