Every good IT infrastructure also needs a good, multi-level backup system. As a vExpert, you not only get VMware by Broadcom licenses for your HomeLab, but you can also obtain an NFR license from Veeam with a one-year term and all features.

Most people are familiar with the 3-2-1 rule for backups, but Veeam now recommends an extended version, the 3-2-1-1-0 rule (https://www.veeam.com/blog/de/321-backup-rule.html).

I have decided to run through the whole thing with Veeam 13 and set up a corresponding environment in my home lab.
I have plans to do the following:

  • A virtual Veeam Backup & Replication Server based on the new Linux appliance
  • A physical Veeam Hardened RepoServer to store local backups
  • S3-based cloud storage to store copies of the local backups.

This would fulfill the 3-2-1 rules. I will consider how to cover the additional 1-0 as I go along with the setup.

Download the right file

The first step is quite simple: log in to the Veeam homepage and download the appropriate file. When you go to the download page in your profile, just scroll down a little and look for the Veeam Software Appliance. In this guide, I´ll show the OVA file way of the installation.

Click on Download to be redirected to the actual download page.
Select “Hardened Software Appliance” and choose “VMware OVA”, then hit the download button.

Back on the first download page, you will find the download link for the Veeam Backup & Replication Console at the bottom. You will probably need this later on, as not all functions are available in the new web UI yet. I also downloaded the Veeam Infrastructure Appliance here, which I will need later for the hardened repo.

OVA Deployment

Since the OVA file comes without any further configuration options, I will not describe these steps here.
In its delivery state, the new VM consists of the following components:

  • 8 CPUs
  • 16 GB memory
  • 2x 240G hard drives
  • One vmxnet3 network card

Please note that both CPU and memory hot add are enabled. If you do not want this, you should change these settings accordingly.

So, we start with the OVA file having been successfully transferred and the new VM then being switched on.

Appliance configuration

Use the arrow keys the move down and hit enter to accept all agreements.
Give your system its hostname and continue with next.
I selected my active network card ens192 and then selected “static” in the right-hand menu to assign a static IP address.
Enter IP, netmask and gateway and confirm everything with apply.
As you can see the IP has been applied, the system should now respond to pings if you want to test the network.
Change the timezone to the current one, configure at least one NTP server.
When hitting the sync button, chrony will try to contact the configured NTP servers to adjust the time of the appliance. I would recommend checking and fixing this if necessary. If the time of the appliance is drifting too much, MFA will not work anymore, and you´ll get into trouble.
Enter a DISA-compliant password, at least 15 characters, small and capital, numbers, special characters. After confirming the password with the next button, the MFA config will take place.
Use the shown code or the provided QR code to register your server within your preferred Authenticator app.

It might also be a good idea to make a copy of the activation code or QR code, or to back up the authenticator app. If you ever have problems with your cell phone, this could save the day.

Provide a generated number to complete MFA setup.
When the MFA setup is done you´ll get back to the veeamadmin page, just hit next once more.
Enter a DISA-compliant password again, at least 15 characters, lowercase and uppercase letters, numbers, special characters. Oh, and there’s another rule: the password must not be the same as the one for the admin user.
Recap time, you can scroll through the list one last time to verify that everything is correct, then finish the installation by hitting enter while “finish” is selected.
The system will now write down your config and bring up all services.
Once everything is done, you´ll see this screen.

The system offers us two web interfaces for different administrative tasks.
The Veeam Host Management Console can be found at https://<vbr hostname>:10443. This can be used, for example, to change the network and time server settings, but also to install updates, create support bundles, and manage local users.

At https://<vbr hostname>, you will find the actual Veeam Backup & Replication WebUI. Later in this series, we will add the hardened repo here and create our first backup job, among other things.

Applying a license

As mentioned at the beginning, I have an NFR license. In order to use and test all functions, I must activate them on the VBR server.

To do this, I first log in to the web interface of the VBR server with the veeamadmin user.

To add a license file, head to the confuration pages by clicking on “Coniguration” in the top right corner.

Next choose “License information” from the menu in the right, and afterwards click on “Install”. Now select your license file and upload it to your server.

As soon as the license file was activated, the server will start looking for updates.
I decided to click an “Yes” to install the mentioned updates.
If you did the same, just wait till all updates got installed and the VBR server is back online.
When you head back to the license page, you´ll see the NFR license is in place and active for almost one year.

That’s it for this part.
Coming up next, a hardened repo will be installed on a physical server.