How to Offload Backup Files to Capacity Tier via Google Cloud Private Access

This article documents configuring an environment so Veeam Backup & Replication Object Repository will use Google Cloud Private Access to connect to a GCS bucket instead of the public IPs.

Connectivity from on-premises to private access can be accomplished via Cloud VPN or Direct/Partner Interconnects to Google Cloud, and Private Access enabled on the VPC Subnet.

Note: Backup repository servers located in GCE need to be on a VPC Subnet where Private Access is enabled. 

If the Gateway server assigned with the Object Storage Repository settings has a restricted internet connection, that machine cannot perform Certificate Renovation List (CRL) checks. In such a scenario, disable certificate revocation checks by creating the following setting on the machine assigned as the Gateway server within the Object Storage Repository settings.

Note: This setting will disable TLS revocation checks for all interactions with Object Storage performed by the machine where the registry value is created.

• For Windows-based Gateway servers, create the following registry value:
  
  Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\
  Value Name: ObjectStorageTlsRevocationCheck
  Value Type: DWORD (32-Bit) Value
  Value Data: 0
  
• For Linux-based Gateway servers, add the following entry to the /etc/VeeamAgentConfigIf the /etc/VeeamAgentConfig file is not present, it must be created. file:
  

  ObjectStorageTlsRevocationCheck=0