NAS Backup Software for Multi-Vendor Environments by Bacula

Home > Corporate Data Backup > Enterprise Plugins > Synology Backup Software

The bigger your organisation, the more NAS vendors you run, the more separate backup tools you juggle. Over time, the schedules and retention rules of those tools drift apart, and that drift can lead to lost backups.

To help organisations manage several vendors with different backup schedules, Bacula’s NAS backup software allows you to back up and recover your entire data set across multi-vendor NAS environments from one single console that operates under one set of backup schedules and retention rules.

With its large array of cybersecurity features, Bacula’s NAS solution makes your organisation’s data promptly recoverable and protects your backups against cyber threats with a modular architecture. On top of that, the plugin works alongside the NDMP plugin and the Incremental Accelerator for NetApp and Nutanix, which speed up backups of very large file shares.

Download Trial NAS/SAN Backup Whitepaper

Key Features of Bacula’s Multi-Vendor NAS Backup Solution

One Console for Every NAS Brand: Bacula backs up Synology, NetApp, Nutanix, HPE, EMC, and Huawei storage under one set of schedules and retention rules.
Flexible Backups: Bacula can either read the files on a NAS over the network or have the NAS package its own data and send it to Bacula through the NDMP Plugin, which is faster for very large volumes of data.
Incremental Accelerator for NetApp and Nutanix: With the accelerator, Incremental backups copy only the files that changed since the last backup, and skip the slow scan of every single item in a share that holds millions of them.

Single-File Restore: You can restore one deleted file or folder without resorting to restoring the entire volume because Bacula records the name of every file in a file-level backup.
Whole-Volume Image Backup for NetApp: For a full rebuild after a disaster, Bacula can copy an entire NetApp volume as a single image, which is the fastest method for volumes with millions of files.

Benefits of Bacula’s NAS Backup Solution

Reduced Long-Term Costs: Your backup bill stays the same as your NAS storage grows, because Bacula licenses the software by the size of your environment and not by the amount of backup data.
Wide Suite of Cybersecurity Features: Bacula protects your organisation’s backups from ransomware, malware, and tampering by encrypting your backup data, scanning it for malware, and locking it against changes for a period you set.

Cyber-Resilient Architecture: Bacula’s core modules function in isolation, and an attacker who takes over the File Daemon can’t reach your existing backups. Backup data stays out of reach because that Director does not know where the Storage Daemon is.
Multi-Vendor Compatibility: You can manage all NAS backups from the same console as your NetApp, Nutanix, HPE, EMC, and Huawei backups for a safer, synchronised backup of your files.

Bacula’s Full Suite of NAS Backup Software Features

Change Tracking for High File Counts

NetApp SnapDiff Change Lists: The Incremental Accelerator isolates modified assets by querying the NetApp SnapDiff API against the prior backup snapshot. Instead of scanning the entire file system, Bacula references this generated file list to ingest only altered data over standard NFS or CIFS mounts.
Nutanix REST API Change Lists: For Nutanix environments, the Incremental Accelerator can replicate this efficiency via native Nutanix REST API calls, which provide a direct inventory of modified files and allow Bacula to target and pull only the specified files over NFS or CIFS.
Automatic Snapshot Rotation: To minimise primary storage overhead, the Accelerator maintains a tight rotation of 3 to 4 snapshots per volume on the filer; each snapshot is automatically pruned the moment Bacula completes its dependency, so that the active storage footprint remains remarkably lean.
Incremental Forever via Virtual Full: Mount-based backup architectures can utilise Virtual Full operations to synthesise data directly on Bacula storage. By consolidating the baseline Full backup with subsequent incrementals entirely on the backend, a new Full image is established without placing any read load on the production NAS.

Backup Methods

NFS and SMB/CIFS Mount Backup: The File Daemon mounts NAS shares over NFS or SMB/CIFS and then backs them up like a local filesystem, giving NAS environments Fileset includes, excludes, as well as file-level restores.
NDMP Dump and Tar: For NetApp, HPE, EMC, and Huawei systems, the plugin operates in conjunction with the NDMP Plugin, which requests the filer’s native Dump stream or the vendor-neutral Tar format, and Full, Incremental, and Differential levels are available for each format.
NetApp SMTAPE: By capturing a raw binary copy of a NetApp volume, SMTAPE preserves the entire snapshot history. This, then minimises snapshot retention requirements on your primary storage tiers. The plugin also supports both Incremental and Differential backup jobs, and manages the snapshots through the ONTAP REST API endpoints.

