Disable Firewall on VM being tested by Surebackup

[BrentBPPI]

When the VM's get spun up in the sandbox the NIC's switch over to the public profile. Is there an easy way to fix or modify the scripts to disable the firewall or do I need to modify the public firewall profile?

[Rick.Vanover]

I have committed this to memory:

netsh advfirewall set allprofiles state off

[BrentBPPI]

I should have been more specific. What is the best way to automate i.e. have Veeam run the netsh command while doing the test scripts?

[Rick.Vanover]

That's an option, but additionally - it would be pretty cool if we we could use VIX of PowerShell Direct to pass thru the command to disable firewall (in the application group UI/options) as a configuration option.

[BrentBPPI]

I agree having a check box would be a lot easier than trying to figure out how to set this up. Is there a chance you can point me in the right direction on how to? This is my first Veeam custom script so I am shooting in the dark and more than likely over thinking it.

[tpayton]

Most commonly this can be resolved by having a DC boot first, and stay running during testing in SureBackup. That way the others servers see the network and Domain Controller, and switch to their Domain profile, as if it's their original network.

1. Create a new application group in the Backup Infrastructure section, or edit an existing application group that the SureBackup job is using.
2. Add a Domain Controller
3. In the App Group item settings select the role for Domain Controller to have Veeam force the DC to come up in authoritative mode.
4. Edit the SureBackup job and make sure the Application Group containing the DC is selected.

Now when the SureBackup job starts, the very first thing it will power on in the lab, and keep running throughout the test, is the Domain Controller.

[BrentBPPI]

I had the DC's start first, however I did realize that I did not have the first one be authoritative. I am testing now to see if that was my issue.

[BrentBPPI]

Veeam doesn't make it easy to troubleshoot the failures when they shutdown the application group and delete everything after a failure. Is there a way to get veeam to run test scripts but continue on failure? I have keep application group running after job completes, but it still cleans up on failure.

[tpayton]

There is no way to both run tests and not stop at failure. Instead disable tests and manually test. When testing I generally focus on one or two VMs at a time. I put them in an Application Group along with a single DC. Then disable all Ping "VM responds to ping on any network interface" and Script tests.

Then create a testing SureBackup job with no linked jobs, and only use the Application Group created for testing, with the "Keep running after completion" option.

With the test disabled the SureBackup job won't fail, because it hasn't tested anything. This does however provide an opportunity to troubleshoot previous test failures.

To perform a manual ping test, just ping the VM in the lab from the Veeam server taking in account the masquerade configured in the Virtual Lab settings.

To perform a manual Script test, you'll need to review the script test selected to see which port it is trying to test. Then use the Veeam.Backup.ConnectionTester.exe found in the VBR installation directory. It's a very simple command line tool, feed it an IP and port, and it will show an error if there is one, or if it's successful it will just exit with no message.