Hello DPM users,
Let's talk about an isolated VLAN for the DPM backup traffic. I've set up a new Failover Cluster for Hyper-V. It's for a completely private network (no customer tenants), so the VMs and the hosts are on the same VLAN and in the same Active Directory domain. I am leveraging LBFO and Management OS interfaces on the Hyper-V switch to isolate the Live Migration traffic, plus another cluster network for CSV redirection, etc., on their own VLANs. The iSCSI shared storage is also completely isolated, on separate physical NICs. So, while my users can see the Hyper-V hosts like any domain member server on layer 2, they can't see any of the underlying raw VM traffic (RAM contents, storage blocks) without breaking through the VLAN segmentation first.
OK, so what about DPM? I want to have the backup traffic invisible to the production VLAN, not just for that extra layer of security, but for better traffic management (jumbo frames, trunking priority, etc.). Since DPM communicates with the VM's guest operating system, it appears we need to set up a separate NIC on each protected VM, put that on an isolated VLAN, and use Add-BackupNetworkAddress on the DPM server to tell it to use that address.
My question is regarding DNS, and I wonder if anyone with experience setting this up has any ideas. Naturally I would ensure the IP address on the isolated backup VLAN for the VMs or the DPM server are not entered into DNS, so that workstations don't decide to use that address for whatever reason, and fail to reach the server they're looking for. But then I found some posts describing setting up isolated VLANs for DPM, and they conflict.
First, Microsoft TechNet:
https://technet.microsoft.com/en-us/library/hh757982(v=sc.12).aspx
This says specifically that the DPM server and protected server have to be able to resolve each other's addresses by FQDN, including those on the backup network. It doesn't mention DNS or HOSTS files, but it does say you should get both IP addresses returned when using nslookup, which only uses DNS. So, this article is telling us to have the backup address in DNS. If you do this, you might have a bunch of traffic from user workstations, printers, scanners, user devices, etc., possibly trying to hit your servers on the backup network address, and network communications will fail, since it won't be reachable. Maybe each workstation or device will be smart enough to pick the IP address that it is directly connected to every time, but should we really count on that?
Then, look here:
http://www.itprotoday.com/system-center/how-configure-backup-network-microsoft-s-dpm-2010
This one says, correctly, about the isolated IP address, that "There will be negative consequences to AD if its IP address is registered in DNS." Their recommended solution is to keep those IPs out of your DNS zone, and set up the HOSTS file on the DPM server to point to the protected servers using their IP address on the isolated network. This seems to solve the problem, but it seems like a bit of a hack, that will cause manageability and scalability problems. Also, if you're backing up a domain controller, the DPM server will contact the domain controller on its backup network for its routine domain communications, which isn't what we want.
This blogger says he did the same, but used the HOSTS file on each protected server as well:
https://charbelnemnom.com/2014/04/isolate-dpm-backup-traffic-in-hyper-v/
So, what is the best way to do this? What works and what doesn't?
We also have to consider recovery, and what challenges this setup might create, both for bare metal recovery of VMs and Hyper-V hosts themselves.
Thanks in anticipation for your input.
Jeffrey Fox
