What to Consider with Unitrends SAN Direct Backups

Backups are simple, right? Ideally, that’s true. However, backups can be a secondary process often overlooked and often far more intricate than initially perceived.  One area in particular we’ll review today is what transport is being used to protect your virtual machine data.  Is it network based or fabric based and what should you consider when using Unitrends SAN direct backups?

First, we should all understand that network based backups are the norm. In my experience, the vast majority of backups are performed over standard 1Gb or 10Gb Ethernet connections.  And as expected, it typically works great and is the easiest to configure and support.  However, in some cases, it’s beneficial to move that backup traffic off of the network and reduce the hops by ingesting data directly from the SAN storage.   This will likely provide the best backup performance and minimize any additional network load.  Properly designed, this all comes back around to meeting backup windows, recovery times and recovery points.  I’m sure we’ve all heard the terms RPO and RTO thrown around a bit when discussing backups.  This all sounds simple enough, but there are a handful of critical pieces to this process and each should receive proper attention in order to experience the best results.   The information that follows is a list of features and configurations worth understanding when looking to implement SAN direct backups with your Unitrends solution.

Let’s start with our support of SAN-direct backups. SAN direct backups are supported on all Unitrends platforms, both physical and virtual, over both fibre channel and iSCSI protocols.  However, physical appliances and software installable instances will require an additional add-on adapter and configuration to support SAN direct backups.  UEB virtual appliance deployments use HotAdd transport and can leverage native SAN connections from the hypervisor.  Unitrends also only supports SAN direct backups for VMware environments.

As we determine the feasibility of SAN direct backups, the second piece to understand is how are the storage processors configured on the SAN? Understanding how the storage processors are configured is very important, as we have limitations with older arrays running in a Passive/Not Ready configuration.

Configuration Examples:

Active/Active – typically used by higher end SAN’s like HP 3PAR, and EMC Symmetrix.  Note: Not all HP and EMC arrays are Active/Active – Supported

ALUA – (Asymmetric Logical Unit Access) A feature found on many modern storage arrays. Supported but could be slower if an alternate path is used (trespass) for data access.  Note: Even though most arrays will support this configuration, the engineer must be aware of the firmware or OS version running on the array to verify its current enough to have this support built in

Passive Not Ready – default mode for older arrays. Proceed with caution!  This configuration is supported, but with a “Passive Not Ready” configuration, the SAN Direct backups will only work if all virtual machines are accessible by the same storage processor.  If this is not the case, the backups will occur over the LAN

Next, let’s look at how we support multipath fibre environments. While the Unitrends appliance does not natively support active multipath failovers, the appliance can easily be configured to work with multipath environments in Active/Active or ALUA mode.  Always be sure that the Unitrends fibre interface is zoned appropriately, so that it has access to all controllers that it will be protecting.  Single path fibre environments are supported for all array configurations.

Thus far, we’ve primarily discussed fibre channel SAN backup, but what about ISCSI? In an ISCSI scenario, the appliance must connect to the primary array IP that can scan and list the LUNs.  Some arrays will have virtual IPs or Group IPs and they may or may not be able to act as the primary connection for backup.  Unitrends will ignore the redundant paths since the solution does not fully support multipath ISCSI environments.  Here’s an example: The Group IP on an EqualLogic array cannot scan and list the LUNs.  Instead, it’s necessary to choose the IP for the Primary (Active) node.

Finally, and maybe the most important consideration, is understanding whether or not the VMware VAAI feature can be leveraged. Unitrends strongly recommends the use of VAAI to leverage SAN direct backups in the most efficient manner.  This requires both a compatible storage array and vSphere licensing that supports it.  At this time, that’s vSphere Enterprise and higher.  So why is this so important? If the protected virtual machines reside on the same LUN, you must be aware of VMware SCSI locking constraints.  SCSI locks are used for many features in VMware, but snapshots for backups are one of the primary reasons.  Without VAAI, and to prevent SCSI lock conflicts, you must carefully stagger the start times for your VM backups. For more information on SCSI locking, review this VMware KB.

Fortunately, SCSI locking is becoming a thing of the past. For customers using the Enterprise or Enterprise Plus version of VMware, along with a SAN array that supports VAAI, they can avoid SCSI locking issues and backup scheduling headaches.  VMware released vStorage APIs for Array Integration (VAAI) in version 4.1.  Compatible environments for VAAI use Atomic Test & Set (ATS), which is used during creation and locking of files on the VMFS volume, rather than legacy SCSI locking.  The key difference is that SCSI reservations lock an entire storage device while an operation that requires metadata protection is performed.  On the other hand, ATS locking is much more granular, as it supports discrete locking per disk sector.  More information about VAAI can be found here:

To find out if your SAN supports VMware VAAI, you can check VMware’s hardware compatibility list (HCL) here.  Note that it’s helpful to filter by the product and the SAN manufacturer in use, and then select VAAI-Block in the “Features Category” list.

For most environments, standard network level backups are perfectly sufficient. In fact, any scenario where 10Gb Ethernet is available, it often provides a very simple solution to network congestion with very few side effects.  But when it’s desired, SAN direct backups provide an efficient and fast backup alternative.  Keep these considerations in mind, and you will be well on your way to successful backups.   After all, backups are easy, right?


Discover how Unitrends can help protect your organization's sensitive data