Learn how to Backup Your Exchange Infrastructure Niels Engelen Systems Engineer for Veeam Software (vexpert, VCP, CCNA) Johan Huttenga Solutions Architect for Veeam Software (MCSA, MCITP)
Contents Executive summary...3 Veeam Backup & Replication overview...4 Veeam Backup & Replication for Exchange....5 Configuring Exchange infrastructure... 5 Exchange roles... 5 Coexistence with older versions... 6 Exchange patching... 6 Database Availability Groups... 7 Mailbox limits... 7 Load testing... 7 Virtualizing Exchange... 8 Configuring backup infrastructure... 9 Installation and requirements... 9 Tips for deployment... 9 Configuring backup jobs... 10 Performing Instant VM Recovery... 11 Performing item recovery... 14 Verifying Exchange backups in the Virtual Lab... 18 Patch testing Exchange in the Virtual Lab... 19 About the Author... 20 About Veeam Software... 20 2
Executive summary This document provides a brief summary of Veeam Backup & Replication (part of Veeam Availability Suite ) and Microsoft Exchange Server. Following a brief discussion of the architecture of both solutions, this white paper focuses on how to protect and restore Exchange data with Veeam Backup & Replication. Veeam Backup & Replication s architecture allows for high-performing, distributed workloads and is one of the most powerful solutions for virtual machine (VM) backup, replication and recovery in VMware vsphere and Microsoft Hyper-V environments. Exchange 2013 s simplified architecture typically one or several multi-role servers makes it an ideal candidate for virtualization. Workload size must be considered, as well as coexistence with older versions and the layout of the database availability groups that hold email data. However, if planned correctly, virtualization will improve availability, resource usage efficiency and manageability, ultimately reducing cost. The exact savings depend on the scenario, but results are typically about 10-50% less power consumption, 10-200% less administration time and significantly less downtime. When it comes to email servers, even one second of downtime matters, and this can come at an astronomical price to the business. The process of deploying Veeam Backup & Replication and setting up Exchange backups is straightforward; the correct permissions are required for backup and restore, and you must configure application-awareness to ensure that Exchange is aware that it is being backed up. This uses Microsoft s Volume Shadow Copy Service (VSS), following Microsoft best practices to ensure a consistent state. After creating the initial backup, it is possible to use it for recovery on a VM level, using Instant VM Recovery and vpower (patented), which can recover an entire VM in less than two minutes by mounting data directly over the network from the Veeam server. It is also possible to recover data on an item or mailbox level using Veeam Explorer for Microsoft Exchange (2010 and later). Backups can also be used to spin up test environments for backup verification, troubleshooting and patch-testing purposes. Veeam Backup & Replication significantly simplifies the protection of Microsoft Exchange Server. It improves availability and uptime through various protection, recovery and testing options. Switching to Veeam can result in significant cost savings; for example, one security vendor saved over $600,000. 3
Veeam Backup & Replication overview Veeam Backup & Replication is one of the most powerful solutions for (VM) backup, replication and recovery in vsphere and Hyper-V environments. With Veeam Backup & Replication, VMs can be backed up to disk, archived to low-cost storage and replicated from one host to another. Recovery of VMs and individual application items can occur in a matter of minutes. The major components of Veeam Backup & Replication consist of a management server, proxy servers, backup repository servers and disk-based backup repositories, but can also include tape and Veeam Cloud Connect servers. The backup proxy servers are Windows-based installations that perform the backup work. The backup repositories hosting backup data can be Windows or Linux-based, network shares or deduplication appliances. These resources (excluding the tape component) can be virtual or physical, depending on the storage and network topology, desired throughput of backup and recovery data streams, as well as the available server resources. Veeam Backup & Replication s architecture allows for resilience and high-performing distributed workloads. Scalability is simple; if more processing power is required, you can add another proxy, and if more storage is required, add another repository. For details, review the product guides online. Veeam s simplicity, efficiency and advanced features can lead to significant cost savings, depending on the environment. Figure 1: General Veeam Backup & Replication architecture 4
