Nuts and bolts in NetBackup for VMware: Transport methods and TCP ports

Thanx Abdul for this information... This one was more informative unlike previous series of yours....

It is only through the feedback that we would know if things like these are beneficial for the esteemed community and whether more like this need to be produced. I appreciate your time and feedback.

 Thank you for this information, but which ports Master server and vCenter (or  ESX) server use for communication?

margo

Hi Margo, 

Technically speaking, the master server does not talk to vCenter server directly for backups or restores. Those are always managed via VMware backup host.

The exception to this rule is when you are browsing the virtual infrastructure (e.g. you are testing the query string for VIP) from an administration console connected to the master server, in this case it tries to communicate to vCenter/ESX server at port 443.

Hence the short answer to your question is…..   NetBackup master uses port 443 to talk to virtual machine server (vCenter or ESX depending on what you had configured) if the specific configuration task requires a connection.

If you have a security requirement to limit connections to vCenter, you can house Windows Administration Console role on VMware backup host. In this case, the master never needs to connect to vCenter directly.

Firstly great post.

I need some clarification if using SAN transport type on Windows Server 2008 for Vmware backup host.

NBU 7.1

Do the LUNs need to be just visible and Offline or do they need to show as Online.

This is for a backups.

I am aware of the Vmware best practices but I have seen some users stating the backups have been working with LUNs showing as offline but I contradict this from previous experience.

http://kb.vmware.com/selfservice/microsites/search...

NBD works and SAN fails with No Transport Method available for the given type.

Hi Craig,

  You bring up an interesting point. This is an area that is controlled by VMware API and we have seen mixed results with different versions of API.

   Strictly for backups, the SAN policy may be set to OfflineShared. I have seen this configuration working for many customers. However for restores, you would need to switch the SAN policy or online the LUN in question explicitly.

May I know if the Hot-add mode is appliable to 5220 appliance? I was told that in order to utilize SAN transport, we must use a physical Backup host instead of a VM backup host which will only connect via LAN.

Recently I install a netbackup VMware solution to a customer using the hotadd method.

The backup systems ware in a different network subnet form ESXs and vcenter. As there is NO document from Symantec that described the firewall ports need to be opened, I folow your article and sent to the customer an email to open the ports 443 and 902.

Guess what, it did not work. I open a case to Symantec asking for ports and the answer was the following ports

SSL            443
SSH            21 & 22
http             80
vnetd          13724
veritas_pbx 1556
bpcd           13782
vopied         13783  (????)

No mentioning at all the 902 port, which I thing is needed. And he added to the email:
"Please not that we offer the VMware ports as advised but unconfirmed information and that you should always confirm the VMware ports with VMware themselves"  

After that we add a second virtual network card bypassing the firewall. It is not good to do test to the client’s environment
I really do not know the ports needed, but definitely are not only 443 and 902. 

Reading the veem manual, it has a page with a big range of ports need to be open for VMware backups. But every backup software, is different

stefanos.

Thanks for the write up. I've been trying to find something similar produced by VMware but most of their documentation is related to the VDDK and VADP APIs.

So in your statement:

"Thus backup is streamed from ESX/ESXi system’s VMkernel port to VMware backup host. If your ESX/ESXi hosts have VMKernel ports (known as the management ports) with dedicated uplinks, your virtual machine traffic links are not affected."

Any idea which VMkernel port is used? If you have multiple VMkernel ports defined (for example, one dedicated for vMotion and another on a separate VLAN or dedicated 10GbE link for NFS datastores or dedicated for mangement traffic), what is the logic to decide which VMkernel port to use?

I know with ESXi this changes slightly as there no longer a service console port, and when configuring a new network port you only have connection types for Virtual Machine (VM port group) or VMkernel. But when adding a VMkernel port, you can specifically select the port properties to include: vMotion, Fault Tolerance logging and Management Traffic. I guess the question there is: do any of these port properties HAVE to be selected in order for the NFC traffic to use the port, or will it use any VMkernel port... and if so, which VMkernel port (hopefully it will be smart enough to try to use one on the same subnet if it exists).

Thanks

Hi bcblake,

Unfortunately, VDDK documentation does not state specific requirements as NBD inherits its root from Linux style kernel module. Technically, NBD can function so long as there is a path from backup host to any of the VMkernel port types. Having said that I would recommend not mixing vMotion traffic with backups as the former might be responding to DRS rules. As a best practice, I would suggest creating a dedicated network segment that backup host and an ESXi management port can use. You can create multiple management ports on an ESXi host, allocate one port to production segment for vCenter to manage the host, allocate another port to a completely different non-routable segment for backup traffic. This also allows to securely route backup traffic without going for processor intensive NBDSSL transport. 

Hope this helps. 

Hi Abdul

you Nuts & bolts series had helped alot me in many cases to design  and provide robust solution for VMware

however V-Ray is tighten with both virtualization market leader. Looking forward the series for Hyper-V too.

As far i know presently there are limitation from Hyper-V end , but need to know What NetBackup can benefit to this customers

Thanks for the information. I wonder if there is any documentation that expands on the best practices or recommendations for NFS backups of VMware? In your example above you show the VMware Backup Host as a VMware guest. I cannot find any references to doing this in the NetBackup 7.1 Admin Guide for VMware.

Hi Abdul,

Can you also share some light on Hyper-V integration too