cannot backup through a firewall (full nat)

Question

hi, i was wondering... i followed the procedure in the tech bulletin on how to backup a client in a firewall. sad to say, the client 'cannot see the server' i got these logs from the server: 04/12/06 08:59:45 nsrd: savegroup info: starting ADHOC_GROUP (with 1 client(s)) 04/12/06 09:03:30 savegrp: command 'savefs -s backupserver -c dmzserver -g ADHOC_GROUP -p -l full -R -v -F / ' for client dmzserver exited with return code 9. * dmzserver:/ Connection timed out 04/12/06 09:03:30 savegrp: dmzserver:probe will retry 5 more time(s) 04/12/06 09:07:14 savegrp: command 'savefs -s backupserver -c dmzserver -g ADHOC_GROUP -p -l full -R -v -F / ' for client dmzserver exited with return code 9. * dmzserver:/ 1 retry attempted * dmzserver:/ Connection timed out 04/12/06 09:07:14 savegrp: dmzserver:probe will retry 4 more time(s) 04/12/06 09:10:59 savegrp: command 'savefs -s backupserver -c dmzserver -g ADHOC_GROUP -p -l full -R -v -F / ' for client dmzserver exited with return code 9. * dmzserver:/ 2 retries attempted * dmzserver:/ Connection timed out 04/12/06 09:10:59 savegrp: dmzserver:probe will retry 3 more time(s) 04/12/06 09:14:44 savegrp: command 'savefs -s backupserver -c dmzserver -g ADHOC_GROUP -p -l full -R -v -F / ' for client dmzserver exited with return code 9. * dmzserver:/ 3 retries attempted * dmzserver:/ Connection timed out 04/12/06 09:14:44 savegrp: dmzserver:probe will retry 2 more time(s) 04/12/06 09:18:29 savegrp: command 'savefs -s backupserver -c dmzserver -g ADHOC_GROUP -p -l full -R -v -F / ' for client dmzserver exited with return code 9. * dmzserver:/ 4 retries attempted * dmzserver:/ Connection timed out 04/12/06 09:18:29 savegrp: dmzserver:probe will retry 1 more time(s) 04/12/06 09:22:13 savegrp: command 'savefs -s backupserver -c dmzserver -g ADHOC_GROUP -p -l full -R -v -F / ' for client dmzserver exited with return code 9. * dmzserver:/ 5 retries attempted * dmzserver:/ Connection timed out 04/12/06 09:22:13 savegrp: dmzserver:probe will retry 0 more time(s) i got these from the client: 04/12/06 08:52:09 nsrexecd: Host name verification failed - unknown host: 04/12/06 08:52:09 nsrexecd: Host name verification failed - unknown host: 04/12/06 08:55:54 nsrexecd: Host name verification failed - unknown host: 04/12/06 08:55:54 nsrexecd: Host name verification failed - unknown host: 04/12/06 08:59:38 nsrexecd: Host name verification failed - unknown host: 04/12/06 08:59:38 nsrexecd: Host name verification failed - unknown host: 04/12/06 09:03:23 nsrexecd: Host name verification failed - unknown host: 04/12/06 09:03:23 nsrexecd: Host name verification failed - unknown host: 04/12/06 09:07:08 nsrexecd: Host name verification failed - unknown host: 04/12/06 09:07:08 nsrexecd: Host name verification failed - unknown host: 04/12/06 09:10:53 nsrexecd: Host name verification failed - unknown host: 04/12/06 09:10:53 nsrexecd: Host name verification failed - unknown host: if i add the hostname in the /etc/hosts file with the firewall_ip, the backup still doesn't run.

ble1 · Answer

the ip that i was referring to before was the ip of
the firewall.

??? Sounds like something is not configured very well there then. While communication should use firewall it is not firewall IP that should go to client but server's translated by firewall for client to understand.

in our firewall, the logs showed that the client is
connecting to the firewall ip, and not the backup
server.

That's doesn't seem right - check your NAT.

i cannot test the rpc communication because 111 is
blocked in our firewall. correct me if i am wrong
but i think legato does not need 111 for
communication because it has its own portmapper.

from_bck_server> rpcinfo -t client_name 390113 1
from_client> rpcinfo -t bck_server 390113 1

As for port 111, I would not put my hand in fire for that - it might depend on the release - but even then you should be able to see drop in the log of the firewall.

techsup2 · Answer

Verify your basic network connectivity (ping,
nslookup) - from what it looks like we are not
getting as far as using any ports to transfer data as
you are failing with unknown hosts errors. Configure
hosts files on the client and server to see if there
are still issues; verify you have listed all aliases
of the client.

actually, the server was able to establish connection with the client given these reasons:
- the firewall logged the connection from the server to the client
- the client responded to an unknown host message during the retries (as seen from my first post). there were also logs in the firewall that the client was trying to connect with the server.

the 6 retries of the server also logged 6 hosts related errors on the dmz client

ble1 · Answer

04/12/06 09:10:53 nsrexecd: Host name verification
failed - unknown host:

if i add the hostname in the /etc/hosts file with the
firewall_ip, the backup still doesn't run.

And what is the error then? I assume you don't see firewall IP but rather IP assigned to backup server on that side of the NAT cloud. Did you test RPC communication between server and client and does it timeout?

techsup2 · Answer

And what is the error then? I assume you don't see
firewall IP but rather IP assigned to backup server
on that side of the NAT cloud. Did you test RPC
communication between server and client and does it
timeout?

the ip that i was referring to before was the ip of the firewall. when i added it in /etc/hosts, no error message was generated on the client, but on the server side, i get a connection timeout.

in our firewall, the logs showed that the client is connecting to the firewall ip, and not the backup server.

i cannot test the rpc communication because 111 is blocked in our firewall. correct me if i am wrong but i think legato does not need 111 for communication because it has its own portmapper.

DavidHampson · Answer

Verify your basic network connectivity (ping,
nslookup) - from what it looks like we are not
getting as far as using any ports to transfer data as
you are failing with unknown hosts errors. Configure
hosts files on the client and server to see if there
are still issues; verify you have listed all aliases
of the client.

DavidHampson · Answer

But is the client able to establish a connection with the server? Please check connectivity from the client to the server.

fclancy1 · Answer

try telnet on port 7937 both ways to verify bi directional communication between server and client

NetWorker

Was this post helpful?