Veeam Orchestrator 4 0 Deployment Guide
Veeam Orchestrator 4 0 Deployment Guide
Veeam Orchestrator 4 0 Deployment Guide
Orchestrator
Version 4.0
Deployment Guide
March, 2021
© 2021 Veeam Software.
All rights reserved. All trademarks are the property of their respective owners.
No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated
into any language in any form by any means, without written permission from Veeam Software (Veeam). The
information contained in this document represents the current view of Veeam on the issue discussed as of the date
of publication and is subject to change without notice. Veeam shall not be liable for technical or editorial errors or
omissions contained herein. Veeam makes no warranties, express or implied, in this document. Veeam may have
patents, patent applications, trademark, copyright, or other intellectual property rights covering the subject matter
of this document. All other trademarks mentioned herein are the property of their respective owners. Except as
expressly provided in any written license agreement from Veeam, the furnishing of this document does not give you
any license to these patents, trademarks, copyrights, or other intellectual property.
NOTE:
Read the End User Software License Agreement before using the accompanying software programs. Using any
part of the software indicates that you accept the terms of the End User Software License Agreement.
Customer Support
Should you have a technical concern, suggestion or question, visit the Veeam Customer Support Portal at
www.veeam.com/support.html to open a case, search our knowledge base, reference documentation, manage your
license or obtain the latest product release.
Company Contacts
For the most up-to-date information about company contacts and office locations, visit
www.veeam.com/contacts.html.
Online Support
If you have any questions about Veeam products, you can use the following resources:
Veeam Availability Orchestrator is built on top of Veeam Backup & Replication and Veeam ONE, and this guide
assumes that you have a good understanding of these solutions.
VAO leverages the backup, replication, failover and restore capabilities of Veeam Backup & Replication to build DR
workflows, to automate recovery processes and to eliminate error-prone manual steps. VAO also provides reporting
capabilities that let enterprises document their DR plans to meet compliance requirements. With VAO, you can do
the following:
• Orchestrate disaster recovery — create workflows to orchestrate recovery operations performed both for
Veeam Backup & Replication backups and replicas, and for replicated storage snapshots created on NetApp
storage systems.
• Automate DR testing — build test schedules to automate the verification of orchestration plans, with
isolated and low-impact testing of VM backups, replicas, applications and storage snapshots.
• Meet DR compliance requirements — generate and automatically update documentation for DR procedures
to eliminate the problem of outdated DR plans.
NOTE
VAO can work with any NetApp SnapMirror snapshots, whether created with NetApp native tools or 3rd-party
integration. However, it is recommended that you drive the creation and transfer of storage snapshots using
Veeam Backup & Replication, as described in the Veeam Backup & Replication User Guide, section Integration
with Storage Systems.
• vCenter Servers
• VAO Server Service — is responsible for managing orchestration plans, and administering user roles and
permissions.
• VAO UI — is a web-based UI that allows users to interact with the VAO Service, and to perform various
configuration and administration actions. In the VAO UI, orchestration plans are designed, checked, tested
and executed.
• Veeam Backup & Replication Server (embedded) — is included in the VAO server to supply Veeam
PowerShell libraries and support certain DR scenarios.
• Veeam ONE Server (embedded) — handles the ONE Business View engine to gather VM inventory. This is a
custom edition of Veeam ONE that should not be used for other monitoring or reporting functions.
• SQL Server — is used to host configuration data, VM inventory and plan definitions. A SQL Server Express
instance can be installed locally with other VAO components. However, for best performance and scalability,
SQL Server Enterprise edition is recommended, which may be a remote server.
All VAO components can be deployed on a single Windows-based physical or virtual machine using the unified
installer.
IMPORTANT
Installation of the VAO server on a machine already running standalone versions of Veeam Backup &
Replication and Veeam ONE is not supported.
NOTE
Best practice recommends that the Veeam Backup & Replication server that runs backup and replication jobs is
located in the DR site. This helps you ensure that the server will not be itself lost as part of a production site
outage.
You can also use the Veeam Backup & Replication servers to create and transfer storage snapshots. For more
information, see the Veeam Backup & Replication User Guide, section Snapshot Orchestration.
NOTE
You can connect only storage virtual machines to the VAO server. Connections to NetApp clusters and nodes
are not supported.
vCenter Servers
All vCenter Servers that manage protected VMs must be connected to the VAO server.
You can also combine any of the described scenarios to support your own data protection strategy. For example,
you can use VAO to orchestrate both failover and restore.
In this scenario, the VAO server that provides plan management, testing and execution is deployed in the DR site,
along with the standalone Veeam Backup & Replication server that protects your production workloads.
In this scenario, the Veeam Backup & Replication server that protects your production workloads is located in the
production site, along with the primary backup repository that stores backup files. The VAO server that provides
plan management, testing and execution is deployed in the DR site, along with the secondary backup repository
that stores backup copy files.
In this scenario, the Veeam Backup & Replication server that triggers the creation of storage snapshots is located in
the production site, along with the storage virtual machine that acts as the source of the data protection
relationship. The VAO server that provides plan management, testing and execution is deployed in the DR site,
along with the storage virtual machine that acts as the destination of the data protection relationship.
In this scenario, the VAO server that provides plan management, testing and execution is deployed in the DR site,
along with the Veeam Backup & Replication server that protects your production workloads and the backup
repository that stores backup files.
System Requirements
The machine where VAO will be deployed must meet the necessary hardware and software requirements. Note that
the VAO server can function as a Veeam Backup & Replication server (in addition to VAO functions) and must have
sufficient resources provided.
