Sure Backup - Ping Virtual Appliance Gateway

Availability for the Always-On Enterprise

Sure Backup - Ping Virtual Appliance Gateway

Veeam Logoby lightsout » Fri Mar 13, 2015 2:14 pm

All,

I did try to search for this, but without luck.... too many other ping issues with virtual labs/sure backup. I have an issue with a Windows 2012 R2 DC thinking it is on a public network, and then, nothing can authenticate to it as the Windows firewall blocks it. This issue seems to describe it:

http://serverfault.com/questions/362374/domain-controller-thinks-its-on-a-public-network

The Sure Backup/Virtual Lab works fine overall:

1. Machines in the virtual lab can ping each other.
2. The Veeam server can ping down to most servers, apart from the DC, as the local Windows FW blocks it.

If I logon to the DC, then it cannot ping its gateway, which is the Veeam virtual appliance. It can ping the other machines as described above.

So, if there anyway to get the virtual lab gateway to respond to a ping?
lightsout
Expert
 
Posts: 188
Liked: 48 times
Joined: Thu Apr 10, 2014 4:13 pm

Re: Sure Backup - Ping Virtual Appliance Gateway

Veeam Logoby foggy » Tue Mar 17, 2015 3:14 pm

I remember similar cases being reported here previously, when Windows Firewall recognized virtual lab network as a new one and applied "public" profile to it. QC is currently looking whether this could be caused by some issue in the proxy appliance. You can disable firewall or configure it appropriately as a workaround.
foggy
Veeam Software
 
Posts: 15303
Liked: 1133 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson

Re: Sure Backup - Ping Virtual Appliance Gateway

Veeam Logoby lightsout » Tue Mar 17, 2015 3:53 pm

In this scenario, I don't control the server I'm backing up so I can't change its firewall so easily.

It would strike me, for testing purposes, being able to ping the appliance would be a good thing regardless?
lightsout
Expert
 
Posts: 188
Liked: 48 times
Joined: Thu Apr 10, 2014 4:13 pm

[MERGED] Proxy Appliance, no ICMP response from isolated net

Veeam Logoby haslund » Tue Mar 17, 2015 4:03 pm

It seems to me the Proxy Appliance does not reply to ICMP/ping from the isolated network(s).
Is there any way to enable that?

I have a customer who has Windows Firewall enabled on all VM's including domain controllers.
The issue is since their default GW does not respond to ping, Windows Firewall changes profile from Domain to Public = blocks basically all traffic = SureBackup validation fails :-(

Thanks!
Rasmus Haslund
Principal Technologist, Global Education Services @ Veeam Software
Veeam Certified Architect #1 | Veeam Certified Trainer #4 [v7,v8,v9] | Veeam Certified Trainer Mentor #1
Twitter: @haslund
Blog: www.perfectcloud.org
haslund
Veeam Software
 
Posts: 279
Liked: 54 times
Joined: Thu Feb 16, 2012 7:35 am
Location: Denmark
Full Name: Rasmus Haslund

Re: Sure Backup - Ping Virtual Appliance Gateway

Veeam Logoby foggy » Tue Mar 17, 2015 4:27 pm

Another workaround is to set unidentified networks to get the Private Profile by default via GPO.
foggy
Veeam Software
 
Posts: 15303
Liked: 1133 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson

Re: Proxy Appliance, no ICMP response from isolated network?

Veeam Logoby alanbolte » Tue Mar 17, 2015 4:57 pm

In my experience Network Location Awareness only changes the profile to Public if the VM cannot connect to a domain controller. Is there a domain controller in your Application Group?

http://blogs.technet.com/b/networking/a ... files.aspx
This article seems to support that while the gateway matters for determination of private networks, only the domain matters to determining if you're on a domain network.

If the VM in question is a domain controller, setting the NLA service to delayed start usually resolves the issue.
alanbolte
Expert
 
Posts: 635
Liked: 172 times
Joined: Mon Jun 18, 2012 8:58 pm
Full Name: Alan Bolte

Re: Sure Backup - Ping Virtual Appliance Gateway

Veeam Logoby haslund » Tue Mar 17, 2015 5:32 pm

How do we enable ICMP responses from the Proxy Appliance from the isolated network?
Corporate policy does not allow GPO changes to set unidentified networks to get Private Profile.
Disabling firewall would also violate corporate policy.

