Professional Documents
Culture Documents
KB1198 - NFC Connectivity Troubleshooting Steps
KB1198 - NFC Connectivity Troubleshooting Steps
Version: All
Published: 2011-08-26
Languages: DE | IT | FR | ES
Challenge
A job fails with an error related to NFC (Network File Copy) connectivity. For example:
Cause
The cause of most NFC errors fall into 4 primary categories:
DNS
(The proxy or Veeam server cannot resolve the ESXi host)
Port (902)
(The proxy can resolve the IP, but port 902 is blocked)
Permissions*
(The account specified in [Backup Infrastructure] for the vCenter does not have permissions)
File Locks
(The file Veeam is trying to read is locked within the vSphere environment)
https://www.veeam.com/kb1198 1/5
8/6/23, 9:49 AM KB1198: NFC connectivity troubleshooting steps
*If the account that Veeam Backup & Replication is using to communicate with the VMware Environment has granular
permissions set, please confirm all permissions are set according to the Granular Permissions Guide.
Due to the nature of NFC as a client<->server type connection, there is also potential that all things may be correct on
the Veeam client-side, and there exists an issue within the VMware Infrastructure itself.
Solution
Troubleshooting Tip
When investigating this issue, it is advisable to reconfigure the job to use a specific proxy. This is done to
isolate the issue to a single proxy being the culprit. This also makes it easier to identify which server the
logs will be found on.
Logs to Investigate
To investigate the potential of DNS, Ports, Permissions, or File Lock issues, you will need to review the Agent process
logs.
%programdata%\Veeam\Backup
2. Open the folder that matches the name of the job that is having an issue.
3. Within this folder, you will need to find the agent log for the specific VM.
Agent.<JobName>.Source.<VMName>.log
Agent.<JobName>.Source.<VMName>.log
Agent.<JobName>.Target.<VMName>.log
5. Here you will want to look for the following items that could point to the cause of the error.
a. DNS
If there is an issue with DNS, the following error will be found.
https://www.veeam.com/kb1198 2/5
8/6/23, 9:49 AM KB1198: NFC connectivity troubleshooting steps
b. Port
If there is an issue with ports, there will be an error like this:
nfc| Establishing connection with the host [esx1]. Port: [902]. Failed.
c. Permissions
If there is an issue with permissions, there will be an error after the following:
d. File Locks
If the file is locked, there will be an error like this:
Troubleshooting
DNS Issues (Most Common)
The proxy must be able to resolve the hostname or FQDN of the ESXi hosts in the Virtual Infrastructure.
Port Issues
Further testing can be done using the following PowerShell command. The destination should be the
hostname/FQDN/IP shown in the logs for the host.
If the Proxy cannot reach port 902, check all applicable Firewalls between the server and the ESXi host.
Permissions Issues
When a vCenter Server or standalone ESXi host is added to the [Backup Infrastructure] section of Veeam Backup &
Replication, the user assigns an account to be used. That account should have sufficient privileges to all objects related
to the VM being backed up.
https://www.veeam.com/kb1198 3/5
8/6/23, 9:49 AM KB1198: NFC connectivity troubleshooting steps
If the account that Veeam Backup & Replication is using to communicate with the VMware Environment has granular
permissions set please confirm all permissions are set according to the Granular Permissions Guide.
For more information, review the following VMware KB article regarding file locks:
Investigating virtual machine file locks on ESXi hosts (10051)
In some cases, Restarting the Management Agents on the ESXi host may correct NFC connection issues.
Isolation Tips
Try a different proxy. (Isolates issue to specific Veeam Proxy)
Try vMotioning the VM to a different host. (Isolates issue to specific ESXi host)
Try Storage vMotioning the VM to a different datastore. (Isolates possible missing permission at datastore level)
Try adding the ESXi host the VM is on as a standalone host to Veeam, then create a backup job to pull the VM
from the standalone host.
(This will help isolate if the Management Agents need to be restarted on the ESXi host)
Remember to remove the job and standalone host from Veeam's configuration after the issue is resolved.
More Information
The proxy being used to process a VM can be identified by opening the “Task” log specific to the VM from inside the
folder named after the job in %programdata%\Veeam\Backup. Searching the Task log for the words “starting agent” will
allow for the identification of which server performed the task.
An issue with Port 902 may represent an issue with a firewall on the ESXi host, Veeam Proxy, or the connection
between the two.
https://www.veeam.com/kb1198 4/5
8/6/23, 9:49 AM KB1198: NFC connectivity troubleshooting steps
https://www.veeam.com/kb1198 5/5