IMPORTANT
• Installation of VAO on a machine already running standalone versions of Veeam Backup & Replication
and Veeam ONE is not supported.
• Installation of VAO on a machine with the Domain Controller role is not supported.
Specification Requirement
Hardware Hardware requirements depend on the size of the managed infrastructure. For more
information, see Hardware Recommendations.
Note: It is not recommended to install VAO on a machine running Microsoft Windows Server
Core.
Veeam If a standalone Veeam Backup & Replication server is used for backup and replication task
Software management, it must be version 10a or later.
Note: If you connect a standalone Veeam Backup & Replication server to the VAO server, it
must be joined to either the same domain or a trusted domain.
SQL Server Local or remote installations of the following versions of Microsoft SQL Server are supported:
• Microsoft SQL Server 2019
• Microsoft SQL Server 2017
• Microsoft SQL Server 2016 (2016 SP2 Express Edition is included in the setup)
• Microsoft SQL Server 2014
• Microsoft SQL Server 2012 (2012 SP4 Express Edition is included in the setup)
Note: It is not recommended to use the Express Edition in any production VAO deployments —
it should only be used for product evaluation.
Virtualization VMware vSphere 6.0, 6.5, 6.7, 7.0 (up to 7.0 Update 1)
Platform
Note: The VAO server must be connected to VMware vCenter Servers. Direct connections to
vSphere hosts are not supported.
Number of
Virtualization 100 100–500 500–1000 >1000
Hosts*
CPU 4 vCPUs (minimum) – 8 8 vCPUs (minimum) – 12 vCPUs (minimum) – >16 vCPUs for
vCPUs (recommended) 12 vCPUs 16 vCPUs the VAO
for the VAO server (recommended) for the (recommended) for the server
VAO server VAO server
4 vCPUs (minimum) – 8 >16 vCPUs for
vCPUs (recommended) 8 vCPUs (minimum) – 12 vCPUs (minimum) – the Microsoft
for the Microsoft SQL 12 vCPUs 16 vCPUs SQL Server
Server and Veeam ONE (recommended) for the (recommended) for the and Veeam
database Microsoft SQL Server Microsoft SQL Server ONE database
and Veeam ONE and Veeam ONE
database database
Hard Disk 50 GB for product installation and sufficient disk space for the Microsoft SQL Server and Veeam
Space ONE database (if installed locally). Use the Veeam ONE Database Calculator to size application
data.
• Administrator — can perform all configuration actions, can manage user roles, and can also act as a Plan
Author and Plan Operator for any orchestration plan.
• Plan Author — can create, edit and test orchestration plans, and can also generate VAO reports and view
dashboards.
• Plan Operator — can schedule, run and test orchestration plans, and can also generate VAO reports and view
dashboards.
The following table describes the functionality available to users with different roles in the VAO UI.
Documentation
Setup Account The account used for product installation must be a domain user who has the local
Administrator permissions on the target machine.
VAO Service Accounts The accounts used to run VAO services, Veeam Backup & Replication services and
Veeam ONE services must have the local Administrator permissions on the VAO
server.
The accounts must also be granted the Log on as a service right. For more
information on Windows security policy settings, see Microsoft Docs.
VAO Agent Account The account used to install and run the VAO agent on a Veeam Backup &
Replication server must be a Windows domain account, and have both the local
Administrator and the Veeam Backup Administrator permissions on the server.
VAO User Accounts The accounts used to log in to the VAO UI must be granted the Allow log on locally
right. For more information on Windows security policy settings, see Microsoft
Docs.
vCenter Server The account used to connect the vCenter Server to the VAO infrastructure must
Permissions have administrative permissions. You can either grant the Administrator role to the
account or configure more granular permissions. For more information, see Veeam
Backup & Replication Required Permissions and Veeam ONE Required Permissions.
To be able to open sessions on the vCenter Server system, the account must also
have the Sessions.Validate session privilege on the root vCenter Server. For more
information on session privileges, see VMware Docs.
Microsoft SQL Server Different sets of Microsoft SQL permissions are required in the following cases:
Permissions
• Installation (remote or local): the current account needs the CREATE ANY
DATABASE permission on the SQL server level. After the database is created,
this account automatically gets a db_owner role and can perform all
operations with the database.
• Operation: the account used to run VAO services, Veeam Backup &
Replication services and Veeam ONE services requires the db_owner role, as
well as permissions to execute stored procedures for the configuration
databases on the Microsoft SQL Server.
For more information, see Veeam Backup & Replication Required Permissions and
Veeam ONE Required Permissions.
NetApp Storage System The account used to connect the storage system to the VAO infrastructure must be
Permissions granted permissions described in section NetApp Data ONTAP Permissions.
VAO Step Accounts The account used to run the Verify SharePoint URL step, must be assigned the
SharePoint_Shell_Access role and must be a member of the WSS_ADMIN_WPG
group on the processed VM.
The account used to run the Verify Exchange Mailbox step, must be assigned the
ApplicationImpersonation role on the processed VM.
DEFAULT none
job readonly
lun all
snapmirror all
version readonly
volume all
vserver readonly
NOTE
These requirements assume that the embedded Veeam Backup & Replication and Veeam ONE components are
used only in the default configuration (to support VAO activities), and not for full production functionality.
If the embedded VAO components are used for additional functionality, refer to the Veeam Backup &
Replication User Guide, section Used Ports and Veeam ONE Deployment Guide, section Ports for the full
requirements.
