Deep Dive - Veeam Backup & Replication with NetApp Storage Snapshots

Deep Dive - Veeam Backup & Replication with NetApp Storage Snapshots Luca Dell Oca EMEA Evangelist, Product Strategy Specialist for Veeam Software, VMware vexpert, VCAP-DCD, CISSP Modern Data Protection Built for Virtualization

Introduction In this technical deep dive, Veeam EMEA Evangelist Luca Dell Oca will guide you through the necessary steps to test and evaluate Veeam Backup & Replication storage snapshots with NetApp. You will learn how to: Deploy and configure a NetApp VSA Connect two arrays and use SnapMirror and SnapVault Connect Veeam Backup & Replication to NetApp arrays Explore NetApp snapshots and run restores using Veeam Explorer for Storage Snapshots Increase backup performance using Veeam Backup from Storage Snapshots NOTE: This document is written for an early internal preview version of Veeam Backup & Replication v8. The user interface may change between the writing of this technical brief and the Generally Available (GA) build. Part 1: Deploy a NetApp Data ONTAP Edge VSA NetApp integration will be included in Veeam Backup & Replication v8. Both Veeam Explorer for Storage Snapshots and Backups from Storage Snapshots will support any NetApp FAS and V-Series storage with at least ONTAP OS 8.1 even with NFS exports! If you want to test these features in your lab, there is an easy solution: NetApp Data ONTAP Edge (http://www.netapp.com/us/products/platform-os/dataontap-edge/). It s a full-featured version of Data ONTAP on a virtual machine (VM). It supports all of the features, including: Snapshot, deduplication, thin provisioned volumes (FlexVol), thin clones (FlexClone) and thin remote backup with SnapVault. Data can be exported via iscsi, NFS or CIFS. And you can use the same management tools such as CLI, the System Manager GUI or VMware vcenter with Virtual Storage Console plug-in. Even if you have a production environment with NetApp arrays, the VSA can be a good alternative to safely tests Veeam before activating the new features in your data center. 2

Download and deploy Data ONTAP Edge NetApp offers a free 90-day evaluation of Data ONTAP Edge by registering on its website. Once you have registered, you will receive some temporary keys and a link to download the VSA in OVA format. To deploy the VSA, simply use the Deploy OVF Template wizard in ESXi or other VMware product (Figure 1). The size of the VSA can vary. The suggested size is 57.5 GB 7.5 GB for the OS and 50 GB for data. You can change this size according to your lab. Figure 1 In the Properties screen (Figure 2), you can configure the VSA to be correctly connected to your lab. 3

Figure 2 In my lab, the iscsi network is available in all ESXi servers and is used to connect to the ethernet storage VLAN where all of my iscsi and NFS storage arrays are connected. After deployment, I also remove three of the four NICs because I don t need them for my lab. Finally, I configured the VSA to have store 200 GB of data. Initial Configuration Once the VSA is up and running and it can be reached in the network, the initial configuration can be done via SSH connection. The login is root with the password you chose during the deployment. First, run the setup command. Accept all the default values that appear in the wizard and configure Time Zone, Location Name, enable DNS Resolver and configure your internal DNS. Once the setup is complete, the VSA should be rebooted using the reboot command. The second part of the installation requires the use of NetApp OnCommand System Manager. By following the instructions provided by NetApp when you downloaded the Data ONTAP Edge VSA, you should have installed it somewhere on your network. Once you start the web-based application, you ll first need to add the Data ONTAP Edge VSA using the IP address and credentials you configured earlier (Figure 3). 4

Figure 3 After few seconds, the VSA appears in the list (in my lab there is also a FAS2020), showing the basic information about it (Figure 4). Figure 4 Next, select the Login button, and again using the configured credentials, open the management interface of the VSA. The first activity is to add the licenses. Open the Licenses section by navigating through the directory tree on the left: Host Name -> Configuration -> System Tools -> Licenses. Add the trial licenses you obtained from NetApp (Figure 5). Figure 5 5

