Search
StarWind is a hyperconverged (HCI) vendor with focus on Enterprise ROBO, SMB & Edge

Configure Veeam Data Domain Retention Lock

  • March 12, 2024
  • 10 min read
Cloud and Virtualization Architect. Paolo is a System Engineer, VCP-DCV, vExpert, VMCE, Veeam Vanguard, and author of the virtualization blog nolabnoparty.com
Cloud and Virtualization Architect. Paolo is a System Engineer, VCP-DCV, vExpert, VMCE, Veeam Vanguard, and author of the virtualization blog nolabnoparty.com

Latest Veeam v12.1 supports the Data Domain Retention Lock feature to manage immutable backups directly from Veeam Backup & Replication.

Although the Data Domain is not always a good choice to store primary backups (random read is not so good), it is a widely used device and fully compatible with Veeam 12.1.

To leverage the Data Domain Retention Lock feature using Veeam Backup & Replication 12.1, you need to meet the following prerequisites:

DDBoost protocol enabled.

Data Domain Retention Lock in Compliance mode.

Configure the Data Domain Retention Lock

Before configuring the Veeam Backup Job using the Dell Data Domain as target repository, it is required to configure the Data Domain Retention Lock in Compliance mode.

Enable the Compliance mode

Using your favorite browser, enter the address https://<IP_data_domain> to access the DD System Manager. Enter the sysadmin credentials and click Log in.

configure-veeam-data-domain-retention-lock-02

Go to Administration > Compliance and check the compliance status. By default the Retention Lock Compliance status is Disabled.

Administration Compliance | check the compliance status

To enable the Retention Lock Compliance you need to run some commands from the Data Domain CLI. Using a tool like PuTTY, SSH the Data Domain using the security user credentials. Run the following command:

# authorization policy set security-officer enabled

Authorization policy | set security-officier enabled

Logoff from the console and login once again using the sysadmin account. Run the following command and specify the security user credentials when requested:

# system retention-lock compliance configure

System retention-lock | compliance configure

System is rebooted automatically.

System is rebooted automatically

When the boot process completes, login to the Data Domain using the sysadmin credentials to access the DD System Manager. Go to Administration > Compliance and click Enable Retention Lock Compliance.

DD System Manager | click Enable Retention Lock Compliance.

 

Click Add to create a new iDRAC user. You can create up to 13 users. At least one user must have the Operator role.

Operator role | Click Add to create a new iDRAC user

Select Operator as Role and enter the Username and Password. Click Add.

Username and Password | Select Operator

 

The new user (operator in the example) has been created. When all required users have been created, click Enable.

Enable Retention Lock Compliance

Enter the security user credentials to enable the new users and click OK.

 

The system is rebooted.

Alert | The system is rebooted

Access the DD System manager and go to Administration > Compliance. By default the new created iDRAC users are Disabled and must be enabled to allows the login to the iDRAC. Click Enable.

DD System manager | default the new created iDRAC users

Enter the security user credentials, specify the Duration for the iDRAC session and click Enable.

Enable iDRAC aser | specify the Duration

The created user (operator in the example) Status is now reported as Enabled.

Compliance | The created user

If you don’t enable the user, when you try to login the IDRAC the operation will fail.

IDRAC | the operation will fail.

 

Create MTree

Now go to Data Management > MTree and click Create to create a new MTree. Write down the just created MTree Name (/data/col1/ddboost in the example).

 Data Management | MTree and click Create

Scroll down and check the DD Retention Lock status. By default is Disabled.

DD Retention Lock status | By default is Disabled.

Access the Data Domain CLI using the sysadmin user and enter the following command to enable the Retention Lock for the MTree created:

# mtree retention-lock enable mode compliance mtree /data/col1/ddboost

Retention Lock | Access the Data Domain CLI

Go back to the DD System Manager. Checking now the DD Retention Lock status in the MTree page, the Mode is now reported as Compliance. Make sure the Retention period max value is higher than the immutable retention you will configure in the Veeam Repository.

DD Retention Lock | MTree page

 

Configure the Veeam Repository

From the Backup Infrastructure area right click Backup Repositories and select Add backup repository.

Backup Infrastructure | right click Backup Repositories

Select Deduplicating storage appliance.

Add Backup Repository | Select Deduplicating storage appliance.

Select the Dell Data Domain storage.

Deduplication Storage Appliances | Select the Dell Data Domain

Enter the Repository Name and optionally a Description. Click Next.

New Backup Repository | Enter the Repository Name

 

Specify the Data Domain server name and the Credentials for the DDBoost user configured in the Data Domain. Click Next.

New Backup Domain | Specify the Data Domain server

Click Browse to specify the Storage Unit.

New Backup Repository | specify the Storage Unit

Select the Storage Unit to use and click OK.

Objects | Select the Storage Unit

Enable the Make recent backups immutable for x days option specifying the immutability retention. Click Next.

New Backup Repository | Make recent backups immutable for x days

If the Retention Lock Compliance mode feature hasn’t been configured in the Data Domain, you receive an error. Immutability cannot be set at this stage.

Veeam Backup and Replication | Retention Lock Compliance mode

Specify the Mount Server to use and click Next.

New Backup Repository | Specify the Mount Server

In the Review section click Apply to process the required components.

New Backup Repository | Review section click Apply

Click Next.

New Backup Repository | Click Next

When the repository has been created successfully, click Finish to close the wizard.

New Backup Repository | click Finish to close the wizard

Create a Backup Job

From Home area, right click the Jobs section and select Backup > Virtual machine.

Veeam Backup and Replication | Create a Backup Job From Home

Specify a Name and click Next.

New Backup Job | Specify a Name

Click Add and select VMs to backup then click Next.

New Backup Job | Click Add and select VMs

Select the just created Data Domain as Backup repository and specify the desired Retention policy. Make sure the value set is equal or greater than the immutable retention configured. Click Next.

New Backup Jop | Select the just created Data Domain

Click Yes to apply the correct settings for the Data Domain.

Veeam Backup & Replication | Click Yes

If you don’t need to enable the application-aware processing, click Next.

New Backup Job | click Next.

Click Apply.

New Backup Job | Click Apply

Enable the Run the job when I click Finish option then click Finish.

New Backup Job | Enable the Run the job when I click Finish

The configured Backup Job is being processed.

Backup DD | The configured Backup Job

After some minutes the backup has been completed successfully.

Backup DD | backup has been completed successfully

 

Test the backup immutability

Once the backup has been processed, it’s time to test if the backup is immutable.

Go to Backups >Disk section and right click a VM in the processed backup. Select Delete from disk.

Backups Disk | section and right click a VM

Click Yes to confirm.

Veeam Backup and Replication | Click Yes to confirm

As expected, the backup cannot be deleted since it’s immutable.

Removing backup | As expected, the backup cannot be deleted since it's immutable

Finally is possible to leverage the Data Domain Retention Lock when this storage device is used as Veeam Backup Repository protecting backups against deletion, overwriting and changes.

 

Found Paolo’s insights on configuring retention lock on Data Domain useful? Looking to implement immutable backups at a fraction of the cost and using your own hardware?
Dmytro Malynka
Dmytro Malynka StarWind Virtual SAN Product Manager

For Veeam users, we offer a compelling option. StarWind Virtual SAN (VSAN) is a software-defined storage solution that features file locking techniques and integrates with Veeam Backup & Replication (B&R) v12, enabling the deployment of immutable backup storage (aka “Hardened Backup Repository”). This approach provides an easy way to secure backups with immutability in just a few clicks. Sounds appealing? Request a brief StarWind VSAN demo now and discover how straightforward it can be!