Integrating Veeam NAS Backup with Dell EMC Isilon

If you still think Veeam only protects VMs you are stuck in 2015. Fortunately for you, I would be lucky to get you to the next paragraph if I dove into everything Veeam can protect, so I will narrow it down to just NAS. More specifically, Veeam's integration with Dell EMC Isilon.

Veeam leverages Isilon's ChangeList API for their SnapshotIQ technology during the backup process to grab only the deltas (changed files and folders) between the current and previous snapshot. Veeam only keeps one snapshot per share on the Isilon. Once the next snapshot is taken the previous is deleted. Minimizing the amount of snaps needed on Isilon can be a massive space saver if the business is retaining 30-plus days worth of snapshots. The integration between Veeam and Isilon allow for both fast backups and potentially reduced consumed space on the Isilon itself.

Increased performance is great and all but saving the business money is even better. In addition to faster backup speeds and less snapshots retained, Veeam provides the capability to instantly recover a share to the same or alternate server whether it is an Isilon or not. Rather than spend money on multiple Isilons for replicas, you can backup your Isilon to something more cost effective and instantly recover file shares in a disaster scenario.

Now, while the main purpose of this post is to inform you of the business value Veeam brings to the table by integrating with Isilon, I also enjoy getting my hands dirty. The rest of this post is a runbook on how to setup/configure Veeam and Isilon together.

NOTE: There are a couple references to Veeam's upcoming v12 release and the enhancements around NAS. Brownie points if you can call out what they are in the comment section.

Isilon Setup

In order for Veeam to leverage Isilon's Snapshot IQ technology, Veeam needs a role with the proper permissions as described here. Instead of making you read that document and manually enter in each privilege though, you can simply take note of the screenshot and Isilon CLI commands below if you prefer.

isi auth user create veeamadmin --zone System --enabled True --set-password
isi auth roles create --name VeeamStorageIntegration --zone System
isi auth roles modify --zone System VeeamStorageIntegration --description "veeam backup role"
isi auth roles modify --zone System VeeamStorageIntegration --add-priv ISI_PRIV_LOGIN_PAPI --add-priv ISI_PRIV_AUTH --add-priv ISI_PRIV_DEVICES --add-priv ISI_PRIV_NETWORK --add-priv ISI_PRIV_NFS --add-priv ISI_PRIV_SMB --add-priv ISI_PRIV_SNAPSHOT
isi auth roles modify --zone System VeeamStorageIntegration --add-user veeamadmin
isi auth roles view Practice --zone System

This creates a custom "VeeamStorageIntegration" role with the user "veeamadmin" associated to it. This role/user needs to be created in the System zone. The BackupAdmin role that comes out of the box with Isilon does not have sufficient permissions.

Lastly, apply the service account you use to any share that needs protecting. We will use this same service account when we add Isilon in the Veeam console.

Veeam Setup

From the Veeam server add the Isilon storage system as described here using the "veeamadmin" user we created above. You can use a root user but the user/role we created is more granular if you prefer. The documentation does a great job guiding you through this step-by-step, so no need for me to plagiarize. Next, add the Isilon under NAS Filer in the Inventory section using your backup service account that was added to the SMB shares.

Check the "Use native changed file tracking" box to ensure you leverage the Isilon SnapshotIQ integration.

Now, it's time to create a backup as described well here. During the backup Veeam creates a snapshot on Isilon as shown below. In my lab, the original backup was 14 folders and 312 files as I am just protecting a small share here for instructional purposes. The next incremental run compared the previous and current snapshot and only found 2 new folders and 7 new files making the backup very performant.

BONUS: See the immutability line item?

To prove I'm not full of it, you can also see the snap in Isilon under Data Protection > SnapshotIQ.

With Veeam v12 coming out later in 2022, NAS backups can target an immutable repository. My lab is using an Object-Lock enabled AWS S3 bucket as the target. There is no way to delete those backups from the Veeam console until the natural expiration date is applied as shown below. In addition, if you login to AWS as a root user and call support they will tell you, "Too bad. We want your storage money."

The Money Saver

Like I mentioned in the beginning, faster backups are great but saving money is better. Many companies store weeks if not months worth of snapshots as well as replicate shares to another Isilon in a DR site. This can be costly if you rarely use your secondary Isilon, or it's main purpose is only for DR. Leveraging Veeam can both reduce the consumed space from snaps as well as replace the replica Isilon with a more cost effective solution.

Instant File Share Recoveries enable companies to store backups in something cheaper and deeper, while also providing quick recovery to the same or alternate server. For example, you could instantly restore to a windows share and have immediate user read/write access.

Starting in v12, instant recoveries of SMB shares in a read/write state will be available as well as NFS shares in a read-only state. In addition, companies will have the ability to migrate the share back to the original source or to a new server. Whether it's the fact that site A is never coming back or simply the business is shifting away from Isilon, you will have the ability to recover NAS data quickly and affordably.

In summary, Veeam's integration with Isilon enables companies to protect their data fast, reduce the amount of snaps taking up consumed space and quickly recover data in a cost effective way.