Veeam Disaster Recovery Plan Template

Standard Operating Procedure: Veeam Disaster Recovery Plan Implementation & Execution

1. Document Control Block

---

2. Executive Summary & Purpose

This Standard Operating Procedure (SOP) defines the institutional-grade framework for authoring, validating, and executing Disaster Recovery (DR) operations using Veeam Backup & Replication infrastructure. The purpose of this document is to eliminate ambiguity during high-stress failure events, establishing deterministic recovery time objectives (RTO < 4 hours) and recovery point objectives (RPO < 1 hour) across all production workloads hosted within the Template Registry environment.

---

3. Scope & Prerequisites

3.1 Scope

This procedure applies to all Tier-0 and Tier-1 virtual machines, physical workloads, container persistent volumes, and cloud-native instances protected by Veeam Backup & Replication v11/v12 within primary and secondary data center domains.

3.2 Prerequisites & Tooling

• Administrative access to the Veeam Backup & Replication Console and Enterprise Manager.
• Out-of-band access to primary and secondary hypervisors (VMware vSphere/Microsoft Hyper-V/Nutanix AHV).
• Active access to offsite storage repositories (Immutable Object Storage / Veeam Cloud Connect).
• Network access to DNS, DHCP, and Active Directory Domain Controllers in the recovery site.
• Valid, off-site stored Master Encryption Keys for encrypted backups.

---

4. Roles & Responsibilities

---

5. Step-by-Step Procedure

Phase 1: Pre-Execution & Declaration of Disaster

• Verify that a catastrophic failure condition has been met (loss of primary site, unrecoverable storage corruption, or ransomware containment isolation).
• Convene the Incident Response Team (IRT) via out-of-band communication channels.
• Secure executive sign-off from the Chief Architect or Incident Commander to initiate disaster recovery failover.
• Isolate surviving primary infrastructure segments to prevent split-brain networking states upon recovery.

Phase 2: Infrastructure Readiness & Network Isolation

• Power on and validate the Veeam Disaster Recovery Orchestrator (VDRO) or secondary management server.
• Establish isolated Virtual Lab or Isolated Recovery Environments (IRE) to test integrity prior to production mapping.
• Validate that secondary site DNS infrastructure is configured to accept authoritative records from restored Domain Controllers.
• Confirm storage repository connectivity at the target DR site, verifying read-write status of immutable object storage buckets.

Phase 3: Execution of Veeam Failover Plan

• Log into the Veeam Backup & Replication console using multi-factor authentication credentials.
• Navigate to Home > Replicas / Backup & Replication > Plans.
• Select the pre-configured Production DR Plan (e.g., TR-Prod-Tier0-Failover).
• Right-click the plan and select Start to initiate the orchestrated failover wizard.
• Monitor execution steps in real-time, verifying automated sequencing:
  • VM power-on ordering and boot delays.
  • IP re-IP rules and network mapping execution.
  • Custom script execution (pre/post-failover hooks).
• Resolve any execution warnings or non-fatal errors flagged by the Veeam orchestration engine immediately.

Phase 4: Post-Failover Validation & Integrity Checks

• Execute automated SureBackup verification jobs against newly powered-on workloads.
• Manually verify Active Directory replication health (repadmin /showrepl) on restored DC instances.
• Confirm internal application functionality via synthetic transactions and API health checks.
• Switch external routing (BGP announcements / DNS TTL updates) to direct user traffic to the secondary DR endpoints.

---

6. Quality Assurance & Pro-Tips

6.1 Best Practices

• Immutable Repositories: Always maintain at least one air-gapped, object-locked repository that cannot be purged via administrative credentials during a ransomware event.
• Orchestration over Manual Scripts: Rely on Veeam DataLabs and SureBackup routines to automate application-level verification rather than manual inspection.

6.2 Common Pitfalls

• Split-Brain Syndromes: Failing to isolate the primary site before powering up replicas can lead to conflicting database transactions and data corruption.
• Expired Credentials: Ensure service accounts used for guest OS processing and application-aware backups are rotated within centralized vaults accessible during a crisis.

6.3 Metric Thresholds

• RTO Target: $\le 240$ minutes from declaration to production traffic restoration.
• RPO Target: $\le 60$ minutes for Tier-0 databases.
• Data Integrity Verification: 100% pass rate on automated cryptographic hash checks of restored volumes.

---

7. Frequently Asked Questions

Q1: What happens if the primary Veeam Backup Server is completely destroyed along with the site?
A: Deploy a fresh Veeam Backup & Replication instance of the exact same build version at the secondary site. Import the configuration backup from the secondary/cloud repository (Configuration Backup job), or rescan the immutable storage repository to rediscover existing backup files and map them to the new server instance.

Q2: How do we handle dynamic IP address changes during a cross-site failover?
A: Veeam's built-in Network Mapping and Re-IP rules should be pre-configured within the replication job settings. The orchestration engine automatically applies guest-OS IP reconfiguration scripts during the final boot phase of the failover process, eliminating manual intervention.