in the last weeks we had two support cases for a Veeam NAS Backup Issue, it was Case 07426619 and 07495374.
We tried to use the NAS backup function with NetApp integration to backup CIFS file shares. Every time we did this we received an Access Denied Username or Password Incorrect error message.
After many hours of troubleshooting, it turned out that the backup via the simple NAS backup, i.e. without storage integration with UNC path \\Fileserver\ShareXY works. However, backing up the same share with integration and the same user did not.
So at the beginning we also suspected the NetApp service account, but since snapshot creation, storage rescan etc. ran smoothly, we were able to exclude this.
Finally, we discovered in the Veeam log files that Veeam accesses the share differently when backing up with and without storage integration.
Direct access / Simple NAS backup:
[NasBackup] Backup spec: ‘RestorePointId “3”, RootLink, “\\fileserver\data”,
With Netapp integration:
[NasBackup] Backup spec: ‘RestorePointId “5”, RootLink, ’\\10.10.120.150\data
Since the customer hardened the NetApp according to best practice, NTLMv2 was disabled on the NetApp, so it could only be accessed via Kerberos. No problem for the Simple NAS Backup, as the hostname was used here.
The IP is used for storage integration, but Kerberos can't use IP by default. Then I realized what was happening, Veeam simply asks the NetApp for the IPs in the background and tries to access them, but this fails.
With a workaround, i.e.
Code: Select all
setspn -S HOST/ip.address AD_Objecthttps://learn.microsoft.com/en-us/windo ... os-over-ip
Here is my feature request:
a) I have not found any information about this in the documentation. If there is really nothing here, there should be a note
b) Veeam could simply do a reverse DNS lookup and then access via DNS OR you could make a field in the storage/NAS backup job for ‘Type FQDN of Fileserver here’.
Even with the support we needed many days until we found the cause...
Best regards
Matze