VMware Backup Job Fails – SSL_ERROR_SYSCALL / TLS Handshake Failed on NFC Download (Sporadic, Multiple Customers)

[Woegerbaeur]

Hello everyone,

Case-ID: #08017504

I'm hoping someone here has encountered this issue before. We are experiencing sporadic SSL/TLS handshake errors during backup jobs across multiple VMware environments. The interesting thing is that the job does not ultimately fail the first retry succeeds without any issues. I only noticed this issue in the first place because I monitor the jobs via PRTG, which alerted me to the initial failures. Without that monitoring I likely would have missed it entirely. Still, we would like to understand why the initial attempt fails. The issue does not occur on any of our Hyper-V environments only VMware.I would really appreciate any input or ideas!

Environment:
- Veeam Backup & Replication: v13.0.1.1071
- Hypervisor: Standalone VMware (ESX) – multiple different ESX versions affected
- Affects multiple customers with different configurations
- Different VMs affected each time (not always the same one)

Error Message:
Failed : Error: Can not retrieve requested properties.
Soap fault. SSL_ERROR_SYSCALL
Error observed by underlying SSL/TLS BIO: Unknown error
Detail: 'SSL/TLS handshake failed', endpoint: 'https://[ESXi-HOST-IP]:443/sdk'

Failed to reconnect to storage.
Storage: [stg:[DATASTORE-UUID], nfchost:ha-host, conn:[ESXi-HOST-IP]]
Storage display name: [Daten]

Failed to create NFC download stream.
NFC path: [nfc://conn:[ESXi-HOST-IP],nfchost:ha-host,stg:[DATASTORE-UUID]@[VM-NAME]/[DISK-NAME].vmdk]

Agent failed to process method {Transfer.FileToText}.

Thanks in advance for any help!

[tj818]

Do you see anything in the vCenter/ESXi Logs or have you ran Wireshark/tcpdump? I have come across this in the past and I believe there were some issues on the vCenter side with too many concurrent HTTPS Connections.

[Woegerbaeur]

Thanks for the suggestion! Yes, both ESXi logs and Wireshark captures have already been collected and submitted to Veeam Support. The case (#08017504) is still open Veeam has been working on it but unfortunately hasn't found a resolution yet. What Veeam has confirmed so far is that this is not a network-related issue.

In the meantime, I've been able to narrow things down: I'm now only seeing the problem at one customer site, where a replication job runs from ESXi 8.0 Update 3 to ESXi 7.0 Update 3. I want to highlight again: the job does not ultimately fail, the first retry always succeeds without any issues.

Has anyone experienced similar issues, especially with mixed ESXi versions? Any ideas would be greatly appreciated, as you can see from the case history, quite a few things have already been tried.

One thing that still strikes me as odd: this problem only started appearing with Veeam v13. It could be a coincidence, of course, but the job had been running without any issues for years before the upgrade.