Backup Exec V12 TCP/IP Port 3527 Conflict

[Jennica]

I have downloaded and attempted to install the Symantec Backup Exec v12 Evaluation Edition for Windows Server, with an intended server destination of Windows-2000 Small Business Server. The environment check identified a port conflict between the default Symantec BE port of 3527 and another service running on the SBS-2000 server that was also configured to use that port.

Having no idea what Windows-2000 service it might be that was creating the conflict, I proceeded with the installation of the BE v12 Eval edition and for the most part the installation seemed to proceed to a satisfactory outcome, and after a couple of reboots I was able to load the BE application user interface successfully.

Unfortunately, following these same reboots the Windows kernel reported at the conclusion of its startup process that one or more services had failed to start. In this case, the actual group of services that had failed to start were in the realm of the server's remote communications services, particularly Routing & Remote Access, along with Windows Firewall and several other services that were either dependent on Windows Firewall or that Windows Firewall was dependent upon.

After diagnosing these failed services at system startup and rebooting the server a couple of times I was able to determine that they truly were unable to start and that it was not a temporary or one-time failure for them to start. Being unable to determine any remedy by which I could coax these important core Windows services to start, and given the 10 or so people that connect to the server throughout the business day via remote VPN connections, I conceded late Sunday night in trying to make everything work together as I had hoped it would and used the Windows control panel add/remove programs applet to completely remove the Backup Exec v12 product.

Immediately upon the first server reboot following the removal of the Backup Exec v12 product, all of the core Windows communications services that had previously been failing to start were once again launching at startup without failure. Thus, it was clear from a cause and effect standpoint that the Backup Exec v12 install had indeed been the culprit in causing my loss of the core group of communications services that are needed for remote communications support.

After returning to the office this morning and verifying that the Windows-2000 server is fully operational, I began to research this port conflict issue at Symantec's Backup Exec website and found a document #274583 that provides information on how to configure the product to use a TCP port other than 3527 when a conflict has been encountered, with the caveat that the preferred method for resolution of the conflict is to modify the port setting of the other service that the Backup Exec is in opposition to rather then changing the Backup Exec port.

I was then surprised to see a note in the support document that indicated that Microsoft SBS-2000 and SBS-2003 install the Windows Firewall service at port 3527 by default. At Microsoft's website a search for port 3527 suggests that it is the port at which Microsoft Message Queueing (MSMQ) services reside. I am not quite sure what to make of these two potentially conflicting port assignments both existing within the Microsoft networking realm, but I do find it to be a matter of great curiosity to me as to why Symantec would establish this port as the default for Backup Exec when it appears that it is well known to have been used in at least one, and perhaps even two, networking application areas by Microsoft.

Further, given that there are likely remaining at least 10,000+ largely undefined TCP/IP ports, I wonder what the rationale would be in Symantec's decision to use any port that had a known "following " as port 3527 appears to have. While indicating the steps required to modify the default Backup Exec port using the Windows registry editor, there was unfortunately no suggestions or recommendations also given for other ports that would likely work well as alternatives to the default of 3527, doing so hopefully without the conflict that would appear to be largely expected as a result of Symantec's decision to use 3527.

If anyone has any experiences with this dilemma that they have successfully worked through or any ideas on other things that I might be able to try to remedy this problem, I would greatly appreciate it. I am a long term and huge fan of Backup Exec from the days when it was sold by Seagate Software, so I really dont want to consider any other alternative products.

Thanks in advance for any help that anyone might be able to provide.

[jtatum]

To answer your question about the rationale, Backup Exec implements the Microsoft Message Queue service.  Since the port listed is the standard port for MSMQ, that is why it was chosen.  Given any particular port (including those not listed in the services file containing all "well known" ports), there will be conflicts with various applications.  It is unfortunate that in this case it is two different implementations of the MS message queue service.

I would suggest modifying the registry entry outlined in the knowledge base article you found:
http://seer.entsupport.symantec.com/docs/274583.htm

[Jennica]

Thank you for your very timely reply and explanation as to Symantec's likely rationale for having chosen port 3527. Given that the document #274583 does not make a suggestion or recommendation for any alternative ports that might be preferable over simply picking other port numbers by trial and error, I am wondering if anyone has actually had to change the default port as described in this document, and if so, to what port did they relocate the default? Thanks for everyone's potential interest and assistance.

[jtatum]

You can use use "netstat -an" at a command prompt to list the port numbers in a LISTENING state on your server.  Those port numbers are unavailable for use.  Anything else will be OK.  You should have success with a port in the range of 32768-65535.

[Studio_Two]

But, isn't this install always going to "fail" on a Small Business Server (due to the presence of ISA Server)?

I previously ran v8.6 without problems - but I just installed v12 and also ran into the "3527 Port Conflict."

Could you explain why BE uses the MSMQ service? Would it be possible to disable it in the Small Business Server Environment?

TIA,

Stephen

[RahulM]

Microsoft Message Queuing (MSMQ) is a component of the Windows operating system that allows cooperating applications to send and receive messages to each other, even if the intended recipient application is not running or the computer on which the sender or recipient application is running is disconnected from the network. Messages are stored and forwarded by MSMQ until they reach the destination queue. Later, when a recipient application runs, it can retrieve the messages from the queue. MSMQ decouples sender and recipient applications so they do not need to run at the same time. Message Queuing provides built-in enhanced security, transaction support, and other features

To disable the MSMQ you can follow the article listed below
Please remember that Symantec is not recommending that you disable the service and you might want to consider the impact on any other application or the OS using the service.
MSMQ Security
http://msdn2.microsoft.com/en-us/library/ms882852.aspx

[Studio_Two]

Hi, 

The registry branch "HKEY_LOCAL_MACHINE\SOFTWARE\VERITAS\Backup Exec\Server" does not exist within my BE12 installation, so I guess the the instructions within Support Article 274583 will need to be reviewed.

Any ideas what I can do in the meantime to resolve this?

[RahulM]

Look for,

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Backup Exec\BackupExec for Windows Servers\Server