Veeam to AWS VTL (Virtual Tape Library) – Guide


You may or may not know that there is quite a cheap way to archive your backup jobs to tape, without actually having a tape drive.

While I was looking at options to store my backup jobs off-site, I researched a number of things:

  • Buying a tape library
  • Buying another enterprise NAS (Network Attached Storage)
  • Using a JBOD (Just a bunch of disks) system like Microsoft Storage Spaces

All of these are expensive. All of these require some sort of hardware plus additional network and configuration. All of these are a pain in the ass.

Our setup

Our setup consists of the following (across data centers):

  • VMWare 5.5/6.5
  • Veeam 9/9.5

We currently replicate between data centers using Veeams built in functionality. This is mainly for disaster recovery. This is an issue for a couple of reasons:

  • Duplicate data at each end
  • Additional hardware required to hold the backups
  • Complexities of a WAN for Veeam

What sparked my interest in a better way of doing things was the recent bouts of Crypto viruses which are now targeting backup devices, either wiping them clean or encrypting them. If that happens, you’re really screwed.

I decided on AWS, simply, due to cost and simplicity. Backup should be simple. Simple is good.


If we look at it purely from a cost perspective, it is as follows (see AWS costs in full here):

Virtual Tape Storage (EC2)

Used as the initial storage when the tape backups are uploaded before they go to Glacier

$0.025 per GB-month of data stored
Virtual Tape Storage Archive (Glacier)

Used when tapes are archived

$0.005 per GB-month of data stored

There is also the cost of the gateway appliance itself. The way this works is, you are billed for the first 100GB written to the gateway. After that, there are no further charges. The AWS calculator says the following: Up to a maximum of $125.00 per gateway per month. The first 100 GB per account is free.

So you will be looking at $125.00 per gateway, per month if you are pushing more than 100GB of data to AWS. In our case, we run a gateway at each data center.

The cost of tape archive is too good to pass up. That’s what really makes the AWS VTL Gateway a no-brainer.


The setup of the VTL Gateway is being done on VMWare 6.5 with Veeam Backup and Replication 9.5 Update 2.

I am going to assume you already have an AWS account.

Step 1 – Download and configure the VTL appliance

  1. From the AWS services, select the Storage Gateway service
  2. You will likely be presented with a wizard on your first run through. Otherwise, select Create Gateway.
  3. Select Tape Gateway
  4. Select VMWare ESXi and download the image. You can follow this guide for Hyper-V as apart from the Hypervisor, the steps are mostly the same
  5. Once the image has downloaded, deploy it to your infrastructure as a new OVF template.
  6. Once the image has been deployed to your environment, go to the console and log in. The server will get DHCP, but you will likely have to assign it an IP address and Gateway. The default username sguser and the password is sgpassword. Note that your VTL Gateway appliance needs to be on the same subnet as your Veeam server.
  7. Once you have configured the network information, you need to attach to disk drives. One is for cache, the other is for an upload buffer. It is up to you what you allocate here, but the cache drive needs to be bigger than your largest backup set. I’ve gone with 500GB for cache and 500GB for upload buffer. Realistically, it should be around 2TB for cache, 200GB for upload buffer. Once the drives are added, reboot the appliance.
  8. Once the device comes back online, if you go back to the AWS console, it will be asking for an IP address to connect to. You do not need to open any ports. This is established through the web browser (nifty).
  9. Once you do this, it will ask to configure the drives you have added
  10. While you are in the AWS console, create some tapes. For the purpose of this guide, I recommend creating some 100GB tapes, which are the minimum.
  11. You are now good to go. Lets move on to the Veeam configuration

Step 2 – Configure Veeam

Your Veeam server needs to be on the same subnet as the AWS VTL Gateway Appliance

  1. On your Veeam management server, go to control panel and select iSCSI connections. Add your AWS VTL Gateway Appliance and quick connect
  2. Connect to every discovered target. These are your tape drives
  3. Once all your targets have been connected, in Veeam, select Tape Infrastructure and add a new tape server
  4. Run through the wizard. Everything should be pretty straight forward
  5. Your new tape server should now be ready!

Step 3 – Create GFS Media Pools

The next step is to create media pools. Media pools control how you are going to store your media. This is very important using AWS, as it will also control how you are going to store your virtual tapes, either in EC2, or Glacier.

The following example, I am going to store 1 year of monthly backups. I am not going to select Weekly, Quarterly, or Yearly. You can choose these options if you wish.

  1. From Veeam, select Media Pools and select Add GFS Media Pool
  2. When it comes to Tapes, you can simply select to add free tapes. However, I usually add tapes specifically to my media pool depending on the backup size. For instance, if I am backing up a 400GB VM, I would add 500GB tapes  (just in case), specifically for this media pool. The reason is to save on cost when pulling these tapes back from AWS. You will be charged to pull an entire tape back if you require files. So it’s best to create your media pools accordingly.
  3. My GFS Media Set is as follows. 0 disables the media set
  4. Click on the Advanced button under media set. There is a very important option which must be selected. You want to move all finished jobs to a Vault. This archives the tape at the end of the job (Glacier storage). You will need to do this for all media sets you create unless you want to leave them on EC2 storage.
  5. Select encryption if you want to (recommended for AWS)
  6. If you have created tapes in the first step, add them to this media pool now. If they are not showing, right click on your tape libaray and import tapes.

Step 4 – Creating GFS Tape Jobs

Now that we have our media pool and vault created, we can now create tape jobs.

