Problems with Veeam B+R 12.1 and SFOS 20.0.2 MR-2-Build378 - failed to create NFC download stream

if you find nothing in your logs, tcp-dump it and see where it fails.

does it fail immediately? do they even connect to each other?

some infos missing here

is it possible you filter something at vcenter firewall? docs.vmware.com/.../GUID-171B99EA-15B3-4CC5-8B9A-577D8336FAA0.html

no it doesnt fail immediately, it takes 1-2 Minutes then it fails.

it worked in the setup before with sg125 to sg310, hence vcenter firewall shouldnt be an issue.

ok trying to make a tcp-dump and checking that again

Would be interesting to see in wireshark if the machines see and fail due to a firewall cert at some point or do not find the target at all due to missing IPSec routing.

To me it sounds more like a timeout fail, expecting no data passing the tunnel

the ipsec tunnel setup and fw-rules is the same as on the sg125 and traffic from backup server and vcenter server network to branch esx server network is not restricted. 

disabled network traffic encryption in veeam completely but doesnt help either.

sometimes in firewall i got some  "could not associate packet to any connection"

but this is strange, because entries before and after that are the same and matching correctly

Finally i fixed it (facepalm)

the veeam backup proxy in the branch is in a different network as the esxi server. it seems i forgot to create a rule for the backup proxy access the esxi host.

but i am really wondering, why this is not protocolled in the firewall log. is the xgs only logging when you enabled logging on the rule? on sg dropped traffic was always logged when i am right.

yes, you may need to create a custom log and drop rule at the bottom. otherwise you're flying blind

good you fixed it

I already created a drop_all rule but i disabled logging this morning for better investigation :-D

didnt know xgs is not logging if you have not a log-option enabled. but now i know better, thx for your help.

finally after 15 years of SG i get more and more used to the xgs series, but this one is one of the first more complexer branch office.