Best Practice for VEEAM on NAS
Hello,
I use to backup my Windows 2016 HyperV HV Server (2 VMs) with Veeam Backup and Replication on a Synology NAS repository
COnfig 1:
Windows Server 2016 HV: 192.168.1.1
- VM1: 192.168.1.100
- VM2: 192.168.1.101
NAS Synology 192.168.1.200
COnfig 2:
Windows Server 2016 HV: NIC1: 192.168.1.1, NIC2: 172.16.10.1
- VM1: 192.168.1.100
- VM2: 192.168.1.101
NAS SYnology: 172.16.10.200
COnfig 3:
Windows Server 2016 HV: 172.16.10.1
- VM1: 192.168.1.100
- VM2: 192.168.1.101
NAS Synology: 172.16.10.200
My concern is about security of data on the NAS which stores my backups (in the event of a CryptoLocker attack in particular)
- Which configuration is recommended for best practice?
- Is Config1 really unsecure and not recommended?
- Should config 3 works OK? The HV will have Internet access ? How?
Thank you for your comments and recommendations
Regards
I use to backup my Windows 2016 HyperV HV Server (2 VMs) with Veeam Backup and Replication on a Synology NAS repository
COnfig 1:
Windows Server 2016 HV: 192.168.1.1
- VM1: 192.168.1.100
- VM2: 192.168.1.101
NAS Synology 192.168.1.200
COnfig 2:
Windows Server 2016 HV: NIC1: 192.168.1.1, NIC2: 172.16.10.1
- VM1: 192.168.1.100
- VM2: 192.168.1.101
NAS SYnology: 172.16.10.200
COnfig 3:
Windows Server 2016 HV: 172.16.10.1
- VM1: 192.168.1.100
- VM2: 192.168.1.101
NAS Synology: 172.16.10.200
My concern is about security of data on the NAS which stores my backups (in the event of a CryptoLocker attack in particular)
- Which configuration is recommended for best practice?
- Is Config1 really unsecure and not recommended?
- Should config 3 works OK? The HV will have Internet access ? How?
Thank you for your comments and recommendations
Regards
David Johnson, CD
create your share on the synology so that only the account used by VEEAM has access i.e. share level permissions, ntfs permissions. You also might want to consider a starwind virtual tape library for your backup #2 and connect to azure/backblaze or other online provider for your offsite backup.
You don't mention what other networking equipment you have. Certainly preventing communication from guest to NAS is a good start. If something gets to the host you're still in big trouble. Lock down NAS as much as possible. Get a copy of data off the NAS and off your local network if all possible.
ASKER
No special networking equipement. A regular switch, no VLAN
What are my options to copy data off the NAS to the local network? Using HyperBackup on a USB drive connected to the NAS should be safe enough?
Cannot copy data online since we are talking about un huge file of 500Go and daily incremental files of 30Go. Not enough bandwith
Thanks for your suggestions
What are my options to copy data off the NAS to the local network? Using HyperBackup on a USB drive connected to the NAS should be safe enough?
Cannot copy data online since we are talking about un huge file of 500Go and daily incremental files of 30Go. Not enough bandwith
Thanks for your suggestions
This question needs an answer!
Become an EE member today
7 DAY FREE TRIALMembers can start a 7-Day Free trial then enjoy unlimited access to the platform.
View membership options
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.