Veeam.Backup.Satellite.exe connecting to online resources, why?

[RGijsen]

Hi,
we've recently moved to a new Veeam server (9.5 u4), migrated the config and all running well. However, we locked it down this time, it's not domain joined anymore and it does not have internet access. Since revoking access to the internet, it takes 2-4 minutes to start the backup console. When I check my firewall logs, Veeam.Backup.Satellite.exe tries to connect to several IP's, like 95.101.39.8 and 104.18.21.226, but there's certainly more. I have NOT enabled the 'Update license automatically' option, which I figured wouldn't work anyway without internet connection.
I've not found any other options for telemetry or anything. So honestly I find it a bit fishy. Why would Veeam want to connect, what is it trying to send or get? Is there an extensive list of where Veeam needs to connect to, and even more so why it has to?

[PTide]

Hi,

Satellite.exe is a proxy-process between veeam service and UI.

Code: Select all

Name: a95-101-39-8.deploy.static.akamaitechnologies.com
Address: 95.101.39.8

Do you use Amazon in any shape or form with that VBR installation by any chance? Or any cloud providers that may be running on Amazon infrastructure?

Thanks!

[RGijsen]

Sorry, didn't turn notifications on. No, we don't use any cloudservices at all. We backup solely to a dedicated SAN, and to a remote repository over a VPN link, which is initiated by the main firewall. That's transparent to Veeam.
Can it have anything to do with Veeam trying to report? It's slow as hell to start the console now, and it warns me every time I should send reports to Veeam, which I don't want. It's not that I don't trust them, it's more that I want to know what I'd be sending.

[PTide]

I'd suggest to open a case with support team then so they can troubleshoot both issues (performance + IP addresses). Please post your case ID in this thread when the case is opened.

Thanks

[RGijsen]

Old thread, but still valid. Ticket raised: 03857138.

[Gostev]

Thanks for opening a support case, now we can finally research it (as this is not expected).

[Gostev]

For the future readers, these connections are a consequence of the periodic certificate validation for the built-in IBM storage plug-in. As you know, certificate validation includes querying certificate revocation list (CRL), which is maintained and hosted by the issuing certificate authority (CA).

Since unlike other plug-ins which are provided by storage vendors, IBM plug-in specifically was created and is maintained by Veeam (as it was a "pilot" Universal Storage API based plug-in), we will see if we can disable these checks for it completely.

[haslund]

An option could be to maybe disable CRL checks in the registry or in the Internet Options window in isolated environments (where such checks would never be possible anyway):