• EN

DR Architecture bests pratices

H
Userlevel 2

Hi everyone,

Hi have a question concerning veeam disaster recovery seting up with veeam

Currently I have my full infra on my production site.

For my disaster recovery project, I plan to move my NAS which is used as SMB Repo, I  plan to also move my backup + proxy server using for replica job.
After that i will install veeam disaster recovery orchestrator on the DR site and manage my disaster recovery plan with it.

I my architecture I don't a vcenter server in my DR site. I plan to use the main site vcenter server to manage DR Esxi (2 hypervisors).

Is it recommended to do it like this?
I would like to know if not having a dedicated vcenter for my hypervisors on the PRA site could be a problem.

I would like to have comments and recommendations on this architecture. And also, your advice on the best practices

Bellow my architecture

 

your answer would be very useful for me :)

Thanks

 

Herbi

14 comments

JMeixner
Userlevel 7
Badge +17

Mhh, when you have your vCenter server on the production site to manage production and DR vSphere, which vCenter will you use in disaster? I think you will need vCenter HA or similar…

Or you need to setup a supported backup of your vCenter and recreate it with this...

Is your connection between the sites strong enough to handle the backup and replica traffic? Otherwise you could add a second repository on the prod site and use this as a the target for your backup jobs and copy the backups at a time with less traffic.

Jochen (Joe) Meixner | Veeam Vanguard 2024 | Veeam Legend 2021 - 2023 | Veeam Certified Architect (VMCA) 2022 | Twitter: @JoMeix | BlueSky: @jmeixner.bsky.social
Chris.Childerhose
Userlevel 7
Badge +20

Based on completing the VMCA2022 recently the best practice is that you have a VBR server in both sites because if you need to failover and the site with the VBR server is down or gone how do you complete the DR?

Also you may not want the vCenter to manage the DR ESXi hosts and just keep that to the PROD site.  You can set up DR to go directly to a host without having vCenter involved but it does make things easier which would require another VC in the DR site.

You can find many things for Architecture here which I reference a great deal - Veeam Architects Support Site (veeambp.com)

Hope this helps.

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
MicoolPaul
Userlevel 7
Badge +20

The one major problem you’ll have here is that Veeam Disaster Recovery Orchestrator requires access to vCenter, it doesn’t support interacting with vSphere hosts directly. If your DR site is purely for DR and runs no production workloads then you may want to run vCenter from your DR site. You could look to run vCenter in HA but you’ll always have the issue of where the witness sits in a 2 site design.

 

More information on the vCenter requirement for VDRO is available here: https://helpcenter.veeam.com/docs/vdro/userguide/system_requirements.html?ver=50

Specifically “Note: The Orchestrator server must be connected to VMware vCenter Servers. Direct connections to vSphere hosts are not supported.”

Michael Paul - #VeeamLegend | #VeeamVanguard | Veeam Certified Architect | VMware vExpert | https://micoolpaul.com | Twitter: @MicoolPaul | Mastodon: @micoolpaul@masto.nu | Bluesky: @micoolpaul.bsky.social
MicoolPaul
Userlevel 7
Badge +20

Another thought as well, for replication you’ll want source and destination proxies which aren’t in the diagram. Veeam is pretty good at detecting the optimal proxies for the job when the sites have different IP address subnets, but if in doubt or if you notice that your source and destination proxies aren’t being utilised correctly, you can specify particular proxies for source & destination.

Michael Paul - #VeeamLegend | #VeeamVanguard | Veeam Certified Architect | VMware vExpert | https://micoolpaul.com | Twitter: @MicoolPaul | Mastodon: @micoolpaul@masto.nu | Bluesky: @micoolpaul.bsky.social
Chris.Childerhose
Userlevel 7
Badge +20

Another thought as well, for replication you’ll want source and destination proxies which aren’t in the diagram. Veeam is pretty good at detecting the optimal proxies for the job when the sites have different IP address subnets, but if in doubt or if you notice that your source and destination proxies aren’t being utilised correctly, you can specify particular proxies for source & destination.

Another excellent point here for Proxies. :point_up_2_tone2:

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
H
Userlevel 2

@Chris.Childerhose  @MicoolPaul  @JMeixner  Thank you very much for your comments. They are very useful for me.

@MicoolPaul  Concerning vcenter on DR Site, I was thinking to to move the witness VM and vcenter slave on the DR site, but I will still have the same limitation with veeam disaster recovery orchestrator.

I think that I will need a dedicated vcenter on my DR site.
I would like to know if a vcenter Essantials license would be suitable for my DR site?

