Error deploying Azure Proxy VM

[kaffeine]

Hello everyone,

we're at the moment stuck trying to create an Azure Proxy. We went through the official documentation multiple times, but we don't see how we can try things any different. We're running the latest Build from Veeam B&R v10 on a W2012R2 Server. There are two errors occurring in the proxy deployment:


1. Error while creating Update Network Interface

On our multiple tries to deploy the proxy, this error only occurred in some of them. On the Azure Activity Log, one the following errors shows up:

Code: Select all

# Azure Monitor | Activity Log #
Microsoft.Network/networkInterfaces/(...) is not in Succeeded state. Resource is in Updating state and the last operation that updated/is updating the resource is PutPublicIpAddressOperation
Microsoft.Network/networkInterfaces/(...) is not in Succeeded state. Resource is in Updating state and the last operation that updated/is updating the resource is PutNetworkSecurityGroupOperation

As these errors are sporadic, my suspicion is that the proxy deployment procedure from VBR has somehow quite a small timeout window for the API callback (at least regarding NIC resources), and if there's no quick (successful) return value, the step fails. Has anyone experienced this error?


2. Error while creating Virtual Machine

The following error always comes up, and ultimately kills the proxy deployment procedure:

Code: Select all

# Veeam B&R Console #
Provisioning state is 'failed': PlatformImageNotFound (System.Exception)
# Azure Monitor | Activity Log #
'MicrosoftWindowsServer:WindowsServer:2012-R2-Datacenter:latest' is not available. Verify that all fields in the storage profile are correct.

So far we made sure that:

# the used azure account for the proxy deployment is the Onwer of the respective Azure subscription
# all of our resources, including the storage account for the proxy VM, are located on West Europe, so there's no Region mismatch between resources
# we ran ___ az vm image list -l 'West Europe' ___ on the Cloud Shell and the W2012R2 Datacenter is listed as available
# AzureRM 5.1.1 is installed on the VBR Server
# the Azure network and subnet resources to be used were provisioned beforehand
# we can manually deploy an Azure VM instance with the W2012R2 Datacenter SKU without any problem whatsoever

We also tried:

# recreate the azure storage account used by the proxy (to no avail)
# add our azure compute account through both "Use the existing account" and "Create a new account" methods. The veeam special application is successfully registered with the later method


We already have an opened ticket with the Azure support, but the assigned support engineer is not familiar with veeam, so we're still grinding through... Veeam case: #04437673

Has anyone faced similar issues in the past?

Regards

[HannesK]

Hello,
yes, Veeam support should find a way to deploy the Azure restore proxy (I mean, the case was opened only an hour before you posted on the forums ). Normally it's a permission or network issue.

If you use VPN to Azure (instead of direct internet connection), then you could also try a workaround:
1) deploy a Windows VM in Azure
2) add it as "managed server" in Veeam
3) add the Azure restore proxy role to that managed server

Best regards,
Hannes

[bit_inspector]

Hi Hannes.

I am dealing with the same problem. Could you elaborate how step 3) would be accomplished?

TY
Thomas

[veremin]

This is how you can do it. Thanks!

[kaffeine]

Hello,

we were finally able to solve the problem. Unfortunately the Azure support was of no help, we just received general advice on alternative ways to create am VM on Azure, but the reported API errors from the Microsoft.Compute provider were just ignored and never looked at, and neither were all the error log entries on our Activity Monitor, and it ended up with "that must be a problem on the Veeam application", super frustrating... We only have the Azure Standard support plan though, which might explain the generic replies.

