1-800-691-1991 | 9am - 8pm ET
EN

Usage of a predefined VMware ESXi extension (VIB) for Veeams Backup from Storage Snapshot with Cisco HyperFlex IOvisor processing

KB ID: 2298
Product: Veeam Backup & Replication 11, Veeam Backup & Replication 10, Veeam Backup & Replication 9.5
Published: 2017-06-07
Last Modified: 2021-09-01

Challenge

This article describes the usage of a predefined VMware ESXi extension (VIB) for Veeams Backup from Storage Snapshot with Cisco HyperFlex IOvisor processing.

For details on how to perform these firewall changes manually please review KB2299.

HyperFlex Version Specific Article

Please follow the KB below only if you are running a HyperFlex version below 3.0.

Starting with Cisco HyperFlex 3.0, the needed Firewall changes have been implemented in the OS image. Please review KB3075.

For new customers, we recommend installing HyperFlex cluster with that latest HX version, and for existing customers, we recommend upgrading to HX 3.0 or higher to benefit from the new Firewall changes.

Cause

To achieve optimal balancing within the Cisco HyperFlex data network at Backup from Storage Snapshot processing, it is needed to change the ESXi host firewall.
See more background information here.

One of the Methods to change the ESXi host firewall is by a pre-defined VIB found on the Veeam Community GitHub site.

To implement this, follow the below instructions.
 

Solution

Install the Firewall VIB on ESXi:

Repeat the following steps on all Cisco HyperFlex nodes in your cluster.

1. Enable ssh and log in to your ESXi host by using a tool like PuTTY
User-added image

2. Copy the VIB file to the ESXi host's tmp folder using HTTP or a SCP client
User-added image

3. Install the VIB
Command:
esxcli software vib install -v /tmp/VeeamCiscoHXFirewall.vib -f
User-added image

4. Verify the VIB was installed
Command:
esxcli software vib list | grep 'Veeam'
User-added image

5. Verify the new firewall rule is active
Command:
esxcli network firewall ruleset list
Note: If the VIB installation fails, you might need to set the acceptance level to CommunitySupport and retry the installation.
Command:
esxcli software acceptance set --level=CommunitySupported
User-added image


Set the Veeam Proxy Servers

1. Enable allowed IP list for the new firewall rule
Command:
esxcli network firewall ruleset set -r "VeeamCiscoHXFirewall" -a false 
User-added image

2. Set the Veeam proxy server data network IP that is on the Hyperflex ("Storage Controller Data Network")
Repeat the following command for all Veeam proxy server or set a subnet:
esxcli network firewall ruleset allowedip add -r "VeeamCiscoHXFirewall" -i "172.17.53.53."
User-added image

3. Verify the IPs are set
Command:
esxcli network firewall ruleset allowedip list | grep -v "All"
User-added image

Note: Veeam recommends to set the all IPs of Veeam proxy servers in the firewall rule. Otherwise the firewall rule is enabled for all incoming connections. You can specify either the IP address or a subnet. Use one command per proxy.


Check if everything is configured correctly

1. Check the Security Profile on the ESXi hosts

For HX systems < HX2.5 using the relevant VIB.
User-added image

For HX system >= HX2.5 using the relevant VIB.
User-added image


2. Check the VIB
Command:
esxcli software vib list | grep 'Veeam'
User-added image

3. Check the ruleset
Command:
esxcli network firewall ruleset list
User-added image

4. Check which Veeam Proxy IPs are assigned
Command:
esxcli network firewall ruleset allowedip list | grep -v "All"
User-added image



 
KB ID: 2298
Product: Veeam Backup & Replication 11, Veeam Backup & Replication 10, Veeam Backup & Replication 9.5
Published: 2017-06-07
Last Modified: 2021-09-01

Couldn't find what you were looking for?

Below you can submit an idea for a new knowledge base article.
Report a typo on this page:

Please select a spelling error or a typo on this page with your mouse and press CTRL + Enter to report this mistake to us. Thank you!

Spelling error in text

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Your report was sent to the responsible team. Our representative will contact you by email you provided.

Oops! Something went wrong.

Please try again later.

KB Feedback/Suggestion

By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Policy.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Thank you for your interest in Veeam products!
We've sent a verification code to:
  • Incorrect verification code. Please try again.
An email with a verification code was just sent to
Didn't receive the code? Click to resend in sec
Didn't receive the code? Click to resend

ty icon

Thank you!

We have received your request and our team will reach out to you shortly.

OK

error icon

Oops! Something went wrong.

Please try again later.