TLS 1.2 Veeam Config backup issue

[ChrisGundry]

Hi all

I have been asked to post this on the forum, so I am doing so. Since moving our organisation to use TLS 1.2+ and disable TLS 1.0/1.1 I have come across an issue with Veeam B&R not using TLS 1.2. Basically B&R uses TLS 1.2 for it's own email notifications, including the 'test' function. However, the 'Veeam Config Backup' job does NOT seem to use TLS 1.2, it seems to be stuck on older versions. Veeam support have confirmed this and have confirmed that they are working on it, but it is apparently NOT addressed in v11.

This leaves us having to have deprecated TLS versions enabled on our email infrastructure to support Veeam B&R config email notifications, which is not good. We have put steps in place to restrict access etc, to limit the scope of the problem, but we are pretty unhappy that this issue still exists. It is not new news that this TLS deprecation was coming, so for Veeam to still not fully support TLS 1.2 is pretty poor in our eyes.

Thanks

Chris

[Andreas Neufert]

I think Veeam uses the OS calls for connections. Did you configured Windows of the B&R Server for TLS1.2 only usage? There are many older OS that do not support TLS1.2 out of the box and you need to implement some procedures.
Please check as well this KB: https://www.veeam.com/kb2853

[ChrisGundry]

Yes, we have configured the server for TLS 1.2 and it is working fine for everything except the B&R Config emails. As I said, Veeam support has already confirmed that this IS an issue with the Veeam product and they need to fix it.

[wishr]

Hi Chris,

Could you please share the ID of the support case where we could find the details?

Thanks

[ChrisGundry]

Case ID: 04368732

[Andreas Neufert]

Do you have checked the KB provided above if your .net version is fully TLS1.2 enabled?

[ChrisGundry]

For the 2nd time, yes I have. And as I said, support have already confirmed that the issue is in the product, NOT in our configuration.

[Andreas Neufert]

Thanks. I have contacted our security team to raise awareness additionaly.

[ChrisGundry]

FYI, still waiting for an update from Veeam on this issue. Was initially told by one team member that it was NOT solved in v11. Then another came back to me and told me it WAS fixed in v11. Now I am told it is complicated and that they are still not sure and to await an update!

[Andreas Neufert]

Hello Chris,

I checked with the responsible people and we will address this in one of the next updates. We can not comment about the timing for now.

As a workaround a PowerShell script can maybe help you to get the backup status information and then use Powershell to send it to you ?

Code: Select all

$jobType = [Veeam.Backup.Model.EDbJobType]::ConfBackup
$configBackup = [Veeam.Backup.Core.CBaseSession]::FindLastByJobType($jobType)

[Andreas Neufert]

Short update, the intent is to add TLS 1.2 support for Veeam Config backup in the v11a (Update) later this year.

[ChrisGundry]

Is this confirmed fixed in v11a and is there an ETA yet?

[Andreas Neufert]

If there are no major bugs related to the code, it will go into v11a. We do not have ETAs for Updates, but I think someone shared already that it is late summer/Q3

[Paulo Balau]

Hi, Dou you guys know when 11a will be available?

BR
Balau

[Andreas Neufert]

I think the plan is to release within this month, but there is no fixed date by design as they depend on external factors like VMware and Microsoft release timing and if they break anything (e.g. Win2022).

[chris.childerhose]

Hi, Dou you guys know when 11a will be available?

BR
Balau

Currently looking like October 5th at the VeeamON Update event FYI.

[Mildur]

Currently looking like October 5th at the VeeamON Update event FYI.

Oct. 14
https://www.veeam.com/veeamon

[chris.childerhose]

Yes the event is the 14th, however, the actual release could be sooner.

[Andreas Neufert]

Technical availability does not depend on this event.

[Andreas Neufert]

And "Early Availability" fully supported: https://www.veeam.com/kb4215

[ChrisGundry]

We have a policy of GA only software, so will be waiting a few more weeks at least to be able to test this. Thanks

[Gostev]

We will likely go GA later this week with the same build... but I must say I like your policy

[ChrisGundry]

That is fine when the build stays the same, but it is often not the case and we have been bitten before with software that was unsupported in EA or RTM releases, or that had significant bugs, now we wait for GA where support is confirmed and bugs are less likely.

[Paulo Balau]

Just asking: is this TLS 1.2 issue addressed on this 11a release or not?

[ChrisGundry]

I have been told by support several times that it is fixed in 11a, but I have not had chance to apply the updates since it went GA. I plan to either later this week or early next, whenever I get time...

[ChrisGundry]

This issue does now finally appear to be resolved with the 11a update

[Andreas Neufert]

Can you please open a support case and upload logs?

[ChrisGundry]

Why, the issue is now resolved now that the 11a update has been released with the fix...?

[wishr]

Hi Chris,

I suppose Andreas misread your message. I apologize for that.

Thanks for confirming V11a has solved the issue!

Thanks