Problem with setting up a VLAB

[jharlow]

I am having a problem setting up a VLAB. In short, the wizard completes but when I try to console into the VLAB I receive a login prompt. Trying to use any SureBackup fails.

I have a very basic setup. One VMware vSphere 4.0 server using attached drives (Internal SAS drives) as the datastore. I have one vSwitch (vswitch0) configured within vSphere (not currently using vCenter) setup with a vmkernal, service console port and the ports for each of the VMs on that active server.

There is only one IP range setup and configured through DHCP running on a NON-VM server (Windows 2003). Most of the network is still physical ATM (DHCP,DNS, MAIL, FS, etc). IIS and SQL are the only current VM sessions.

Again very basic as this is our first VM server. Everything else is still sitting on physical servers.

Reading the forums, mentions it is related to not being able to reach the backup server but that should not be the case as again this is on the same box using the basic configuration wizard. One thought I had is that our DHCP, DNS, and for that matter AD is still physical; but I am hoping that is not the case as it will be a ways down the road before I can move those servers.

The IP range is all within one subnet (ex: 10.0.0.x).

Advice?

[Vitaliy S.]

Hello Jeff, could you please tell me the exact error message you receive while trying to run a surebackup job?

[ptmartin]

Hey Jeff,
This is just a hunch but I'd be willing to bet you are seeing the same thing I posted about in this thread (http://www.veeam.com/forums/viewtopic.php?f=2&t=5633) pertaining to the virtual appliance not configuring for the correct subnet in basic mode. If that is the case, you will need to go into advanced mode and manually configure the vNIC appliance IP (Virtual Lab Network Settings) for your network subnet. Mine is also a fairly simple and flat design and I had what sounds to be the same problem for no explainable reason.

Good Luck,
Paul

[jharlow]

I did a manual configuration but a bit lost. I am sure I did not configure something right. This round I received an error "Unable to find destination network for IP address 192.168.0.210). .210 is the IP of the server being restored.

Here is what I selected on Manual:

Isolated Network: VM Network (the only vSwitch on the vSphere) VLAN ID 0
Network Settings: vNIC1 Masquerade IP 192.168.255.x Appliance IP 192.168.2.1 DHCP Yes

I admit, I am totally confused by all of this. It mentions that the Appliance IP should be the same as the Production Gateway (192.168.0.1). I am leary in setting that up as it could cause network issues. I am sure I am being overly protected. The whole Masquerade stuff is equally confusing.

Everything is on one subnet. VM Servers are all in the .200 range. Physical Server are all in the .10-.40 range. Gateway as stated above is at .1

[ptmartin]

The appliance IP needs to match your virtual machine network IP subnet to match my configuration and to get past the error you are seeing. Select vNIC1 and choose EDIT. Set the Proxy appliance IP subnet to your subnet. The rest looks ok.

[jharlow]

To clarify; setup the Proxy IP with an ip adderss that is within our IP subnet (ex: 192.168.0.211) not the actual gateway IP as it states...

[ptmartin]

Sorry - no. Set it to the gateway ip on your vm subnet and give it a shot.

[jharlow]

Ok. Did that and it got farther. It fails trying to ping the original server.

Publishing, Updating, Registering, Configuring, Power On Heartbeat OK. Pinging(ping failed). TimedOut.

[Gostev]

Hi Jeff, can you ping original server (just in case ICMP is disabled on it)? Do you see route into the isolated network when you do route print on your Veeam Backup server (when the SureBackup job is running)? Does this route correctly assign proxy appliance production IP as gateway?

Usually it all just works out of box, but there are some scenarios where automated configuration does not work, and these require good understanding of networking concepts, and some networking troubleshooting expertise. We would certainly like to get you going, but it will be much easier for everyone if you just log a support call. Our support staff will be able to do much more and much faster having access to full logs and/or webex to live environment. Thanks!

[jharlow]

I can ping the original server. Even within the actual VM (servername_[random char]), I can ping the server. I cannot ping anything else even the gateway which I can do from the live server.

Route Print Info:

Active Routes:
Netowkr Destiation Netwmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.210 266
127.0.0.0 255.0.0.0 On-Link 127.0.0.1 306
127.0.0.0 255.255.255.255 On-Link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-Link 127.0.0.1 306
192.168.0.0 255.255.255.0 On-Link 192.168.0.210
192.168.0.210 255.255.255.255 On-Link 192.168.0.210 266
192.168.0.255 255.255.255.255 On-Link 192.168.0.210 266
224.0.0.0 240.0.0.0 On-Link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-Link 192.168.0.210 266
255.255.255.255 255.255.255.255 On-Link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-Link 192.168.0.210 266

Persistent Routes
0.0.0.0 0.0.0.0 192.168.0.1 Default

[jharlow]

Any additional thoughts on this?

thanks.