Restore Capabilities

Single Item Restore: With the use_hist directive, you instruct Bacula to log every filename from an NDMP dump directly into the Catalog. This type of granular indexing allows your administrators to browse the file tree and select specific files or directories for the target filer to restore.
Alternate Volume and Directory Targets: The where configuration parameter redirects an NDMP recovery stream into an alternate directory path. To route the restored data to an entirely different volume on the enterprise filer, you should deploy the dest_volume directive instead.
Local Extraction on the File Daemon Host: Set the destination path using where=”>/path” and stream the raw NDMP payload directly to the File Daemon host. Native utilities like tar or restore can then extract individual files locally. This capability eliminates any dependency on the original source NAS architecture.

ACL and Metadata Handling

Vendor-Native ACLs with NDMP: NDMP backups pack the ACLs and metadata right inside the vendor’s own data stream. Because it stays in its native format, the filer itself handles the application and enforcement of those permissions whenever you run a backup or a restore.
POSIX ACLs over NFS: To capture POSIX ACLs from NFS shares, be sure to mount the target share with the acl option enabled. Furthermore, the corresponding Bacula FileSet resource configuration must explicitly include the ACL Support = yes directive.
Windows ACLs on CIFS Shares: Securing Windows ACLs on CIFS shares necessitates a dedicated Windows File Daemon to mount the share. To optimise performance and prevent backup traffic from crossing the local network twice, administrators can host this Windows instance as a KVM guest directly on the Storage Daemon machine. For detailed architecture design and implementation guidance on this specialized setup, contact Bacula Systems directly.

NetApp ONTAP Cluster Support

Cluster Aware Backup (CAB): Introduced in Bacula Enterprise version 16.0.2, the use_cab directive dynamically routes each NDMP session to the specific cluster node hosting the target volume. Bacula strongly recommends deploying CAB as the baseline configuration for all cluster environments.
ONTAP API Node Routing: Beginning with Bacula Enterprise 16.0.1, the plugin can query the ONTAP API directly to locate the appropriate hosting node. For complex FlexGroup volumes where automated discovery might fail, administrators can configure static node entries within the ontap.conf file to ensure seamless coverage.
Cluster-Mode Incremental Accelerator: The Incremental Accelerator offers comprehensive compatibility across all NetApp cluster-mode architectures via the vserver parameter. Legacy 7-Mode environments are fully supported, specifically targeting releases 7.3.6, 8.0, 8.1, 8.2, and 8.3.

Platform and Vendor Support

NDMP Vendor Coverage: Bacula’s NAS backup plugin supports major filers like NetApp, HPE, EMC, and Huawei, and we have fully tested it on NetApp Data ONTAP 8.x and 9.x. Keep in mind that NDMP standards vary by manufacturer, so you may need to verify compatibility if you’re using an unlisted storage platform.
Incremental Accelerator Platforms: The Incremental Accelerator is built specifically for NetApp and Nutanix gear. If you are running it on Nutanix, make sure your environment is on Bacula Enterprise 14.0 or newer.
Any NAS with NFS or SMB Shares: For Synology or any other NAS using standard NFS or SMB shares, you don’t actually need a vendor-specific plugin. You can just protect those shares directly using the standard Bacula File Daemon.
SMTAPE Incremental Requirements: To run incremental or differential jobs with SMTAPE, your system needs ONTAP 9.6 or later. You also need to make sure the NetApp ONTAP Python API is installed directly on the File Daemon host.

Bacula Suite of Cybersecurity Features for NAS Backups

Bacula’s NAS backup solution is packed with a suite of cybersecurity features such as alerts, antivirus scans, PITR, encryption at every Layer, and a backup path that is closed for cybercriminals.

Alerts of Poisoned Backup Files with BGuardian

Backup Deviation Detection: BGuardian compares each backup job’s data volume, file count, along with run time against that job’s history and tells you which restore points to double-check if it identifies a sharp drop in any of those numbers.
Secure Configuration Assessment: BGuardian also audits your full Director configuration and alerts you to weak and/or duplicate daemon passwords.
Malware Job Reporting: You are notified of which backup jobs contained ransomware or malware, and each alert gives you the client name, job name, and job ID.
Restore Testing Gaps: You are warned when a backup job falls below your configured restore frequency.

