Avamar: Data Domain backups are failing to replicate with "the user has insufficient access rights"

A client may have been specified which would have stopped access from all clients.

Backups that are saved on a Data Domain with Avamar integration are not replicated for Disaster Recovery (DR) purposes.

When replication runs, backups stored on Avamar replicate successfully, but backups stored on Data Domain fail when avtar attempts a connection to the target DD.

The following messages are seen in the replication logs which can be accessed from the Avamar Administrator console for each failed job:

avtar Warning <18125>: Calling DDR_OPEN returned result code:5075 message:the user has insufficient access rights
avtar FATAL <10608>: Replication failed: could not open connection to dest DDR <target DDR hostname>, dest LSU: avamar-xxxxxxxxxx, handle: -1, DDR result code: 5075, desc: the user has insufficient access rights. 
avtar FATAL <40009>: DDR encountered errors.

The destination DD's DD boost access list is not allowing access from the source Avamar or DD or all clients.

Add the source Avamar and DD hostnames into the access list. Then rerun replication to confirm there are no further issues logging in to the Data Domain.

sysadmin@datadomain-dst# ddboost access show
**   This command is deprecated and will be unavailable in future releases.
Use 'ddboost clients show' instead.
DD Boost access allowed from the following clients:
dev-test.corp.dell.com

sysadmin@datadomain-dst# ddboost access add clients avamar-src.corp.dell.com
**   This command is deprecated and will be unavailable in future releases.
Use 'ddboost clients add' instead.
avamar-src.corp.dell.com : Added

sysadmin@datadomain-dst# ddboost access add clients datadomain-src.corp.dell.com
**   This command is deprecated and will be unavailable in future releases.
Use 'ddboost clients add' instead.
datadomain-src.corp.dell.com : Added

sysadmin@datadomain-dst# ddboost access show
**   This command is deprecated and will be unavailable in future releases.
Use 'ddboost clients show' instead.
DD Boost access allowed from the following clients:
dev-test.corp.dell.com
avamar-src.corp.dell.com
datadomain-src.corp.dell.com

The Avamar replication logs should show the following:

2015-06-09 14:55:08 avtar Info <40041>: - Establishing a connection to the Data Domain system with basic authentication (Connection mode: A:0 E:0).
2015-06-09 14:55:08 avtar Info <0000>: - Connected to:
Data Domain System: datadomain-src.corp.dell.com
Model:              DD4500
DDOS:               Data Domain OS 5.5.0.9-471508
Serial Number:      FXXXXXXXXXXXXX
          Capacity
Total:        140,454,501,285,888 (127.74 TB)
Available:     70,235,477,508,096 (63.879 TB)
Used:          70,219,023,777,792 (63.864 TB)
Used logical: 6,445,745,982,552,764 (5.7250 PB)
2015-06-09 14:55:08 avtar Info <0000>: Setting default storage unit to 'avamar-xxxxxxxxxx' for handle 1
2015-06-09 14:55:08 avtar Info <10543>: Data Domain login to datadomain-src.corp.dell.com successful
2015-06-09 14:55:08 avtar Info <18845>: Restore mode - No Data Domain read compression.
2015-06-09 14:55:08 avtar Info <0000>: GSAN connected via: IPv4, retrieved Data Domain IPv4 hostname = datadomain-dst.corp.dell.com
2015-06-09 14:55:08 avtar Info <10606>: Connecting to Data Domain Destination Server "datadomain-dst.corp.dell.com" (LSU: avamar-xxxxxxxxxx, User: "********")
2015-06-09 14:55:08 avtar Info <10540>: - Resolved Data Domain Server name "datadomain-dst.corp.dell.com" to the IP address "10.1.1.2"
2015-06-09 14:55:08 avtar Info <40041>: - Establishing a connection to the Data Domain system with basic authentication (Connection mode: A:0 E:0).
2015-06-09 14:55:08 avtar Info <0000>: - Connected to:
Data Domain System: datadomain-dst.corp.dell.com
Model:              DD4500
DDOS:               Data Domain OS 5.5.0.9-471508
Serial Number:      FXXXXXXXXXXXXX
          Capacity
Total:        141,259,219,402,752 (128.47 TB)
Available:    105,297,588,781,056 (95.768 TB)
Used:          35,961,630,621,696 (32.707 TB)
Used logical: 2,021,959,548,732,281 (1.7959 PB)

This can also be done using the DD System Manager:

1. Select Data Management > DD Boost > Settings.
2. In the Allowed Clients section, click Create (+).
   The Add Allowed Client dialog appears.
3. Enter the hostname of the client.
   This can be a fully-qualified domain name (for example, host1.dell.com) or a hostname with a wildcard (for example, *.dell.com).
4. Select the Encryption Strength.
   The options are None (no encryption), Medium (AES128-SHA1), or High (AES256-SHA1).
5. Select the Authentication Mode.
   The options are One Way, Two Way, or Anonymous.
6. Click OK.

A similar error can occur with Avamar maintenance activities (checkpoint, hfscheck, garbage collection). If any of these activities are failing with MSG_ERR_DDR_ERROR, and the ddrmaint log shows that "the user has insufficient privilege." See Avamar-Data Domain Integration: Maintenance failures due to incorrect ownership of the Avamar mtree on the Data Domain system

Other causes include an incorrect password, or password timeout. The following knowledge articles contain additional information:
Avamar - Failed to update or connect to Data Domain system due to locked DDBoost user.
Avamar Administrator UI Reports Data Domain Incorrect Status Due to expired ddboost password.