Can no longer backup CIFS after migrating data to new NetApp Filer

[behbhelp]

We are using BackupExec 2010 R3. We have a NetApp FAS2020 running ONTAP 7.3.6. We were successfully backing up CIFS data to tape. This weekend we migrated the data to a new FAS2240 running ONTAP 8.1.2 (7-mode). I attempted to add the share to User-Defined Selections and get this error:

"An error was encountered while attempted to browse the contents of 10.1.0.X."

"A network connection to the server could not be established."

NDMPD is turned off on the filer. I can access the share through windows explorer. The system logon account has correct credentials and they are on the share with "full control" in the filer. In BackupExec I have "Enable selection of user shares" as checked in Options -> Network and Security.

I am not sure what else to try. This was working on previous system, now it doesn't work on this one. I read somewhere to change the NDMP port. I didn't try this because it is not enabled on the filer or in BackupExec.

I did CIFS audit on the filer and see the BackupExec Media Server trying to log in.

Any advice?

[behbhelp]

I have some more information to add. 

When I try to connect from BackupExec Selection list to both heads of the old filer, it works. When I connect to the other head of the new filer (that does not have any CIFS shares) it says "Access is Denied" and prompts me for which login account to use. I do not get an "Access is Denied" prompt with the FAS2240 with the CIFS shares.

[pkh]

Try point 2 in Colin Weaver's answer and see whether that works.

https://www-secure.symantec.com/connect/forums/netapp-san-not-able-backup#comment-8352731

[behbhelp]

pkh, thank you!

I was unable to block outbound connections as it is running on Windows 2003.

However, I followed the instructions here: http://www.symantec.com/business/support/index?page=content&id=TECH24256

I added the NDMP line to services and set it to 9000 and I checked "enable remote agent tcp dynamic port range" and chose numbers that did not include 10000.

This allowed me to connect to the filer and select the backup list.

Alas, when the job runs it does not complete and provides an error: 

Error category    : Resource Errors

Error             : e000846b - The resource could not be backed up because an error occurred while connecting to the Backup Exec for Windows Servers Remote Agent. 

Make sure that the correct version of the Remote Agent is installed and running on the target computer.

Any ideas on this one?

After this error, I changed the port range for NDMP on the filer to also not include 10000, enabled NDMP and disabled NDMP. It did not help with the above error.

[pkh · Accepted solution]

I understand that changing the port will not solve the problem.  You got to block the outgoing connnection from the media server on port 10000 to that device.  You can use the Windows Firewall 

http://technet.microsoft.com/en-us/library/cc778394(v=ws.10).aspx

or some other firewall to do so.

[Colin_Weaver]

Just to backup what pkh stated: if it is the issue caused by certain versions of Ontap and changes NetApp made then changing the NDMP port on the media server will not fix the issue as it relates to how the operating system on a NetApp responds to inbound requests on any IP port.

The only options I am currently aware of are:

1) Use a software firewall to block outbound connecvtions to Port 10000 on the IP address of the NetApp and do not customize the NDMP port on the media server.

2) Upgrade to very latest version of Ontap 8.1.x and disable ndmpd on the NetApp

3) Downgrade to an older version of Ontap 7.x  (not 100% sure which version) and make sure that NDMP is stopped on the NetApp

[behbhelp]

Colin,

We have in place the latest version of ONTAP at this time which is 8.1.2.

Now that I changed either that TCP setting I mentioned above or the NDMP service setting, I can't connect to BE agents on other servers. I'm going to fix that first, then try again with the CIFS.

- Elan