VBU 4.1 Veeam VSS ports

[donikatz]

According to the user guide, for Veeam VSS the following ports are required between the console & VM:

"In case of using VSS, Veeam Backup & Replication 4.1 uses NetBIOS (TCP port 139, UDP ports 137, 138), SMB (TCP port 445) and RPC (TCP port 135) protocol connections from the console to guest VM additionally."

I'm trying to backup a new hardened Window 2003 VM on the DMZ and have opened these ports. There are no firewall restrictions between Veeam, ESX hosts, and targets. Backup jobs seem to work, but I'm receiving an error:

RPC function call failed. Function name: [Unfreeze]. Target machine: [<redacted>].
RPC error:The RPC server is unavailable.
Code: 1722

Interestingly, the firewall is logging & denying attempts to high ports (one job was TCP 1862, the next was TCP 1866), as well as IGMP traffic.

Am I missing something? Thanks

[donikatz]

Digging deeper in the forums, I've found reference that you may also need to have 5200(+) ports open to the VMs, and then specify these ports in the VM's registry. Is that what I have to do here?

http://www.veeam.com/forums/viewtopic.p ... =rpc#p8905

If so, the user guide really needs to be updated (unless I have an outdated version).

Thanks again

[Gostev]

Thanks Doni, I will ask developers to confirm, and we will update the documentation.

[fgw]

Digging deeper in the forums, I've found reference that you may also need to have 5200(+) ports open to the VMs, and then specify these ports in the VM's registry. Is that what I have to do here?

http://www.veeam.com/forums/viewtopic.p ... =rpc#p8905

If so, the user guide really needs to be updated (unless I have an outdated version).

Thanks again

yes thats what you need to do!

in simple words: the veeam backup server initiates rpc communication with the vm through one port, but the rpc server on the vm responds on a different port which is taken from a pool of available ports. you need to tell the rpc server not to use any available port out of this pool but rather use a defined range of ports. this range is configured in the registry on the vm. this range of ports also needs to be opened on the firewall to allow communication from the rpc server on the vm back to the veeam backup server.

you are right, this is missing in the manual. took me some time and a call to veeam support to figure this out ...

[Gostev]

Hopefully in v5 you won't need to open any ports at all for Veeam VSS to work
Let's keep our fingers crossed that one idea we have here works out.

[donikatz]

Thanks Franz, worked great after implementing this. Anton, definitely looking forward to the v5 enhancement. Best, doni

[gunnarwb]

A standard script based VCB backup doesn't require this, why does Veeam? VCB backups use VSS. I have many servers in the DMZ and I'm not about to open this many ports from my internal network to the DMZ. I also don't want to go to every server I have and modify the windows firewall, that's very labor intensive. Does Veeam have a whitepaper on doing this via Group Policy?

How soon can we expect v5?

[Gostev]

Short answer is that while VCB backups use VMware Tools VSS, which is very basic and incomplete VSS integration (you can read this article for more details). If you do not enable Veeam VSS in backup job wizard, Veeam will also use VMware Tools VSS and thus won't require opening Veeam VSS ports. And results will be as good as with VCB, or any other image-level backup tool out there on the market.

On the other hand, Veeam VSS provides complete and proper VSS integration implementation, however it requires network connectivity between Veeam Backup server and VM to coordinate all activities.

Veeam Backup v5 will be released towards the end of H1 2010, but note that this specific feature may or may not make it into release. We are using some brand new and innovative technologies in implementation (as it is usual for Veeam ), so I do not want to make any promises until I hear from QC that everything works well. Chances are good though!

[fjones]

Gostev,

How is this feature looking? This is the single most desired feature on my list and for my clients. I just evaled v4.1.1 and with the exception of this feature and message level restore for Exchange it does pretty much everything we want.

[Gostev]

Hello Frank, let me check on the latest news for you, it was looking good last time I heard.

As for message level restores for Exchange, we have this coming:
SureBackup : Granular Item Recovery

[fjones]

Did you get a chance to check on the status of this feature?

[Gostev]

Yes, the feature has been in testing for some time now, and it looks good .