ESX Virtualization

VMware ESXi, vSphere, VMware Backup, Hyper-V... how-to, videos....

StarWind Virtual Tape Library Best Practices

By | Last Updated:

Shares

As you know, virtual tape libraries (VTL) are a very good way to create air gaps and protect your valuable data or backups from being infected by ransomware. One of the VTLs around there is from StarWind and we have already blogged about this solution in conjunction with Veeam Backup and Replication software and 3-2-1 backup rule in our article here. Basically, the 3-2-1 backup rule suggest storing three copies of data on two different medias where one copy is in an offsite location. One of those media kind is VTL. Today's post will talk about StarWind Virtual Tape Library best practices.

StarWind VTL is a software solution that replaces physical tape libraries with virtual ones. It allows businesses to move beyond their costly and cumbersome tape backup processes, while still meeting the regulatory requirements for data archival and retention. StarWind VTL integrates seamlessly with existing backup software, and creates an immutable and air-gapped backup target that is resistant to ransomware attacks. StarWind VTL also enables tiering and replication of backup data to any public cloud or object storage, such as AWS S3, Glacier, Backblaze B2 for flexible scalability, security, and cost-efficiency.

Quote:

VTL is designed for organizations that want to either get rid of physical tapes completely or to accelerate the backup process, add an extra level of protection and automate the DR process by offloading tapes to the cloud.

StarWind Virtual Tape Library (VTL) can be used to store backups (Storage Repository) and it is also possible to offload Virtual Tapes to the cloud or object storage arrays. Such method guarantees redundancy of backups and fits the 3-2-1 backup rule. It can be useful in DR scenarios or for restoring after a ransomware attack. If there is a requirement to store the backups for a long period of time, offloading to the cloud maximizes the security and minimizes the cost of maintaining a physical tape-based infrastructure.

There can be several installation scenarios for StarWind's VTL

  • Scenario 1 – All in one box – The Backup software and VTL with storage repository on the same box. Easier to manage, typically used in Greenfield environments.
  • Scenario 2 –  Separate solutions – Backup software is installed inside the VM in (or outside) the Cluster, VTL is installed inside the physical server with Storage Repository connected. Usually used in Brownfield scenarios, more flexible on the permissions configuration which allows enhancing the security of the entire setup.

The Virtual Tape Library server is connected to the IT infrastructure, but not joined into the domain, to enhance security.

Screenshot from StarWind

Storage best practices

If your (still) planning to use cheap spinning media, it is recommended to have good redundancy that can be obtained by doing Raid 5, 50, 6 or 60 for VTL storage. If you want faster restores, use flash or hybrid storage.

 

Networking best practices

Network throughput between the IT infrastructure and the VTL server has to be sufficient to ensure that it will not bottleneck the backup performance. 1GbE network is required, while for bigger loads, 10 GbE or higher throughput networks should be in use. It is strongly recommended to have dedicated network interfaces and a separate VLAN to achieve the expected performance.

 

Security recommendations

Here are some of the recommendations I have found on StarWind's site:

  • Don’t join the VTL server to the domain;
  • Assign a separate user to access the backup server;
  • Create a dedicated service user for backup software;
  • In order to fit the ransomware resiliency into the local environment, the Virtual Tape Library should be located on the dedicated storage that is isolated from the production environment;
  • Disable file shares for the StarWind Virtual Tape Library (VTL) host or Storage Repository;
  • Additionally, CHAP authentication and access rights have to be configured for ISCSI connections in StarWind Virtual Tape Library (VTL);
  • Enable firewall and keep antivirus and OS updated;
  • Configure VTL cloud replication to have at least one copy of your backups off-site. This guarantees protection and restores in case of a ransomware attack.

 

Source: StarWind VTL best practices

 

More posts about StarWind on ESX Virtualization:

 

More posts from ESX Virtualization:

Stay tuned through RSS, and social media channels (Twitter, FB, YouTube)

 

Shares
5/5 - (1 vote)

About Vladan SEGET

This website is maintained by Vladan SEGET. Vladan is as an Independent consultant, professional blogger, vExpert x16, Veeam Vanguard x9, VCAP-DCA/DCD, ESX Virtualization site has started as a simple bookmarking site, but quickly found a large following of readers and subscribers.

Connect on: Facebook. Feel free to network via Twitter @vladan.

Leave a Reply

Your email address will not be published. Required fields are marked *

x