Encryption for Enterprise Plug-In with Veeam


Security is always extremely important. Encryption should be used whenever possible. When using Veeam plug-in for enterprise database, you should be aware of the options for encryption and settings that can be configured.

With the latest update of Veeam, v12.1.2, the following links should help clarify encryption for Veeam Enterprise plugin backup.

Network Traffic Encryption

Starting with v12.1.2, by default, network traffic encryption is in place for Veeam plug-in backup. See the following links for detail on utilization for each plug-in. The encryption may be disabled if desired. Specific commands and steps required are illustrated with each plug-in:

SAP HANA

Oracle

SAP on Oracle

Microsoft SQL Server

DB2

 

Repository Encryption

SAP HANA – Note this special variation on encryption for backup for SAP HANA – ‘Veeam plug-in supports SAP HANA integrated encryption. The encryption processes are performed on the SAP HANA side. Veeam plug-in is not involved in encryption processing.’

See the link for expanded discussion regarding how to utilize SAP HANA and its encryption with the Veeam plug-in: SAP HANA .

See the link “Access and encryption Settings on Repositories” for further information regarding Veeam plug-in ability to send backups to a repository where Veeam encryption is enabled.  See item #5 – ‘Veeam plug-in cannot send backups or backup copies to a backup repository where encryption is enabled. Thus, make sure that the Encrypt Backups Stored in this repository check box is not selected.’

This is not the same as the first note where using SAP HANA encryption is supported.

Microsoft SQL Server – Note a special variation on encryption for backup for Microsoft SQL Server – MS SQL Server TDE integration is supported during Veeam backup. The encryption processes are performed on the SQL Server side. Veeam Plugin is not involved in the encryption processing. Plan the protection of the encryption environment using the information in the TDE documentation. In case you lose the encryption keys, Veeam Plug-in can only provide access to the encrypted backup file.

For further information regarding Veeam Plug-ins ability to send backups to a repository where Veeam encryption is enabled. See the link for Microsoft SQL Server item #5 “Access and Encryption Settings on Repositories” ‘Veeam plug-in cannot send backups or backup copies to a backup repository where encryption is enabled. Thus, make sure that the Encrypt Backups Stored in this repository check box is not selected.’

Oracle - Specific encryption conditions are in place. Oracle – “The Oracle Secure Backup SBT library supports RMAN encrypted backups. Veeam Plug-in does not support encrypted backups of Oracle databases.”

Also, please see the link Access and Encryption Settings on Repositories and note item #5 for repository settings with respect to Veeam plug-in backups.

SAP on Oracle - See IMPORTANT note information within note #5 in the Veeam plug-in configuration section - SAP on Oracle  ‘Encryption must be disabled on the target backup repositories. Otherwise, backup repositories will not be listed as available.’

DB2 – Please see the link for DB2 item #5 “Access and Encryption Settings on Repositories” ‘Veeam plug-in cannot send backups or backup copies to a backup repository where encryption is enabled. Thus, make sure that the Encrypt Backups Stored in this repository check box is not selected.’


2 comments

Userlevel 7
Badge +21

Great write-up.  👍

Userlevel 7
Badge +6

Great information here....thanks for sharing this as I don’t often use these features and wasn’t aware of this.

Comment