Veeam Backup & Replication for Exchange Veeam Backup & Replication has extensive support for Microsoft Exchange 2013. This section will first cover the Exchange architecture and then go over backup configuration and various restore options. NOTE: Although this document tries to be as general as possible, as of this writing, the current version of Microsoft Exchange is 2013 and Veeam Backup & Replication is v8. In some cases the information given here will not apply to older versions. It is possible to restore an Exchange VM using Instant VM Recovery and perform mailbox- and itemlevel recovery for anything within the Exchange Server database (EDB), but you can also leverage Veeam s Virtual Lab for backup verification, troubleshooting and patch testing. Configuring Exchange infrastructure If you require protection for your Exchange setup it is likely that you already have some version of Exchange installed in your environment. But whether Exchange is already installed, or decisions are being made on how to deploy or upgrade Exchange, we hope that some of the information in this brief overview of Exchange 2013 will be helpful to you. Exchange roles The Exchange Server 2013 roles have been simplified where you typically will be deploying multi-role servers hosting both your Mailbox and Client Access Server (CAS) roles in your Exchange organization. This is best practice for quite some time, but in large deployments these roles can be split. The Mailbox Server role will host your databases containing mailbox and public folder information, and it runs email routing services using the Hub Transport Service and Mailbox Transport service. The Client Access Server handles client connections to mailboxes, and it performs traffic filtering and routing using the Client Access Service and Front End Transport service. Although Unified Messaging has been significantly improved in Exchange 2013, there is no longer a dedicated role for this, as the functionality has been split between the Mailbox and Client Access Server roles. As email is one of the most critical IT components in your organization, you will likely be using a dedicated anti-spam and anti-virus solution for Exchange. The built-in Edge Transport role can provide this functionality or you can deploy a third-party solution; and if you have an existing Edge server (2007 or 2010), it can coexist with your new 2013 architecture, or you can deploy a 2013 Edge server (included in 2013 SP1). NOTE: Also included with Exchange 2013 SP1 is more robust client communications protocol: MAPI over HTTP, and more important, a simplified IP-less Database Availability Group (DAG) architecture without cluster administrative access point. IP-less DAGs are supported because Veeam Backup & Replication is agentless, unlike most other backup products. 5
Coexistence with older versions In order to facilitate upgrades, Exchange 2013 can coexist with Exchange 2010 SP3 and higher as well as Exchange 2007 SP3 Rollup 10. Exchange 2003 is no longer supported by Microsoft, so if you want to upgrade to 2013, you must first upgrade all your 2003 servers to an intermediate version. Coexistence can be quite tricky to get right, so make sure that you read the relevant Microsoft documentation for 2007 and 2010 and run this in a test environment first! Figure 2: Sample Microsoft Exchange Server coexistence architecture Exchange patching Because Exchange is a business-critical service and integrates directly with Active Directory (AD), keeping it up to date is very important, not only to ensure the rollout of bug fixes and updated functionality, but primarily to maintain good security. However, upgrading and patching Exchange is not always simple, and installing a cumulative update or service pack can sometimes fail something you cannot afford in a production environment. Make sure that when patching Exchange you first run this as a test, in a test environment that mirrors production; this way you can extend the AD schema, run the install wizards, fix any issues you might have and document the entire process before you run this in production. 6
Database Availability Groups Database Availability Groups (DAGs) in Exchange allow for high availability and site resilience. You can have up to 16 servers in one DAG, which uses Windows Clustering but is managed by Exchange. As a cluster is being used, all Windows servers must be on the same version and patch level. It is possible to have DAGs spanning multiple sites and, perhaps more important, you can use VSS to back up your DAG; but remember that DAGs fail over quite quickly, so make sure that you change the cluster timeouts and also ensure that circular logging is disabled when using VSS. For a deep-dive view of how VSS-based backup works, look at this blog post. NOTE: It is always better to have several small DAGs and several small Exchange VMs than one or two really large ones. Smaller VMs are easier to manage than large ones and the same is true for Exchange databases, especially when considering database replication, failover and RTOs. Mailbox limits Not all of us have the vast budgets and capacity available that enterprise cloud services