Availability for the Always-On Enterprise
lightsout
Expert
Posts: 206
Liked: 52 times
Joined: Apr 10, 2014 4:13 pm
Contact:

Sure Backup - Ping Virtual Appliance Gateway

Post by lightsout » Mar 13, 2015 2:14 pm

All,

I did try to search for this, but without luck.... too many other ping issues with virtual labs/sure backup. I have an issue with a Windows 2012 R2 DC thinking it is on a public network, and then, nothing can authenticate to it as the Windows firewall blocks it. This issue seems to describe it:

http://serverfault.com/questions/362374 ... ic-network

The Sure Backup/Virtual Lab works fine overall:

1. Machines in the virtual lab can ping each other.
2. The Veeam server can ping down to most servers, apart from the DC, as the local Windows FW blocks it.

If I logon to the DC, then it cannot ping its gateway, which is the Veeam virtual appliance. It can ping the other machines as described above.

So, if there anyway to get the virtual lab gateway to respond to a ping?

foggy
Veeam Software
Posts: 16691
Liked: 1343 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Sure Backup - Ping Virtual Appliance Gateway

Post by foggy » Mar 17, 2015 3:14 pm

I remember similar cases being reported here previously, when Windows Firewall recognized virtual lab network as a new one and applied "public" profile to it. QC is currently looking whether this could be caused by some issue in the proxy appliance. You can disable firewall or configure it appropriately as a workaround.

lightsout
Expert
Posts: 206
Liked: 52 times
Joined: Apr 10, 2014 4:13 pm
Contact:

Re: Sure Backup - Ping Virtual Appliance Gateway

Post by lightsout » Mar 17, 2015 3:53 pm

In this scenario, I don't control the server I'm backing up so I can't change its firewall so easily.

It would strike me, for testing purposes, being able to ping the appliance would be a good thing regardless?

haslund
Veeam Software
Posts: 428
Liked: 85 times
Joined: Feb 16, 2012 7:35 am
Full Name: Rasmus Haslund
Location: Denmark
Contact:

[MERGED] Proxy Appliance, no ICMP response from isolated net

Post by haslund » Mar 17, 2015 4:03 pm

It seems to me the Proxy Appliance does not reply to ICMP/ping from the isolated network(s).
Is there any way to enable that?

I have a customer who has Windows Firewall enabled on all VM's including domain controllers.
The issue is since their default GW does not respond to ping, Windows Firewall changes profile from Domain to Public = blocks basically all traffic = SureBackup validation fails :-(

Thanks!
Rasmus Haslund
Principal Technologist, Global Education Services @ Veeam Software
Veeam Certified Architect #1 | Veeam Certified Trainer #4 [v7,v8,v9] | Veeam Certified Trainer Mentor #1
Twitter: @haslund
Blog: www.perfectcloud.org

foggy
Veeam Software
Posts: 16691
Liked: 1343 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Sure Backup - Ping Virtual Appliance Gateway

Post by foggy » Mar 17, 2015 4:27 pm

Another workaround is to set unidentified networks to get the Private Profile by default via GPO.

alanbolte
Expert
Posts: 635
Liked: 172 times
Joined: Jun 18, 2012 8:58 pm
Full Name: Alan Bolte
Contact:

Re: Proxy Appliance, no ICMP response from isolated network?

Post by alanbolte » Mar 17, 2015 4:57 pm

In my experience Network Location Awareness only changes the profile to Public if the VM cannot connect to a domain controller. Is there a domain controller in your Application Group?

http://blogs.technet.com/b/networking/a ... files.aspx
This article seems to support that while the gateway matters for determination of private networks, only the domain matters to determining if you're on a domain network.

If the VM in question is a domain controller, setting the NLA service to delayed start usually resolves the issue.

haslund
Veeam Software
Posts: 428
Liked: 85 times
Joined: Feb 16, 2012 7:35 am
Full Name: Rasmus Haslund
Location: Denmark
Contact:

Re: Sure Backup - Ping Virtual Appliance Gateway

Post by haslund » Mar 17, 2015 5:32 pm

How do we enable ICMP responses from the Proxy Appliance from the isolated network?
Corporate policy does not allow GPO changes to set unidentified networks to get Private Profile.
Disabling firewall would also violate corporate policy.

