Replication status show 'Not Active' due to blocked TCP port in VMware Live Recovery
search cancel

Replication status show 'Not Active' due to blocked TCP port in VMware Live Recovery

book

Article ID: 447951

calendar_today

Updated On:

Products

VMware Live Recovery

Issue/Introduction

  • When using Protection and Recovery 9.1 with VCF Automation 9.1, configured replications for Virtual Machines (VMs) remain stuck in a 'Not Active' state.

  • Errors in /var/run/log/hbrsrv.log : - Failed to connect to <IP>:32032: Input/output error - Failed to connect to broker: Input/output error.

  • Example events on source ESXi host /var/run/log/hbrsrv.log.

ERROR hbrsrv 10807095 [esx@4413 sub="ProxyConnection"] [LegacyProxy [127.0.0.1:63273]-> [172.##.##.66:32032]: Failed to connect to 172.##.##.66. Using nic '172.##.##.88'. Error: Connection timed out
ERROR hbrsrv 10807095 [esx@4413 sub="ProxyConnection"] [LegacyProxy [127.0.0.1:63273]-> [172.##.##.66:32032]: Failed to bind to any of the specified VMKs for connection to 172.##.##.66
ERROR hbrsrv 10807095 [esx@4413 sub="ProxyConnection"] [LegacyProxy [127.0.0.1:63273]-> [172.##.##.66:32032]: Failed to connect to broker on 172.##.##.66:32032: Input/output error
ERROR hbrsrv 10807095 [esx@4413 sub="ProxyConnection"] [LegacyProxy [127.0.0.1:63273]-> [172.##.##.66:32032]: Failed to connect to broker: Input/output error

  • Required ports for protection and recovery are enabled at external network.

Environment

  • VCF Automation 9.1
  • Protect and Recovery 9.1 / VMware Live Recovery 9.1

Cause

  • The issue is caused by TCP port 32032 being blocked between the ESXi hosts and the Protection and Recovery proxy servers (vredge). 

  • The proxy server(vredge)  VMs deployed during setup of Protection and Recovery does not allow tdp port  32032 by default  and it is a primary requirement for enhanced replication. 

Resolution

  1. Identify all ESXi hosts and vredge proxy appliances involved in the replication.

  2. Configure the network firewall or NSX-T Distributed Firewall to allow TCP Port 32032 between the ESXi VMkernel interfaces and the Proxy appliances.

  3. On Protection and Recovery Proxy VMs, create a rule to allow 32032 between nodes involved in protection and recovery. Follow the instructions below to add a rule on photon OS.

    1. Login to proxy server using command line with the credentials available on VCFA portal.

    2. Command to allow port 32032 on photon appliance: iptables -A INPUT -p tcp --dport 32032 -j ACCEPT

    3. Command to validate if the rule is added: iptables -L -n -v | grep 32032

  4. Verify connectivity from the ESXi host using: nc -zv <Proxy_IP> 32032 4. Restart the replication task or wait for the status to refresh to 'Active'.

Powered by Wolken Software