cancel
Showing results for 
Search instead for 
Did you mean: 

Backing up through a firewall

Timothy_Payne
Level 4
I have 8 servers that I back up through a Firewall on 2 seperate subnets. We are using IPSEC for the servers to Authenticate through the Firewall.

The problem I am having is that the backup/restores speeds are extremely erratic, one time I will get a speed og 2000 kbs the next time I will get 5 kbs. I have performed some tuning on the servers but they are still erratic. Does anyone else have any insight into the best way to backup/restore through a firewall?
6 REPLIES 6

rilwan_dawodu
Level 4
Certified
Have you checked the NIC speed of the clients you are backing up? The speed should be in full duplex mode.

Timothy_Payne
Level 4
All NIC's on both sides are set to !00MB Full Duplex. Each server has as a large a page file as feasible.

Timothy_Payne
Level 4
This question is no longer an issue. We have reverted to Veritas's recommended method of backing up through a firewall.

Chia_Tan_Beng
Level 6
> This question is no longer an issue. We have
> reverted to Veritas's recommended method of backing
> up through a firewall.

Hi Tomithy,

Are you able to share what are the key points and important pointers of Veritas's recommended method of backing up through a firewall so that all can benefit?

Timothy_Payne
Level 4
It is really simple to set up:

Have the firewall setup as follows:

Port 13782 from master to Client
Port 13724 from client to Master



From the "Veritas Architects Networks"

Here are the steps for 5.0:

You need 13782 incoming from the master to the client:
- Test from master with portqry -n clientname -e 13782
- Should get TCP port 13782 (bpcd service): LISTENING

You need 13724 outgoing from client to master:
- Test from client with portqry -n masterserver -e 13724
- Should get TCP port 13724 (vnetd service): LISTENING

If you get FILTERED for either of these tests, your firewall is not opened in the correct direction.

Then you need to add the client to the master server in "Client Attributes"
Check "Use Connect Back" or "No Connect Back" (I can't remember exactly as we are now on 6.0)

At this point, you should be able to open host properties on the client.

If you want to be able to initate restores from the client, you will also have to go into the client properties, and go to the Firewall tab, and add the master server and choose "no connect back"

With 6.0 vnetd is the default, so you only need 13724 both directions, and NO other ports and no other configurations.

Chia_Tan_Beng
Level 6
Thanks for sharing.

:)