Deep Analysis on How Veeam SureBackup Works

Please refer to the following Deep Analysis on How Veeam Sure Backup Works based on our implementation experience for few clients

What is SureBackup

A SureBackup job is a task for recovery verification. The SureBackup job aggregates all settings and policies of the recovery verification task, such as application group and virtual lab to be used, VM backups that must be verified in the virtual lab and so on. The SureBackup job can be run manually or scheduled to be performed automatically.

But the documentation from Veeam didn’t provided much information on how is Sure Backup Really work in the background, and I had decided to prepare the following diagram for ease of understanding


  1. It will deploy a Small Linux Appliance (512MB RAM) in vSphere Hosts to act as NAT between Production LAN & the isolated LAN for Backup VM
  2. Backup VM (IP Address = Default Gateway= will be boot up remaining its own IP Address in vSphere by connecting to Isolated LAN.
  3. The internal interface of the Small Linux Appliance MUST be configured as in order for the Backup VMs to reach out to production LAN 

Error message – Cannot Ping VM IP Address when Veeam Sure Backup Job if the Internal IP of Linux Appliance is NOT configured as the Default Gateway IP using by Backup VM

  1. One Production IP Address need to be assigned to Linux Appliance ( for it to communicate with Veeam Backup Server (
  2. New vSwitch with No Adapter will be created in vSphere Host to connect Backup VMs to Linux Appliance ( interface to reach to Production LANSureBackup-04
  3. NAT will be done in Linux Appliance
  4. 192.168.3.x (NATing IP) –> 10.3.3.x (Real IP for BackupVM)
  5. **How to Veeam Backup Server knows how to reach Linux Appliance via the NATing IP? **
    Static Route will be automatically inserted in Veeam Backup Server when Sure Backup started 

Step by Step Configuration for SureBackup

High Level Configuration

  • Add Virtual Lab
  • Add Application Group
  • Add SureBackup Job
  • Run SureBackup Job

A. Add Virtual Lab


Go to Backup Infrastructure –> SureBackup –> Add Virtual LAB  SureBackup-06

Enter a Name for this Virtual Lab SureBackup-07

Select vSphere Host with Sufficient Resource (CPU & RAM) to power On all the VMs included in SureBackup Job

Select a Data Store

Click Configure and assign an IP Address (Production LAN) to Linux Appliance – IP Address assigned have to be reachable by Veeam Backup Manager SureBackup-10

Select Advanced Single-Host (Manual Configuration) SureBackup-11

Select Next to continue

Change the Virtual NIC IP Address to match the Default Gateway IP Address of the Backup VM Images which will be restored via SureBackup and assign NAT IP , like 192.168.3.x to 10.3.3.x SureBackup-13

Skip Static Mapping for now (will need to study in more detail for this topic) SureBackup-14
Click Finish to create a New Virtual Lab

**B. Add Application Group **

Enter Name for Application Group

Add VM form Backup

SureBackup-26 Select VM from the recent backup or schedule daily backup job if you would like to run SureBackup job daily

SureBackup-16 Select the Roles related to the VM (i had selected DNS, Domain Controller and Global Catalog) for my AD Domain Controller

SureBackup-17 Reduce the Memory for the VM when it is power on to minimize the resources consumption in the Physical vSphere Host (Optional Step)

SureBackup-18 Click Finish to create a New Application Group Successfully

**C. Add SureBackup Job **

SureBackup-19 Create a New SureBackup Job

SureBackup-20 Select the Virtual Lab created

SureBackup-21 Select the Application Group

Check Notification if you would like to received Email for the job result

SureBackup-23 Schedule SureBackup to run

D. Manually Run SureBackup Job

SureBackup-24 SureBackup completed successfully I will provide more detail based on the Session log above in my next post soon.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top