Port requirements clarfication

Availability for the Always-On Enterprise

Port requirements clarfication

Veeam Logoby timofcourse » Wed Jun 07, 2017 3:54 pm

Hi all
I'm hoping to get some clarification as to what ports and to/from what machines we need to setup to meet our specific configuration.

We have 2 isolated vSphere environments that currently have no network access to between them - let's call them environments "A" and "B". Within each environment we have a Veeam B&R instance/VM responsible for backing up all VMs within their respective environments. What we'd like to do is setup a Veeam VM Copy job in environment "A" to copy VMs from environment "B" to a Veeam backup repository in environment "A".

I've looked through Veeam's Used ports guide, but I'm still not clear on the minimum requirements to make this happen. For example, I'm not sure if we actually need to setup communication to the vSphere server in env "B" or if we can route everything through the Veeam server in that env.

Any advice provided would be greatly appreciated!
timofcourse
Enthusiast
 
Posts: 25
Liked: 1 time
Joined: Mon Nov 28, 2011 5:18 pm
Full Name: Tim Graffam

Re: Port requirements clarfication

Veeam Logoby foggy » Wed Jun 07, 2017 5:26 pm

Tim, could you please confirm you're talking about VM Copy and not Backup Copy jobs between the environments?
foggy
Veeam Software
 
Posts: 14904
Liked: 1096 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson

Re: Port requirements clarfication

Veeam Logoby timofcourse » Wed Jun 07, 2017 5:48 pm

Correct. We're only looking to use a VM Copy job to copy a few VMs from "B" environment to a backup repository in the "A" environment.
timofcourse
Enthusiast
 
Posts: 25
Liked: 1 time
Joined: Mon Nov 28, 2011 5:18 pm
Full Name: Tim Graffam

Re: Port requirements clarfication

Veeam Logoby skrause » Wed Jun 07, 2017 6:09 pm

All of the transport communication should be handled by the machines acting as Veeam proxies between the sites so as long as your proxy in site A can talk to your proxy in site B you should be ok.

Of course each site's proxy will also need to be able to communicate with the vCenter/hosts in their site and the B&R server that is managing the job will have to be able to access both environments to orchestrate the job but I assume you were already aware of that.
Steve Krause
Veeam Certified Architect
skrause
Expert
 
Posts: 300
Liked: 45 times
Joined: Mon Dec 08, 2014 2:58 pm
Full Name: Steve Krause

Re: Port requirements clarfication

Veeam Logoby foggy » Thu Jun 08, 2017 11:13 am

Since VM copy jobs use the same infrastructure components as backup jobs, you'd need connection between the proxy and repository server (or gateway server, in case of CIFS target). Of course, backup server would also need access to the remote repository, otherwise the repository cannot be added. Make sure all components shared between Veeam B&R instances are at the same patch level. Connection to remote vSphere would'n be required.
foggy
Veeam Software
 
Posts: 14904
Liked: 1096 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson

Re: Port requirements clarfication

Veeam Logoby skrause » Thu Jun 08, 2017 12:19 pm

For some reason I was thinking about replication and not backup copies. Ugh, recovering from a site failure is really great on the cognitive skills...
Steve Krause
Veeam Certified Architect
skrause
Expert
 
Posts: 300
Liked: 45 times
Joined: Mon Dec 08, 2014 2:58 pm
Full Name: Steve Krause

Re: Port requirements clarfication

Veeam Logoby timofcourse » Thu Jun 08, 2017 1:33 pm

foggy wrote:Since VM copy jobs use the same infrastructure components as backup jobs, you'd need connection between the proxy and repository server (or gateway server, in case of CIFS target). Of course, backup server would also need access to the remote repository, otherwise the repository cannot be added. Make sure all components shared between Veeam B&R instances are at the same patch level. Connection to remote vSphere would'n be required.

My network team needs a list of servers and specific ports that need connectivity to one another. They don't care/need to know whether communication is inbound/outbound, however.

Also, one thing I didn't mention is the Env B backup repository is connected locally to the Env B Veeam server. So I believe the only connectivity between the two networks is Env A Veeam Server needs to communicate with Env B vSphere and Env B Veeam Server (which is acting as the proxy and the connection to backup repository, right?)?

If that assumption is correct, this is my best guess so far as to what exactly needs to be setup :
Code: Select all
Servers                          Protocol   Port/s     Need
Env A Veeam / Env B vCenter      HTTPS+TCP  443        Connections to vCenter Server
Env A Veeam / Env B Veeam        TCP        2500-5000  Transmission channels for replication jobs
Env A Veeam / Env B Veeam        TCP        6061       Veeam vPower NFS Service
Env A Veeam / Env B Veeam        TCP        6062       Veeam Data Mover Service

Anything else I'm missing here or that can be removed?

Also, regarding the "Transmission channels for replication jobs" ports - if we only have 5 VMs we ever plan to copy, can we get away with only opening ports 2500-2504 or does Veeam randomly pick ports in that range?

Thanks!
timofcourse
Enthusiast
 
Posts: 25
Liked: 1 time
Joined: Mon Nov 28, 2011 5:18 pm
Full Name: Tim Graffam

Re: Port requirements clarfication

Veeam Logoby skrause » Thu Jun 08, 2017 3:31 pm

Typically the Veeam process starts at the bottom and works up from my experience but you want to make sure you give it at least some overhead.

