7.2 Air-gapped backups using Tenants to Tape

Tenants to Tape is a new feature available in Veeam Cloud Connect 9.5 Update 4 that enables service providers to offer truly air-gapped protection to their tenants.

Tenants to Tape has two main use cases:

• For the service provider: it’s one of the two options to protect Cloud Connect by creating a second copy of the stored data (the other one being the copy of backups into the Capacity Tier of SOBR);
• For the tenant: service provider can offer Tape as a service options by storing additional copies of tenants backups into tapes, to achieve regulatory compliance, long-term retention, and so on.

In both cases, Tenants to Tape is a managed service operated by the service provider.

The first step for the service provider is to setup a media pool. Tenants to Tape supports two types of media pools:

• GFS Media pool
• GFS WORM Media pool

Depending on their needs, the service provider can choose to use one of the two options. For example, internal protection of Cloud Connect may leverage regular media pools, while services like immutable backups may use WORM (Write Once Read Many) media pools.

7.3: GFS Media Pool

Cloud Connect protection

From the main section Tape Infrastructure the service provider selects Tenants to Tape:

7.4: Tenants to Tape

In the selection list, the service provider will use the Tenants option and will add the tenants he wants to protect. One option is to select All Tenants to protect the entire Cloud Connect environment:

7.5: Backup all tenants to tape

In the remaining steps, the service provider selects the previously created GFS media pool as the target, configures additional options and set the schedule for the scan needed to find new backup sets. This scan should ideally happen after all the new backups have been uploaded by the tenants, for example in the late morning.

When new backup sets are identified, they are processed by the tape job and stored in the media pool:

7.6: Tenants to tape in action

Tape as a Service

Service providers can also offer Tenants to Tape to individual tenants, in order to guarantee to them additional secure copies of their data. The configuration of a tape job is similar to the one explained before; the main difference is that here the service provider only selects one tenant:

7.7: Select a single tenant to be protected

Restore from tape

Regardless the choice for the backup, the restore from tape is common for both options. The service provider goes into the tape infrastructure and selects Restore Tenant from Tape to start the restore wizard:

7.8: Start the Restore Tenant from Tape operation

Using the Add Tenant button, the service provider selects one of the available backups:

7.9: Select a tenant’s backup

Finally, the service provider has multiple target options, like to restore the backups into the original location following a data loss in the cloud repository for example, or in a new destination like a new cloud repository or a removable media to ship the backups to the tenant.

7.10: Select a destination