One of the features Veeam doesn’t talk enough about (in my opinion) is SureBackup. I work in the financial sector in the States, a highly regulated market with annual audits by the government. Auditors present a catalog of way over a hundred questions about IT operations, policies, and of course… backup.
One of the main questions is, how do you ensure you can restore your backups successfully and comply with your BCP (Business Continuity Plan)? After all, without testing a backup, it is just hope sitting on a repository.
This is where SureBackup comes into play. In a nutshell it provides:
- Automatically Verifies Backup Recoverability
- Boots Systems Directly from Backup in an Isolated Lab
- Can be a start for a Clean Room after infection
- Performs Automated Health & Application Testing
- Provides Audit & Compliance Proof
SureBackup depends on several components to play nicely together, specifically:
Virtual Lab
The virtual lab provides the isolated environment in which backed-up machines run. It prevents the test workloads from conflicting with live production systems while allowing Veeam to communicate with the machines for verification.
Application Group
The application group contains the supporting systems needed by the machine under test. These systems might provide authentication, name resolution, database, or application dependencies.
SureBackup Job
The SureBackup job ties the testing process together. It identifies the virtual lab, application group, backup source, machines to test, and verification activities to perform. It can also run according to a predefined schedule.
When I first set it up years ago, I was struggling a bit, to be honest. It is one of those things, once you have done it, it makes sense, but the first setup can be confusing. So I’m going to walk through a setup in my homelab. This is done under the most current version of Veeam at this time, 13.1
First step is to create a Virtual Lab. Navigate to Backup Infrastructure > SureBackup > Virtual Labs > Add Virtual Lab
Next we need to choose our host. You can have several Virtual Labs on one host, or separate them by host.
My cluster has 2 nodes right now, so I chose the second one. I’ll leave the resource pools and folder at the default.
For home use I’m leaving redirect write cache off.
Next comes the more interesting part. SureBackup uses a proxy for network segmentation. Just like a VM, it needs a datastore and IP configuration.
Make sure you choose the right network if you have several different ones.
DHCP is usually fine. We can also activate IPv6.
This is a very important step. For my needs, Advanced fits just right. I might want to leave the VM running in an isolated environment. I have never used Basic.
Next we map the networks and can set a VLAN ID if needed. As a reminder, the appliance sits between the production network and the virtual lab network to ensure we have separation.
Next we configure the vNIC. Important step, the appliance assumes the gateway address of your SureBackup workload. Veeam points out that this is usually the gateway address of your network.
Static mapping is another feature worth mentioning because it can save you some troubleshooting time.
Static mapping allows you to assign a specific IP address from your production network to a VM running inside the isolated SureBackup Virtual Lab. This is useful when you need to access a recovered VM from outside the lab, such as for application testing, troubleshooting, or allowing users to validate functionality before the SureBackup session is shut down.
One issue you might run into is routing. Depending on the complexity of your network, you might have to add a route on your Datacenter routers to the virtual lab network range. This gets missed sometimes; I missed it too on my first deployment.
Lab has been deployed, nice!
Next it is time to create an Application group. Navigate to Backup Infrastructure > SureBackup > Application Groups > Add Group
We can have one or several machines in an Application Group. Think of a Domain Controller, DNS, DHCP, and a SQL Server. So let’s add a machine.
Note: you can choose to run it from a replica or a backup (and storage snapshots)
I’m adding one of my VPN servers (Amnezia). You are then able to define roles for it.
Under Startup Options, an important part is the startup time option. Depending on the load of your environment, you might run into timeout issues, so you may have to increase the boot time. I have had that happen on a few occasions.
You can also define your own test scripts. There are predefined ones to make the process easier, but you can write your own as well.
This is all we need to do for the Application Group. Now it’s time to create a SureBackup job to tie it all together.
Let’s navigate to Home > SureBackup Jobs > Add Job
Create a new job. We want to make sure we select Full Recoverability Test.
Next select the Virtual Lab we created earlier.
Next we select the Application Group we just created. If you want to keep the machine running after the tests, select “Keep the application group running after the job completes.”
In the next window, we could add more machines to be tested. For this exercise, we will leave it blank.
Once nice feature here is we can use our Virtual Lab as a clean room station/ hunting station. We can have Veeam Threat Hunter scan it, or even add Yara Rules.
For our automation purpose, we can schedule this job. This is what we do at my organization for various jobs, and you get a report emailed with the test results. Auditors love this!
All done. Now it’s time to run this!
From the vCenter side, we can see how the environment is starting up.
Our SureBack workload is running.
You remember when we set up the static mapping earlier? The workload is reachable under 192.168.254.19.
Since this is a Linux machine I’m using SSH to log into it.
Lastly, we will stop the SureBackup session now. We explicitly set the job to keep it running, so we must manually stop the session.
Yep, workload is gone for sure.
So this concludes our little example of SureBackup. It works pretty smoothly and is a great help for us at work. There are two gotchas I mentioned to be on the lookout for.
- Routing to the virtual lab network
- Start up timer for the virtual machines might need to be increased.
I hope you all found this useful. Let me know in the comments what other user cases you found for SureBackup!