Configuring Cisco HyperFlex Controller Firewall for Veeam standard backup processing with DirectNFS enhancements

Important!

This configuration is automated with the Veeam HyperFlex integration (Backup from Storage Snapshot) and is only needed if the Cisco HyperFlex System was NOT added to the Veeam Storage Infrastructure and DirectNFS with standard VMware snapshot processing is used. Veeam recommends using the HyperFlex Integration with Backup from Storage Snapshot with HyperFelx Snapshots instead of DirectNFS.

VMware vSphere VMs hosted on Cisco HyperFlex access the storage with the help of special Cisco HyperFlex HX Data Platform controllers. The controllers are dedicated VMs deployed on the same VMware ESXi host that hosts the VMs.
By default, the controllers are configured to receive traffic only from the ESXi host where they are located. To provide communication between Veeam Backup & Replication and the Cisco HyperFlex storage system, you need to manually enable the Direct NFS access mode between the backup proxy and controllers.

To enable Direct NFS access on a data platform controller:

1. Log on to the controller with an account that has root privileges:

#ssh <user account>@<Controller IP Address>

2.    Enable the NFS traffic between the backup proxy and NFS share:

stcli security whitelist add --ips <Veeam NFS Data IP>

To verify backup proxy settings, use the following command:

stcli security whitelist list

Important!
Veeam Backup & Replication cannot back up VMs using DirectNFS mode if they have a VMware vSphere or Cisco HyperFlex snapshots present prior to backup. This limitation does not apply to Backup from Storage Snapshot over NFS.