Considerations and Limitations

Before you install Veeam Infrastructure Appliance, consider the following:

• You can assign the following roles to a machine deployed with Veeam Infrastructure Appliance:

• Virtualization Server and Host
• Backup Proxy

• General-Purpose Backup Proxy
• VMware Backup Proxy
• VMware CDP Proxy

• Cache Repository
• Backup Repository

• Linux Server
• Hardened Repository
• NFS Share

• Scale-Out Backup Repository Extent

• Guest Interaction Proxy
• Gateway Server
• Mount Server
• WAN Accelerator

• The following roles cannot be assigned to a machine deployed with Veeam Infrastructure Appliance:

• Tape Server
• Off-Host Backup Proxy
• Log Shipping Server
• NDMP Server

• In addition to the standard system requirements for a backup infrastructure component, the machine where Veeam Infrastructure Appliance is installed must also meet the following requirements:

• (Hardened Repository only) Hardware RAID controllers must be used. Software RAID, Intel VMD VROC, and FakeRAID controllers are not supported.
• UEFI Secure Boot must be enabled.

• When you install Veeam Infrastructure Appliance, the Rocky Linux operating system is installed with predefined settings, including volume partitioning and user account creation. After installation is complete, you need to proceed with the initial configuration of Veeam Infrastructure Appliance, which includes setting up default user accounts and basic system settings.

• Veeam Infrastructure Appliance uses DISA and FIPS-compliant Linux policies. These policies cannot be changed.

• Veeam Infrastructure Appliance is compliant with most DISA STIG requirements except for the following ones:

• V-258230 — RHEL 9 must enable FIPS mode.
• V-257816 — RHEL 9 must disable the use of user namespaces.
• V-270180 — The RHEL 9 fapolicy module must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
• V-258042 — RHEL 9 user account passwords must have a 60-day maximum password lifetime restriction.
• V-258054 — RHEL 9 must automatically lock an account when 3 unsuccessful logon attempts occur.
• V-257832 — RHEL 9 must not have the gssproxy package installed.
• V-257819 — RHEL 9 must ensure cryptographic verification of vendor software packages.
• V-257928 — All RHEL 9 world-writable directories must be owned by root, sys, bin, or an application user.
• V-257929 — A sticky bit must be set on all RHEL 9 public directories.
• V-257828 — RHEL 9 must not have the nfs-utils package installed.