[Gostev]

Hi Jeff, reading back through my response above I recommend that you work directly with support on this. Thanks!

[jharlow]

Chatted with technical support. The problem was related to Windows 2008 firewall. I am still waiting to hear back on what ports need to be allow for the software to work but at current, disabling the firewall solved the issue. Just in case someone else runs into this same problem.

[Gostev]

Thanks for the update - did you disable firewall on Veeam Backup server itself?

[jharlow]

No. I disabled the firewall on the vm client. I am waiting to hear back from support on which ports are needed for this to work as I prefer to keep the firewall enabled. Just best practices to have a secondary level of security...

[Gostev]

OK, please update this topic with resolution if possible (or at least your support case number, so that I could look it up in future if someone else needs the same info). Thanks in advance!

[nguyent]

Hi All,
I have been with the problem for month and I am working with Tier 3 support now. The problem is still ( ticket #540677). Please me know if someone figures out.
Thanks
Tan

[jharlow]

Enable "File and Printer sharing (Echo Request - ICMPv4 or 6)" Inbound rules, resolved the issue. VLABs jobs are coming up as successful now.

Thanks for your assistance.

BTW: Ticket #544130

[Gostev]

This makes perfect sense, you cannot really ping a computer which has ICMP blocked as ICMP is what makes ping possible. May want to disable ping test altogether for all VMs with ICMP blocked in firewall...

[nguyent]

I have windows firewall off on win2k8 R2, but still can not ping. Maybe there is something worng with the virtual machine. It works fine for other VMs. I and tier 3 support tech can not figure what wrong with that VM.

[Gostev]

Bad sign if even Tier 3 folks don't know, as we have one really really good networking guru there, don't know if he is involved in this case though. By the way, can you ping this VM from another VM located next to it in the isolated network?

[jharlow]

Just a reminder, After you turn off firewall (or enable the ICMP), You will still need to do another backup job for that setting to take place. Just in case you forgot that part. After the backup is completed, try your VLAB job again and see if it works.

I would have to agree though, that the software should check if it is Windows 2008 and either not do a ping test or better, let you know some how.

[nguyent]

I can not ping anything. It is weird problem.

[buckmaster]

Having the same issue, ping is failing. Turning off the firewall did not help. I'm running my network with vDS and I'm not sure it that piece is correct. Version 5.0.1 is suppose to add support for vDS?

[Alexey D.]

Yes, version 5.0.1 adds support of DVS to virtual labs, so please upgrade if you are using this kind of switches in your environment.

[eric.siedentopf]

I see jharlo asked the same question that is on my mind?

"I admit, I am totally confused by all of this. It mentions that the Appliance IP should be the same as the Production Gateway (192.168.0.1). I am leary in setting that up as it could cause network issues. I am sure I am being overly protected. The whole Masquerade stuff is equally confusing."

I just don't get this, you cant have two IP address on the same network. All of my server would be looking for the gateway and wouldn't this proxy and my core router try to answer?

[Gostev]

you cant have two IP address on the same network

On the same network, you certainly cannot. In this case however, there are 2 networks - your production network, and separate virtual lab network (that is basically a copy of your production network). Except that in the virtual lab network, there is no gateway or core router, so this IP address is not occupied.

[eric.siedentopf]

So even though these two statement below from the manual say Production Network and you then must select a vNIC for the Production Network and then give it the IP of your Production Gateway. it is not really on the Production Network....

From Backup 5.0 User Guide
"Click the Configure… button in the Production network connection section to select a network where the proxy appliance should be created, specify its IP address and settings of DNS server to be used. " "Typically, the IP address should coincide with the gateway IP address in the production network. "

[Gostev]

"Click the Configure… button in the Production network connection section to select a network where the proxy appliance should be created, specify its IP address and settings of DNS server to be used. " "Typically, the IP address should coincide with the gateway IP address in the production network. "

If you keep quoting things out of context, you can as well prove that I am an elephant quite easily

These 2 quotes are actually a few pages away from each other. They explain very different configuration steps (step 4 and step 7 respectively). Step 4 explains how you configure production side of things (first quote), whereas Step 7 explains configuration of isolated side (second quote).

[eric.siedentopf]

Got it, Now that makes sense. I could have sworn i seen them on the same page originally.