provide. Although users of these private email services have gotten used to the near-infinite storage capacity available, it does not mean that you, as the provider of the company Exchange infrastructure, can afford to provide this seemingly endless storage capacity. This is not because you want your users to suffer, but limiting capacity will ensure the performance and cost-effectiveness of your Exchange solution so that you will grow within the bounds of your projections and scale appropriately. Of all things configurable in Exchange, mailbox limits are probably the most important they can ultimately make or break a deployment so make sure that you use them wisely (smaller mailboxes are usually better) and, for those users who need larger mailboxes, use In-Place Archiving instead. Load testing It is always a good idea to get an indication of how Exchange will perform in production before actually rolling it out. The sizing calculator will help, but you can also use the Exchange Jetstress Simulator and Exchange Load Generator to simulate actual load. The Jetstress simulator can be used to test storage performance and the Load Generator can be used to test how Exchange will perform with multiple client connections. 7
Virtualizing Exchange It is crucial that you make Exchange a first-class citizen in your virtual environment after all, it is running one of the most mission-critical workloads in your infrastructure. With the current Exchange architecture, it is easily virtualized, and this comes with benefits around high availability, resource usage efficiency and management flexibility, all of which will result in cost savings. Of course the exact savings vary for each deployment, but calculating the ROI should not be hard. The numbers vary, but typically virtualization results in 10-50% less power consumption, 10-200% less administration time1 and significant reductions in downtime. Every second an email server is unavailable is critical; downtime of an hour is generally unacceptable. Extended downtime can come at an astronomical price to the business. It is a good idea to review the detailed VMware and Microsoft best practice documentation concerning the virtualization of Exchange, and even though some of the documentation is a little dated, a lot of it is still relevant today. Also make use of the Exchange sizing calculator to ensure that you allocate the correct amount of resources to each component. Figure 3: Basic virtual Microsoft Exchange Server deployment 1. Figures based in part on VMware data provided by EMA and Cisco customer data. 8
Configuring backup infrastructure When your Exchange setup is virtualized there is no better way to start protecting it than to use Veeam. In order to get started with Veeam Backup & Replication, install it on a Windows-based system. The user guide outlines the system requirements both physical and virtual installations are supported, depending on the transport mode chosen. Download the latest version and patches from: http://www. veeam.com/downloads. Installation and requirements The default installation creates a backup repository on the largest available drive and configures a default backup proxy so VMs can be backed up to this server immediately. The backup infrastructure is scaled with the addition of virtual and physical Windows proxy servers to move data. Disk-based backup storage resources in the form of CIFS shares, LUNs, Linux paths and dedicated deduplication appliances can be used as backup repositories. The entire installation process, including both simple and complex deployment scenarios, is documented at http://helpcenter.veeam.com/ NOTE: For test purposes the Veeam backup server should have a minimum configuration of one Intel/AMD 64-bit capable processor (at least two cores) and 4 GB of RAM when running with the supplied Microsoft SQL Express instance (standalone SQL servers can be used). It is recommended that you allocate more resources for production use. Tips for deployment There are several very good best practice guides for deploying Veeam Backup & Replication, but here are some basics specifically related to Exchange: Always put Exchange on the best performing storage in your environment (when possible) after all, it is a critical piece of your infrastructure. Remember that block-level storage is the only storage officially supported by Microsoft for Exchange. Veeam has multiple data transport modes; for the best performance on VMware, use Direct SAN Access and, when possible, use Veeam Backup from Storage Snapshots for VMware, which supports HP StoreServ and StoreVirtual and devices running NetApp Data ONTAP 8.1 or higher. Veeam Explorer for Microsoft Exchange requires full access to the mailboxes for recovery, so you will need to point it to the correct version of ese.dll in your Exchange environment and configure Application-Impersonation on Exchange for the account that you wish to use for restores. NOTE: You will be required to be a member of Exchange Organization management if you wish to restore public folder data. Currently any account that you wish to use for restores must also be mail-enabled. 9