In this instance the tested VM _IS_ the Domain Controller.
Rasmus Haslund
Principal Technologist, Global Education Services @ Veeam Software
Veeam Certified Architect #1 | Veeam Certified Trainer #4 [v7,v8,v9] | Veeam Certified Trainer Mentor #1
Twitter: @haslund
Blog: www.perfectcloud.org

lightsout
Expert
Posts: 206
Liked: 52 times
Joined: Apr 10, 2014 4:13 pm
Contact:

Re: Sure Backup - Ping Virtual Appliance Gateway

Post by lightsout » Mar 17, 2015 5:58 pm

So we've got the same issue, which is good. :)

I turned the ping check off, which is bad, but is still stops the VMs from authenticating if the FW profile goes to public. The DCs are tightly controlled, and I can't change them at all. Having the gateway ping seems like a good idea as I already mentioned, if nothing else, to help TS issues. I am guessing the appliance's firewall is blocking ICMP on the isolated networks, so if this was allowed, I suspect it'd fix both of our problems.

mplep
Service Provider
Posts: 61
Liked: never
Joined: Sep 16, 2009 7:50 pm
Contact:

Re: Sure Backup - Ping Virtual Appliance Gateway

Post by mplep » Mar 18, 2015 10:31 am

I am experiencing the same issue where the DC see's a Public Network and I cannot ping the Proxy Appliance. My research led me here but we don't seem to have an answer on allowing ICMP response from the Appliance? I do not wish to make GPO changes either.

Any help appreciated.

lightsout
Expert
Posts: 206
Liked: 52 times
Joined: Apr 10, 2014 4:13 pm
Contact:

Re: Sure Backup - Ping Virtual Appliance Gateway

Post by lightsout » Mar 18, 2015 12:58 pm

Given we've got a lot of people with the same issue, rather than us all changing our environments, is there any reason not to get the virtual lab appliance just to respond to ICMP and fix it for all of us?

nefes
Veeam Software
Posts: 590
Liked: 140 times
Joined: Dec 10, 2012 8:44 am
Full Name: Nikita Efes
Contact:

Re: Sure Backup - Ping Virtual Appliance Gateway

Post by nefes » Mar 18, 2015 1:47 pm 1 person likes this post

As Alexander already said, we are now reproducing that behavior in our environment.
If the bug is confirmed, it will be fixed in one of upcoming patches.
For now we are trying to propose you temporary solution, not avoid fixing at all.

foggy
Veeam Software
Posts: 16691
Liked: 1343 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Sure Backup - Ping Virtual Appliance Gateway

Post by foggy » Mar 18, 2015 2:11 pm 1 person likes this post

Indeed, ICMP is not currently allowed on the appliance for some reason. The good thing is that it is already allowed there in the next update, so we expect this issue to not show up anymore, once the update is released.

adrien.herve
Enthusiast
Posts: 48
Liked: 13 times
Joined: Dec 16, 2014 8:15 am
Full Name: Adrien HERVE
Contact:

Re: Sure Backup - Ping Virtual Appliance Gateway

Post by adrien.herve » Apr 02, 2015 3:15 pm

Hi guys,

I have the same issue in my lab. I can't ping the gateway in my isolated network from my restored VM in the vLab, can you please tell me if it's a proper behavior?

Thanks,

foggy
Veeam Software
Posts: 16691
Liked: 1343 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Sure Backup - Ping Virtual Appliance Gateway

Post by foggy » Apr 02, 2015 9:15 pm

Adrien, this is expected with the current version, however will be addressed in the next update, as it was mentioned above.

lightsout
Expert
Posts: 206
Liked: 52 times
Joined: Apr 10, 2014 4:13 pm
Contact:

Re: Sure Backup - Ping Virtual Appliance Gateway

Post by lightsout » Apr 28, 2015 8:07 pm

So I've updated to Update 2, I edited the virtual lab so Veeam pushed the new appliance image and then started my virtual lab.

I still can't ping the gateway. :( Can anyone else test it?

Post Reply

Who is online

Users browsing this forum: Bing [Bot], Majestic-12 [Bot], Regnor and 35 guests