NFC connectivity troubleshooting steps
Challenge
Error: NFC storage connection is unavailable.Failed to create NFC download stream.Failed to create NFC upload stream.
Cause
The cause of the majority of NFC errors fall in to 3 primary categories:
- DNS
(The proxy or veeam server cannot resolve the ESXi host) - Port (902)
(The proxy can resolve the IP, but port 902 is blocked) - Permissions*
(The account specified in [Backup Infrastructure] for the vCenter does not have permissions)
*If the account that Veeam Backup & Replication is using to communicate with the VMware Environment has granular permissions set please confirm all permissions are set according to the Granular Permissions Guide.
Due to the nature of NFC as a client<->server type connection, there is also potential that all things may be correct on the Veeam client side and there exists an issue within the VMware Infrastructure itself.
Solution
Logs to Investigate
To investigate the potential of a DNS, Ports, or Permissions issues you will need to review the Agent process logs.
- Navigate to the following location, on the Veeam Proxy:
%programdata%\Veeam\Backup
- Open the folder that matches the name of the job that is having an issue.
- Within this folder you will need to find the agent log for the specific VM.
- For a Backup Job:
Agent.<JobName>.Source.<VMName>.log
- For a Replication Job:
Agent.<JobName>.Source.<VMName>.log
Agent.<JobName>.Target.<VMName>.log
- For a Backup Job:
- Search for the following:
Creating NFC download stream
- Here you will want to look for the following items that could point to the cause of the error.
- DNS
If there is an issue with DNS, the following error will be found.nfc| Resolving host name (esx1) to IP address... nfc| Resolving host name (esx1) to IP address... Failed.
- Port
If there is an issue with ports, there will be an error like this:nfc| Establishing connection with the host [esx1]. Port: [902]. Failed.
- Permissions
If there is an issue with permissions, there will be an error after the following:nfc| Sending authd message: [SESSION ID NUMBER]. nfc| Sending authd message: [Name of Host]. nfc| Waiting for the authd reply message...
- DNS
DNS Issues (Most Common)
Port Issues
Test-NetConnection -ComputerName "<destination_host>" -Port 902Permissions Issues
When a vCenter server or standalone ESXi host is added to the [Backup Infrastructure] section of Veeam Backup & Replication, the user assigns an account to be used. That account should have sufficient privileges to all objects related to the VM being backed up.
If the account that Veeam Backup & Replication is using to communicate with the VMware Environment has granular permissions set please confirm all permissions are set according to the Granular Permissions Guide.
Host-side Issues
Isolation Tips
- Try a different proxy. (Isolates issue to specific Veeam Proxy)
- Try vMotioning the VM to a different host. (Isolates issue to specific ESXi host)
- Try Storage vMotioning the VM to a different datastore. (Isolates possible missing permission at datastore level)
- Try adding the ESXi host the VM is on as a standalone host to Veeam, then create a backup job to pull the VM from the standalone host.
(This will help isolate if the Management Agents need to be restarted on the ESXi host)
Remember to remove the job and standalone host from Veeam's configuration after the issue is resolved.
More information
The proxy being used to process a VM can be identified by opening the “Task” log specific to the VM from inside the folder named after the job in %programdata%\Veeam\Backup. Searching the Task log for the words “starting agent” will allow for the identification of which server performed the task.
Further information can be found in this forum post: http://forums.veeam.com/veeam-backup-replication-f2/failed-to-create-nfc-download-stream-t2991-15.html#p69806
The NFC connection requires the following:
- DNS Resolution of target host
- Port 902 is open to/from Backup Server/Proxy to ESX(i) host
- Permissions to download files via ESX(i) host and/or vCenter
An issue with Port 902 may represent an issue with a firewall on the ESXi host, Veeam Proxy, or the connection between the two.
Couldn't find what you were looking for?
Please select a spelling error or a typo on this page with your mouse and press CTRL + Enter to report this mistake to us. Thank you!