Create a iscsi LUN Let s start with iscsi. Go to the Configurations menu, choose Protocols, then iscsi. I usually change the initiator name to something more easily identifiable then the default name, but this is not mandatory. Next, start the service. Since security is disabled by default, you can move directly to creating your first LUN. From the directory tree, go to Host Name -> Storage -> LUNs. Open the Initiator Groups tab. Here we will register our ESXi servers that will then have access rights to the LUN. Choose Create and give a name to the group, if you have multiple ESXi servers, you can use the name of the cluster. Select VMware as the OS. Add the IQN values of all the ESXi servers (Figure 6). With this setup, it will be easy then to assign any new LUN to a group. You will not have to manually add any new ESXi server to all the existing LUNs. Figure 6 Next, move to the LUN Management tab, and click Create (Figure 7). Figure 7 6

The Create LUN Wizard appears. Configure the LUN with a name, select VMware as the type and configure its size. Check the Thin Provisioned box to save disk space (Figure 8). Figure 8 Since we have FlexVolume licenses, in the next step you can let NetApp select the best location for your volume and move on. Since we created the Initiator Group previously, now we can simply select it to assign this new LUN, and configure a LUN ID (Figure 9). The LUN is now ready to be used. Figure 9 7

Create an NFS export NetApp is known for its NFS support, and Veeam Backup & Replication v8 is going to support VM hosted both on a block volume or in a NFS export. So, it s a nice idea to have also a NFS export to test. To start, go to Storage -> Volumes and click Create. The volume will be carved out from aggr0 (the only aggregate existing in the VSA). It will be configured as NAS (Used for CIFS or NFS access), and I also reserved some space for snapshots. The default is 5%, but I increased it to 10% so there will be more space for running snapshots later. Finally, I chose Thin Provisioned for this volume to save space (Figure 10). Figure 10 If you then go to Storage -> Exports, you will see the NFS export is already created (Figure 11). Default permissions are read/write for any host accessing it, but you will also need to make a change. Figure 11 8

Select the export (1), edit the permissions (2), set the Security Flavor to UNIX (3), and set Anonymous Access to Grant root access to all hosts (4). I m not a NetApp expert so I don t know if this is the best configuration, but in a lab it s a quick way to allow ESXi to access the NFS share. Part 2: SnapMirror and SnapVault In Part 1, I showed you how to deploy and configure a NetApp Data ONTAP Edge VSA, how to create LUNs and NFS exports and how to connect them to a vsphere environment. In Part 2, I will show you how to test two of the replication and data protection features of NetApp in your lab: SnapMirror and SnapVault. NetApp snapshot software First of all, here is a quick review of what SnapMirror and SnapVault are. I adapted these explanations from a part of an article by Nick Howell, which you can read here. SnapMirror is a mirror of a dataset between two different NetApp filers. When you first build a SnapMirror relationship of a volume between two filers, this relationship must be initialized. Initializing the SnapMirror is a fancy way of saying, I need to copy all the data from the source to the destination before I can actually start syncing the data. How does it do this effectively? A snapshot is taken at the time of initialization, and this is called your baseline. Contents of this snapshot are completely synced between the two filers, including any and all other snapshots you ve taken on the source. Since snapshots of a volume are stored within said volume, and you re making a 1:1 mirror copy of said volume, all the other snapshots from the original source volume are coming along too. So when you go to snap list <vol name> or Volume -> Snapshots -> Manage in FilerView, you will see all of your scheduled snapshots, a new one ( baseline ), and all of these will exist for that volume on both filers hosting the SnapMirror relationship. SnapVault is the disk-to-disk backup version of SnapMirror. Where SnapMirror is the 1:1 scheduled syncing of a volume, SnapVault is the scheduled backup of a volume only copying changed blocks in Snapshots from the source to the destination. SnapVault systems are made up of two major components: SnapVault primary systems: These are the source systems containing volumes/ datasets that you want to backup. SnapVault secondary systems: These are the destination systems where you store long-term archives with as many iterations of a dataset as you have available disk space to store them. 9