VAO server vCenter Server HTTPS 443 Used by the embedded Veeam Backup &
TCP Replication and Veeam ONE servers to connect
to the vCenter Server.
Microsoft SQL TCP 1433 Required to provide access to the Microsoft SQL
Server Server where VAO, embedded Veeam Backup &
Replication and ONE databases are stored.
Veeam Backup & VAO server HTTPS 8888 Required to deploy VAO agents to standalone
Replication Veeam Backup & Replication servers. Then, is
server used by the VAO Server Service to connect to
the VAO agents running on these servers.
Workstation web VAO UI HTTP 9898 Required to access the VAO UI from a user
browser workstation.
Veeam ONE HTTP 1239 Required to access the Veeam ONE Reporter
Reporter Web console from a user workstation.
UI
The Veeam ONE Reporter Web UI is deprecated
in VAO but included for compatibility reasons.
VAO UI VAO server TCP 12348 Used by the VAO UI to connect to the remote
VAO Server Service.
Veeam ONE VAO server TCP 139; 445 Used by Veeam ONE Client to communicate
Client with the embedded Veeam ONE server.
Veeam Backup Veeam Backup TCP 9393 Required to collect indexing data for backup
Catalog service & Replication and replication jobs, and to store this data in
server the Veeam Backup Catalog folder on the Veeam
Backup & Replication server.
Veeam Backup & Veeam Backup TCP 9392 Used by the Veeam Backup & Replication
Replication & Replication console to connect to the Veeam Backup &
console server Replication server.
Veeam backup Veeam Backup TCP 9401 Used by the mount server to communicate with
source & Replication the Veeam Backup & Replication server.
connection server
License Types
Veeam offers the following types of licenses for VAO.
Paid Licenses
There are 2 types of paid licenses available for VAO:
Free Licenses
There are 2 types of free licenses available for VAO:
• Evaluation license is a full license that can be used for product evaluation.
The trial license is valid for 30 days from the moment of the product download.
• NFR license is a full license that can be used for product demonstration, training and education.
This license is not for resell or commercial use.
NOTE
All VMs added to the plan consume licenses, even if they have no replica or backup. All VMs used in DataLab
groups to support plan testing environments also consume a license instance.
Licenses for VMs are included in the VAO license file. A license file may include an arbitrary number of licenses that
form a license pool for VMs. Each VM managed by VAO consumes required licenses from this pool.
NOTE
VAO requires its own specific license file. It does not obtain or consume the ‘portable’ license instances from
connected Veeam Backup & Replication servers.
Edition check is the only check made by VAO to verify licensing of standalone Veeam Backup & Replication servers.
All operations with licenses on standalone Veeam Backup & Replication servers are accomplished according to the
Veeam Backup & Replication guidelines. For more information on Veeam Backup & Replication licensing, see the
Veeam Backup & Replication User Guide, section Licensing.
If you plan to use the embedded Veeam Backup & Replication server for production backup and replication
activities, you can install an additional paid license to the server using the Veeam Backup & Replication console. To
learn how to install Veeam Backup & Replication licenses, see the Veeam Backup & Replication User Guide, section
Installing License.
After you install VAO, you can change the license that you provided during installation:
1. Log in to the VAO UI as a VAO Administrator. For more information, see Accessing VAO UI.
3. Navigate to License.
5. In the Install License Key window, click Browse to browse to a license file, and then click Install.
NOTE
You can update the license automatically only if you have a paid license (Rental or Subscription) installed.
1. Log in to the VAO UI as a VAO Administrator. For more information, see Accessing VAO UI.
3. Navigate to License.
5. In the displayed dialog box, click OK to acknowledge the license update result.
• Operation is successful. A new license key has been successfully generated, downloaded and installed.
• A new license is not required. The currently installed license key does not need to be updated.
• The Veeam License Update Server has failed to generate a new license. You will get this message if an
error occurs on the Veeam License Update Server side.
• Veeam Availability Orchestrator has received an invalid answer. You will get this message if there are
connectivity issues between the Veeam License Update Server and VAO server.
• Licensing by the contract has been terminated. The contract has expired. In this case, VAO automatically
disables automatic license update.
1. After you enable automatic license update, VAO starts sending weekly requests to the Veeam License Update
Server on the Internet to check if a new license is available.
2. Seven days before expiration of the current license, VAO starts sending requests once a day.
3. When a new license becomes available, VAO automatically downloads and installs it to replace the old
license.
NOTE
To allow VAO to send email notifications, you must connect an SMTP server that will be used for sending
these notifications, as described in the Veeam Availability Orchestrator Operations Guide, section Configuring
Notification Settings.
• If VAO fails to establish a connection to the Veeam License Update Server, retry takes place every 60
minutes.
• If VAO establishes a connection but the Veeam License Update Server does not return a new license key upon
request, the retry takes place every 24 hours.
The retry period ends one month after the license expiration date. The retry period is equal to the number of days
in the month of license expiration: for example, if the license expires in January, the retry period will be 31 day; if
the license expires in April, the retry period will be 30 days.
If the retry period is over but the new license has not been installed, VAO automatically disables automatic license
update.
NOTE
Enabling automatic license update activates Automatic Usage Reporting. You cannot use automatic license
update without automatic usage reporting.
1. Log in to the VAO UI as a VAO Administrator. For more information, see Accessing VAO UI.
3. Navigate to License.
4. Set the Update license automatically (enables automatic usage reporting) toggle to On.
• Operation is successful. A new license key has been successfully generated, downloaded and installed.
