Veeam v11: configure double immutable backups on-prem and cloud - pt.2


To avoid possible ransomware attacks issues, configuring double immutable backups on-prem and cloud in Veeam Backup & Replication v11 enforces dramatically the security of your data.

Once the required Repositories have been configured, the Backup jobs configuration is the next step to perform.


Blog series

Veeam v11: configure double immutable backups on-prem and cloud - pt.1
Veeam v11: configure double immutable backups on-prem and cloud - pt.2


Configure the primary Backup Job

Access the Home area and select the Backup section. Right click on the Backup item and select Backup > Virtual machine > VMware vSphere.


Enter a Name for the Backup Job and click Next.


Click Add and select the VMs to backup (vSphere Tags are used in this example). Click Next.


Select the local Backup repository and specify the Retention policy (14 days in the example). Click Next.


Enable VSS processing if required then click Next.


Specify the Schedule then click Next.


Click Finish to save the configuration.


The created Backup Job.



Configure immutable backups with Backup Copies

From Home area, right click Backup Copy and select Backup Copy > Virtual machine > VMware vSphere backup option.


Enter the Name for the Backup Copy and specify Immediate copy (mirroring) as Copy mode to use. Click Next.


Click Add and select the Backup Job to process. Click OK.


Once the objects to process have been selected, click Next.


Select the Scale-out Repository previously created as Backup repository and specify the Retention policy. Make sure the retention is the same or greater than the immutable retention specified in the Hardened Repository. As prerequisite to leverage Immutability, you need to enable Keep certain full backups longer for archival purposes option and click Configure. Configure GFS based on business requirements then click OK.


Configured the target, click Next.


Select Direct as Data Transfer mode then click Next.


Click Apply.


Thick the Enable the job when I click Finish option if you want to run the backup immediately. Click Finish to save the configuration.


The created Backup Copy job.



Test the backup

To test the overall backup configuration, right click the created Backup Job and select Start.



Primary Backup

The first backup is being performed and stored to the primary Repository.


Depending on the amount of data to backup, after some minutes the Backup Job completes successfully.



First immutable Backup Copy on-prem

Because the Immediate copy (mirroring) as Copy mode has been configured in the Backup Copy Jobs, both jobs start running as soon as a restore point appears in the corresponding repository.


The first Backup Copy job stored to the Hardened Repository on-premises completes successfully.



Second immutable Backup Copy in the cloud

When the first Backup Copy has been completed, the offload process to Object Storage in the cloud (Wasabi) starts immediately (mirroring configured as copy mode).


After some minutes also the second immutable Backup Copy completes successfully.




After processing both Backup and Backup Copy jobs, we have the following backups available:

  • One Backup stored to the local Primary Repository


  • One immutable Backup Copy stored to the Hardened Repository on-prem.


  • A second immutable Backup Copy stored to the Object Storage in cloud.



Are backups immutable?

To test if backups are actually immutable, let's try deleting them from the corresponding repository.


On-prem backup

Access the Backups > Disk (Copy) area and right click the Backup Copy just processed. Select Delete from disk option.


The task fails because backups cannot be deleted due to immutability. The error reported is the following:

Error [Backup Copy [3-2-1-1-0]\Backup Website [3-2-1-1-0]] Failed to delete backup Error: Unable to delete backup in the Capacity Tier because it is immutable until 22 December 2021 16:11:09.



Immutable Cloud backup

Access the Backups > Object Storage area and right click the Backup Copy just processed. Select Delete from disk option.


Also in this case, the task fails because backups cannot be deleted due to immutability.


This configuration with Veeam Backup & Replication v11 ensures a very high level of security protecting the two backup copies against deletion, overwriting and ransomware attacks.

Veeam Backup & Replication v11 is available to download as 30-day trial.


Leave a Reply