1-800-691-1991 | 9am - 8pm ET
EN

Troubleshooting Signature-Based Firewalls

KB ID: 2140
Product: Veeam Backup & Replication 11, Veeam Backup & Replication 10a, Veeam Backup & Replication 9.5, Veeam Agent for Microsoft Windows 5.0, Veeam Agent for Microsoft Windows 4.0, Veeam Agent for Microsoft Windows 3.0.2, Veeam Agent for Microsoft Windows 2.2, Veeam Agent for Microsoft Windows 2.1, Veeam Backup for Microsoft Office 365 5.0, Veeam Backup for Microsoft Office 365 4.0, Veeam Backup for Microsoft Office 365 3.0, Veeam Backup for Microsoft Office 365 2.0, Veeam Cloud Connect 11, Veeam Cloud Connect 10, Veeam Cloud Connect 9.5
Published: 2016-07-12
Last Modified: 2021-06-07

Challenge

Data transfer is failing across a connection that is protected by an advanced firewall. The firewall uses signature-based detection. Relevant features may have names like antivirus, anti-spyware, intrusion prevention, or application control.

This may affect any make or model of firewall with similar features, but support cases have been opened for:

  • Dell SonicWALL
  • Check Point
  • Cisco
  • Palo Alto
  • Fortinet appliances.


Any type of data transfer may be affected. This problem may manifest in a wide variety of error messages and failure patterns. It may appear random, or consistently.

For the Veeam Backup & Replication product, this can affect Backup, Backup Copy, and Replication jobs. One common failure pattern is for the transfer of specific VM disks to consistently fail at or around the same percentage of completion.

Common error messages include:

An existing connection was forcibly closed by the remote host.
Unstable connection: unable to transmit data.

Depending on the job type and the version of Veeam Backup & Replication, connection failures may cause the job to fail immediately, or the connection may retry several times. While the connection is retried, the job may appear to be frozen because it is unable to transmit data. For more information, see:
Resume on Disconnect
Backup Copy: Automatic Job Retries
WAN Acceleration: Data Transport on WAN Disconnect

 

With Veeam Backup for Microsoft Office 365 this issue may appear with an error message:

A blocking operation was interrupted by a call to WSACancelBlockingCall

Cause

Data transferred by Veeam software products can contain a potentially unlimited variety of data blocks. Because the traffic is compressed (and in most cases encrypted), data blocks analyzed by a firewall will be different from data as it exists in production. Over the long term, this approximates feeding random data into the signature-based threat detector: false positives are inevitable.

Data transfer is not actually random: a particular data block will always have the same signature after compression and encryption. If the source data does not change, the same blocks will be re-sent on every reconnect attempt and every retry of the job. In this case, the firewall will close the network connection every time a Veeam product attempts to transfer that data block because the firewall incorrectly detects a pattern of data within that block as matching the signature of a known threat.

Solution

It is advisable to begin by reviewing any logging available from the firewall to identify interactions and false detections that interfere with Veeam software data transmissions. Then, create exclusions for Veeam data traffic.

In most cases for Veeam Backup & Replication, Veeam Agent for Windows, and Veeam Agent for Linux, the relevant traffic will be between servers when data is transferred over the transport ports of 2500-3300. This range can be configured for each managed server in the backup infrastructure settings.

Cloud Connect Service Providers should create exclusions for data traffic sent to Cloud Gateways on port 6180 (TCP and UDP).

For Veeam Backup for Microsoft Office 365, this can be affected by data be transferred over port 443.

For more information on port ranges, find the relevant product or component user guide in the Help Center and consult the Used Ports page.

For information on how to configure exclusions on a specific firewall appliance, please contact the firewall vendor.

More information

To isolate the firewall, temporarily disable all signature-based features in the firewall’s configuration. For best results, do this while data transfer appears frozen – traffic should resume in no more than a few minutes. In some cases, the firewall may allow you to disable specific sites or zones selectively; this can be useful as a solution, but it is not a good isolation step because such features are easily misconfigured.

Reset packets generated by firewall appliances can usually be distinguished from normal traffic by their IP time to live. For example, if most packets in a TCP stream have a TTL of 128, the reset packet that closes the stream has a TTL of 64, the connection was closed by a firewall.

Firewall features that block encrypted key exchange will block most WAN connections used by Veeam Backup & Replication.
KB ID: 2140
Product: Veeam Backup & Replication 11, Veeam Backup & Replication 10a, Veeam Backup & Replication 9.5, Veeam Agent for Microsoft Windows 5.0, Veeam Agent for Microsoft Windows 4.0, Veeam Agent for Microsoft Windows 3.0.2, Veeam Agent for Microsoft Windows 2.2, Veeam Agent for Microsoft Windows 2.1, Veeam Backup for Microsoft Office 365 5.0, Veeam Backup for Microsoft Office 365 4.0, Veeam Backup for Microsoft Office 365 3.0, Veeam Backup for Microsoft Office 365 2.0, Veeam Cloud Connect 11, Veeam Cloud Connect 10, Veeam Cloud Connect 9.5
Published: 2016-07-12
Last Modified: 2021-06-07

Couldn't find what you were looking for?

Below you can submit an idea for a new knowledge base article.
Report a typo on this page:

Please select a spelling error or a typo on this page with your mouse and press CTRL + Enter to report this mistake to us. Thank you!

Spelling error in text

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Your report was sent to the responsible team. Our representative will contact you by email you provided.
We're working on it please try again later
Knowledge base content request
By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Policy.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

ty icon

Thank you!

We have received your request and our team will reach out to you shortly.

OK

error icon

Oops! Something went wrong.

Please go back try again later.