This is a post to show you how to setup Veeam SureBackup for automated restore testing and checking your restored VMs function as expected
Surebackup
SureBackup is a technology included with Veeam Backup and Replication that is designed to test our existing backups. It does this by mounting the backup files (within our existing backup storage), creating a switch on the host with all relevant VLANs (with no uplinks) and starting up the VM. SureBackup will then run various tests that you specify. Communication between the Veeam Backup server and the mounted VMs is handled by a Veeam proxy appliance.
The overview of the process is as below:
1. A SureBackup Job starts and brings up the Virtual Lab and its Proxy Appliance[s].
2. Pick the first VM from an Application Group or the first 3 VMs from a Linked Job. Register and power on a VM and run heartbeat and/or application tests against it. Tests are initiated from the Backup Server through the Proxy Appliance’s NAT and to the test VM.
3. Optionally perform a CRC check on the files.
4. Add the status of the VM to the report
5. Power off and unregister the VM
6. If the VM is a member of an application group and has failed, abort the run
7. Repeat steps 1-6 for the remaining VMs, moving from Application Group VMs to Linked Job VMs.
8. Clean up all the temporary restore VMs and power off the Virtual Lab
Core Features of SureBackup
Application Groups
Application groups are created when we need to test a number of VMs that are related. For example an SQL server may have a dependency on an Active Directory server for authentication and DNS.
Linked Job
We can set the restore to test all the VMs in a backup job by powering on 3 VMs at a time. We will not use this as with so many VMs it would be too time consuming. These tests are basic power on and heartbeat tests, no application level tests.
Virtual Lab
Each job is run inside a virtual lab to isolate it from the live networks. The lab is attached to one host only not a cluster. A standalone vSwitch with no uplinks is created in the host. We will need to provide a datastore for the temporary files used during the testing.
Proxy Appliance
Not to be confused with a Backup Proxy! This linux-based VM bridges the production and isolated networks using iptables and NAT masquerading to allow access to the restored VMs. It is managed entirely by Veeam, including creation, settings, powering on and off, etc.
SureBackup Job
A new job type in addition to Backup and Replication jobs. This option is not visible until a Virtual Lab exists.
Creating an application group
We will be using an application group as we will be testing some related VMs within our environment. We will be using the following VMs from the corporate environment for testing:
monitor01 voned202
To create the application group go to:
Backup Infrastructure> SureBackup> Application Groups> Right click and choose Add Group
Give the Application Group a name and a description. For this example we will use:
Appgroup_Veeam
Veeam Corporate Application Group Test
Click Add> From backups
Next on the Virtual Machines page select some VMs:
monitor01 voned202
Leave the default settings
Click Finish
Virtual Lab
The Virtual Lab is slightly more complex to configure. This will create a vSwitch and a Proxy Appliance VM on the host and datastore that we choose.
We need to provide an IP for the proxy appliance that will be on the same network as the backup server.
Then go to Backup Infrastructure > SureBackup > Virtual Labs> Right click and choose Add Virtual Lab. It is also possible to reconnect to a previous Virtual Lab if one exists.
Give the lab a name and description:
Labgroup_Veeam
Veeam Corporate Lab Test
Now we select a host, for this test we will use esxi03 (we cannot choose a cluster for this). Click configure and put into the Test VMs folder.
Click Redirect write cache
Select an appropriate datastore for the temporary files.
Proxy Appliance
On the next page the proxy appliance is configured. Remember this is not a Veeam proxy this is just a routing engine to replace your actual router as it doesn’t exist in the isolated network. Choose a name by clicking configure and use the naming convention as below:
Prxy_Veeam
Then click Configure to set the network settings. Provide the static IP for the proxy using the appropriate IPs (This should be a spare IP on same network as your Veeam Backup and Replication server):
10.40.36.220
255.255.255.0
10.40.36.1
We can also use this for internet proxy but we will not on this occasion.
This is the proxy configured
On the Networking Tab choose Advanced Single-host – we need this as our VMs are in multiple networks. If they were all in the same network we could use Basic/Automatic mode. Then click Next.
Now we setup the isolated networks. These are the various networks that the restored VMs will exist in. If we do not setup and isolated network only verification and heartbeat tests are performed. Once we setup the isolated network ping and script tests can be performed.
When you add the network the name defaults to the name of the production network name appended to the lab name.
There will be one isolated network already, we can leave this as is except for the VLAN ID. We will add 1000 to every VLAN we add as a precaution in case anyone ever adds uplinks to this switch.
Create the additional networks required for the VMs. To do this click Add and choose the network, make sure you choose the same host selected earlier for the appliance. Be sure to name the new networks uniquely then click ok.
Network Settings
Create a vNIC on the proxy server for each isolated network we’ve created.
This is practically the same assigning vnics to your VMs that are in certain port groups.
Though we chose a manual network mode, a route to the masquerade IPs will automatically be created on the Backup server during restore jobs, so we do not have to manage that (this is why we did not put the proxy appliance in a different network than the Backup server).
The proxy appliance is basically going to server as your router between the different networks. Therefore you have to enter the IP address of your default gateway for this network.
No Static Mapping is used
Once you have done this add an IP for the masquerade network. We do not use 192.168.0.0 in our environment so we will use this as the IP 192.168.0.0 but the X.X will be same as the real network.
You then repeat this for every network required. If we need VMs to talk to each other, check the Route network traffic between vNICs. If we don’t need it, it probably won’t hurt, though. Here’s what this might look like when complete. Skip static mapping and then Apply and Finish.
The configuration is applied
While this happens you can watch the live tasks in vCenter. You will see the new switch and the proxy servers being created and configured. Veeam creates an NFS datastore from you backup stored to the host to mount the restored VM.
Create a SureBackup Job
Go into Backup & Replication > Jobs > SureBackup (this is only available if one or more virtual labs exists) and right click to create a new job with SureBackup
Give the job a name and description and click Next. On the next page we must select a virtual lab. In this case, there is only one. Click Next. On the next page we may optionally select an application group.
Select the virtual lab we created earlier
Since we created an application group, we will select it. We cannot edit the application group settings from here, only view them to ensure we select the correct group. We may choose to check the Keep the application group running after the job completes box. If so, the job will remain at 99% with all application group VMs and the Proxy Appliance VM powered on until someone right clicks on the job and chooses Stop Session.
Select the Application Group we created earlier
No linked jobs are used
The Settings page is where you specify to send SNMP or email notifications and determine if CRC checks are performed on the backup files. I only received emails in my testing for failed jobs; there appears to be no exposed setting for whether or not to send emails on successful job runs.
Configure your schedule
Click Finish
After you create the virtual lab, don’t forget to update the lab resources created to add Notes, Tags, and other standard meta-data you use internally.
Running a SureBackup Job
Run the job manually to make sure it works. If your isolated networks are configured correctly the ping test should succeed.
When the job runs you will see the proxy server start, the VM mounted and registered and then the VM start all displayed in vCenter tasks
All being well you will see successes for all VM tests
Overview Diagram