You can SnapVault many primary systems to a single secondary system, again, for as much disk as you have available on the secondary system to store data. For every controller (two on clustered systems) you must have a SV_Primary license if you intend to use SnapVault to back up volumes on that controller. However, you will only need the single SV_Secondary license to act as a source. Veeam Backup & Replication is able to read and retrieve data from both SnapMirror and SnapVault copies. Deploy a secondary VSA As you have probably already understood from the descriptions of the two NetApp technologies, you will need an additional NetApp filer to be used as a target. In my lab, I m going to deploy an additional Data ONTAP Edge VSA. You can follow the instructions I published in Part 1, and you will only need to use a different IP address. Remember to enable the iscsi service if you are going to replicate iscsi-based volumes. Veeam Backup & Replication will need to connect to the secondary filer via this protocol. Set up SnapMirror Once both the VSAs are in place, it s time to set up our replicas. Let s start with SnapMirror. In the source filer (the first VSA I deployed in Part 1), go into Data Protection and select SnapMirror. As explained at the beginning, we first need to create a SnapMirror relationship. We do so by hitting the Create button. Following the Wizard (Figure 12), we first of all need to decide if edgevsa (the name of my filer) is going to act as a source or a destination. Figure 12 As I said, SnapMirror replicas are created per volume. 10

First, select which volume you want to replicate (1).Next, select the destination system (2). If you registered both of your VSAs in the OnCommand System Manager, you will be able to simply select it from a dropdown list. In my example, I selected edgevsa-secondary, which is the second VSA I deployed earlier (Figure 13). Figure 13 As you ll notice, I did not configure any previous volume in the secondary VSA as I did in the first one, nor I did connect it to my vsphere cluster. Nonetheless, NetApp is able to create a new volume for the SnapMirror activity from within the wizard (Figure 14). 11

Figure 14 Finally, set up the most important part the schedule (Figure 15). Figure 15 NetApp offers really complex schedules in which you can change the scheduling scheme based on the day of the week, the time of day, as well as other parameters. From the SnapMirror Relationship Create Wizard, I chose Create new schedule for SnapMirror relationship (1), then clicked Create (2). Next I chose the Basic schedule (3), set Recurring Days to Daily and set the Recurring Schedule to Run Every 1 hours (4). 12

In the same screen, you can also initialize the relationship as I explained at the beginning. This means a first complete replica of the volume is performed and the destination VSA is populated. You can also configure a bandwidth limit in the following screen (Figure 16) before saving the relationship and starting to replicate. After some time, depending on the size and I/O activity of the selected volume, the relationship is in place, and we can see its details. Figure 16 SnapVault The other data protection mechanism available on NetApp is SnapVault. For the sake of comparison, SnapMirror is more like a Veeam replica, while SnapVault is more like a Veeam backup. Setup of Snapvault is as quick and easy as SnapMirror. Using the same infrastructure (edgevsa as the source and edgevsa-secondary as the destination) I m going to save the content of the NFS export. The best option is to configure SnapVault in the destination filer. So, login into the secondary VSA and go into Data Protection -> SnapVault. Here, you select Create in the relationship tab (Figure 17). Figure 17 13

The wizard asks you for the source filer. Here you ll select the primary VSA for the Source System (edgevsa in this example), and remember to flag Provide access to destination system, which tells NetApp to set up the correct access rights to let the two filers communicate with each other. In the following screen, the wizard asks you to select the interface you want to use (e.g., on a multihomed filer you can use a dedicated connection for SnapVault) and the source volume you want to save (Figure 18). Figure 18 In the destination, you can create a new volume to hold the SnapVault backups, and in order to save space, you can enable both Thin Provisioned and Storage Efficiency (runs deduplication). Then, you can apply a Schedule (accept the default or create a new one). In my lab I configured SnapVault to create a copy every four hours and to keep six copies so I have a full day of history. After some time, the state of the relationship is going to be listed as snapvaulted, meaning your backup is in place. In Part 3, we will see how Veeam Backup & Replication interacts with NetApp. 14

Part 3: Veeam Explorer for Storage Snapshots In Parts 1 and 2, I showed you how to configure a NetApp filer, how to add a second one and how to enable data protection with SnapMirror and SnapVault. Now, it s time to finally introduce Veeam Backup & Replication into the architecture, with its new support for NetApp storage snapshots! Add storage to Veeam Backup & Replication The first step you need to take is to connect Veeam Backup & Replication to the NetApp filers you have. In this way, Veeam can scan and catalog any resource that is available on your arrays. Start by going into the SAN Infrastructure section of the left menu, right-click on the NetApp link select Add Storage (Figure 19). Figure 19 The wizard guides you through the needed steps. The only two pieces of information you ll need are the management IP of your arrays and the credentials to log into them (usually the root account you configured when you deployed the array). Once all the arrays are registered into Veeam, they are automatically scanned to discover every VM they have, regardless where they are stored. You are going to see snapshot chains, SnapMirror and SnapVault information and in each of them you can see the hosted VMs (Figure 20). Figure 20 15

