WireGuard secure tunnel

Unitrends continues full support of OpenVPN.

Copying backups to a hot backup copy target happens over a secure tunnel between the source appliance and the target.

Unitrends supports two tunnel protocols:

  • WireGuard: new replication configurations beginning with release 11.2.0-1.
    WireGuard runs in the Linux kernel, which reduces CPU overhead on both appliances and improves throughput over the same link.
  • OpenVPN: replication configured before release 11.2.0-1, and for any configuration that is not eligible for WireGuard.

Which transport a pairing uses

The transport is determined per source appliance, and it does not change automatically from OpenVPN to WireGuard after updating to Unitrends 11.2.0-1.

●   New replication configurations use WireGuard, as long as both the source and the target are eligible. See WireGuard eligibility.

●   Replication configured before release 11.2.0-1 continues to use OpenVPN after you update the appliance. Updating to 11.2.0-1 does not convert an existing tunnel.

●   A new target added to a source that is already using OpenVPN also uses OpenVPN.
A source appliance will not run both transports at the same time.
If you want WireGuard for that source, migrate it before adding more targets.

To move an existing OpenVPN source to WireGuard, see Request a migration from OpenVPN to WireGuard.

WireGuard eligibility

Both the source appliance and the target must be eligible and running 11.2.0-1 or later.
If either one is not, you will see Replication error messages.

NOTE  Cold backup copy targets including third-party cloud, attached disk, NAS, SAN, tape, and eSATA or USB do not use a secure tunnel, so WireGuard does not apply to them.

An appliance is eligible for WireGuard when all of the following are true:

●   It is running AlmaLinux 9. Appliances running CentOS 6 or CentOS 7 are not eligible.
To upgrade an appliance to AlmaLinux 9, see CentOS 7 Upgrade to AlmaLinux 9.

●   It is not a FIPS appliance. FIPS appliances use OpenVPN and cannot use WireGuard.
See WireGuard and FIPS appliances.

●   It is not already using OpenVPN, either as a backup copy source or as a backup copy target.

●   It is not acting as both a source and a target.
See Cross-copy configurations.

●   It is not a multi-tenant target.

Supported replication topologies

For new replication configurations, WireGuard supports:

●   One source to one target.

●   One source to multiple targets (fan-out). A separate tunnel is created for each target.

●   Multiple sources to one target (fan-in).

Cross-copy configurations

Cross-copy configurations, in which each appliance acts as both a backup copy source and a backup copy target, cannot use WireGuard.

Both appliances in a cross-copy pair must continue to use OpenVPN.

For details on cross-copy, see Backup copy targets.

Ports and firewall requirements

WireGuard uses UDP only.
OpenVPN uses both TCP and UDP.
If you are migrating an existing source, the tunnel continues to use the port already configured for OpenVPN, but only the UDP protocol is required.

For the full list of ports used by the appliance, see Additional port requirements.

Replication error messages

If a source and target cannot be paired over WireGuard, the appliance reports one of the following. In each case the pairing does not complete.

Message

What it means

Source is not WireGuard-eligible but target <target> is. Migrate the source first.

The target is ready to use WireGuard but the source is not eligible, most often because the source is already using OpenVPN. Check the source against WireGuard eligibility.
To move the source to WireGuard, see Request a migration from OpenVPN to WireGuard.

A message stating that the target is on an older software version that does not support WireGuard.

The target is running a release earlier than 11.2.0-1. Update the target and try again.

WireGuard keys and appliance recovery

WireGuard authenticates each end of the tunnel with a key pair rather than with certificates. Each source and target holds a private key that never leaves the appliance.

Private keys are excluded from appliance metadata backups. When you recover an appliance, it generates a new key pair and notifies its peers, so the tunnel is re-established with new keys rather than restored ones. No action is required from you. A recovered source appliance re-handshakes with each of its targets the first time replication runs after the recovery.

For details on appliance recovery, see Appliance Disaster Recovery (DR).

How to...

To determine which transport a pairing is using, check the network interface names on the appliance.

1.  Access the appliance console, either by attaching a monitor, keyboard, and mouse to the appliance, or by using IPMI or iDRAC virtual console access if your appliance supports it.
See To enable local network access if UniView is unreachable for details on reaching the console.

2.  Enter this command:

ip addr

3.  Look at the network interface names in the output:

●   An interface whose name begins with wg0 indicates a WireGuard tunnel.

●   An interface whose name begins with tun indicates an OpenVPN tunnel.

NOTE  On a source appliance with more than one target, a separate WireGuard interface exists for each target and the interface name includes the target hostname, so you can identify the transport for each individual pairing. On a target appliance, a single WireGuard interface serves all of its sources.

Existing OpenVPN replication continues to work after you update to release 11.2.0-1, and there is no requirement to migrate.

If you want the performance benefits of WireGuard for a source that is currently using OpenVPN, contact Support to request a migration.

Migration is performed by Support and is not a self-service procedure. Review the following before requesting one:

●   Both the source and all of its targets must be eligible. See WireGuard eligibility.

●   A source with one or more targets (fan-out) can be migrated. A target that receives backup copies from multiple sources (fan-in) cannot be migrated in this release.

●   Migration reuses the tunnel network and port already configured for OpenVPN, so no new firewall rules are required for the tunnel addresses themselves. Confirm that the tunnel port is open for UDP. See Ports and firewall requirements.

●   Migration can be rolled back. Support takes a snapshot of the OpenVPN configuration before migrating and restores it if the migration does not complete successfully.

NOTE  Migrating only changes the tunnel transport. Backups, backup copies, retention, and schedules are not affected, and existing backup copies on the target remain valid.

FAQ

No. New replication configurations use WireGuard automatically when both appliances are eligible.

There is no setting in the UI, and no keys or certificates for you to exchange.
If either appliance is not eligible, the pairing uses OpenVPN instead.
See WireGuard eligibility.

Because the source appliance was already using OpenVPN.

The transport is set per source appliance rather than per target, and a source does not run both transports at once.
Any target you add to an OpenVPN source also uses OpenVPN.
To move the source to WireGuard, see Request a migration from OpenVPN to WireGuard.

No. FIPS appliances use OpenVPN for the secure tunnel.

This applies to new configurations as well as existing ones, and a FIPS appliance cannot be migrated to WireGuard.
For details, see WireGuard and FIPS appliances.

No. Migrating changes only the tunnel transport.

Backups, backup copies, retention, and schedules are not affected, and existing backup copies on the target remain valid.
See Request a migration from OpenVPN to WireGuard.