After upgrading vCenter to 7.0 u3h configuring backup fails with error "Access to backup server is denied. Check your credentials"

Products

• VMware Cloud Foundation
• VMware vCenter Server

Issue/Introduction

Symptoms:

• Post upgrading VC to 7.0 u3h, when trying to configure the backup on VAMI it fails with the error "Access to backup server is denied. Check your credentials"

•  Checked applmgmt.log

2023-02-24T00:00:03 AM AEDT [3096]INFO:plugins.SMBClientStorageIOLib:Running Command: ['/usr/bin/smbclient', '//backupserver.vsphere.local/backup_share/', '-A', '/dev/shm/smbCredentialFile8begk_do', '--send-bu
ffer', '100M', '-c', 'cd files/backup/vxrail/vCenter/vcsa1.vsphere.local/; ls']
2023-02-24T00:00:04 AM AEDT [3096]ERROR:plugins.SMBClientStorageIOLib:Command failed with error: NT_STATUS_LOGON_FAILURE
2023-02-24T00:00:04 AM AEDT [3096]ERROR:vmware.appliance.backup_restore.archive_impl:Failed to enumerate archive info. Url smb://backupserver.vsphere.local/backup_share/files/backup/vxrail. Err [Failure instance: Traceback: <class 'plugins.StorageIOErrorsLib.PluginError'>: Plugin error occurred. ErrCode: 1, Args: ()
/usr/lib/python3.7/threading.py:926:_bootstrap_inner
/usr/lib/python3.7/threading.py:870:run
/usr/lib/python3.7/site-packages/twisted/_threads/_threadworker.py:46:work
/usr/lib/python3.7/site-packages/twisted/_threads/_team.py:190:doWork

• Backup using IP fails with same UI error and NT_STATUS_LOGON_FAILURE in the applmgmt.log

Environment

VMware vCenter Server 7.0.3

Cause

Starting vCenter 7.0 Update 3h build 20395099, the backup architecture has been changed to 'smbclient' from 'cifs' . Limitation of samba client being kerberos DNS TXT packets that are needed for kerberos authentication are not supported.
This causes specific failure in environments where Domain-based DFS namespace is used for the target backup location.

 

Resolution

Configure VCSA to backup by using the DFS UNC path instead of the DFS referral path.

For example:
All VCSAs are configured to use backup path //backup_server.vsphere.local/imsshare/files/backup/vxrail which is a DFS path that points to a cluster of DFS shares which has been working fine until the the VCs are upgraded to 7.0.3.01000.

Change the backup path to the direct UNC path i.e. //server01.vsphere.local/server01/Files/Backup/VxRail the VCSA backup will complete successfully.

Additional Information

This could also be caused by an invalid or missing NTP configuration in vCenter.

Please configure NTP on the vCenter to match the server hosting the SMB share.