How to Connect to an Object Storage Repository via Azure Blob Private Endpoints
Purpose
This article documents how to configure Veeam Backup & Replication to use Azure Blob Storage Account private endpoints (via Azure VPN or Azure ExpressRoute) for Scale-Out Backup Repository offload to Capacity Tier or Archive Tier or to connect to an Object Storage Repository in Veeam Backup & Replication 12 or newer.
Solution
The Veeam Backup Server and the Archiver Appliance must have access to CRLs used by Azure over port 80.
Prepare the Azure Environment
- (If using ExpressRoute, skip to Step 2.) For Azure Blob Private Endpoint support, configure a site-to-site or point-to-site Azure VPN connection to the virtual network required.
- For VPN support, create a virtual network gateway, of type VPN. Give it an
instance nameandregionto match the virtual network you plan to use for the storage account,public IP address name,and theavailability zone. It is assumed if you're using Azure ExpressRoute that you have configured this prior. - Under ↔ Point-to-site configuration, select
Configure now. You'll need to generate a certificate using PowerShell for your connection. Specify an address pool, selectIKEv2andOpenVPN (SSL)as your tunnel type, and for authentication type, chooseAzure certificate, uploading the root certificate contents. - ↓ Download VPN client and install this and the corresponding client certificate on the backup repository gateway servers that will be communicating with Azure Blob. If you have not specified a gateway server, all scale-out backup repository extents must have access.
- For VPN support, create a virtual network gateway, of type VPN. Give it an
- Create a storage account with a private endpoint. Make sure you use supported options and create a container to use.
- To disable public access for an existing storage account, select Networking > Firewall and virtual networks and ensure
public network accessis disabled. If you need to access Azure Blob from another resource without using a private endpoint, for example, to see container contents in the Azure Portal you will need to chooseenabled for selected virtual networks and IP addressesinstead. - Under Networking > Private endpoint connections, click add a + Private endpoint.
- Under Basics, enter a
nameandnetwork interface name. - For Resource, target sub-resource select
blob. - For Virtual Network, select the virtual network you want to associate. You can statically or dynamically allocate an IP address. In these instructions, we’ll be using a static IP address.
- For DNS, make sure you’ve selected ◉ Yes to
integrate with DNS zone.
- Under Basics, enter a
- To disable public access for an existing storage account, select Networking > Firewall and virtual networks and ensure
- Ensure your backup repository gateway servers can resolve the private endpoint via DNS or add the IP address to your hosts file. If you go to the private endpoint in Azure under
DNS configuration, you should be able to see a private link entry that points to the specific IP address. This is required to support Azure Archive Tier as Veeam Backup & Replication Azure Proxy Appliances are deployed dynamically.
Prepare the Veeam Backup & Replication Environment
- If the Object Storage Repoistory you are adding will be used as an Archive Tier for Scale-Out Backup Repository, and want to ensure that the Archive Appliance communicates via a private IP address, add the following registry value on the Veeam Backup & Replication server:
Key Location: HKLM\Software\Veeam\Veeam Backup and Replication
Value Name: ArchiveFreezingUsePrivateIpForAzureAppliance
Value Type: DWORD (32-Bit) Value
Value Data: 1
1 = Enable using Private IP | 0 = Disable
PowerShell cmdlet to create the registry value and enable the setting:
- To configure the Helper Appliance used for Object Storage Repository Health Checks to use the private IP address, add the following registry value on the Veeam Backup Server:
Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication
Value Name: ArchiveUsePrivateIpForAzureHelperAppliance
Value Type: DWORD (32-Bit) Value
Value Data: 1
1 = Enable Archive Appliance use Private IP | 0 = Disable (Default)
PowerShell cmdlet to create the registry value and enable the setting:
Add Object Storage Repository
Add your Azure object storage account to Veeam Backup & Replication.
- Under credentials, add the account and shared key, select Azure Global, and click next.
- Select or create a folder under an existing container and click next.
- All traffic to this Azure storage account should flow via your private endpoint.
More Information
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.