Network Routes

In most modern data centers, corporate networks use one or many firewalls. A firewall blocks TCP and UDP ports between two networks, to ensure restricted users cannot access sensitive resources and data. An example is computers that are required to have direct access to the internet, such as web servers. These servers are usually isolated in a dedicated network called a demilitarized zone, or DMZ. This ensures that if a hacker successfully breaks into and accesses a web server, he or she cannot reach the corporate network since the machine is isolated in the DMZ.

There are two methods of implementing network routes:

• Physical network appliance that segregates networks through physical connections
• Software-based firewall that restricts inbound and/or outbound traffic

A typical illustration of a DMZ

Commvault^® Software Default Ports

Commvault^® software uses predefined ports to handle communication and data transfer. Some are static, and some are dynamic.

Commvault^® Software Default Ports

Since multiple ports are used, especially dynamic ports, it makes it hard to protect a computer behind a firewall if no other mechanism is in place. If this is the case, you would have to ask your network team to open ports 1024 to 65535 between all clients in the DMZ and the internal servers. Because this scenario is not an effective solution, Commvault^® software has a set of network routes in place.

Automatic Tunneling

Since service pack 15, the network configuration is easier than ever. The Commvault^® components communicate using the traditional communication port and dynamic ports. If the system notices that the dynamic ports are blocked and therefore unavailable, it automatically encapsulates data transfers through a tunnel port. There is no need to configure any network topologies nor network routes in Commvault^® software.

The only requirement is that the communication port (8400) and tunnel port (8403) are opened and accessible between the components.

Automatic tunneling requirements

Multi-Stream Tunneling

Traditionally, Commvault^® software was capable of tunneling a single stream at a time per network route. This means that streams were sent sequentially to the MediaAgent. This was known to slow backups when using network routes as opposed to regular backups. In SP11, multi-stream tunneling was introduced to circumvent this limitation. Now there's an option available that lets you define a number of streams to use when configuring a network route. Each stream opens its own tunnel.

Note: A maximum of 8 streams can be defined when configuring a network route. If instead, automatic tunneling is used, it will automatically multi-stream jobs up to three streams.

Illustration of a multi-stream tunneled job

Defining the Number of Tunnel Streams 

The Route Settings window lets you define the number of streams for a network. The route is created in the Outgoing Route tab.

Troubleshooting a Multi-Stream Tunneled Backup

It is possible to validate the use of multiple streams using the netstat - anob command. The findstr.exe tool can also be used to filter entries with the destination system's IP address.

Network Routes

CommCell^® components separated by a firewall must be configured to reach each other through the firewall using network routes. Once configured, they can communicate to perform data management operations like backup, browse, and restore. For example, if a client needs to communicate with a CommServe^® server through a firewall and back up data to a MediaAgent through a firewall, all three components (CommServe server, MediaAgent and client) require network route configuration.

There are three primary methods for connecting through a firewall:

• Direct – where the CommCell components communicate directly with each other through a firewall
• Gateway – where CommCell components communicate through a gateway resource
• Through a proxy – where CommCell components use a proxy in a DMZ to communicate with each other

Define Network Routes for Client and Client Groups

Right-click the client or client group | Click Properties | Network
To configure network routes for a client or client group, right-click on the entity in the CommCell browser, select Properties and then click the Network button. In the Network Route Configuration tab, check the 'Configure Network Route Settings' check box. Selecting the Advanced radio button enables full network route configuration.

There are four configuration tabs available:

• Incoming connections
• Incoming ports
• Outgoing routes
• Options

A fifth tab for Network Properties displays a summary of all options configured for the network route settings. This summary is in the format used to populate the FWConfig.txt file, which is in the base folder of all CommCell^® components using network route configurations.

Configure Incoming Connections

The Incoming Connections tab is used to determine if other CommCell^® components can connect the client or client group to where the network route settings are being configured.

There are two connection states:

• Restricted – there are firewall port restrictions in place and a component on the other side of the firewall can reach the component that is currently being configured.
• Blocked – there are firewall port restrictions in place and a component on the other side of the firewall CANNOT reach the component that is currently being configured.