As you can see in my example, my edgevsa array has two volumes one published via iscsi (edgevsa_iscsi_lun_vol) and one via NFS (edge_nfs_vol). They are both connected to my vsphere cluster as I explained in Part 1. The iscsi volume has SnapMirror in place and it s replicated to the volume edgevsa_ iscsi_snapmirror on the secondary VSA. Finally, the NFS volume has SnapVault in place, and you can see its schedule is creating daily copies (one every four hours) that are then saved into the remote volume called nfs_snapvault. Restores via Veeam Explorer for Storage Snapshots In each available copy of any volume, if I look at its content, I can see the VMs it contains. Each of the volume copies in both arrays can be used as source for Veeam restores. I can also search for a specific VM and see all its available copies directly from the root of the NetApp infrastructure (Figure 21). Figure 21 If I select one of these VMs and I start a restore (e.g., a Linux file-level restore), I can immediately see all the available snapshots that have been taken for this VM (Figure 22). Figure 22 If you look at the date and time of any snapshot, you can see each of them is separated from the other by four hours. This is confirmation that Veeam is reading the information from the SnapVault I configured. 16

You can also start the restore from the Backup & Replication menu (Figure 23). Figure 23 Veeam Explorer for Storage Snapshots populates the SAN section of the Backups list, so you can easily see which restore points you have and where they are located. You can run any kind of restore Instant VM Recovery, Instant File-Level Recovery, U-AIR (Universal Application-Item Recovery) starting from any restore point that you already have in your NetApp infrastructure, without creating an additional backup. In Part 4, I will show you how Veeam Backup & Replication can directly back up VMs running on NetApp using Veeam Backup from Storage Snapshots. Part 4: Veeam Backup from Storage Snapshots In Part 4, I will show you how Veeam can leverage NetApp Snapshots to create hardware-assisted backups. Veeam Backup from Storage Snapshots uses storage snapshots as the data source for backups so that any VMware snapshot stays open only for few seconds, thus allowing for faster backups even for heavily utilized VMs with a high I/O activity. Check your backup infrastructure In order to use Backup from Storage Snapshots, your Veeam infrastructure has some requirements that need to be met, including: At least one proxy with direct access to the storage fabric. (If you are using Fibre Channel (FC), the proxy needs to be connected in the FC fabric. If you are using iscsi or NFS (yes, Backup from Storage Snapshots for NetApp supports also NFS!) the proxy should be in the same network as the storage array.) Veeam Backup & Replication v7 Enterprise Plus licenses (other editions do not include Backup from Storage Snapshots) Modified access permissions on your NetApp array that grant the Veeam backup proxy has at least read access to the volumes you want to back up 17

Once you have the correct infrastructure in place, you can simply edit an existing job or create a new one in order to enable Backup from Storage Snapshots (Figure 24). Figure 24 One nice enhancement that is coming with version 8 is the Failover to standard backup option. Previously, a backup created from storage snapshots would have failed if for any reason it was not able to connect to the storage array. Now, it can simply fail over to a standard backup, so that your job will be completed regardless. Backup from Storage Snapshots as seen in Veeam Once the job is executed, you can see the specific actions it takes when using Backup from Storage Snapshots from the job activity (Figure 25). Figure 25 The job has created and then deleted a storage snapshot in the NetApp array, and has used it as its data source. And if you select one of the VMs, this is what you ll see (Figure 26). 18

Figure 26 You can appreciate the real difference Backup from Storage Snapshots provides. The job starts as always with a vsphere snapshot, but once the storage snapshot is created, the vsphere snapshot is immediately removed. Instead of staying open for the whole duration of the job, the VM snapshot was open for only 22 seconds. What about NFS? Earlier I said NFS is also supported, and the example in the previous section is created with the NFS volume from my NetApp array. How is it possible? Don t VADP libraries only support block volumes when used for data extraction directly from the arrays (what we call Direct SAN in Veeam Backup & Replication)? Yes it s still correct. VADP does not support Direct SAN backups with NFS. Simply, Veeam is not using the VDDK driver in this situation. Instead, Veeam developed a proprietary NFS client that runs in the proxy and connects to the NFS exports just like any Linux or ESXi server would. You can appreciate what happens by looking at the local processes and network ports of the proxy when a job using Backup from Storage Snapshots is running (Figure 27). Figure 27 19

