Troubleshooting Signature-Based Firewalls

KB ID: 2140
Product: Veeam Agent for Microsoft Windows | 2.1 | 2.2 | 3.0.2 | 4.0 | 5.0
Veeam Backup for Microsoft 365 | Veeam Backup for Microsoft Office 365 2.0 | Veeam Backup for Microsoft Office 365 3.0 | Veeam Backup for Microsoft Office 365 4.0 | Veeam Backup for Microsoft Office 365 5.0 | 6.0
Veeam Backup & Replication | 9.5 | 10 | 11
Veeam Cloud Connect | 9.5 | 10 | 11
Published: 2016-07-12
Last Modified: 2022-02-04
Get weekly article updates
By subscribing, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Policy.

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

error icon

Oops! Something went wrong.

Please try again later.

Challenge

Data transfer is failing across a connection that is protected by an advanced firewall. The firewall uses signature-based detection. Relevant features may have names like antivirus, anti-spyware, intrusion prevention, or application control.

This may affect any make or model of firewall with similar features, but support cases have been opened for:

  • Check Point
  • Cisco
  • Dell SonicWALL
  • Fortinet appliances
  • Palo Alto
  • Sophos


Any type of data transfer may be affected. This problem may manifest in a wide variety of error messages and failure patterns. It may appear random, or consistently.

For the Veeam Backup & Replication product, this can affect Backup, Backup Copy, and Replication jobs. One common failure pattern is for the transfer of specific VM disks to consistently fail at or around the same percentage of completion.

Common error messages include:

An existing connection was forcibly closed by the remote host.
Unstable connection: unable to transmit data.

Depending on the job type and the version of Veeam Backup & Replication, connection failures may cause the job to fail immediately, or the connection may retry several times. While the connection is retried, the job may appear to be frozen because it is unable to transmit data. For more information, see:
Resume on Disconnect
Backup Copy: Automatic Job Retries
WAN Acceleration: Data Transport on WAN Disconnect

 

With Veeam Backup for Microsoft 365 this issue may appear with an error message:

A blocking operation was interrupted by a call to WSACancelBlockingCall

Cause

Data transferred by Veeam software products can contain a potentially unlimited variety of data blocks. Because the traffic is compressed (and in most cases encrypted), data blocks analyzed by a firewall will be different from data as it exists in production. Over the long term, this approximates feeding random data into the signature-based threat detector: false positives are inevitable.

Data transfer is not actually random: a particular data block will always have the same signature after compression and encryption. If the source data does not change, the same blocks will be re-sent on every reconnect attempt and every retry of the job. In this case, the firewall will close the network connection every time a Veeam product attempts to transfer that data block because the firewall incorrectly detects a pattern of data within that block as matching the signature of a known threat.

Solution

It is advisable to begin by reviewing any logging available from the firewall to identify interactions and false detections that interfere with Veeam software data transmissions. Then, create exclusions for Veeam data traffic.

In most cases for Veeam Backup & Replication, Veeam Agent for Windows, and Veeam Agent for Linux, the relevant traffic will be between servers when data is transferred over the transport ports of 2500-3300. This range can be configured for each managed server in the backup infrastructure settings.

Cloud Connect Service Providers should create exclusions for data traffic sent to Cloud Gateways on port 6180 (TCP and UDP).

For Veeam Backup for Microsoft 365, this can be affected by data be transferred over port 443.

For more information on port ranges, find the relevant product or component user guide in the Help Center and consult the Used Ports page.

For information on how to configure exclusions on a specific firewall appliance, please contact the firewall vendor.

More information

To isolate the firewall, temporarily disable all signature-based features in the firewall’s configuration. For best results, do this while data transfer appears frozen – traffic should resume in no more than a few minutes. In some cases, the firewall may allow you to disable specific sites or zones selectively; this can be useful as a solution, but it is not a good isolation step because such features are easily misconfigured.

Reset packets generated by firewall appliances can usually be distinguished from normal traffic by their IP time to live. For example, if most packets in a TCP stream have a TTL of 128, the reset packet that closes the stream has a TTL of 64, the connection was closed by a firewall.

Firewall features that block encrypted key exchange will block most WAN connections used by Veeam Backup & Replication.
Click here to send feedback regarding this KB, or suggest content for a new KB.
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Spelling error in text

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please try again later.

KB Feedback/Suggestion

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case

By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Policy.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Verify your email to continue your product download
We've sent a verification code to:
  • Incorrect verification code. Please try again.
An email with a verification code was just sent to
Didn't receive the code? Click to resend in sec
Didn't receive the code? Click to resend
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

error icon

Oops! Something went wrong.

Please try again later.