A bit of a mashup of systems here, so bear with me. Essentially, I'm having some trouble using the Backup Exec agent for Oracle, while trying to backup a remote Linux server. The BE agent appears to use RMAN to backup the databases
The backup server is on one VLAN and the target server on another, with a Cisco ASA firewall providing the only link between them. This is by design, as the backup server is to support numerous clients and each client must be on its own VLAN to prevent them from accessing each other. I have added the recommended ports to the firewall to at least allow the agent to talk to the media server.
The backup starts well enough (indeed a smaller Oracle database on the same server completes without issue) but a 200GB database, which would clearly take a few hours to complete, is not able to complete.
I believe the problem to be related to http://www.symantec.com/business/support/index?page=content&id=TECH59632, which says that a CORBA session is established on port 5633 at the start of the backup and used before each RMAN operation but, while data is being transferred, the CORBA session's socket receives no packets. Since the connection timeout on the firewall is 60 mins, the CORBA session is dropped and, when the RMAN agent tries to perform its next action, the whole process bombs. Symantec say this problem was fixed in an earlier version of Backup Exec, but do not detail any additional settings to enforce it.
Setting the connection timeout on the firewall to something high-enough to cover the backup window (e.g. 12 hours) seems like the wrong thing to do, as it is an estate-wide change, which would also affect the connection lifetime of (for example) web requests to another client's web server.
Moving the Linux server into the same LAN as the backup server is out of the question.
I'm not a Linux guru, but I roughly know my way around. So far, I have tried starting using libkeepalive (http://libkeepalive.sourceforge.net/) to force the beremote process' socket creation to be made with a KEEPALIVE TCP flag, but a quick
netstat -top indicates that it is not taking. Either I'm using libkeepalive incorrectly, or it doesn't work for the beremote binary
I guess I am looking for an option that fits with the environment I am in. I figure I'm looking for one or more of the following:
- a way to configure the BE agent to keep the connection alive?
- a way to inject the keepalive flag to the existing TCP connection (e.g. via a cronjob)?
- a way to tell the Cisco device to increase the connection timeout for a specific source/target (maybe a policy-map)?
Any/all (other) ideas welcome...
RE: Comment by @Weaver
class-map CLS_INSPECTION_TRAFFIC match default-inspection-traffic class-map CLS_ALL_TRAFFIC match any class-map CLS_BACKUPEXEC_CORBA description Oracle/DB2 CORBA port for BackupExec traffic match port tcp eq 5633 ! ! policy-map type inspect dns PMAP_DNS_INSPECT_SETTINGS parameters message-length maximum client auto message-length maximum 1280 policy-map PMAP_GLOBAL_SERVICE class CLS_INSPECTION_TRAFFIC inspect dns PMAP_DNS_INSPECT_SETTINGS inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ipsec-pass-thru inspect icmp inspect snmp class CLS_BACKUPEXEC_CORBA set connection timeout idle 1:00:00 dcd class CLS_ALL_TRAFFIC set connection decrement-ttl !