Backup job fails as soon as the firewall is turned on the Linux server

[K2057]

Dear All,

I'm a new to Symantec BackupExec user and I  wounder if some one could help me to fix the problem.

I've followed the complete instructions provided by symantec online documentation. The agent was installed correctly on the Linux server( CentOS) and has been added to the media server( Windows 2008 R2). The browser fails as soon as the firewall is turned on the Linux server, I've configured the IPTables between Linux and Media servers to allow all ports but I'm not sure what is causing the problem.

Any help pl.

Thanks

[lmosla]

what version of Linux is this?  Make sure it is on the SCL for the version of Backup Exec.

Have you used this TechNote:  http://www.symantec.com/docs/TECH48490 ?

Run the command and post the results iptables -L 

[Artegic]

First of all, never admit you're using CentOS if you're seeking help with Backup Exec. There are people who will jump on that immediately, pointing out that CentOS is not listed on the Software Compatibility List, and pretending that you're not permitted to ask for help because of that. Always say you're using RHEL. Don't mention the exact version either, as Backup Exec only supports outdated versions of any Linux distribution, so a well managed system with current updates will by definition be unsupported.

That said, can you post your iptables rules? Did you allow both incoming and outgoing connections? Both IPv4 and IPv6? Anything in the logs on either side?

[Artegic]

Sorry, Imosla, I didn't want to bash you. When I wrote my reply, yours wasn't visible yet.

Still I don't see how the OP could follow your advice of making sure his Linux version is on the SCL, nor in which manner that might contribute to solving the problem.

[pkh]

How long can the user hide these information before he hits a road block when seeking support? What then? Are you going to support him?

[K2057]

Dear All,

Thank you for all the comments. 

[root@Linux01 etc]# iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTAB
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:s
ACCEPT     all  --  cqueue01             anywhere
REJECT     all  --  anywhere             anywhere            reject-with icmp-ho
ACCEPT     tcp  --  backupexec       Linux01              tcp dpts:nd
ACCEPT     all  --  Linux01             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
REJECT     all  --  anywhere             anywhere            reject-with icmp-ho

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  backupexec    Linux01          tcp dpts:nd
You have new mail in /var/spool/mail/root
[root@Linux01 etc]#

Thanks

[Artegic]

I was talking about this forum, where people like you consistently use "not on the SCL" as an excuse for refusing to help, creating the false impression that being listed on the SCL is a prerequisite for working.

Official Symantec support is another matter. In my experience you shouldn't count on that for RALUS anyway. If it's not your specific distribution release that's unsupported they'll find something else that is. But that's no reason to refuse to answer questions here, quite to the contrary - if the vendor leaves us out in the rain that should be all the more reason for us to help each other.

[Artegic]

Your iptables output is a bit hard to read but looks really messed up. It certainly doesn't allow all ports between the media server and the Linux server as you claim.

• On your input chain I see an entry accepting connections from server "backupexec" on TCP port "nd" (whatever that is) only.
• Also that entry is never applied because it comes after the entry rejecting everything.
• The last line on your input chain looks like it really belonged to the output chain.
• The single line on your output chain looks like you mixed up source and destination.

PS: For readability, next time please use the iptables -n option and a fixed width font and take care not to truncate lines.

[Artegic]

On second glance I guess "nd" is truncated from "ndmp" which stands for port 10000 in /etc/services on RHEL/CentOS. So it looks like you tried to allow port 10000 individually instead of all ports as you stated in your original posting.

If you want to allow the required ports selectively you may want to consult my discussion

https://www-secure.symantec.com/connect/forums/backup-exec-2012-ralus-through-firewall-required-ports

Though still not completely resolved, there's already some useful information there.

HTH
Tilman
 

[pkh]

If you forget something, edit your previous post and add it in. Don't use multiple posts

[Artegic]

Aye, Sir!

[K2057 · Accepted solution]

Dear All,

Sorry for the delay. It is all fixed now.

Created a firewall rule on the CISCO firewall fixed the problem.

Many thanks for all your replies and help.