Failed to install Veeam Analytics Service. Failed to establish connection between the Veeam ONE server and Veeam Analytics service. Operation timed out: 10
Challenge
After upgrading Veeam ONE to version 13.0.x, the Veeam Analytics Service installation fails with the following error:
Failed to install Veeam Analytics Service. Failed to establish connection between the Veeam ONE server and Veeam Analytics service. Operation timed out: 10.
The failure can present in either of two ways:
- The Veeam Analytics Service initially completes installation, but is later marked as failed if the connection is not established within 24 hours.
- The installation fails immediately with a timeout, and the Veeam Analytics Service does not show as installed on the Veeam Backup & Replication server.
Cause
This issue may occur for one of two reasons:
Cause 1: Connection Token Expired After 24 Hours
The Veeam ONE server issues a 24-hour connection token when a Veeam Analytics Service deployment is initiated, either from the Veeam ONE Web Client (using the Install command) or by downloading the MSI for manual installation. If the service is not installed and connected within that window, the token expires and Veeam ONE rejects the subsequent connection attempt.
Cause 2: Network Connectivity Issue
The Veeam Analytics Service cannot establish a connection from the Veeam Backup & Replication (VBR) server to the Veeam ONE server. The failure appears immediately after the deployment is initiated and is caused by one of the following:
- The Veeam ONE server's FQDN is not resolvable or accessible from the Veeam Backup Server.
- The Veeam Backup Server's FQDN is not resolvable or accessible from the Veeam ONE server.
- Inbound TCP port 2805 on the Veeam ONE server is blocked from the Veeam Backup Server.
Bidirectional name resolution and network connectivity between the two servers is required even when Veeam Enterprise Manager is used to supply Veeam ONE with the list of monitored Veeam Backup Servers.
The communication direction also changed in Veeam ONE 13. After upgrading from an earlier release, firewall rules configured for the previous direction no longer permit the required traffic. See More Information for the traffic pattern.
Solution
Solution 1: Manually Allow the Connection
If the connection token has expired, the connection can be re-established manually from the Veeam ONE Web Client:
- Log in to the Veeam ONE Web Client.
- Navigate to ⚙ (Configuration) > Data Collection > Overview.
- Select the checkbox for the affected Veeam Enterprise Manager or Veeam Backup & Replication server.
- From the toolbar, click Veeam Analytics Service > Management > Connect.
This allows the Veeam ONE server to accept the connection request despite the expired token. Once the connection is established, the token is refreshed automatically.
Solution 2: Resolve Network Connectivity Issues
Allow connectivity from the Veeam Backup Server to the Veeam ONE server on TCP port 2805. This port may not be open if Veeam ONE was upgraded from an earlier version, because the connection direction changed in Veeam ONE 13 (see More Information).
Step 1: Verify Port Connectibity from the Veeam Backup Server
Confirm that TCP port 2805 on the Veeam ONE server is accessible from the Veeam Backup Server. In each example below, replace veeamone.yourdomain.local with the FQDN or IP address of the Veeam ONE server.
A FAIL result can indicate either an inbound firewall on the Veeam ONE server (Step 2) or an outbound firewall on the Veeam Backup Server (Step 3).
For a Windows-based Veeam Backup Server, run the following in PowerShell:
Step 2: Open Inbound TCP 2805 on the Veeam ONE Server
If the test fails, run the following on the Veeam ONE server in PowerShell to allow inbound connections on TCP port 2805. To restrict the rule to a specific Veeam Backup Server, append -RemoteAddress <VBR_IP> to the command.
Step 3 (Optional): Open Outbound TCP 2805 on the Veeam Backup Server
If steps 1 and 2 do not resolve the issue, outbound traffic from the Windows-based Veeam Backup Server may also be restricted. Run the following PowerShell cmdlet to create an outbound firewall rule.
Note: To restrict the rule to the Veeam ONE server, append -RemoteAddress <VEEAM_ONE_IP> to the command.
Once the firewall rules are in place, allow up to 60 minutes for the Veeam Analytics Service to push the updated package and re-establish the connection. No further action on the deployment is required.
More Information
Veeam ONE 13 Connection Direction Change
Starting in Veeam ONE 13, the Veeam Analytics Service communication model changed:
- In Veeam ONE 10.x through 12.x, the connection was initiated from the Veeam ONE server to the Veeam Backup & Replication server over TCP port 2805.
- In Veeam ONE 13, the connection is initiated from the Veeam Backup & Replication server to the Veeam ONE server over TCP port 2805.
Traffic pattern in Veeam ONE 13:
- Source: Veeam Backup Server (ephemeral TCP port)
- Destination: Veeam ONE server (TCP port 2805, inbound)
After upgrading from a pre-13 release, existing firewall rules configured for the previous direction no longer permit the required traffic. The new direction applies to all supported Veeam Backup & Replication versions and for both Windows-based deployments and the Veeam Software Appliance.
If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
Spelling error in text
Thank you!
Your feedback has been received and will be reviewed.
KB Feedback/Suggestion
This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
Thank you!
Your feedback has been received and will be reviewed.
Oops! Something went wrong.
Please, try again later.