In this instance the tested VM _IS_ the Domain Controller.
Rasmus Haslund
Principal Technologist, Global Education Services @ Veeam Software
Veeam Certified Architect #1 | Veeam Certified Trainer #4 [v7,v8,v9] | Veeam Certified Trainer Mentor #1
Twitter: @haslund
Blog: www.perfectcloud.org
haslund
Veeam Software
 
Posts: 279
Liked: 54 times
Joined: Thu Feb 16, 2012 7:35 am
Location: Denmark
Full Name: Rasmus Haslund

Re: Sure Backup - Ping Virtual Appliance Gateway

Veeam Logoby lightsout » Tue Mar 17, 2015 5:58 pm

So we've got the same issue, which is good. :)

I turned the ping check off, which is bad, but is still stops the VMs from authenticating if the FW profile goes to public. The DCs are tightly controlled, and I can't change them at all. Having the gateway ping seems like a good idea as I already mentioned, if nothing else, to help TS issues. I am guessing the appliance's firewall is blocking ICMP on the isolated networks, so if this was allowed, I suspect it'd fix both of our problems.
lightsout
Expert
 
Posts: 188
Liked: 48 times
Joined: Thu Apr 10, 2014 4:13 pm

Re: Sure Backup - Ping Virtual Appliance Gateway

Veeam Logoby mplep » Wed Mar 18, 2015 10:31 am

I am experiencing the same issue where the DC see's a Public Network and I cannot ping the Proxy Appliance. My research led me here but we don't seem to have an answer on allowing ICMP response from the Appliance? I do not wish to make GPO changes either.

Any help appreciated.
mplep
Service Provider
 
Posts: 59
Liked: never
Joined: Wed Sep 16, 2009 7:50 pm

Re: Sure Backup - Ping Virtual Appliance Gateway

Veeam Logoby lightsout » Wed Mar 18, 2015 12:58 pm

Given we've got a lot of people with the same issue, rather than us all changing our environments, is there any reason not to get the virtual lab appliance just to respond to ICMP and fix it for all of us?
lightsout
Expert
 
Posts: 188
Liked: 48 times
Joined: Thu Apr 10, 2014 4:13 pm

Re: Sure Backup - Ping Virtual Appliance Gateway

Veeam Logoby nefes » Wed Mar 18, 2015 1:47 pm 1 person likes this post

As Alexander already said, we are now reproducing that behavior in our environment.
If the bug is confirmed, it will be fixed in one of upcoming patches.
For now we are trying to propose you temporary solution, not avoid fixing at all.
nefes
Veeam Software
 
Posts: 552
Liked: 129 times
Joined: Mon Dec 10, 2012 8:44 am
Full Name: Nikita Efes

Re: Sure Backup - Ping Virtual Appliance Gateway

Veeam Logoby foggy » Wed Mar 18, 2015 2:11 pm 1 person likes this post

Indeed, ICMP is not currently allowed on the appliance for some reason. The good thing is that it is already allowed there in the next update, so we expect this issue to not show up anymore, once the update is released.
foggy
Veeam Software
 
Posts: 15303
Liked: 1133 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson

Re: Sure Backup - Ping Virtual Appliance Gateway

Veeam Logoby adrien.herve » Thu Apr 02, 2015 3:15 pm

Hi guys,

I have the same issue in my lab. I can't ping the gateway in my isolated network from my restored VM in the vLab, can you please tell me if it's a proper behavior?

Thanks,
adrien.herve
Enthusiast
 
Posts: 48
Liked: 12 times
Joined: Tue Dec 16, 2014 8:15 am
Full Name: Adrien HERVE

Re: Sure Backup - Ping Virtual Appliance Gateway

Veeam Logoby foggy » Thu Apr 02, 2015 9:15 pm

Adrien, this is expected with the current version, however will be addressed in the next update, as it was mentioned above.
foggy
Veeam Software
 
Posts: 15303
Liked: 1133 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson

Re: Sure Backup - Ping Virtual Appliance Gateway

Veeam Logoby lightsout » Tue Apr 28, 2015 8:07 pm

So I've updated to Update 2, I edited the virtual lab so Veeam pushed the new appliance image and then started my virtual lab.

I still can't ping the gateway. :( Can anyone else test it?
lightsout
Expert
 
Posts: 188
Liked: 48 times
Joined: Thu Apr 10, 2014 4:13 pm

Next

Return to Veeam Backup & Replication



Who is online

Users browsing this forum: baber, Bing [Bot] and 1 guest