Avamar: NDMP Backup Fails with Error 41862: Unable to Establish Data Connection

NDMP Backup Failure Indicators

The following symptoms are observed when an NDMP backup cannot establish a data connection:

• Backup job ends with a failure status.
• Avndmp log records error <41862> entries.
• Log message states "Unable to establish data connection to address port."

avndmp Error <41862>: [snapup-/DFS_Shares] Unable to establish data connection to address 10.11.12.13 port 10500

Root Cause of NDMP "Unable to establish data connection" Failure.

The NDMP backup fails because the data channel cannot be opened between the Avamar NDMP accelerator and the NAS. The underlying reasons are:

• **Avamar firewall (avfirewall) enabled** - the internal avfirewall blocks the TCP port that the NAS advertises for the data pipe.
• **External network firewall, VLAN, or gateway restrictions** - a customer‑managed firewall or network segmentation device denies traffic to the IP address and port supplied by the NAS.
• **Dynamic or unrestricted NAS data ports** - most NAS devices select any available port for NDMP data transfer; if that port is not explicitly allowed, the connection is refused.
• **Vendor‑specific port limitations** - certain NAS platforms restrict NDMP ports (for example, NetApp can limit the range, Unity defaults to ports 10500‑10531).

The issue is reflected in the avndmp log with error code 41862:

avndmp Error <41862>: [snapup-/DFS_Shares] Unable to establish data connection to address 10.11.12.13 port 12345.

Verify and Resolve "Unable to establish data connection" Errors.

1. Check the Avamar NDMP Accelerator firewall status.

# Display current avfirewall status
system avfirewall status

2. If avfirewall is enabled, temporarily stop it.

# Stop the avfirewall service
service avfirewall stop

3. Rerun the backup job.

Perform the backup again from the Avamar client or Management Console. If the job completes without error 41862, the firewall is the cause.

Caution: Stopping avfirewall leaves the accelerator exposed. Re‑enable it after the issue is resolved.

4. Configure avfirewall to allow NAS traffic (preferred method for Avamar 7.3 and later)

Follow the "Add NAS to Avamar firewall" section of the *Dell Avamar NDMP Accelerator for NAS Systems* user guide. The typical steps are:

• Identify the NAS IP address and the data‑pipe port range reported in the avndmp log (for example, 10.11.12.13:xxxxx).
• Add the NAS as a trusted client in avfirewall configuration.
• Open the required ports in the accelerator’s firewall rules.
• Save the configuration and restart the firewall service.

# Example: add NAS client (replace placeholders with actual values)
avfirewall --add-client --ip 10.11.12.13 --port-range 10500-10531

# Restart avfirewall to apply changes
service avfirewall restart

5. If the avfirewall is already disabled, open the required ports on the network firewall.

• Contact the customer’s network team.
• Request that the port ranges used by the NAS for the NDMP data pipe are allowed through any intervening firewalls, VLAN ACLs, or gateways.
• Note: Most NAS devices can use any available port. Specific vendors may restrict ports:
  • NetApp - configurable port range.
  • Unity - default ports 10500‑10531.

6. Verify the fix.

# Run the backup again
# Check avndmp log for absence of error 41862
cat /var/log/avndmp.log | grep "Error <41862>"

  If the log shows no entries for error 41862 and the backup completes successfully, the issue is resolved.