NetWorker: How to test communication through a firewall
Summary: How to test Dell NetWorker communication through a firewall.
Instructions
To test the NetWorker communication through a firewall.
NetWorker uses a direct socket connection to communicate and move data across the network to the required service. NetWorker uses two types of TCP ports: Service ports and Connection ports.
The TCP server processes that run on each NetWorker host use service ports to listen for inbound connections. It has fixed ports 7937 & 7938. You must include these ports in the service port range of each NetWorker host as it uses these ports to initiate connections.
NetWorker also dynamically opens ports. A NetWorker host can allocate any port in the defined service port range, and the NetWorker daemons select the dynamic ports within that range randomly. The default range is 7937-9936, and you can narrow or expand this range.
NetWorker processes use connection ports (outbound ports) to connect to a service. The NetWorker software requires one connection port for any type of communication between the client, storage node, and server.
When the data zone uses an external firewall, you must open the service port range in the firewall for TCP connections. A standard NetWorker client requires a minimum of four TCP service ports to communicate with the NetWorker server. The number of service ports that must be open depends on the environment. For specific port range instructions with examples, refer to the NetWorker Security Configuration Guide for your NetWorker version.
The following article details specific NetWorker processes and which ports they use: NetWorker Processes and Ports
Example - Communication ok
On the server:
# nsradmin -s vm-lego-231 -p nsrexecd
NetWorker administration program.
Use the "help" command for help, "visual" for full-screen mode.
nsradmin>
## nsrrpcinfo -t vm231 nsrexecd
Program 390113 version 1 ready and waiting
## nsrrpcinfo -p vm231
PROGRAM VERSION PROTOCOL PORT SERVICE
100000 2 tcp 7938 nsrportmapper Port Mapper
100000 2 udp 7938 nsrportmapper Port Mapper
390436 1 tcp 8353 nsrexecd GSS Authentication
390435 1 tcp 9437 nsrexecd Resource Mirror
390113 1 tcp 7937 nsrexecd Remote Execution
On client:
# nsradmin -s vm-lego-121
NetWorker administration program.
Use the "help" command for help, "visual" for full-screen mode.
nsradmin> quit
# nsradmin -s vm-lego-121 -p nsrexecd
NetWorker administration program.
Use the "help" command for help, "visual" for full-screen mode.
nsradmin>
NW Client.vm231.## nsrrpcinfo -t vm121 nsrd
Program 390103 version 2 ready and waiting
NW Client.vm231.## nsrrpcinfo -p vm121
program vers proto port
100000 2 tcp 7938 nsrportmapper
100000 2 udp 7938 nsrportmapper
390436 1 tcp 9245 nsrexecd
390435 1 tcp 8190 nsrexecd
390440 1 tcp 8278 nsrexecd_nsrfa
390113 1 tcp 7937 nsrexecd
390402 1 tcp 9001 gstd
390460 1 tcp 7999 auth_proxyd
390103 2 tcp 9434 nsrd
390109 2 tcp 9434 nsrstat
390110 1 tcp 9434 nsrjb
390120 1 tcp 9434 nsrd
390109 2 udp 8063 nsrstat
390114 1 tcp 9840 nsrdispd
390105 5 tcp 9105 nsrindexd
390105 6 tcp 9105 nsrindexd
390439 1 tcp 8092 nsrfa
390107 5 tcp 8319 nsrmmdbd
390107 6 tcp 8319 nsrmmdbd
390433 1 tcp 8505 nsrjobd
390438 1 tcp 9416 nsrlogd
390111 1 tcp 8259 nsrsnmd
390104 305 tcp 8905 nsrmmd
390104 205 tcp 9658 nsrmmd
390104 405 tcp 9576 nsrmmd
Example - Communication not working
On the server:
# nsradmin -s vm-lego-231 -p nsrexecd
42503:nsradmin: Remote system error - No route to host
There does not appear to be a NetWorker nsrexecd server running on vm-lego-231.
# nsradmin -s 10.64.19.79 -p nsrexecd
42503:nsradmin: Remote system error - No route to host
There does not appear to be a NetWorker nsrexecd server running on 10.64.19.79.
NW Server.vm121.## nsrrpcinfo -t vm231 nsrexecd
nsrrpcinfo: Remote system error - No route to host
program 390113 is not available
On client:
NW Client.vm231.## nsrrpcinfo -t vm150 nsrd
84866:nsrrpcinfo: Failed to get DNS information for host 'vm150': Name or service not known.
# nsradmin -s vm-lego-121 -p nsrexecd
NetWorker administration program.
Use the "help" command for help, "visual" for full-screen mode.
nsradmin> quit
# nsradmin -s vm-lego-121
NetWorker administration program.
Use the "help" command for help, "visual" for full-screen mode.
nsradmin>
Temporarily stopping the firewall confirms that the firewall was blocking the inbound communication to the NetWorker client:
On client:
Windows client (PowerShell):
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False
Linux client using firewalld
systemctl stop firewalld
On server:#
nsradmin -s vm-lego-231 -p nsrexecd
NetWorker administration program.
Use the "help" command for help, "visual" for full-screen mode.
nsradmin>