• A new license is not required. The currently installed license key does not need to be updated.
• The Veeam License Update Server has failed to generate a new license. You will get this message if an
error occurs on the Veeam License Update Server side.
• Veeam Availability Orchestrator has received an invalid answer. You will get this message if there are
connectivity issues between the Veeam License Update Server and VAO server.
• Licensing by the contract has been terminated. The contract has expired. In this case, VAO automatically
disables automatic license update.
As part of reporting, VAO collects statistics on the current license usage and sends it periodically to the Veeam
License Update Server. The report provides information on the contract ID, product installation ID, and the
maximum number of licensed objects managed by VAO over the past week. The reporting process runs in the
background mode, once a week at a random time and day.
The collected data does not include information on VAO usage by any individual person identifiable for Veeam, or
any data gathered by VAO. Veeam may also use the collected data for any other internal business purposes it
deems appropriate, including (but not limited to) evaluation, improvement and optimization of Veeam licensing
models.
By enabling automatic license update, you agree with collection, transmission and use of the reporting data.
To ensure a smooth license update and provide sufficient time to install a new license file, VAO offers a grace
period after the license expiration date. During the grace period, VAO keeps working in a full-version mode. The
license status during this period appears as Your subscription license has expired and needs to be renewed.
Rental 60 days
Subscription 30 days
You must update the license before the end of the grace period. If you do not update the license, VAO will stop
executing orchestration plans as soon as the grace period ends. Plan testing will be disabled as well.
VM License Statuses
In VAO, a VM can have one of the following license statuses:
• [Applies only to Rental licenses] New — the VM was added to a VAO plan within the current calendar month.
The VM will be fully managed by VAO until the end of the current month.
• Unlicensed — the VM does not have licenses assigned, as there are no more licenses in the license pool. The
unlicensed VM will have either the Licensed by Exceed or Unlicensed status.
o Licensed by Exceed — the VM has no licenses assigned but is within the allowed increase limit. The VM
can be used in VAO plans until the end of the grace period.
o Unlicensed by Exceed — the VM has no licenses assigned, and the allowed increase limit was exceeded.
The VM will not be managed by VAO.
For more information, see Exceeding License Limit.
To deal with a situation where you need to manage more VMs than covered by your license, VAO provides
mechanisms of Allowed Increase Limit and New VMs.
When the number of VMs managed by VAO exceeds the license limit, VAO will treat them as follows:
• If the number of VMs is within the allowed increase limit or less, VAO will continue to manage all VMs until
your license expires.
To detect what VMs must be managed, a FIFO (first-in first-out) queue is maintained: VMs that were added
to VAO plans first will be included in the allowed exceed scope first. The license status of VMs within the
increase limit will be set to Licensed by exceed.
You must update the existing license by the license expiration date. Otherwise, the license status of VMs
within the increase limit will be set to Unlicensed, and these VMs will no longer be managed by VAO.
• If the number of VMs is above the allowed exceed limit, the VMs exceeding the licensed number plus the
allowed increase limit will be excluded from management.
The license status of VMs above the increase limit will be set to Unlicensed.
New VMs are managed by VAO as regular VMs, but do not consume licenses until the beginning of the new month.
In license terms, New VMs are counted separately from regular managed VMs. However, such VMs do participate in
all VAO activities and are fully functional.
On the first day of the new month, the number of New VMs introduced in the previous month is added to the
number of regular managed VMs. VMs that were treated as New will be managed by VAO in the following cases:
• If there are no VAO licenses, but the allowed increase limit has not been breached yet. In this case, the VMs
will obtain the Licensed by exceed status.
If the allowed increase limit has been already surpassed, these VMs will obtain the Unlicensed status.
At the beginning of January, the number of VMs is 140. Within the first 2 months (January and February), VAO will
manage 100 + 20 VMs that were added to VAO plans first (license limit + 20% allowed increase). 20 VMs that
were added last will not be managed.
If the license is not updated upon expiration, in March, VAO will change the status of all 140 VMs to Unlicensed.
In the middle of January, 40 New VMs are added to VAO plans. VAO will manage these VMs until the end of the
month. If the license is not updated, and the license pool is not increased, in February, VAO will change the license
statuses as follows:
• The first 20 VMs that obtained the Licensed by Exceed status in January will keep the same Licensed by
Exceed status.
• The second 20 VMs that obtained the Unlicensed status in January will keep the same Unlicensed status.
• The last 40 VMs added in the middle of January will obtain the Unlicensed status according to the FIFO
queue.
1. Log in to the VAO UI as a VAO Administrator. For more information, see Accessing VAO UI.
3. Navigate to License.
The licensing section will display details on the currently installed VAO license.
• Status — the license status. The status will depend on the license type, the number of days remaining until
license expiration, the number of days remaining in the grace period (if any), and the number of VMs that
exceeded the allowed increase limit (if any).
Click the Details link to get more information on the number of licenses consumed by managed VMs, and the
number of licenses reserved for New VMs that exceed the license limit and that were discovered less than a
month ago.
For more information on New VMs, see Exceeding License Limit.
• Instances — the total number of licenses for VMs included in the license file.
• License ID — the ID of the provided license file (required for contacting Veeam Customer Support).
• Package — the software product for which the license was issued.
• Support ID — the ID of the contract (required for contacting Veeam Customer Support).
1. Install Veeam Availability Orchestrator including all components on a machine that meets the system
requirements.
