Why not look in to Wasabi using Immutability?  I know it is online all the time but not much will meet the offline requirement other than tape.

Yeah..I’m not aware of any offline solution aside from tape, myself. You can use an ‘isolated’ physical server housed with storage disks, assuming you can house all your data, and create a Linux Hardened Repo on the server itself. If you need to make it offline, you could remotely disable the switch port it’s connected to. Maybe not exactly what you’re looking for, but a potential option.

thanks Chris, yes I’m actually in discussions with them now. I’m surprised that there arent many turn key solutions out there that will provide this. Even in the cloud, a time based access for an account should be adopted. This will provide a window to replicate into then the account closes.

thanks. Yes hardened repo server is an option as we could adopt a simple script to down/up the NICs. This server could be on-prem or cloud based. Its workable but would like to see an out-the-box solution to tackle this requirement. Tape is always an option but I think we mostly want to avoid it due to obvious problems and also human intervention thats required. thank you.

Yeah not any that I am aware of. I know you can expire a tenant in Veeam Cloud Connect and maybe that would be something to look in to as a way to satisfy this requirement.

You could use AWS S3 storage gateway as a virtual tape library (yes tape again) to send data to S3 then eject media.

I would recommend just using S3 directly with immutability, but depending on policy the VTL solution may be a better fit.

thank you for that, good possibility there. Will explore that. Would prefer to leverage Wasabi if I can….

also thank you for your videos and web pages for VMCE and VMCA. Definitely helped me towards my certs! 

I think Wasabi with immutability is a great way to go. Just not really airgapped. I think the key is backups can’t be deleted/lost more than the offline aspect… did you question RTO? 
Thank you for the kind words on your cert help, this is exactly what I love to hear :-)

You might also want to look at Exagrid as an on-prem option.  It’s effectively a Linux appliance with all the security features in-built, uses MFA and immutability can be configured from 10 days upwards. Deduplication is excellent and backup and restoration times are brilliant.

thanks, yes I’ve seen these and the capabilities however is it offering air-gap/digital disconnect? This is where the requirement is.

I am pretty sure ExaGrid does not offer this like many appliances.  I guess if you disconnect the network then it would.

Quite right, it doesn’t but as has been previously mentioned unless you’re going to use tape then I’m not sure any other solution will do this? And what is wrong with tape? But Exagrid does offer an an acceptable solution for Ransomeware attacks and protects against being able to delete your immutable images.

Definitely agree for sure that tape seems to be the only solution to fit the need here.  ExaGrid is definitely a great solution.

like many appliances they offer great solutions with immutability etc...etc however the only viable solution I see at present is….

1. Dell Cyber Vault
2. Linux hardened repo where we could script the down/up of the NIC. That will offer a logical airgap

would be great to see more development is these options

I’d look at the likes of Wasabi with an immutable bucket, or of you want a turn-key appliance, Object First might be a good option.  There are some other appliances as well, but Object First has my eye because it’s object storage.

The hacked together version I’ve had in theory is to use a script before and after a backup job that logs into a switch and administratively ups and downs the ports before and after the job starts.  Not elegant really and comes with it’s own issues, but it would work in theory.

I do also like the idea of using a VTL as Rasmus suggested.

Disclaimer straight away: Object First SE here.

As mentioned, Object First OOTBI is a great option to have implement immutable backup storage into your infrastructure. It was specifically designed for Veeam and provides direct-to-object storage configuration powered by the Smart Object Storage API. https://objectfirst.com/object-storage/

In case on-premises storage is not an option, VTL can be used. Amazon Storage Gateway is a great option for AWS. You can also take a look at Starwinds VTL, if you want to use Wasabi.

@MavMikeVBR, in your post 

“like many appliances they offer great solutions with immutability etc...etc however the only viable solution I see at present is….

1. Dell Cyber Vault
2. Linux hardened repo where we could script the down/up of the NIC. That will offer a logical airgap

would be great to see more development is these options”

I was reading about commvault, it offer airgap solution, Have you heard about this one?

Hey, some time ago a friend of mine told me that, they were executing a pre and post task scrip that enables / disables the port switches were the destination NAS for the backups is connected to,

so they keep only the management interface for monitoring, but the interfaces used for the NFS and CIFs are activated only by Veeam with the script.

Maybe that helps, 
Nevertheless, S3 + immutability is, in my opinion, much better, 
Copy Outside of the Site, Immutable, Flexible / elastic in size / capacity, no need warranty / mantenance.

cheers.

I have mentioned this in the past of creating a virtual air gap in this way.  But the issue I have with it of course is that you have to have the passwords stored in some method to log into the switch.  Still, better than nothing, but now with immutable storage, I’m a lot more comfortable going that route instead.

right, there is no easy way to accomplish this, but the idea behind is to protect the storage, if you get a bad actor inside your VBR server, you have a bigger problem than a leaked switch password, with a user only able to enable / disable a few ports.

also this was done before immutability was available, so a cheap workaround, they are poor! 

I do see the utility of this, but I dont like that it adds extra steps and possible troubleshooting in case of a DR or quick recovery, but is a good way to “kind of” air-gap a repository.

cheers.

@MavMikeVBR - I’m late to the thread...not sure if you resolved this and made your choice already, but Scality can help you with an immutable on premise storage appliance for use with Veeam (although there is no “digital disconnect” feature). There is a free trial over at https://artesca.com/

Cheers

Adam

Find out first if you want onprem or cloud. 

Next I’d decide, the size you require using a sizing calculator at VeeamBP as you will need that talking to vendors and reps.  

You will need to know how many copies of production data, size of servers, change rate and as much as you can.

After you know the size, what features do you want, speeds, RTO/RPO. Are you looking at slower larger disk, or an all flash array? do you need to boot up all the VM’s from backup to run in production while doing a restore? it’s going to get slow on a bunch of spinning rust if your production SAN is an AFA.

Any SAN can be stacked up with a Linux immutable repository these days. Things like Object First, and Exagrid take a lot of the work away, and scale quite nicely as you grow.  Wasabi is a great cloud solution that can be made immutable with no egress fees. At the end of the day. Immutable and AirGap are not the same thing though.  

Example. If i put an immutable Linux host in front of my storage, add MFA to Veeam, separate VLANS isolated to a specific jump box, and have my SAN management port with a simple password, I’ve wasted my time if someone can go in and format or delete the volumes/pools.  You need to make sure you are secure everywhere. This is where Tape is so good. When I eject a tape, unless you you physically access or destroy the datacenter, that data will remain. If you do this for multiple sites or ship them elsewhere, you are even more protected. You can encrypt the tapes and put them in a safe for internal threats for double protection.

I am a huge fan of tape because it’s cheap too. If I export a Quartey job for ransomware protection, I don’t have to worry about it using all my space or being too expensive. If I am using cloud storage or disk, there is a lot more cost associated with it.  It’s nice to say, lets just keep that 6 more months incase someone wants to restore something.

• this is more of an example. quarterly jobs in my environment are not even cheap on tape anymore. I’m sure by the time LTO10 comes out and I upgrade I'll be waiting for 12 

I was supposed to mention this! But good thing you did already Adam!