Configuring backup jobs In order to have the best possible backup of Exchange, it needs to be application-consistent. This is accomplished by using application-aware processing in the Veeam backup job wizard. When the job runs, it will issue the relevant VSS commands required to make an application-consistent backup. Additionally, the backup job can be configured to truncate the logs of the Exchange Server at this point. This can be configured on a job level by right-clicking on a backup job and clicking Edit, followed by Guest Processing and enabling the option called Enable application-aware processing. You will have to provide Guest OS credentials as well. To change this on an individual VM-level and change log truncation behavior, select the Applications option and configure the relevant options. Figure 4: Configuring Application-Awareness. Figure 5: Configuring application-aware processing 10
Performing Instant VM Recovery In case of disaster recovery or other loss of an Exchange server, Veeam can restore the specific server back into a production-ready state in a matter of minutes. Veeam uses patented technology called vpower to do this. With vpower, you can run a VM directly from a compressed and deduplicated backup file. This ground-breaking technology eliminates the need to extract the backup and copy it to production storage; you simply start the VM from the backup. Veeam will expose the VM files in a backup repository through a disk mount. Veeam enables a backedup VM to be powered on and used without having to wait for it to be fully restored. Local disk space serves as a temporary write area, recording changes while the VM is running from the backup. The full VM migration is conducted in the background, after which the VM running from the backup disk can be migrated to production storage for continued operation. To perform an Instant VM Recovery, select the Restore button in the ribbon. Choose Instant VM recovery. Figure 6: The restore button Figure 7: The restore wizard 11
This will start a restore wizard to quickly recover the full VM. First select the backup job that contains the VM or use the search option. Figure 8: Instant VM Recovery wizard In the Restore Point tab, select the point you wish to restore to. Then choose the Restore Mode. Figure 9: Select the correct restore mode 12
Select Restore to the original location if you want to restore VM and the original is lost; do not choose this if the original VM is still available in your infrastructure. This will restore the VM with its original settings, to its original location. If this option is selected, you will pass directly to the Restore Reason step of the wizard. This will re-use settings, such as the original host, resource pool and folder, which were saved in the backup file. Select Restore to a new location, or with different settings if you want to restore VMs to a different location and/or with different settings (such as VM location, network settings, the format of restored virtual disks and so on). If this option is selected, the Instant VM Recovery wizard will include additional steps to allow for customization. In the Restore Reason step you can specify a reason for restore (this is not required, but it allows for auditing), which will lead to the Ready to Apply step where Veeam offers two extra options. Figure 10: Ready to apply settings You can select Connect VM to network and Power on VM automatically so that the server becomes available as soon as the recovery is done. NOTE: The user interface for an Instant VM Recovery on VMware (shown in this guide) and Hyper-V differ slightly; however the general options available are the same. Veeam will now perform the recovery based on the instructions given, exposing an NFS datastore for VMware or using a filter driver for Hyper-V to run the VM from the backup file and power it on so you can use it again. Finally, Veeam can migrate this server back to production using either the virtualization platform tools (Storage vmotion or Live Migration) or Veeam's Quick Migration (VMware only). 13
Figure 11: Successful Instant VM Recovery Performing item recovery Although an Instant VM Recovery is incredibly powerful, you will likely spend more time recovering individual application items. You can use Veeam Explorer for Microsoft Exchange (Exchange 2010 and higher) to perform granular recovery. To perform a restore of a specific Exchange item, select Restore from the ribbon. Figure 12: The restore button This time select Application items under the Restore from backup list. 14
Figure 13: Restoring a specific application item In the next step you will be able to select Microsoft Exchange as the application. Figure 14: Restoring Microsoft Exchange items This will start the Microsoft Exchange Item Level Restore wizard. 15
