Excessive ports for VB&R components deployment

[ysukhov]

Hi,

If we look at the used ports list for Windows servers, we will find the following ports, required for deploying Veeam Backup & Replication components:

TCP/UDP 135, 137 to 139, 445

My question is why (and when) would you need ports 135, and 137 to 139 to deploy Veeam components?

As far as I can tell, the only needed port is 445. If it's open, a Veeam Installer package will be uploaded to a remote machine and deployed. After that, ports 445 and 6160 will be used to deploy additional components.

It seems that NetBT ports (137-139) were listed to support name resolution in networks without a DNS server, but in that case only UDP port 137 is needed. I can't see where else NetBT services are used during the deployment. And what about port 135?

Is this a documentation issue, or am I missing some corner cases or specific OS version/configuration support? I was testing the deployment on Windows Server 2016.

Thanks!

[HannesK]

Hello Yuri,
you are right, you can work with less ports than documented in some situations. The documentation does not go into these details as it would make it more complicated to read (so you can count it as documentation issue, just to answer your question).

If it works for you with less port - go for it

Best regards,
Hannes

PS: even a manual deployment of the installer service is possible

[ysukhov]

Hi Hannes,

Yeah, it works with just 445, but I was wondering in what situations it won't

It might not seem as a big deal, but the "used ports" docs is used to secure the environment, so I don't think putting there more ports than actually needed is the right approach. Security is more important than admin's convenience.

Personally, I am pretty sure NetBT ports are unnecessary, but I would love to hear from someone at R&D or QA on that topic.

[HannesK]

Hi Yuri,

but I would love to hear from someone at R&D or QA on that topic.

you already got an answer from R&D as product management is part of it

The reason for this might be legacy Windows versions where we dropped support... I will check that with tech writers team.

Best regards,
Hannes

[HannesK]

Hi Yuri,
sorry for that late answer.

For V11 we adjusted the documentation. 445 is the only port required for deployment. With port 135 it works some seconds faster (failback is to 445).

Best regards,
Hannes