Backups through a PIX Firewall

[badlooser]

NetWorker 5.5, Siemens OEM on Solaris 7
NetWorker Client 5.5/5.7 on Windows NT4.0 sp6a / Win2k sp1
Cisco PIX Firewall

I am having problems since we installed a Firewall between th BU server and clients: data is backed up but index save doesn't start and group is hanging...

Here is the way the backup goes:
1. The data is sent to the BU server and is recoverable (it is what mminfo says BUT savegroup completion reports the save set is ABORTED!)
2. NetWorker server is waiting for some feedback that the backup is done from the client but nothing is sent:

connection state is:
netstat -a on SERVER
SERVER.16448 CLIENT.7937 7916 0 9660 0 ESTABLISHED
SERVER.16450 CLIENT.7937 7984 0 9660 0 FIN_WAIT_2 <- !!

netstat -a on CLIENT
TCP CLIENT.7937 SERVER:16448 ESTABLISHED

as a result, index is never saved and group is running indefinitely (is has to be stop manually).

It seems that the PIX firewall is closing connections preventing the &quot;feedback&quot; from the client save process to be sent to nsrexec on the BU server (That's why I have a FIN_WAIT_2 connection).

We changed some timeout parameters on the Firewall:
timeout conn 24:00:00 half-closed 3:00:00 udp 0:02:00 rpc 24:00:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00

And set the /dev/tcp tcp_keepalive_interval attribute to 10minutes on the BU server..

But nothing has changed...
Does anyone encoutered (solved?) this problem ?

 

[dchp]

Have you gone into the pix and looked at the logs to see if it is being blocked by an access list? ie &quot;en&quot;, &quot;term mon&quot;, &quot;logging on 7&quot;. I am thinking this might be the case since this connection is being initiated from the outside, or demil zone.

Just a thought.