Figure 15: Microsoft Exchange Item Level Restore wizard Now select the correct Exchange Server and then select the Restore Point. A reason can be defined in the Restore Reason step (for auditing) and when ready, Veeam Explorer for Microsoft Exchange will start. Figure 16: Veeam Explorer for Exchange Once started, you can browse the Exchange database, search for and find the items you wish to restore, such as email, calendar items or tasks. NOTE: Veeam Backup & Replication v8 adds support for restore of permanently deleted items and Online Archive mailboxes. For more information about this and other features, have a look at the What s New document. 16
Figure 17 : Browsing and restoring items After this you can right-click the item or mailbox you wish to restore and select the appropriate option. Figure 18: Restore options for individual items and mailboxes 17
Verifying Exchange backups in the Virtual Lab By leveraging the built-in Virtual Lab technology, Veeam can automatically create an isolated, yet easily accessible environment for performing application-item recovery, validating VM backups and replicas, performing testing, training and troubleshooting without affecting your production environment. Veeam offers a solution called SureBackup, which will automatically verify the recoverability of your backups. SureBackup will start an application group in a separate Virtual Lab, which means there is no impact on production. Once everything is started, Veeam automatically performs the necessary tests to see if the VM can be powered on, if the operating system is healthy, and most importantly, if you can talk with the application that runs on the server. For Exchange, Veeam tests the SMTP port (25) but, if necessary, it is possible to create additional scripts to test services, etc. Figure 19: Configuring the mail server verification option By following the step-by-step instructions presented in the user guide, you can configure a Virtual Lab and get started with automatic testing by using SureBackup. 18
Patch testing Exchange in the Virtual Lab Once you have the SureBackup job configured, you can use Veeam s Virtual Lab to perform patch testing of new cumulative updates for Microsoft Exchange. SureBackup normally stops the VMs after testing is complete, but for patch testing to work, the VMs must continue running after testing (select Edit, the Application Group section, and enable the option: Keep the application group running once the job completes). Figure 20: SureBackup advanced settings By enabling this option you will be able to log on to the servers by using the virtual console via the vsphere Web Client or the Hyper-V Manager and run whatever tests and additional commands are required. Virtual Lab access can be delegated, and because of its usefulness in testing, it can lead to massive organizational savings from streamlining change control to speeding up product development lifecycles. NOTE: Remember that your changes are not saved after you are finished testing, so be sure to document the process, after which you can apply your changes in production. Although it is possible to migrate a VM from inside the Virtual Lab back to production in VMware by cloning the VM or using a Veeam VM copy job, it is not a good idea to do this with Exchange, as it must remain running at all times (where possible). 19
About the Author Niels Engelen (vexpert, VCP, CCNA) is a Systems Engineer for Veeam Software based in Belgium, covering the Benelux region. Niels is a blogger and active member of the virtualization community. Niels has over five years of IT experience, mostly focusing on virtualization and cloud technologies. Follow Niels on Twitter @nielsengelen. Johan Huttenga (MCSA, MCITP) is a Solutions Architect for Veeam Software based in Ireland, covering Europe, the Middle East and Africa. Johan has a wide range of IT experience, focusing primarily on automation, virtualization and various Microsoft products. Follow Johan on Twitter @johanhuttenga. About Veeam Software Veeam recognizes the new challenges companies across the globe face in enabling the Always- On Business, a business that must operate 24/7/365. To address this, Veeam has pioneered a new market of Availability for the Modern Data Center by helping organizations meet recovery time and point objectives (RTPO ) of less than 15 minutes for all applications and data, through a fundamentally new kind of solution that delivers high-speed recovery, data loss avoidance, verified protection, leveraged data and complete visibility Veeam Availability Suite, which includes Veeam Backup & Replication, leverages virtualization, storage, and cloud technologies that enable the modern data center to help organizations save time, mitigate risks, and dramatically reduce capital and operational costs. Founded in 2006, Veeam currently has 29,000 ProPartners and more than 135,000 customers worldwide. Veeam s global headquarters are located in Baar, Switzerland, and the company has offices throughout the world. To learn more, visit http://www.veeam.com. 20
Learn how to Backup Your Exchange Infrastructure 21