Commvault^® software uses port 8400 as the default communication port for all CommCell traffic. When network route settings are enabled for a CommCell component, by default, port 8403 is used as a listening port for any inbound connection attempts. Additionally, a dynamic port range can be configured to provide additional data traffic ports for backup and recovery operations. How these ports are used is dependent on several factors:

1. Communication is based on the 'Listen for tunnel connections on port' setting.
2. If port 8400 is available on the firewall, once initial communication is made using the listen port, by default, data transmission uses port 8400 and metadata and communication uses port 8403.
3. By default, a dynamic port range is not used for data traffic. This is by design of the network model Commvault^® software uses to transmit data to a MediaAgent. When the 'Optimize for concurrent LAN backups' MediaAgent setting in the Control tab is enabled, all data will be tunneled through a single data port. This means dynamic port ranges are not needed by Commvault software to backup and restore data through a firewall. In certain situations, performance may be improved by disabling the 'Enable for concurrent LAN backup' option and defining a dynamic port range. Keep in mind, that when the LAN optimization option is disabled, the default number of streams a MediaAgent can process is 25 and the maximum is 75.

Configure Outgoing Routes

The outgoing routes tab determines how CommCell^® components will communicate with each other.

There are three route types:

• Direct
• Via gateway
• Via proxy

For each route type, encryption options can be set by determining which connection protocol is used:

• Regular – Authentication and data will NOT be encrypted.
• Authenticated – Authentication will be encrypted but data transfer will not be encrypted.
• Encrypted – Authentication and data will both be encrypted
• Raw – Transmit TCP packet without any encapsulation. Useful when a device in the tunnel path, such as a gateway or a firewall modifies the packets.

The default option 'Authenticated' is the recommended option. If data transfer requires encryption, consider using client 'inline' encryption instead of using the 'encrypted' option in the firewall settings.

Configure Options

When the CommServe^® server can reach clients to initiate data protection and recover jobs, it is configured as restricted on the clients. If the CommServe server cannot communicate to the client, it is configured as blocked and the client is responsible for establishing connections with the CommServe server. The 'Keep-alive Interval' and 'Tunnel Init Interval' are used to determine how connections are made and maintained when the CommServe server is blocked from communicating with clients.

The 'Tunnel Init Interval, seconds' option determines the frequency in which the client attempts to establish a connection with the CommServe server. The 'Keep-alive Interval, seconds' determines how long the connection is kept alive. At the end of the 'keep alive' interval which defaults to five minutes, the client attempts to renew the connection.

Tip: Installing Clients Requiring Network Routes
Before you install a client on a machine behind a firewall, ensure that the network routes are already configured in the Commvault^® software. If the client is installed without the routes being properly set first, communication between the client and CommServe^® server might fail, and manual manipulation might have to be done on the client network route configuration file. To create network routes before you install the client, create the client in the CommCell browser by right-clicking the Client Computers entity and choosing New Client. Once the client is logically created, network routes can be configured for it.

Restricted Network Route Configuration

A restricted network route configuration is when Commvault components can communicate through a firewall, but only on specific ports. A listening port is used to establish a connection between resources. In a restricted configuration, any resource can initiate communication. Before setting up network routes, the listening port must be opened bi-directionally on the firewall between components.

Typical restricted firewall environment

Blocked Network Route Configuration

A blocked network route configuration is when only components on one side of the firewall initiates communication. This is typically used in a strongly secured DMZ or when external clients such as laptop clients are connecting to the CommCell^® environment from unsecured networks.

The CommCell component that establishes connection attempts to communicate with other CommCell resources when Commvault services start. Connection attempts and 'keep alive intervals' are set in the Options tab of the firewall settings.

Typical blocked firewall environment for DMZ clients

Blocked firewall environment for roaming users when no proxy is available

Proxy Network Route Configuration

A proxy network route configuration is used when resources cannot directly communicate using a blocked or restricted connection. A proxy is designated in the DMZ by selecting the 'This computer is in DMZ and will work as a proxy' check box in the Options tab of the Network Route Configuration settings. Network routes must be configured from resources outside the firewall to the proxy and then from the proxy to resources inside the firewall.

Typical proxy configuration