Forum Discussion

liuyang's avatar
liuyang
Level 6
10 years ago

Backup Exec 15 firewall ports requirements

Hi, our customer's BE server is BE 15 on Windows Server 2008 R2 SP1 Std. All the clients are Windows clients (Windows Server 2008 R2 SP1 or Windows 7 Pro). Some of the clients are in different subnets than the BE server. Between those clients and the BE server, there are physcial firewalls. We have opened ports in the firewalls based on our past experiences with BE 2014. However, we found the backup jobs of these clients failed. We did some troubleshooting and found the BE server seems use some random ports (from 5xxxx to 6xxxx) to communicate with the clients. As these ports are not open, the backup jobs failed.

 

My questions are:

1) What are the required firewall ports to open on the phsycial firewall for BE 15? Bi-directionly or one direction?

2) Is there a way in BE to limit the BE server to communicate to the client via specific ports?

Thanks in advance.

15
Backing Up
Backup and Recovery
Backup Exec
Configuring
Windows Server (2003-2008)
  • pkh's avatar
    pkh
    10 years ago

    See these documents

    http://www.symantec.com/docs/TECH49563

    http://www.symantec.com/docs/TECH43579

    In particular, note the dynamic ports requirement as stated in the second document.

  • VJware's avatar
    VJware
    10 years ago

    1) Bi-directional.

    2) The default dynamic port range is 1025 to 65535. Secondly, open atleast 6 ports per resource. So if a remote server contains 3 resources such as C:\, D:\ and System State, open atleast 18 ports. You can specify the range from BE button - Configuration & Settings - BE Settings - Network & Security.

     

  • pkh's avatar
    pkh
    Moderator
    10 years ago

    See these documents

    http://www.symantec.com/docs/TECH49563

    http://www.symantec.com/docs/TECH43579

    In particular, note the dynamic ports requirement as stated in the second document.

  • VJware's avatar
    VJware
    Level 6
    10 years ago

    1) Bi-directional.

    2) The default dynamic port range is 1025 to 65535. Secondly, open atleast 6 ports per resource. So if a remote server contains 3 resources such as C:\, D:\ and System State, open atleast 18 ports. You can specify the range from BE button - Configuration & Settings - BE Settings - Network & Security.

     

  • Colin_Weaver's avatar
    Colin_Weaver
    Moderator
    10 years ago

    As an aside BE 2014 should have had more or less the same requirements as 15 when it comes to firewalls, although it is possible that Port 6101 from remote to Backup Exec Server (So Backup Server listens on 6101) may have become more important

     

    Basically all versions of Backup Exec since 10.0 have used

    NDMP Control Port (Backup Exec Server to Remoet Server) on 10000 (Remote Listening port)

    NDMP Data Ports (Backup Exec Server to Remote Server) on a configurable dynamic range but defaults to 1025-65535 and selection is random in the range (again Remote listening port)

    When Agent publising was introduced (not sure which version) the requirement for Remote Server to Backup Exec server on 6101 (Backup Exec server listening port)  arrived and this affects database backups and possibly the trust certificate configuration.

    CASO environment communications between CAS and MBE will have different port requirements

    Client Side Deuplication could have different port requirements

    Push install of agents and updates will have different port requirments