Just a note with GFS tape jobs: The job will start and then wait for the next backup to occur. The tape job checks every hour for new backup files. It starts at midnight 12:00 and will check every hour after that. Once a job has finished, you will see the tape job activate. Manually running the tape job will finish without any files being backed up unless Active Full is selected. This isn’t stated anywhere and was a real pain in the ass when testing this.

  1. Select New Backup to tape job
  2. Under backup files, select your backup job. You can select a backup copy job here. Select the latest not incremental (If you are only doing full backups like me)
  3. Select the media pool you created before. If you added tapes to the media pool, the free space will be displayed
  4. This is the most important step make sure you click the following options

    Ejecting the media and exporting them will add the media to the vault you created earlier and archive the tapes. Since you are creating virtual tapes, having a ton of monthly tapes isn’t really an issue.
  5. For the schedule, since it’s monthly, I go for the last Saturday each month.

That’s it. You’re done. If you configured it right, your backup will finish and your tape will be archived:

Some common questions

  • I create a media pool per set of backups or per customer to cut down on AWS fees
  • For each backup set, eject and archive your tapes. This will cut down on your AWS costs
  • If you delete an archive tape from AWS under 90 days, you will be charged for the full tape (data transfer charges)
  • Size your tapes for the backup job so you don’t cause massive data charges when you only need a sub-set of files for one VM

If you have any further questions, please let me know.

13 thoughts on “Veeam to AWS VTL (Virtual Tape Library) – Guide”

  1. Hi,

    Nice article, it was very helpfull

    As the AWS documentation explains tape gateways perform compression of data in-transit and at-rest, had data compression % are you seeing and what type of files are your backups made up of?


    1. More than I was expecting actually. Veeam backups are already compressed. I think It’s probably 30-40% in some cases. I had a 700gb job I pushed which shows as 400gb on tape.

  2. Hi,

    I meet the issue, I use Veeam 9.0 to backup to data to the storage gateway VTL and then export the tape, then I try to retrive the tape from glacier trying to restore the data from the tape.

    While the tape always show offline from the Veeam console, nothing I can do.

    I wondering if you have met this issue before, and waiting for your reply.Thanks.

    1. Jerry,

      I think that the steps to retrieve a tape from glacier are these:
      1.- Go to AWS Console > Storage Gateway> Tapes and select your archive tape then click on Actions>Retrieve Tape. It will take a while to retrieve the tape but once it’s done it should no longer say “archived” it should say “available”.
      2.- In Veeam, go to Tape Infrastructure > Libraries> Select your AWS Gateway, click “Import Tapes”

      Let me know if that helps.


  3. Hayden,

    Do you know if archiving a tape only archives used space on the tape or is it the whole tape?
    Say I have a 2TB Tape but I’m only using 1TB and I archive it; will I be charged for transferring 2TB or 1TB?

    1. Good question. From what I’ve seen you will only be using 1TB. So I automatically just create 2TB tapes, mainly because im lazy. If the backup is 100gb, meh, who cares.

  4. Hi Hayden,

    How do you manage deletion of expired tapes?
    What we’d like to do is archive all tapes as soon as backup completes and then when the backup retention’s have been met the Archived tape is made available again for re-use. If we retrieve that tape to re-use it though we will be paying to retrieve data that we don’t need. We just want the tape’s to go back into the rotation.
    Could you advise how you are handling this? I guess we could just manually delete expired data sets and create new tapes as required but that seems like a stupid way to manage things and introduces the possibility of deletion of tapes that are still required.


    1. I haven’t got to my expired tapes yet, but as I read through the documentation, it should erase the tape, and nothing should be bought down. This is how I understand it. The AWS appliance has a bit of smarts, but I still have to test this. I am coming up to my 12 month retention this month.

  5. Hayden, hi.
    I have about 25 TB of data that needs to be backed up, my daily incrementals are about 1 TB in size. I want to use the AWS VTL with GFS schema.
    My concerns are such that, sitting on a 100 Mb pipe, my weekly full backup uploads will take more than a week to finish, under the circumstances, creating a backlog.
    What would you suggest in this case? Should I create a local VTL appliance, or host it as an AWS EC2? Or maybe move the entire Veeam installation into AWS? Get a dedicated high-speed connection to AWS? Or change my backup strategy? The systems being backed up are on-premise Hyper-V.
    Any suggestions would be greatly appreciated.

    1. That’s a hard question. I have one VM which is around 4-5Tb which I backup once a month. It does indeed hog the pipe for an extended period of time (only 100mbit too).

      I would probably stagger my AWS backups over the entire month. Leave everything on-site.

  6. Hi,
    It is really helpful guide. I have VMware cluster with 3 ESXi hosts in primary location. I use Veeam to back it up daily to local IP SAN and I’m doing nightly replication to remote DR site. I’ve been tasked to implement air gap solution. I called Veeam support and they recommended tape drive. I was thinking about passing it thru SAS card directly attached to ESXi and Veeam locked in to specific host but looks like it is not supported solution by VMware. We are basically looking to protect our backups from ransomware attacks. Will your AWS solution be considered ransomware protection?

    Thank you

    1. Yes – as the tapes are stored offline. Just make sure you backup the Veeam configuration somewhere else as well and keep the encryption password safe.

      If you use Azure, you can also look at scaling out to blob storage which supports duplication as well as a new archive tier. This became fully available as of v10

Leave a Reply