2. Complete the Initial Configuration Wizard on the VAO server (during the configuration process, you will
connect to a vCenter Server).
NOTE
The VAO solution can be installed in the unattended mode. Installation is launched from the command line
and performed without any user interaction. For more information, see Installing Veeam Availability
Orchestrator in Unattended Mode.
• Review dashboards
• Generate documentation
For more information, see the Veeam Availability Orchestrator Operations Guide.
IMPORTANT
• Installation of VAO on a machine already running standalone versions of Veeam Backup & Replication
and Veeam ONE is not supported.
• Installation of VAO on a machine with the Domain Controller role is not supported.
1. Make sure the machine where VAO will be installed meets the prerequisite conditions described in section
System Requirements.
1. Log in to the machine where you want to install VAO using an account with the local Administrator rights.
2. Insert the installation disc into the CD/DVD drive or mount the installation image. The setup will open a
splash screen with VAO installation options.
NOTE
Before proceeding with installation, the installer will check whether you have Microsoft .NET Framework 4.7.2
installed on the machine. In case the required version is missing, the installer will offer to install it
automatically. To do that, click OK.
Installation will require performing a reboot. Click Reboot in the warning message to acknowledge the reboot.
To read the terms of the license agreement for the 3rd party components, click View.
When all the required software is installed, click Re-check to repeat verification.
NOTE
During VAO installation, by default, the setup will install Microsoft SQL Server Express to host VAO databases.
If you want to use an existing local or remote Microsoft SQL Server instance, select the Let me specify
different settings check box and click Next.
In this case, you will also be able to configure used ports, choose an SSL certificate to secure traffic between
the VAO UI and a web browser, and to select local folders where VAO, Veeam ONE and Veeam Backup &
Replication components will store data cache.
At the SQL Server Instance step of the wizard, choose a Microsoft SQL Server instance that will host the VAO
database:
• If on the target machine you do not have a Microsoft SQL Server instance that you can use for VAO, select the
Install new instance of SQL Server option. In this case, the setup will install Microsoft SQL Server Express
locally, on the machine where you are installing VAO.
NOTE
If a Microsoft SQL Server instance that meets VAO system requirements is detected on the machine, you can
only use the existing local Microsoft SQL Server instance or choose one that runs remotely. In this case, the
option to install a new Microsoft SQL instance will be unavailable.
• If you want to use an existing local or remote Microsoft SQL Server instance, select the Use existing instance
of SQL Server option and choose a local Microsoft SQL Server instance, or browse to a Microsoft SQL Server
instance running remotely. You can either enter the address of the instance manually or use the Browse
button to search among available remote instances.
To connect to the Microsoft SQL Server instance, you must provide valid credentials for an account that will
be used by VAO components to access the Microsoft SQL Server database. You can either specify credentials
explicitly or use Windows authentication credentials. Note that the account must have the System
Administrator rights on the selected Microsoft SQL Server instance.
At the SQL Server Database step of the wizard, enter names for databases that will be used to store data collected
from VAO, Veeam Backup & Replication and Veeam ONE.
At the Ports Configuration step of the wizard, customize the following ports:
• Veeam Availability Orchestrator communication ports used for collecting data from connected servers, for
accessing the VAO UI through a web browser, and for connecting to the REST API functionality.
• Veeam Availability Suite ports used for communication between Veeam ONE components and Veeam
Backup & Replication infrastructure components.
For the full description of ports used by VAO and their default values, see Ports.
At the Certificate Selection step of the wizard, choose an SSL certificate that will be used to secure traffic between
the VAO UI and a web browser.
You can choose an existing certificate installed on the machine (self-signed or provided by CA) or generate a new
self-signed certificate. If you generate or choose a self-signed certificate, you must configure a trusted connection
between the VAO UI and a web browser later. For more information, see Configuring Trusted Connection.
IMPORTANT
For an existing certificate to be displayed in the Use certificate list, the following prerequisites must be met:
• The certificate signature algorithm must be Secure Hash Algorithm 1 (SHA-1) or later.
• The certificate cryptography algorithm must be RSA with a key of 2048 bits in length or longer.
• The certificate must contain the Key Encipherment and Data Encipherment key usage.
• The certificate must be added to the Certificates > Personal folder in the Microsoft Management
Console snap-in. To learn how to move SSL certificates, see this Microsoft KB article
At the Data Locations step of the wizard, select local folders where Veeam ONE and Veeam Backup & Replication
components will store data cache:
• In the vPower NFS field, specify a path to the folder where Instant VM Recovery write cache must be stored.
Make sure that you have at least 10 GB of free disk space to store the write cache.
• In the Guest file system catalog field, specify a path to the folder where Veeam Backup & Replication index
files must be stored. By default, the setup wizard creates the VBRCatalog folder on the volume with the
maximum amount of free space.
• In the Performance data cache field, specify a path to the folder where Veeam ONE write cache must be
stored.
At the Ready to Install step of the wizard, review installation configuration and start the installation process:
2. Wait for the installation process to complete and click Finish to exit the setup wizard.
After the upgrade process completes, open the Veeam Backup & Replication console on the VAO server to update
Veeam Backup & Replication components installed on all managed servers. To perform the update, follow the steps
of the Components Update wizard. For more information on updating server components, see the Veeam Backup
& Replication User Guide, section Server Components Upgrade.
