How Zmanda Pro Implements Air Gapped Backup for Ultimate Data Protection

Air gap backup represents the gold standard in data protection security—and it’s a capability we’ve engineered into the core of Zmanda Pro. In fact, working in highly secure, air-gapped environments has been a key requirement of Zmanda, going back to day one. This post will walk you through different types of air gapping, what it takes to configure your environment, and the pros and cons of various levels of air gap backup options.

Try Zmanda Pro For Free  Request Demo

What is air gap backup?

Air gap backup creates a complete physical or logical separation between production systems and backup storage. Unlike connected backup solutions, an air-gapped system ensures backup data remains physically disconnected from the network, making it inaccessible to malicious actors.

The concept is straightforward but powerful: what attackers can’t reach, they can’t corrupt or encrypt. This approach creates an impenetrable barrier that even the most sophisticated ransomware can’t breach.

Why air gap matters in enterprise backup

Air gap backup has transitioned from a nice-to-have security feature to an essential component of enterprise data protection:

• 86% of organizations that implemented proper air gap mechanisms recovered from ransomware attacks without paying ransom
• Recovery time from air-gapped backups averages 63% faster than from compromised connected backups
• The financial impact of data breaches is 2.7x higher for organizations without air-gapped backup strategies

For IT Directors and CISOs tasked with mitigating catastrophic data loss scenarios, air gap represents the most reliable defense against both external threats and insider risks.

Types of air gap implementation with Zmanda Pro

Zmanda Pro offers two distinct approaches to implementing air gap protection, each offering different security levels and operational considerations:

Try Zmanda Pro for free

1. Offline Backup Storage

The first method involves creating standard backups that are then air-gapped after creation. This approach allows for normal backup operations through the Zmanda Pro interface while adding a crucial security layer through post-backup isolation.

The workflow typically follows this pattern:

1. Zmanda Pro backup jobs run on their normal schedule
2. After backup completion, storage targets are physically or logically disconnected
3. During reconnection periods for incremental updates, strict access controls minimize exposure

This approach balances operational convenience with enhanced security. It’s particularly suited for organizations with existing Zmanda Pro implementations looking to strengthen their defense-in-depth strategy.

2. Completely Offline Self-Hosted Deployment

For organizations with stringent security requirements or regulatory obligations, Zmanda Pro supports a fully air-gapped self-hosted deployment. This implementation establishes a Zmanda Pro server instance in an environment entirely disconnected from public networks.

This represents true air gap protection—Zmanda Pro operates within your restricted network perimeter with no external dependencies. Here’s what makes this approach particularly robust:

• The backup server can’t initiate outbound connections
• No cloud connections exist that could be exploited
• All components operate exclusively within your security boundary

Learn more about our Zmanda Pro deployment options.

Technical implementation guide: Self-hosted offline Zmanda Pro

Implementing a fully air-gapped Zmanda Pro environment requires careful planning and precise execution.

Note, you can always find the latest, detailed steps for our various deployment models in our detailed Zmanda Pro Deployment Models Documentation.

Prerequisites

Before beginning installation, ensure your environment meets these requirements:

• Supported Linux distributions: RHEL 8+ or Debian 12+
• Docker CE (v27.3.x+) installed
• Containerd.io package
• Docker compose plugin (v2.29.x+) installed
• Unzip utility available
• Network configuration with internal DNS or host file modifications

DNS configuration

For proper Zmanda Pro server operation, you’ll need DNS A records for two FQDNs.

For proper Zmanda Pro server operation, you’ll need DNS A records for two FQDNs:

<ZMANDAPRO_SERVER_IP> backup.zmanda.com
<ZMANDAPRO_SERVER_IP> root-backup.zmanda.com

If you lack an internal DNS server, modify client device files to map these FQDNs to your Zmanda Pro server IP.

Certificate configuration

For production environments, we strongly recommend using certificates signed by your organization’s Certificate Authority:

1. Prepare an intermediate CA certificate trusted across your environment
2. Generate an HTTPS certificate for your configured domain (e.g., backup.zmanda.com)
3. Include root-backup.zmanda.com as a Subject Alternative Name (SAN)

Network requirements

The fully air-gapped implementation requires these ports:

• Port 443: HTTPS traffic to the Zmanda Pro server
• Port 9001 (optional): HTTPS traffic to the StorageManager service

Implementation process

Follow these steps to deploy your air-gapped Zmanda Pro instance:

1. Obtain and unpack the setup package
2. Execute the installer
3. License activation
4. Initial configuration

See the full details here: Zmanda Pro Self-Hosted Offline setup (docs.zmanda.com).

Security considerations

When implementing your air-gapped Zmanda Pro solution, remember:

1. The license activator is a password-protected binary file that may require whitelisting in your security software
2. Each license activator activates only one instance of a Zmanda Pro Server container
3. For DR strategy or replica server setup, contact Zmanda Sales about additional instances

Operational challenges and best practices

While air-gapped deployments provide superior security, they present unique operational considerations:

Managing Without External Connectivity

• Patching and Updates: Plan regular maintenance windows for applying updates to your offline Zmanda Pro environment
• Troubleshooting: With no direct connectivity for remote support, your IT team must develop internal expertise
• Documentation: Maintain detailed deployment documentation that includes all configuration specifics

Testing and validation

In air-gapped environments, backup testing becomes even more critical:

1. Schedule regular backup restoration tests to verify integrity
2. Document and time recovery procedures to meet established RTOs
3. Maintain comprehensive logs of all backup operations for audit purposes

Zmanda Pro: Purpose-built for air gap security

Our Zmanda Pro solution was engineered from the ground up to support true air gap protection without compromising functionality. This wasn’t an afterthought—it’s a core design principle that differentiates our solution in the market.

When implemented properly, Zmanda Pro’s air gap capabilities provide:

• Immunity to network-based ransomware propagation
• Protection against malicious external actors
• Defense against insider threats with privileged access
• Compliance with stringent regulatory requirements for data isolation

Finding the right balance

While complete air gap isolation provides maximum security, it may not be necessary for all workloads. Many organizations implement a tiered approach where:

• Critical systems with sensitive data receive full air gap protection
• Secondary systems utilize partial air gap with scheduled connectivity
• Less critical systems employ standard backup practices

This risk-based approach optimizes both security and operational efficiency.

Expert consultation for your air gap strategy

Implementing an effective air gap solution requires careful planning and deep technical expertise. Our team of implementation specialists can help you:

1. Assess your specific organizational requirements
2. Design a tailored air gap architecture
3. Implement and validate your Zmanda Pro offline deployment
4. Establish operational procedures for long-term management

Book a consultation with our data protection experts to discuss your air gap backup strategy.

For organizations serious about ransomware defense and data integrity, there’s no substitute for properly implemented air gap protection. With Zmanda Pro’s purpose-built offline deployment capabilities, you can achieve true data isolation without sacrificing the enterprise-class backup features your organization depends on.