featurerequest: Veeam Agent for windows behind NAT

[cell]

Hi, i know NAT is'nt really supported for Veeam agent but for what i can see it's possible with "a few" changes.
The main issue today seemes to be that the first communication back to the VBR server is using fqhn while the communication with the repository is made by ip (trying all available ip's on the repository-server).
If you change the communication from ip to fqhn to the repository-server, it would just be a matter och adding records to hosts-file or dns to get veeam-agent backup behind NAT to work.

To get backup to work with the current design you would first need to add portforward on the firewall on ( TCP 10001,10005,10006, 49152:65535,2500:5000 )
then add record to the hosts-file on the clients (to point traffic to the "client side ip" of the firewall handling the portforward)
finally you need to add a secondary ip(client side ip for the firewall) on the network-interface on the repository-server and restart Veeam data mover service.

my finding should be documented in case 03027245

[Dima P.]

Hello cell.

Thanks for sharing a workaround. I've added your vote to this feature request. Cheers!

[albert@iwv.cloud]

Hello Veeam support

I also vote for this feature to be added in coming release of VBR. Thank you.

[Dima P.]

Hello and welcome to the community albert.

Thanks. Have you considered using Veeam Cloud Connect for your infrastructure? No only it eliminates the NAT issue but also allows you to perform backup over WAN directly to the backup repository. Thanks!

[masonit]

Hi

This is exactly what is needed: https://www.veeam.com/kb2098
I have tried it on vbr server with Veeam agents in protection group. But I does not seem to work. It presents repository with its fqdn host name. But only tries to connect with its ip-address.
Does this only work when communicating with Enterprise manager?

\Masonit

[Dima P.]

Magnus,

Enterprise Manager wont help. Agent requires Veeam B&R host name to be resolved properly from the agent side.

[masonit]

Magnus,

Enterprise Manager wont help. Agent requires Veeam B&R host name to be resolved properly from the agent side.

Think you missunderstand the issue. Of course Enterprise manager won't help. But the principle is the same as the kb fix. Where VBR change it's behaivure to present it self to EM with fqdn name instead of internal ip-address. We would like the same fix for when VBR present it self to Veeam Agents. Or more specific when the repository-server presents it self as stated above by Cell.

\Masonit

[albert@iwv.cloud]

Hello and welcome to the community albert.

Thanks. Have you considered using Veeam Cloud Connect for your infrastructure? No only it eliminates the NAT issue but also allows you to perform backup over WAN directly to the backup repository. Thanks!

Dima, we have some servers in the same data center with agents installed. Since its under the same LAN and not involving WAN, i think cloud connect might be not suitable for this.
Please advise if i am wrong.
From what i understand, cloud connect is for service provider providing customer cloud backup storage from dumping backup data from their office premise or their own data center to us over the WAN. If for our case, we do have many servers with agents or HyperV or Vmware EXSi VMs where they are all under the same DC with LAN, cloud connect still relevant?

[Vitaliy S.]

Hi Albert,

Yes, If you have issues with NAT and Veeam Agents, then yes, you may want to consider using Cloud Connect internally to work around this.

Thanks!

[zx.savage]

Vote!

[nchand]

Is this still not an option? I have a server offsite that has the ports open to my backup server, which is behind a NAT. The agent can find the backup server and repository when setting up the job using FQDN, but when I execute the backup it fails because it is trying to use the internal private IP of the backup server, which of course it cannot resolve.

[Vitaliy S.]

Yes, current situation is still the case.

[nchand]

Are we still waiting for a solution to get this to work behind NAT?

[Dima P.]

Hello nchand,

The provided solution remains valid - Veeam Cloud Connect repository provides the ability to connect to a cloud repository via simple IP address/port. Any chance you've tried it? Thanks!

[mike-ucsit]

Just moved my B&R server from a public IP to a NAT'd IP and came across this issue aswell.
I solved it just by adding the public IP to the network card of the server with a /32 netmask.

Of course this IP cannot access anything as it's on a totally different VLAN but it still uses this IP to present to the Veeam Agents and it works beautifully.

But indeed this feature should be added to the B&R Server to present the NAT IP instead of LAN IP.

[Egor Yakovlev]

Interesting workaround.
Added your +1 to feature request too!
/Thanks!

[viktu]

+1 to this feature please.

I cannot understand how an easy solving issue is not addressed even in version 10...

Thank you

[nchand]

I am not quite understanding how Cloud Connect solves this issue, are there guides on how to set up an internal private cloud Cloud Connect system using my existing local repository? I cannot use one of the providers.

Would be a lot easier if the VBR server could just respond with FQDN. I will give the solution offered by mike-icsit a try.

[Vitaliy S.]

Cloud Connect would help only if you host it, but not a service provider. In this scenario, you would create a cloud repository based on your existing local repository. Please reach out to your Veeam sales rep as you might be eligible for Veeam Cloud Connect for the Enterprise (use this in your infrastructure).

[viktu]

Would be a lot easier if the VBR server could just respond with FQDN. I will give the solution offered by mike-icsit a try.

This solution did not work for me. I added the IP to one of the NIC's of the server, and Agent is trying to connect only to the first internal IP address...

Cloud Connect would help only if you host it, but not a service provider. In this scenario, you would create a cloud repository based on your existing local repository. Please reach out to your Veeam sales rep as you might be eligible for Veeam Cloud Connect for the Enterprise (use this in your infrastructure).

But is there an additional cost associated with Veeam Cloud Connect? I have payed for an Agent license that simply, does not work...

[Vitaliy S.]

But is there an additional cost associated with Veeam Cloud Connect? I have payed for an Agent license that simply, does not work...

There have been some changes in the VCC-E licensing, so I would recommend discussing it with your Veeam sales rep.

[doitman]

Solution by mike-ucsit worked for me. I just added my public-facing IP to the ethernet interface, and a subnet mask of 255.255.255.255. It didn't work initially after making the change, so I just restarted all of the Windows Veeam services, thinking maybe they cached the IP configuration. That worked.

[nchand]

@doitman - are you saying you added the public IP to the same interface as your internal NATed IP Address? So the interface has both IP addresses?

[nchand]

Still no vendor solution for this?

[Vitaliy S.]

The solution in this case is to use Veeam Cloud Connect for Enterpise framework (there are some requirements for obtaining this product though). Thanks!

[nchand]

Vitaliy,

Can I use CLoud Connect Enterprise with my own private cloud? I do not want to connect to a third part provider of cloud storage. I just want to get my offisite servers into my local repository.

[Egor Yakovlev]

Yes, you can.

Contact your prefered Veeam reseller in order to get details how to obtain Veeam Cloud Connect for Enterprise license. No cloud provider will be involved - you will host your own VCC Server, your own access Gateway server for remote agents to use, and your own storage servers.

/Cheers!

[nchand]

I am told my VBR license includes cloud connect, but I cannot figure out how to create this private cloud VCC server with my current backup server and repository. Do you know of any documentation that can lead me to a solution? All I see is how to connect to third party cloud connect service providers.

[Mildur]

You cant configure your normal vbr server as a cloud connect server.
The vbr cloud connect server has to be a standalone server.

1. install vbr server
2. import your „Cloud Connect Enabled“-License
3. configure your cloud connect gateway

[Egor Yakovlev]

Veeam Cloud Connect Guide for the rescue.
/Cheers!