TIP
If you want to use the embedded Veeam Backup & Replication server to run backup and replication jobs along
with orchestration, connect to the vSphere infrastructure and create jobs on that server. VAO will discover
backups and replicas produced by these jobs and will use them for orchestration plans. For more information
on adding VMware vSphere Servers and creating jobs, see the Veeam Backup & Replication User Guide,
sections Adding VMware vSphere Servers, Creating Backup Jobs and Creating Replication Jobs.
2. Insert the installation disc into the CD/DVD drive or mount the installation image. The setup will open a
splash screen with VAO installation options.
3. Click Install.
a. At the License Agreement step of the wizard, read and accept both the Veeam license agreement and
the 3rd party components license agreement. If you reject the agreements, you will not be able to
continue installation.
To read the terms of the license agreement for the 3rd party components, click View.
b. At the Program Features step of the wizard, choose Veeam ONE Client to be installed. If necessary, you
can change the installation directory.
d. At the Veeam ONE Server Connection step of the wizard, specify the hostname or IP address of the
VAO server.
e. At the Ready to Install step of the wizard, review installation configuration. Click Install to begin
installation.
1. [For Veeam Availability Orchestrator Server Service] Pre-install the following components on the target
machine:
g. Veeam ONE 11
For more information on how to install Veeam ONE in the unattended mode, see the Veeam ONE
Deployment Guide.
2. [For Veeam Availability Orchestrator Web UI] Pre-install the following components on the target machine:
4. Browse the .ISO contents — the files that you will need for installation will be located in the following
folders:
5. Log on to the target machine under the account that has the local Administrator permissions on the machine.
For more information, see Permissions.
6. Obtain a license file. The license file is required for VAO installation. You will not be able to perform
installation without providing a license.
The following command-line options are used to run the setup file:
Example: /L*v
”C:\ProgramData\Veeam\Setup\Temp\Logs\VAO_S
erver.txt”
/q n Yes Sets the user interface level to None, which means no user
interaction is needed during installation.
/I setup file Yes Installs the Veeam Availability Orchestrator Server Service
component.
Example: /I “C:\Veeam\VAO.Server.x64.msi”
ACCEPT_THIRDPARTY_LI 0/1 Yes Specifies if you want to accept the license agreement for 3rd
CENSES party components that Veeam incorporates.
Example: ACCEPT_THIRDPARTY_LICENSES="1"
Example: INSTALLDIR=”C:\Veeam\”
VAO_LICENSE_FILE path Yes Specifies a full path to the license file. You will not be able
to perform installation without providing a license.
Example:
VAO_LICENSE_FILE="C:\Users\Administrator\Do
wnloads\vao_nfr.lic"
VAA_SERVICEACCOUNT user Yes Specifies an account under which the Veeam Availability
Orchestrator Server Service will run. For more information
on the required account permissions, see Planning and
Preparation.
Example:
VAA_SERVICEACCOUNT="srv\Administrator"
Example: VAA_SERVICEPASSWORD="1234"
VAO_SERVER_MANAGE port Yes Specifies a WCF port that will be used to connect to the
MENT_PORT Veeam Availability Orchestrator Server Service. By default,
12348.
Example: VAO_SERVER_MANAGEMENT_PORT=”12247”
VAA_PORT port No Specifies a TCP port that will be used by the Veeam
Availability Orchestrator Server Service to connect to VAO
agents running on standalone Veeam Backup & Replication
servers. By default, 8888.
Example: VAA_PORT=”8884”
Example: VAA_VO_SQL_DATABASE="VeeamOne"
VAA_SQL_SERVER SQL No Specifies a Microsoft SQL Server instance where the VAO
Server\ins configuration database will be deployed. By default,
tance (local)\VEEAMSQL2012.
Example:
VAA_SQL_SERVER="VAOSERVER\VEEAMSQL2012_MY"
Example: VAA_SQL_DATABASE="OrchestratorDB"
VAA_SQL_AUTHENTICAT 0/1 No Specifies if you want to use the SQL Server authentication
ION mode to connect to the Microsoft SQL Server where the VAO
configuration database is deployed.
Example: VAA_SQL_AUTHENTICATION="1"
Example: VAA_SQL_USER="sa"
Example: VAA_SQL_PASSWORD="1234"
The following command-line options are used to run the setup file:
Example: /L*v
”C:\ProgramData\Veeam\Setup\Temp\Logs\VAO_We
bUI.txt”
Example: /I “C:\Veeam\VAO.WebUI.x64.msi”
ACCEPT_THIRDPARTY_LI 0/1 Yes Specifies if you want to accept the license agreement for 3rd
CENSES party components that Veeam incorporates.
Example: ACCEPT_THIRDPARTY_LICENSES="1"
Example: INSTALLDIR=”C:\Veeam\”
VAO_SERVER_NAME server Yes Specifies an IP address or FQDN of the server where the
name or Veeam Availability Orchestrator Server Service is installed.
address
Example:
VAO_SERVER_NAME=”servername.domain.local”
VAO_SERVER_PORT port Yes Specifies a WCF port that was defined to connect to the
Veeam Availability Orchestrator Server Service. By default,
12348.
Example: VAO_SERVER_PORT=”12247”
VAA_IIS_SITE_PORT port Yes Specifies an IIS port that will be used to connect to the VAO
UI website from a web browser. By default, 9898.
Example: VAA_IIS_SITE_PORT=”9998”
Example:
VAO_THUMBPRINT="a909502dd82ae41433e6f83886b0
0d4277a32a7b"
The following command-line options are used to run the setup file:
Example: /L*v
”C:\ProgramData\Veeam\Setup\Temp\Logs\VAO_REST
API.txt”
ACCEPT_THIRDPARTY_LIC 0/1 Yes Specifies if you want to accept the license agreement for 3rd
ENSES party components that Veeam incorporates.
