Backup won't run through firewall

Opening 7937 and 7938 ports for the client is not enough. The client needs at least 4 service ports (If other add-ons installed, more service ports will be required). Therefore, open more ports on the client (best to open 7937-9936 if it is possible).

Please refer to the following document to calculate how many ports and what ports are needed in your enviroment.

This definitely a DNS issue.

I have no DNS resolution in this environment and need to do it by hosts-files. But this won't work.

I have the client DNS-information in networker servers hosts-file and the networker servers DNS-infos in the clients hosts-file.

I have no DNS-server specified in the /ets/resolv.conf and the nsswitch-file contains the line: hosts:          files.

But no nslookup will go through, I always get a time out.

How can I realise forward and backward DNS-resolution via hosts-files?

I hope you can read Page 5 to Page 7 "Calculating service port ranges".

Ok, we fixed the DNS issue. But we still have trouble with the ports which needs to be opened.

I tried with opening ports 111, 514 and 7937-7940 in both directions but the backup failed with a timeout.

Now ports 111, 514 and 7937-9936 are opened and backup is running.

When I read the "Configuring TCP Networks and Network Firewalls for EMC NetWorker"-Guide right, only ports 7937+7938 needs to be open. Is that right?

Do I need to set the nsrports on the server or the client side? Currently it is set to default.

Any help would be appreciated.

Regards

Jan

As far as I understand it, I don't need to calculate any ports since the networker server I'm running is outside the DMZ and it is also the storage node. There is nothing networker related inside the DMZ.

So it needs to be four ports (7937-7940), at least this is the statement on page 5. "NetWorker client: A NetWorker 7.3 or later client uses nsrexecd that requires four service ports: the reserved ports 7937 and 7938 and two user-configurable ports from the service port range."

However, I'm not sure where to set the nsrports portrange. On the networker server or the networker client?

Hi Jayjay,

You have to set the ports in both, server and client with the following command:

nsrports -S xxxx-xxxx

If you want to use certain ports, you can also do as follows:

nsrports -S -S 7937-7938 8284-8333 8346-8395 8638-8694 8900-8942

This will use ports 7937 and 7938, from 8284 to 8333 etc.

Port 111 should be also open.

Can you please let us know what you have in the hosts file in regards to the loopback?

Thank you,

Carlos

1) Don't touch any nsrports setting on the server.

2) On the client, open a command line window and enter the command, "nsrports -S 7937-7940"

3) On the client, restart "Networker Remote Exec Service"

4) Try your backup again.

Xao,

With that you are limiting the number of ports client can use to contact NW server and send data. I wouldn't do such restriction, as if there is for instance Oracle DB's running on it, it will definitely need more ports for the backup.

Thank you,

Carlos

Carlos,

I was giving answers base on JayJay's scenario which looks like he was just trying to do filesystem backups.  You only need 4 ports on the client and 4 ports on the firewall to make filesystem backups work.  Also JayJay mentioned the client is on the DMZ.  I have not seen environment where someone will put their internal applications and database servers out on the DMZ.  So pretty much filesystem backups is that's needed.

Xao

Hi,

Networker’s default port range is 7937-9936; so on the firewall you will need to allow for bi-directional TCP traffic on ports 7937-9936.

Allow incoming service connections to the NetWorker server’s IP address on ports, from the IP addresses of each of the storage nodes or client machines (as well as any other machines on that subnet). The firewall is also configured to allow connections to the IP addresses for each storage node on ports , and to each client IP address on ports. Each NetWorker host must be configured with the appropriate port range for that machine, and the NetWorker services must be restarted on each machine after a change to the port range. A simpler configuration to administer these machines would be to assign a range of 24 ports, 7937–7960, to all machines, and configure the firewall to allow traffic to these ports on any host.