Are you wanting to do Backup Copy jobs or replication? The processes work very differently and require different network connections

For Backup Copy jobs, you will need to make sure that the ports listed in "Microsoft Windows Server" on the used port lists are open between the B&R server managing the jobs and the repository server:

https://helpcenter.veeam.com/docs/backu ... =95#backup

You only need 2500-5000 to be open between two repository servers for Backup Copy jobs as long as the B&R server managing the job can access both servers as listed above.
Steve Krause
Veeam Certified Architect
skrause
Expert
 
Posts: 300
Liked: 45 times
Joined: Mon Dec 08, 2014 2:58 pm
Full Name: Steve Krause

Re: Port requirements clarfication

Veeam Logoby timofcourse » Thu Jun 08, 2017 3:52 pm

skrause wrote:Typically the Veeam process starts at the bottom and works up from my experience but you want to make sure you give it at least some overhead.
Are you wanting to do Backup Copy jobs or replication? The processes work very differently and require different network connections

We're only looking to setup VM Copy jobs.

skrause wrote:For Backup Copy jobs, you will need to make sure that the ports listed in "Microsoft Windows Server" on the used port lists are open between the B&R server managing the jobs and the repository server:
https://helpcenter.veeam.com/docs/backu ... =95#backup

In regards to the Windows Server requirements listed there... Because this communication is occurring between two Veeam servers at the same version, I would assume the following requirements wouldn't be needed since all Veeam components are already on the server, right?:
  • Ports required for deploying Veeam Backup & Replication components.
  • Default port used by the Veeam Installer Service.
Also, my network team isn't going to be okay with us asking that "all ports at and above 1058 and 2049, and the entire range of 49152-65535 need to be open". I'm hoping / assuming we can be more precise in what is actually required here?

skrause wrote:You only need 2500-5000 to be open between two repository servers for Backup Copy jobs as long as the B&R server managing the job can access both servers as listed above.

Apologies for not fully understanding what you're trying to implicate here - are you saying these ports are or are not needed? Further, does that entire range really need to be open, or only the range for the number of VM's that would ever be copied in a job (e.g. 5 VMs = only need ports 2500-2504)?

Thanks again all!
timofcourse
Enthusiast
 
Posts: 25
Liked: 1 time
Joined: Mon Nov 28, 2011 5:18 pm
Full Name: Tim Graffam

Re: Port requirements clarfication

Veeam Logoby skrause » Thu Jun 08, 2017 4:06 pm

In the document it describes which services are used by each port. For example, if you don't plan on using vPower NFS to do Instant VM Recovery from the backup copy location, those ports would be unecessary.

You will likely need the component install ports open regardless of if the components are installed already.

I am sure your networking guys have had to deal with RPC before, there are ways to shrink the range of ports used by RPC which they may have a practice for already.

As I said, in my experience, Veeam starts with 2500 and increments from there. But there is no guarantee that it won't have an issue on port, say 2501 and try 2505. Limiting it to EXACTLY 4 ports is probably more hassle than it is worth. Since it is only between two specific servers and not a blanket open to the world rule, I don't think your networking guys are going to scream too much about opening that range.
Steve Krause
Veeam Certified Architect
skrause
Expert
 
Posts: 300
Liked: 45 times
Joined: Mon Dec 08, 2014 2:58 pm
Full Name: Steve Krause

Re: Port requirements clarfication

Veeam Logoby timofcourse » Thu Jun 08, 2017 4:30 pm

skrause wrote:In the document it describes which services are used by each port. For example, if you don't plan on using vPower NFS to do Instant VM Recovery from the backup copy location, those ports would be unnecessary.

So if we don't plan to do Instant VM Recovery, could we also eliminate the network requirement for [For Microsoft Windows servers running the vPower NFS Service] Standard NFS ports. If ports 2049 and 1058 are occupied, the succeeding port numbers will be used. or would that be needed regardless?

Thanks!
timofcourse
Enthusiast
 
Posts: 25
Liked: 1 time
Joined: Mon Nov 28, 2011 5:18 pm
Full Name: Tim Graffam

Re: Port requirements clarfication

Veeam Logoby skrause » Thu Jun 08, 2017 4:45 pm

Correct. If you don't plan on using vPower NFS (used by instant recovery) you would not need the ports listed in that line.
Steve Krause
Veeam Certified Architect
skrause
Expert
 
Posts: 300
Liked: 45 times
Joined: Mon Dec 08, 2014 2:58 pm
Full Name: Steve Krause

Re: Port requirements clarfication

Veeam Logoby timofcourse » Thu Jun 08, 2017 4:57 pm

Excellent. And one more question (for now) - if we added the WAN accelerator to each environment (we don't currently have licensing for it, but considering in the future), is my assumption correct that all port requirements between these two environments would be replaced entirely with only needing the 2 ports mentioned in Communication Between WAN Accelerators here: https://helpcenter.veeam.com/docs/backup/vsphere/used_ports.html?ver=95#wan?
timofcourse
Enthusiast
 
Posts: 25
Liked: 1 time
Joined: Mon Nov 28, 2011 5:18 pm
Full Name: Tim Graffam

Re: Port requirements clarfication

Veeam Logoby foggy » Fri Jul 28, 2017 3:43 pm

You would still need to allow connection from the backup server.
foggy
Veeam Software
 
Posts: 14904
Liked: 1096 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson


Return to Veeam Backup & Replication



Who is online

Users browsing this forum: Google Feedfetcher and 24 guests