The repository type that will be most impacted by using Veeam’s native encryption is dedupe repositories. Dedupe repositories are backup repositories that use deduplication appliances or software to reduce backup size and optimize storage utilization. However, if you use Veeam’s native encryption for backup jobs that target dedupe repositories, you will lose most of the deduplication benefits, as encrypted data blocks cannot be deduplicated effectively. Therefore, it is recommended to use either the encryption feature of the deduplication device or software, or avoid encryption altogether for dedupe repositories.

The component that can help meet the requirement of alternative decryption capabilities on encrypted backups in the event of lost passwords is Veeam Backup Enterprise Manager. Veeam Backup Enterprise Manager is a web-based interface that allows centralized management of multiple Veeam backup servers. It also provides a password loss protection feature that enables authorized users to restore encrypted backups without entering passwords if they forget or lose them. This feature requires enabling password loss protection in Veeam Backup Enterprise Manager settings and assigning a security officer role to a user who can approve password recovery requests.

References: [Veeam Backup Enterprise Manager], [Password Loss Protection]

A possible issue that could arise if you put the backup repositories in the backup network only is that laptop agents cannot communicate with the repository. This is because laptop agents are not part of the backup network, which is non-routable according to the existing technical environment. Therefore, laptop agents cannot access or write data to the backup repositories in the backup network unless there is a proxy or gateway server that can bridge the communication between them.

References: [Veeam Agents Management Guide], [Veeam Backup Infrastructure Sizing Calculator]

The assumption that can be made for the conceptual design is that Veeam Agent backups of sale staff laptops should be managed by the backup server. This assumption is based on the best practice and recommendation for using Veeam Backup & Replication. Veeam Agent backups of sale staff laptops should be managed by the backup server to enable centralized management, monitoring, and reporting of all agent-based backups. This can also simplify the backup configuration, scheduling, and retention for the laptop agents.

A possible cause of failures to meet the requirement to test gold tier backups is that you cannot firewall traffic between vLANs in the SureBackup job configuration. This could prevent the gold tier virtual machines from communicating with each other or with other required services in the isolated virtual lab. For example, if a gold tier virtual machine needs to access a database server or a domain controller in another vLAN, it might fail to start or function properly in the SureBackup job. Therefore, it is important to ensure that all necessary vLANs and network settings are configured correctly in the SureBackup job.

The steps that should be taken to correct the storage configuration based on the customer’s hardening requirements are to add hardened repositories to each Scale-out Backup Repository and evacuate the data from the CIFS extents. A hardened repository is a type of backup repository that provides immutability and ransomware protection for backup files by using Linux XFS file system features and Linux access control mechanisms. A Scale-out Backup Repository is a logical entity that groups several backup repositories into one pool of storage. A CIFS extent is a type of backup repository that uses a shared folder on a Windows or Linux server as a backup target. By adding hardened repositories to each Scale-out Backup Repository, you can ensure that your backups are secure, compliant, and efficient. By evacuating the data from the CIFS extents, you can remove the risk of ransomware infection or deletion of your backups.

The recovery point objective (RPO) requirement of periodic backups every hour for gold tier virtual machines directly conflicts with the technical requirement of all backups must complete within the hours of 5 p.m. to 8 a.m. local time. This is because these two requirements are mutually exclusive, as hourly backups would need to run during the daytime as well as the nighttime, while the backup window only allows backups to run during the nighttime. Therefore, you need to get clarification from the customer on which requirement has priority and how to adjust the other one accordingly.

The retention requirement for gold tier virtual machines is that they must have 14 daily, eight weekly, three monthly and seven yearly backups. This requirement can be derived from the technical requirement of having eight weekly backups, three monthly backups, and seven yearly backups for regulatory purposes, as well as the business requirement of having daily backups for gold tier virtual machines.