Backup Exec 15 firewall ports requirements

[liuyang]

Hi, our customer's BE server is BE 15 on Windows Server 2008 R2 SP1 Std. All the clients are Windows clients (Windows Server 2008 R2 SP1 or Windows 7 Pro). Some of the clients are in different subnets than the BE server. Between those clients and the BE server, there are physcial firewalls. We have opened ports in the firewalls based on our past experiences with BE 2014. However, we found the backup jobs of these clients failed. We did some troubleshooting and found the BE server seems use some random ports (from 5xxxx to 6xxxx) to communicate with the clients. As these ports are not open, the backup jobs failed.

My questions are:

1) What are the required firewall ports to open on the phsycial firewall for BE 15? Bi-directionly or one direction?

2) Is there a way in BE to limit the BE server to communicate to the client via specific ports?

Thanks in advance.

[pkh · Accepted solution]

See these documents

http://www.symantec.com/docs/TECH49563

http://www.symantec.com/docs/TECH43579

In particular, note the dynamic ports requirement as stated in the second document.

[VJware · Accepted solution]

1) Bi-directional.

2) The default dynamic port range is 1025 to 65535. Secondly, open atleast 6 ports per resource. So if a remote server contains 3 resources such as C:\, D:\ and System State, open atleast 18 ports. You can specify the range from BE button - Configuration & Settings - BE Settings - Network & Security.

[Colin_Weaver]

As an aside BE 2014 should have had more or less the same requirements as 15 when it comes to firewalls, although it is possible that Port 6101 from remote to Backup Exec Server (So Backup Server listens on 6101) may have become more important

Basically all versions of Backup Exec since 10.0 have used

NDMP Control Port (Backup Exec Server to Remoet Server) on 10000 (Remote Listening port)

NDMP Data Ports (Backup Exec Server to Remote Server) on a configurable dynamic range but defaults to 1025-65535 and selection is random in the range (again Remote listening port)

When Agent publising was introduced (not sure which version) the requirement for Remote Server to Backup Exec server on 6101 (Backup Exec server listening port)  arrived and this affects database backups and possibly the trust certificate configuration.

CASO environment communications between CAS and MBE will have different port requirements

Client Side Deuplication could have different port requirements

Push install of agents and updates will have different port requirments