By default when you create an Azure Blob Storage repository inside of VEEAM you are only required to enter the Blob Storage account name and key.
Somehow VEEAM knows how to connect to Azure Blob and I assume it then relates to the actual Blob Account’s URL eg. https://myblobaccount.blob.core.windows.net/
We have multiple sites and have set up multiple Azure Blob accounts (1 for each site)
We also have a distributed firewall system whereby each site has its own set of firewall rules
To date we have been setting firewall allow rules to allow VEEAM to access AZURE Blob storage site-by-site meaning X sites == X firewall rules
We are trying to move to a single wildcard-based rule which can be applied in a consistent manner to all edge firewalls however in our testing we were unable to get this to work.
Using MS Azure Custom Domain for access blob data (see excerpt at bottom of this post) we created a cname like below:
myblobaccount.myinternalstorage.mycompanydomain.com CNAME myblobaccount.blob.core.windows.net
then deployed a single firewall rule like
ALLOW: *.myinternalstorgae.mycomanydomain.com
We have confirmed that the CNAME resolves both internally and externally to our network
So the question is:
Is there a way in VEEAM (VBR12) to configure the URL that is associated with the Azure Blob account such that i can over-ride the (‘Default’) myblobaccount.blob.core.windows.net references and use my custom domain name
---excerpt from MS Blob Account - Custom Domain ----
From MS Blob Account page - Networking - Custom Domain
Configure a custom domain for accessing blob data in your Azure storage account, like www.contoso.com. There are two methods you can use to set up a custom domain.
- Create a CNAME record with your DNS provider that points from your domain (like www.contoso.com) to myblobaccount.blob.core.windows.net or myblobaccount.z8.web.core.windows.net then enter you domain below. This method is simpler, but results in a brief downtime while Azure verifies the domain registration.
- Create a CNAME record with your DNS provider that points from the "asverify" subdomain (like asverify.www.contoso.com) to asverify.myblobaccount.blob.core.windows.net or asverify.myblobaccount.z8.web.core.windows.net. After this step completes, enter your domain below (exclude the 'asverify' subdomain). This method does not incur any downtime. To use this method, select the 'Use indirect CNAME validation' checkbox.
