VBR 11 Broken with Nutanix AHV 5.20.4 LTS

[rwgsa]

Has anyone had issues with Veeam B&R 11 (Build 11.0.1.1261 P20220302) working with Nutanix AHV 5.20.4 LTS? We have two Veeam installations and two Nutanix clusters, each on the respective versions. We have recently upgraded both Veeam and Nutanix to these respective versions, so I am not sure which is causing the issue.

Veeam no longer seems to be able to communicate with Nutanix. I have tried following the steps in https://www.veeam.com/kb4237 but this has not resolved the issue; in fact it has made one of the Veeam instances worse. Name resolution appears to be working fine from the VBR servers and Nutanix AHV Proxy. Unfortunately the AHV proxy continues to show offline in Veeam and when I try to rescan the AHV cluster, it comes back with the following error:

Failed to Rescan cluster. Command failed (Error:'Failed to rescan cluster - Backup REST error: HTTP StatusCode:'Conflict', Description:'"AHV Cluster not available"'')

On the second Veeam instance, I tried to remove and re-add the Nutanix AHV cluster. This failed and when I try to re-add the Nutanix AHV cluster to Veeam, it now says:

Exception of type 'Nutanix.Client.Common.Exceptions.NutanixServerException' was thrown.

The VBR servers have Nutanix AHV Plug-In for Veeam Backup and Replication (v11.0.3.819) deployed.

I am waiting for Veeam tech support to come back to me but I am I'm curious if anyone else has had this issue?

(Technical Support Case ID: 05481692)

[Mildur]

Hi Raymond

Looks like the case was a few minutes before your post. Let's wait for our support to analyze the logs.
UPDATE: We don't expect any issues with the new release or have heard of any issues. So please continue to work with our support.

Thanks
Fabian

[Devas]

Experiencing similar issues. We have multiple AHV clusters in place. The 5.20.3 LTS editions work properly and work from the VBR console. However, the 5.20.4 clusters are not able to communicate with VBR. From within the console a message pops-up to do a rescan. However, this re-scan fails due to an certificate error.

Somewhere online someone dug trough the release notes of AOS stating that Nutanix has removed weak ciphers in 5.20.4 LTS. I have a feeling that's causing this issue. Also IE11 is not able to open the cluster's main page on the 5.20.4 LTS versions, the 5.20.3 LTS versions work fine.

I've opened a case with support (Case #05481394) and upgraded AHV plugin ánd proxy's to the latest versions: 11.1.3.43, however, without result.

Still waiting for support to get back in contact.

Is your issue in the meanwhile resolved?

[Kochkin]

In this version Nutanix left only a couple of supported ssl ciphers

Code: Select all

 nmap --script ssl-enum-ciphers cluster.address -p 9440

Code: Select all

| ssl-enum-ciphers:
|   TLSv1.2:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A

The problem is these ciphers are supported only starting from Windows Server 2016/Windows 10.
https://docs.microsoft.com/en-us/window ... s-10-v1607

They are not supported in Windows Server 2012 R2 and earlier
https://docs.microsoft.com/en-us/window ... indows-8-1

Since Windows cannot work with it (you can check -- IE will not be able open it), Veeam software cannot work as well.

[lorenzopani]

I have the same problem after resetting a windows server 2012 R2
failed to get certificate error

Is there a workaround to make it work?

[Mildur]

Hi Lorenz

Yes, we have a KB Article ready:
https://www.veeam.com/kb4335

Either upgrade your VBR server to a OS version with current cypher support or modify your AOS to re-enable the dropped ciphers.

Thanks
Fabian