Restore Points Cybercriminals Cannot Delete

Immutable Disk Volumes: Nobody can alter or delete a locked disk volume once Bacula writes it (even with backup credentials).
Immutability on the Storage You Already Own: Bacula supports NetApp SnapLock, DataDomain RetentionLock, HPE StoreOnce Catalyst, WORM tape, S3 Object Lock, and Azure immutable blob storage.
Air-Gapped Tape: Tapes that you eject and store offline sit out of reach of any network-based cyberattack.
Backup Copy Jobs: Bacula keeps a second set of your files’ restore points on separate storage with different credentials. If your primary backup gets corrupted or deleted, the second set survives.

Encryption at Every Layer

FIPS Compliance: Bacula’s cryptographic module meets the federal standard used by US government and military organisations.
Per-Client AES Encryption: You choose AES 128, 192, or 256 for each client, and a breach of one storage target exposes only that client’s data.
Storage Daemon Encryption: Bacula Enterprise encrypts data before it leaves your backup infrastructure, and your disk or cloud target only ever sees ciphertext.

Antivirus Scans and Malware Detection

Known-Hash Malware Detection: Bacula checks your backup files against malware signatures and marks the job “OK — with warnings” and lists the infected files for you.
Clam AV Antivirus Plugin: The Antivirus plugin detects infected files in your existing backups and names the virus found in each one.

Bacula’s Cyber-Resilient Architecture

Separate Components with Separate Jobs: Bacula splits the backup work between the Director, the File Daemon, the Storage Daemon, and the Catalog, with each component running as its own program with limited privileges. A breach of one component doesn’t hand the attacker the rest.
Backups Kept Off Your Production Machines: The Storage Daemon runs on its own server, apart from the computers it backs up. If ransomware hits one of your servers, the backups sit on a different machine, out of the attacker’s reach.
A Director That Never Touches Your Data: The Director schedules jobs and keeps the Catalog, but your backup data never passes through it.
Segregated Storage Silos: Multiple Storage Daemons and distinct Pools let you keep each agent’s data in its own silo, with its own access controls.

A Backup Path Closed to Attackers

Isolated Service Accounts – Every Bacula daemon runs under its own locked-down account; none of your production credentials work against backup storage.
Multi-Factor Authentication – BWeb asks for a one-time password on top of the regular login. A leaked password alone will not get anyone into your backup console.
SIEM integration – BGuardian alerts, along with failed logins and Director events, go straight to your SIEM.

Frequently Asked Questions

Is RAID on a NAS the same as a backup?

No. RAID keeps a NAS running when one of its disks fails, but it doesn’t keep a second copy of your files anywhere else. If you accidentally delete a folder, it is gone from every disk. Ransomware encrypts every disk at once, and a fire or theft takes the whole unit. A backup is a separate copy on different storage, and Bacula’s NAS backup software keeps that copy on disk, tape, or the cloud, out of ransomware’s reach.

Can ransomware encrypt the files on a NAS?

Yes. The SynoLocker attack in 2014 and the eCh0raix campaign in 2019 each encrypted files on Synology devices, and in each case the attackers got in through weak passwords or outdated software. To prevent these types of incidents from happening, Bacula keeps your backups on separate storage and can lock them against changes for a period you set. After an attack, you restore your files from the last clean backup.

Do I need NDMP to back up a NAS?

No. NDMP is a backup standard that the NAS itself has to support, and not every brand does. Bacula backs up any NAS over its network shares (NFS or SMB), the same way an office computer opens the files. For brands that do support NDMP, such as NetApp, HPE, EMC, and Huawei, Bacula’s NAS backup software includes the NDMP Plugin, which is faster for very large volumes.

Can I back up NAS systems from different vendors with one tool?

Yes. Bacula backs up Synology, NetApp, Nutanix, HPE, EMC, and Huawei storage from one console, under one set of schedules and retention rules. Synology’s built-in backup apps generally protect Synology devices only, and a second NAS brand would otherwise need a second backup tool.

Can I back up a NAS to tape?

Yes. Bacula reads the files on the NAS and writes the backup to disk, tape, as well as cloud storage. Tape suits long-term storage, and if you eject a tape and store it offline, attackers won’t be able to reach it during a breach.

NAS Backup Software for Multi-Vendor Environments

Protect Synology, NetApp, Nutanix, HPE, EMC, and Huawei storage from one Bacula console, with a backup method matched to each volume’s size and file count.