Example: ACCEPT_THIRDPARTY_LICENSES="1"
Example: INSTALLDIR=”C:\Veeam\”
VAO_SERVER_NAME server Yes Specifies an IP address or FQDN of the server where the Veeam
name Availability Orchestrator Server Service is installed.
or
addres Example:
s VAO_SERVER_NAME=”servername.domain.local”
VAO_SERVER_PORT port Yes Specifies a WCF port that was defined to connect to the Veeam
Availability Orchestrator Server Service. By default, 12348.
Example: VAO_SERVER_PORT=”12247”
VAO_RESTAPI_SERVICE_P port Yes Specifies an HTTPS port that will be used to connect to the VAO
ORT REST API website from a web browser. By default, 9899.
Example: VAO_RESTAPI_SERVICE_PORT=”9999”
Example:
VAO_RESTAPI_CERTIFICATE_THUMBPRINT="934367bf1c
97033f877db0f15cb1b586957d313"
IMPORTANT
Starting from version 4.0, Internet Explorer is no longer supported. To access the VAO UI, use Microsoft Edge,
Google Chrome or Mozilla Firefox.
2. If you log in for the first time, in the Username and Password fields, specify credentials of the local
Administrator who performed VAO installation.
To authenticate using the credentials provided when logging into the system, select the Log in as current
user check box.
TIP
To be able to log in as the current user, you must first do the following:
1. Complete the Initial Configuration Wizard as described in section After You Install.
2. Enable the Automatic logon with current user name and password option in the security setting of
your browser.
In future, you can configure users and roles to grant access to the VAO UI. For more information, see the
Veeam Availability Orchestrator Operations Guide, section Assigning User Roles and Permissions.
3. Click Login.
Logging Out
To log out of the VAO UI, at the top right corner of the Veeam Availability Orchestrator window, click the user
name and then click Logout.
When you install VAO, you can generate or choose a self-signed certificate. In this case, when you try to access the
VAO UI in a web browser, the browser will display a warning notifying that the connection is untrusted (although it
is secured with SSL).
To eliminate the warning, import the self-signed certificate to client machines (the machines from which you plan
to access the VAO UI website). To learn how to import SSL certificates, see this Microsoft KB article.
If you want to use the certificate generated during VAO installation, perform the following steps:
b. Export the Veeam Self-Signed Certificate following the instructions provided in this Microsoft KB
article.
You can also provide a contact name, email and telephone number of a person responsible for monitoring VAO
performance.
If you want to assign the VAO Administrator role to the local Administrator who performed VAO installation, click
Add Current User.
2. In the Domain and Account fields, enter the user name and a domain to which the user belongs, and click
Find.
For more information on the required account permissions, see Permissions.
Repeat the procedure for each user that must become a VAO Administrator and click Next.
If you want to connect a standalone Veeam Backup & Replication server, proceed with the Deploy VAO Agent step,
or skip it and follow the instructions provided in the Veeam Availability Orchestrator Operations Guide, section
Connecting Veeam Backup & Replication Servers.
At the Deploy VAO Agent step of the wizard, in the Server field, enter a DNS name or an IP address of the server
that you want to register. Use the Type option to specify whether the server is a Veeam Backup & Replication
server or Veeam Backup Enterprise Manager server.
At the Remote Access Credentials step of the wizard, in the User name and Password fields, specify credentials
of a user account for connecting to the Veeam Backup & Replication server. The provided credentials will be also
used to run the VAO agent on the server.
The user name must be specified in the DOMAIN\USERNAME format. For more information on the required account
permissions, see Permissions.
At the Synchronize Credentials step of the wizard, choose whether you want to retrieve credentials from the
connected Veeam Backup & Replication server.
You will be able to use these credentials later when configuring orchestration plan steps. For more information, see
the Veeam Availability Orchestrator Operations Guide, section Configuring Plan Steps.
1. Enter a DNS name or an IP address of the vCenter Server that you want to connect to.
You will be able to register other VMware servers later. For more information, see the Veeam Availability
Orchestrator Operations Guide, section Connecting VMware vSphere Servers.
Upgrade Checklist
Check the following prerequisites before upgrading VAO:
1. Perform backup of all existing databases that are used to store data collected from VAO, Veeam Backup &
Replication and Veeam ONE, so that you can easily go back to the previous version in case of upgrade issues.
2. Make sure there is enough space for upgrade of the Microsoft SQL Server configuration database. To
calculate the required space, add at least 25% of free space to the size of the Microsoft SQL Server
configuration database.
By default, the setup wizard installs VAO with Microsoft SQL Server Express. Mind that the maximum
configuration database size for Microsoft SQL Server Express is 10 GB.
3. Make sure there are no orchestration plans being tested or executed (that is, no plans are in the IN USE
mode, HALTED state or any of the active states).
For the list of modes and states that a regular replica plan can acquire, see the Veeam Availability
Orchestrator Operations Guide, section Running and Scheduling Regular Replica Plans. For the list of modes
and states that a restore plan can acquire, see Running and Scheduling Restore Plans. For the list of modes
and states that a storage plan can acquire, see Running and Scheduling Storage Plans.
4. Make sure there are no orchestration plans scheduled to run during upgrade. Otherwise, disable the
configured schedule as described in the Veeam Availability Orchestrator Operations Guide, sections
Scheduling Failover, Scheduling Restore and Scheduling Storage Failover.