The job has parallel processing enabled, and it s saving two VMs with one disk each. So, two VeeamAgent processes are retrieving data from the NetApp array (red arrows). Compression and deduplication are enabled as well. In fact you can see the Network Send Bytes values are much lower than Network Receive Bytes values. The total amount of data is then sent to a third agent (green arrow), which is the Veeam backup repository, and if you look at numbers, the sum of Network Send Bytes from backup proxies is basically the same as the Network Received Bytes from backup repository. But, looking at the network connections is even more interesting (Figure 28). Figure 28 VeeamAgent is retrieving data from the NetApp array (IP 10.2.70.50) connecting to it via TCP port 2049. Guess what? TCP-2049 is the NFS server running in the NetApp array. NOTE: The NFS client is available only when you run backups using Backup from Storage Snapshots. It is not an alternative to simple Direct SAN backups. NetApp snapshots and vaulting While a backup is running, what happens in the NetApp array? As you could imagine, Veeam sends a request to the array to create a snapshot of the desired volume (Figure 29). Figure 29 The snapshot is temporarily created, and after the backup job is completed, it s removed. 20

And there is another interesting feature to explore. We saw in the previous sections that everything in NetApp revolves around snapshots, and that SnapVault is a remote copy of a volume snapshot. Since the storage has already created a snapshot to serve Veeam, why not use this same snapshot as a source for an additional SnapVault copy? In this way, the production storage has to create only one snapshot, that is then used both by Veeam and SnapVault. This is exactly the meaning of the additional options in the configuration of storage integration in the Veeam backup job settings (Figure 30). Figure 30 When you enable Store produced storage snapshots in SnapVault, Backup from Storage Snapshots works in the same way as before, but there is one fundamental difference (Figure 31). Figure 31 21

The temporary snapshot is added to SnapVault before it s deleted. The final result is an additional restore point in SnapVault. I configured six scheduled snapshots, and I now have seven points (Figure 32). Figure 32 The new copy has the name of the backup job and is registered just like any other copy. The only difference comes from the FlexClone license. If you do not have this license, you cannot delete this copy at will, but you need to wait for SnapVault retention to expire and remove it. Conclusion As you can see, this is a very powerful feature for Veeam customers and prospects that are using or considering NetApp storage systems for their vsphere environments. You can find more information on this and other exciting Veeam Backup & Replication v8 features at: http://go.veeam.com/v8. 22

About the Author Luca Dell'Oca is Product Strategy Specialist for Veeam Software based in Italy. Luca is a popular blogger and an active member of the virtualization community. Luca s career started in information security before focusing on virtualization. His main areas of expertise are VMware and storage design, with a deep focus on Cloud Service Providers and Large Enterprises. About Veeam Software Veeam enables the always-on business by delivering Advanced Data Protection for the Modern Data Center. Veeam recognizes the challenges in keeping a business up and running at all times and addressees them with solutions that provide high speed recovery, verified protection, risk mitigation, complete visibility and data loss avoidance. Veeam Backup & Replication leverages the enabling technologies of the modern data center, including VMware vsphere, Microsoft Hyper-V, NetApp Storage and HP 3PAR StoreServ, to help organizations meet RPOs and RTOs, save time, mitigate risks, and dramatically reduce capital and operational costs. Veeam Backup Management Suite provides all the benefits and features of Veeam Backup & Replication along with advanced monitoring, reporting and capacity planning for the backup infrastructure. Veeam Management Pack (MP) extends Microsoft System Center monitoring to enterprise vsphere environments and also offers monitoring, reporting and capacity planning for the Veeam Backup & Replication infrastructure. The Veeam Cloud Provider Program (VCP) offers flexible monthly and perpetual licensing to meet the needs of hosting, managed service and cloud service providers. VCP currently has over 4,000 service provider participants worldwide. Monthly rental is available in more than 70 countries from more than 50 Veeam aggregators. Founded in 2006, Veeam currently has 23,000 ProPartners and more than 91,500 customers worldwide. Veeam s global headquarters are located in Baar, Switzerland, and the company has offices throughout the world. To learn more, visit http://www.veeam.com. 23

Veeam Backup and Replication with NetApp Storage Snapshots To learn more, visit http://www.veeam.com/backup 24