@JMeixner I have a 10 Gb link between the main site and DR Site. Also the subnets of my main site are available on the DR Site.
I plan to put hypervisor in the same subnet as the main site

Any other comments would be appreciated.

MicoolPaul
Userlevel 7
Badge +20

Hi @herbi,

 

Moving the “slave” vCenter and witness to the DR site would certainly keep your recovery a possibility in a DR scenario, but if you lost site to site connectivity, your production site would lose quorum. Have you got a third site you could use as a witness?

 

You’ve mentioned a 10Gb link between sites so you should be fine but do factor in the latency for vCenter HA over a stretched network must be below 10ms.

 

You could use Essentials but you’d have to have a second SSO domain as essentials won’t let you share this, could cause you some extra friction or administrative effort.

 

Have you already got vCenter configured as HA or were you thinking of deploying HA?

Michael Paul - #VeeamLegend | #VeeamVanguard | Veeam Certified Architect | VMware vExpert | https://micoolpaul.com | Twitter: @MicoolPaul | Mastodon: @micoolpaul@masto.nu | Bluesky: @micoolpaul.bsky.social
H
Userlevel 2

Hi @MicoolPaul 

Thanks.

Yes i agree, if the link is not stable, I could have  issues with vsphere HA.

I also don't have a third site to deploy the wintness VM.

 

I have not yet configured vsphere HA.

I'm currently trying to find the different scenarios in order to choose the best while respecting the best practices.

 

Please what do you suggest me ?

MicoolPaul
Userlevel 7
Badge +20

If the link is stable and redundant I’d suggest moving vCenter to your DR site if you’re only licensed for one site. Preferrably though I’d just buy a second vCenter license and link the two, no need to rely on any remote connectivity for vCenter management is best. The feature is vCenter enhanced linked mode and more information is available here: https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vcenter.install.doc/GUID-4394EA1C-0800-4A6A-ADBF-D35C41868C53.html

 

vCenter being backed up by tools such as Veeam isn’t recommended before and would only complicate recovery efforts if it doesn’t exist so it’s not a step I would want to miss out on my recovery plan.

Michael Paul - #VeeamLegend | #VeeamVanguard | Veeam Certified Architect | VMware vExpert | https://micoolpaul.com | Twitter: @MicoolPaul | Mastodon: @micoolpaul@masto.nu | Bluesky: @micoolpaul.bsky.social
ger.itpro
Userlevel 4
Badge

Hi,

doing a proper DR is way more challenging then a working backup.

I am not aware of your budget but I highly recommand not using an SMB share on whatever hardware as an repository.
If there is only a NAS available please use at least iSCSI volumes from the NAS to an VM or better an “real” hardware server (maybe a refurbished one if budget is a problem). Also consider a secound repository for backup copy jobs.

If both sites have a dedicated and stable internet connection you can also consider to place the witness in the cloud and connect the cloud with VeeamPN (for example).

Please also check carefully the vCenter DR situation because for VBR the vCenter is absolut necessary and critical.

Best regards
Daniel

A

Hi there!
My recommendation would be to keep it as simple as possible,
IMHO:
when you enter in DR mode, it's very important to see everything clear and have a clear plan and priorities.
I would move the Veeam B&R vm to the DR Site, the Repos would set them up as Scale Out. to be able to add a future cloud or remote storage.
also the Veeam Storage I would set it in a virtual hard disk, presenting the Storage from the NAS to the DR Vsphere as NFS or so, as a Datastore, not presenting it directly to veeam as a CIFS repo.
And finally, if you have more than 1 ESXi host in the DR site, I would install a secondary vcenter in the DR site, and communicate both to have full access to the environment in case of DR, if the DR site has only 1 ESXi Host, I would keep it without secondary vcenter (I never had any issue spinning up a vcenter replica in a DR situation), saving budget and in case of DR, Spin up first the vcenter and the DCs for comms and logons, then the rest of vms.

 

 

H
Userlevel 2

Hi @MicoolPaul 

Thanks again for the recommendations.

They are very useful to me.

 

Thanks

H
Userlevel 2

Thanks @ger.itpro  for your suggestion.

Concerning the repository, the idea of a physical server withh iscsi seems very interesting to me. I could have a significant IOPs performances.

The benefit of SMB/CIFS is better flexible, I can easily browse the repository content directly on my NAS.

 

Regards

H
Userlevel 2

Thanks @HunterLF ,

I plan to use a replica job to move the VBR to my DR site.

 

Then I will move the NAS as well if on the DR.
I am looking into the feasibility of using an iscsi repo or directly mounted it as an NFS datastore on vmware.

 

Also, the most important thing would be to also have a clear plan of the failover in order to define which parts should be processed first.

 

Regards

Comment


Terms & Conditions