So we picked apart all the API log entries created from VBR calls. This is the one that sets the VM parameters and triggers the error "ImagePlatformNotFound" right after:

Code: Select all

"responseBody": "{\"name\":\"[PROXYVM]\",\"id\":\"/subscriptions/(...)/resourceGroups/(...)/providers/Microsoft.Compute/virtualMachines/[PROXYVM]\",
\"type\":\"Microsoft.Compute/virtualMachines\",\"location\":\"westeurope\",\"tags\":{\"Veeam\":\"VBA for Azure\"},\"properties\":{\"vmId\":\"(...)\",\"hardwareProfile\":
{\"vmSize\":\"Standard_F4s_v2\"},\"storageProfile\":{\"imageReference\":{\"publisher\":\"MicrosoftWindowsServer\",\"offer\":\"WindowsServer\",\"sku\":\"2012-R2-Datacenter\",
\"version\":\"latest\"},\"osDisk\":{\"osType\":\"Windows\",\"name\":\"osdisk\",\"createOption\":\"FromImage\",\"vhd\":{\"uri\":\"(...)/vhds/[PROXYVM].vhd\"},
\"caching\":\"ReadWrite\"},\"dataDisks\":[]},\"osProfile\":{\"computerName\":\"[PROXYVM]\",\"adminUsername\":\"(...)\",\"windowsConfiguration\":{\"provisionVMAgent\":true,
\"enableAutomaticUpdates\":true},\"secrets\":[],\"allowExtensionOperations\":true},\"networkProfile\":{\"networkInterfaces\":[{\"id\":\"/subscriptions/(...)
/resourceGroups/(...)/providers/Microsoft.Network/networkInterfaces/[PROXYVMNIC]\"}]},\"provisioningState\":\"Creating\"}}",

So we wanted to emulate this Proxy VM creation procedure (as done by VBR), and to this end we tried to setup an unmanaged disk (container/blob based) on the same storage account we selected on the VBR Proxy Wizard previously, and to our surprise.. this storage account was not listed/selectable, while some others were. We went through all of their settings, and the only differentiating factor between the storage accounts available for VHDS creation and the ones not even listed, was the Replication setting. It turns out the storage account we wanted to put the Proxy VM disks on was configured with ZRS redundancy, and for some reason the accounts with ZRS are not eligible to receive unmanaged disks!? We couldn't find any official documentation that mentions such restriction, but at least on our azure environment it's not possible.

We ended up recreating the storage account with GRS redundancy, and from this point on everything worked as expected (Note: LRS works as well). So in the end the explanation for the "ImagePlatformNotFound" is obvious: as the disks couldn't be created, no image SKU could be assigned. The tenant in question is set up with "EU Model Clause compliant datacenters" as Location, and all respective resources have "West Europe" as main region. If this constellation is a factor for the ZRS incompatibality.. we don't know, but it might be.

As a final suggestion to Veeam, I would say it would be helpful to have a little more details on the Azure Proxy documentation, namely how exactly the Wizard works in the background and what steps it takes to created the needed resources. Ideally one would be able to manually simulate a VBR Azure Proxy deployment with the help of a RM Template or a PowerShell/AzureCLI script (something like this, an alternative way to set things up). This way one would have a more granular control of the whole process and would be able to handle failed resources' deployments much better.

i hope this infos help those who might experience the same errors in the future.

Regards

[veremin]

We will try to confirm the described behaviour internally; I will reach you, once I have more information.

Thanks!

[veremin]

Digging deeper into this, we found Microsoft documentation which confirms your findings:

Neither managed nor unmanaged disks support ZRS or GZRS.

We will update our documentation to mention this limitation.

Thanks!

[kaffeine]

Hello Vladimir,

thanks for pointing that out. I went through those compatibility charts to make sure the GPv2 accounts could support our chosen region and the needed blob storage, but we missed those footnotes.

So only LRS is recommended, and GRS is actually discouraged. We'll convert our Veeam Proxy accordingly.

Regards

[veremin]

Correct, we've already reached technical writers team, the documentation will be updated soon. Thanks!

[veremin]

The documentation has been updated:

https://helpcenter.veeam.com/docs/backu ... ml?ver=100
https://helpcenter.veeam.com/docs/backu ... ml?ver=100
https://helpcenter.veeam.com/docs/backu ... ml?ver=100

Thanks again for raising this.