Azure VMware Solution Support — Considerations and Limitations

Implementation Step 1 - VMware Azure Solution

1. Deploy and access AVS.
   
   After deploying AVS, you will end up with an AVS private cloud resource and an Azure virtual network associated with it. If you have not done so, you will need to provision an externally accessible workload with access to this virtual network. Review: Microsoft - Learn how to access an AVS private cloud and Microsoft - Configure networking for your AVS private cloud.
2. Ensure you have network services configured.
   
   You will need to deploy DHCP and DNS. You may also wish to configure an identity provider.
   
   For this, your Hub virtual network will act as a central point of connectivity between your on-premises network, your other Azure-native services, and your AVS private cloud. For an architecture overview, please reference Microsoft - Learn how AVS integrates with native Azure services.
3. Create a DHCP server.
   
   Create a DHCP server on NSX. Be sure to add an NSX-T network segment if you have not already done so and change its default DNS settings under Advanced Networking & Security. Review: Microsoft - Create and manage DHCP in AVS
   
   (Note that it is possible to use a local DHCP server in the private cloud instead of the NSX-integrated option, but you would not want to use external DHCP and route broadcast DHCP traffic over the WAN.)

4. Configure a DNS service.
   
   For Azure DNS resolution, it is recommended you configure an AD domain controller and Azure DNS private zones. Microsoft - AVS DNS Resolution Considerations
   
   Be sure to configure DHCP in the step above to point directly to this local DNS server or Azure DNS.
   
   (Optionally, you can configure a DNS forwarder service on NSX, ensure your NSX Tier-1 Gateway is associated with your edge cluster, allowing you to configure stateful services. Set up a DNS zone for your NSX deployment and then create a DNS forwarder service. VMware - Add a DNS Forwarder Service.)

5. Configure an identity provider in the Azure portal.
   
   Configure vCenter SSO to point to the same AD domain controller as in the previous step. This can be integrated using Azure AD Connect for identity purposes. Microsoft - AVS Identity Sources
6. Configure external storage
   
   For virtual machine storage, if you want to use something besides VSAN, you can configure third-party datastores. Veeam will be able to read data from these datastores for processing, for example:
   • Azure NetApp Files
   • Azure Elastic SAN
   Note that third-party virtual machine storage may be subject to different network throughput than local VSAN storage, considering that it is externally connected.
   
   Note that for some third-party storage implementations, additional networking is configured on AVS. These network switches are used for storage traffic but, depending on the environment may be partially visible using standard permissions. You can ask Microsoft Support to fully hide these network switches from the vCenter credentials used or contact Veeam Support for a hotfix that ignores switches it does not fully have access to.
   
   For backup storage, see Implementation Step 5 — Add Veeam Repository. When writing to a local target, make sure to use a local disk, not a file share mount. For example, using Azure Blob or Azure Files via an NFS mount to send backup data to from Veeam Backup & Replication is not supported.

Implementation Step 2 - Veeam Backup & Replication

• Use a new Windows Server virtual machine and install Veeam Backup & Replication. This can be deployed within any AVS or on-premises datacenter environment, if network connectivity exists between it and the AVS vCenter as well as other Veeam servers if needed, or other virtual machines for guest processing.
• Ensure DNS settings are configured so that this server can resolve the fully qualified domain name (FQDN) of the AVS vCenter Server.
• Check the below information carefully for known limitations and configuration steps before you proceed.

Implementation Step 3 - Add VMware vCenter

Add vCenter to the Veeam console. Review: Veeam - Adding VMware vSphere Servers

• When adding a vCenter server, specify the fully qualified domain name (FQDN) that ends with avs.azure.com.
• Use the cloudadmin@vsphere.local user, or create a vCenter User with the required permissions.