Configure proxy fails

[NashBrydges]

I've just downloaded and installed the latest trial for Veeam For Office 365 and trying to setup a proxy server but the configuration fails. Every step before "configure" works perfectly. The actual error from the log reads:

Code: Select all

2/8/2018 10:43:57 AM   24 (1668) Error: Proxy connection to controller failed: The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '00:00:09.9840000'.
2/8/2018 10:43:57 AM   24 (1668) Stack:
2/8/2018 10:43:57 AM   24 (1668) 
Server stack trace: 
   at System.ServiceModel.Channels.ServiceChannel.HandleReply(ProxyOperationRuntime operation, ProxyRpc& rpc)
   at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
   at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)

Exception rethrown at [0]: 
   at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
   at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)
   at Veeam.Archiver.Interfaces.IArchiverAdmin.GetInstallProxyResult(Guid taskId)
   at Veeam.Archiver.Client.ArchiverAdminConnection.GetInstallProxyResult(Guid taskId)
   at Veeam.Archiver.Shell.Dialogs.ProxyWizard.Tasks.ProxyAsyncTaskFactory.<CreateInstallProxyTaskFactory>b__9_1(Guid taskId)
   at Veeam.Archiver.Client.Tasks.RemoteTask`1.CheckTaskCompleted()

- Veeam Office 365 is installed on a MS Win Server 2012 R2 VM with latest updates/patches
- The proxy I'd like to add is a Win Server 2012 R2 backup file server with latest updates/patches (it is also being used for Veeam Backup & Replication successfully)
- The environment is a Workgroup environment (no domain)
- All ports have been enabled on both Veeam Office 365 management server VM as well as intended proxy server (9191, 9193, 9194, 80, 443, 587)
- Local network is a 10Gb network interconnect between servers (no signs of network issues in the past or recent history)

Not sure what to try next.

[Mike Resseler]

Hey NashBrydges,

This looks like a communication problem between the two (because of the timeout). I would suggest that you create a support call on this one and post the support case ID here + the follow-up after investigation with the engineers.

Thanks
Mike

[NashBrydges]

Case #02595984

[Mike Resseler]

Thanks!

Please keep us informed further about the progress and the outcome

Thanks
Mike

[NashBrydges]

So, after a few days of back and forth with support and various attempts at creating a Proxy, the final word is that creating a Proxy is NOT a supported function in a Workgroup environment. Only the default proxy created at install time can be used. We're a small company and have no need for AD/DC. This seems counterintuitive as this essentially excludes a very large number of small businesses. I'll be adding a feature request to include this capability in a future build.

[Mike Resseler]

Hey NashBrydges

Now I feel actually bad because I could have saved you the trouble. I should have read the original post better instead of focusing on the log. It is even in our guide that this is not a supported scenario: https://helpcenter.veeam.com/docs/vbo36 ... tml?ver=15

Sorry about that. I will also contact support to make sure that they are aware of this.
Consider the feature request noted. I cannot promise you it will make the next version, but we will investigate and depending on the importance add it to the solution

Again, sorry

Mike

[jayscarff]

I've a similar setup, tying to point but the proxy i'm trying to add is actually my Cloud Connect repository server...also no domain. I guess i will need to install O365 on the repo directly to have access to the Tenant LUNS.
+1 for feature request,

Thanks

[Mike Resseler]

Request noted, but as said before, no promises

PS: Please note that the repository is not the same as a VBR repository. So I would not advice to create the repository in the same directory.

[Tarqy]

I'd also like to see this change, We too have a physical Cloud Connect Repository server that is non-domain and would like to utilise it for access to tenant storage. (Different repository as mentioned above obviously)

[jkettler]

We're looking to isolate our Veeam infrastructure from the domain with a repository for Office 365 that isn't joined to the domain. Is this possible?

[Polina]

Hi @jkettler,

You still need to have all VBO components - server and its backup proxies - to be installed within the same or a trusted domain.

[jochot]

Hey,
I am also moving our Backup infrastructure out of the domain and got the same issue.
My VBO365 backup server is still in the domain, but the Proxy isn't.
I figure this is the reason why this doesn't work anymore?
As I understand it, installing VBO365 on the BackupRepo/Proxy Server would work?

To be honest, for me, removing the Backup infra from the Domain (especially repositories) does make a lot of sense to have a bit of security against potential ransomware attacks with domain admin accounts

[Polina]

Hi jochot,

If you need a distributed deployment, VBO server and proxy must be installed in the same or trusted domain.

Otherwise, you can go with a single-server installation and use the default backup proxy. Note, that it's not possible to install a backup server on the backup proxy server, but a proxy can be installed on the same machine running a server.

[bflood2000]

Please add this IMPORTANT ability to future release. I mean the is best way to stop lateral movement of malware/ ransomware in a domain is to put backup server outside domain with different credentials. With current product you can't do this. As it stands now, if installed outside domain backup can ONLY go on the VBO server and no where else. Roll out hot a hotfix or something to address quickly, please.

[Polina]

Hi Brian,

This would require quite a few changes in the code, so delivering it as a hotfix can hardly be an option. But anyway your concerns make a perfect sense and the request is noted.

Thanks!

[TitaniumCoder477]

Please add this IMPORTANT ability to future release. I mean the is best way to stop lateral movement of malware/ ransomware in a domain is to put backup server outside domain with different credentials. With current product you can't do this. As it stands now, if installed outside domain backup can ONLY go on the VBO server and no where else. Roll out hot a hotfix or something to address quickly, please.

I'm guessing this still isn't the case because I'm running into the same symptom with 4.0.0.1533. This lack of support for WORKGROUP machines blows my mind. We don't put ANY of our backup servers on the domain. Whether a small AIO or a distributed deployment of Veeam Backup & Replication, all backup infrastructure is completely separate from the production domain. Obviously we could stand up another domain, but for a client with a single host and four virtual servers, that makes absolutely no sense. I concur with you that this is a very IMPORTANT ability. I can't believe the VBR backup server and proxy can work fine in WORKGROUP deployment but I can't use the same proxy for Veeam Backup for Microsoft Office 365 because of "lack of support".

5/17/2020 8:56:52 AM :: Configure proxy. Error: Proxy connection to server failed: The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '00:00:09.9960000'. :: 0:00:20

[Polina]

Hi James,

Apologies for the late response.
For v4, the domain is still needed; however, the workgroup support is on a roadmap and we expect to deliver it in the next versions.

Thanks!

[Herbert Sz]

I assume, this will not be in V5, right ?
Will it be in the next version ?

[nielsengelen]

The full list of V5 features will be available upon GA via either the what's new or the release notes.

[pesos]

Hi all, has this limitation been fixed in v5, or is this still not possible? (backup server and proxy in different AD domains in our case)

[Mike Resseler]

In v5 you have the possibility to mix domains and workgroups.

[pesos]

Fantastic, thanks Mike!