We have an internal disagreement on the architecture for services for private cloud customers. Services include backup.
I think services - incl backup - belong on a management network which can acccess VCentre for VADP conversations. Our VC instance is accessible at layer 3 on the hypervisor management network. This is a routed / firewalled link and is totally inappropriate for backup data in our case
Some folk think backup should have the VSA placed directly on the hypervisor management network. I disagree as I think the hypervisor mgt network is for management, not large scale streaming of backup data.
Both camps won / lost : the prod VSA is on a management net with an additional dedicated backup network created at layer 2 between hypervisors and VSA. Non prod VSA is connected directly to the hypervisor network.
Confounding factor : a SINGLE VCentre for both prod and non prod clusters is on the prod hypervisor management network- and hypervisor mgt traffic for non prod is routed to non prod. Yuck.
However, both prod and non-prod backups work in NBD mode. Great!!! But whilst I prefer the management network approach, it is not actually clear to me how prod works at all!!!
If I read the backup logs for VSA, I see the VM discovery happen and each of the VMs are identified along with their hypervisorss which are in turn identified by name or IP - name or IP on the hypervisor network.
If I trace network traffic for the job, I see that data does indeed traverse the dedicated backup netwok.
Fantastic!!! This is what I want. But if the logs identify hypervisors by IP on the hypervisor network, by what mechansim is data pushed over the dedicated backup network? This is my question.
The dedicated backup net has no references in cust side DNS or DNS on my side. Logs do not reference IP addresses on this network.
My guess is that this is part of the VADP conversation : I guess that all the IP addresses of multi-homed ESX nodes / VSAs are shared and the elements work together to decide where data goes. Logically, a layer 2 link to VSA is always going to be more efficient than a layer 3 comnversation from hypervisor mgt network to the VSA on the management net. But I dont know. I cannot find any low-level refs on VADP that address this.