Hello Community,
as part of a hardware refresh project project for a new customer, we are planning on creating a separate /24 VLAN subnet behind the firewall in order to better segment and protect the Production vSphere environment, the new soon to come vSphere DR cluster as well as the Veeam backup fabric as they currently reside in the same flat VLAN and IP subnet where all clients and servers reside (as depicted below):
==================================================
==================================================
Currently the Veeam Backup server/primary backup repository is a physical Windows server running Windows Server 2019 with 50TB of local storage. We are planning on moving the Veeam Backup Server to a new dedicated VM hosted on the soon to come vSphere DR cluster and, at the same time, repurpose the primary backup repository hardware into a Veeam Hardened Repository.
The main concern here are the 60 or so client computers with the Veeam Agent for Windows. More specifically, in the current scenario all network traffic between the source Veeam Data Movers running on the backup agents side and the target Veeam Data Movers running on the primary backup repository side are local in the same /23 subnet depicted above. After placing the Veeam backup fabric in the separate /24 VLAN subnet behind the firewall in order to better segment and protect it, all network traffic between the source and the target Veeam Data Movers will need to traverse the firewall and this is something we want to avoid at all costs for several reasons.
It looks that for some reason the external network and security consultants are reluctant to use VLAN routing and create proper ACLs on the core switch, so we are trying to find a way to work around this.
Although not recommended (especially from a security perspective), technically we could multihome the soon to come Veeam Hardened Repository to allow the source Veeam Data Movers running on the backup agents side to locally connect from the /23 subnet and, at the same time, allow the source Veeam Data Movers running on the VMware backup proxies side to locally connect from the new /24 subnet.
Could you please tell me if this is something that can be achieved, for example by properly configuring Network Traffic Rules or by splitting name resolution on the two subnets ?
It would be great if someone could kindly advice me on this matter.
Thanks and Regards,
Massimiliano