Performing Upgrade
To upgrade from VAO 3.0 to VAO 4.0, perform the following steps:
1. Make sure the machine where VAO will be installed meets the prerequisite conditions described in section
System Requirements.
2. Download the latest version of the product installation image from the Veeam downloads page. You can burn
the downloaded image file to a CD/DVD or mount the installation image to the target machine using disk
image emulation software.
9. Begin upgrade.
11. [Optional] Upgrade additional Veeam ONE Monitor Client instances to version 11.
1. Log in to the machine where the Veeam Availability Orchestrator Server Service component is installed. Use
an account with the local Administrator rights.
2. Insert the installation disc into the CD/DVD drive or mount the installation image. The setup will open a
splash screen with VAO installation options.
NOTE
Before proceeding with installation, the installer will check whether you have Microsoft .NET Framework 4.7.2
installed on the machine. In case the required version is missing, the installer will offer to install it
automatically. To do that, click OK.
Installation will require performing a reboot. Click Reboot in the warning message to acknowledge the reboot.
To read the terms of the license agreement for the 3rd party components, click View.
At the SQL Server Instance step of the wizard, review configuration information and click Next.
NOTE
When the setup wizard upgrades the VAO server, the embedded Veeam Backup & Replication server and the
Veeam ONE server are automatically upgraded as well.
1. Open the Veeam Backup & Replication console on each standalone Veeam Backup & Replication server to
update configured virtual labs. To perform the update, follow the steps of the Edit Virtual Lab wizard.
For more information on editing Veeam Backup & Replication virtual labs, see the Veeam Backup &
Replication User Guide, section Editing and Deleting Virtual Labs.
2. Open the Veeam Backup & Replication console on each standalone Veeam Backup & Replication server to
update Veeam Backup & Replication components installed on all managed servers. To perform the update,
follow the steps of the Components Update wizard.
For more information on updating server components, see the Veeam Backup & Replication User Guide,
section Server Components Upgrade.
3. Open the VAO UI and make sure all VAO agents running on standalone Veeam Backup & Replication servers
have also been upgraded successfully.
To do that, switch to the Administration page, navigate to VAO Agents and check the status of each
connected Veeam Backup & Replication server. If you encounter a connection issue with a VAO agent, repair
the agent as described in the Veeam Availability Orchestrator Operations Guide, section Repairing VAO
Agents.
1. Log in to the machine where the VAO UI component is installed. Use an account with the local Administrator
rights.
3. Insert the installation disc into the CD/DVD drive or mount the installation image. The setup will open a
splash screen with VAO installation options.
To read the terms of the license agreement for the 3rd party components, click View.
6. The installer will automatically detect the VAO UI component of the previous version installed on the
machine. At the Upgrade step of the wizard, review the component to upgrade.
8. The installer will automatically detect the Microsoft SQL Server instance that was previously used to host the
Veeam ONE database. The installer will also detect credentials for an account used by the VAO UI component
to access the database.
At the SQL Server Instance step of the wizard, review configuration information and click Next.
9. At the Ready to Install step of the wizard, click Install to begin upgrade.
2. From the Start menu, select Control Panel > Programs and Features.
3. Select Veeam Availability Orchestrator, click Uninstall and then click Remove.
IMPORTANT
It is required that the restored databases are located on the same Microsoft SQL Server instance and have the
same names as the previously installed databases.
At the SQL Server Database step of the wizard, browse to the restored VAO database and specify names for new
Veeam Backup & Replication and Veeam ONE databases.
NOTE
VAO reinstallation process does not involve the Veeam Backup & Replication and Veeam ONE databases
restored at Step 2. Restore Backed Up Databases.
To allow VAO to use the restored databases, you must perform reconfiguration of Veeam ONE and Veeam
Backup & Replication servers. For more information, see Step 4. Reinstall Veeam ONE and Veeam Backup &
Replication.
1. Open the Services snap-in and stop the Veeam Orchestrator Server Service, Veeam Orchestrator ONE
Integration Service and Veeam Orchestrator Agent for Backup service.
2. Reconfigure Veeam ONE and Veeam Backup & Replication servers to use old databases instead of new ones
created during VAO installation.
For more information, see these Veeam KB articles: Moving Veeam ONE database to a different SQL Server
and How to move the Veeam Backup & Replication software to another server.
2. Navigate to VAO Agents. All VAO agents previously installed on the server will have the Repair Required
status.
b. In the Repair VAO Agent window, enter passwords required for the remote access and service
credentials.
c. Repeat the step for each agent with the Repair Required status.
3. Navigate to VMware vCenter Servers. All VMware servers previously connected to the server will have the
Disconnected status.
b. In the Edit VMware vCenter Server window, enter a password required to connect to the server.
c. Repeat the step for each VMware server with the Disconnected status.
b. In the Edit VAO Credential window, enter a password for the credential.
NOTE
All credentials collected from standalone Veeam Backup & Replication servers will be automatically updated
as soon as VAO agents installed on the servers connect to the VAO server.
5. [This step applies only if you have previously connected an SMTP server and enabled authorization]
a. Click Edit.
b. In the SMTP Server window, enter a password required for SMTP server authentication.
TIP
To make sure all the configuration changes are correct, after you perform the required actions, generate the
Plan Readiness Check Report for each VAO plan. For more information on the report, see the Veeam
Availability Orchestrator Operations Guide, section Running Plan Readiness Check.