Veritas NetBackup™ Release Notes

Connection time-out issue with IPv6-only NetBackup master server and dual stack host

In a mixed environment of IP addresses where the NetBackup master server is IPv6-only and media server (or client host) is dual stack, then the connection between the master server and media server (client host) is timed out. This can lead to a peer host validation time-out issue with respect to secure communication. The bptestnetconn -w -H <IPV6-only master server name> command takes much longer to connect; sometimes more than 120 seconds to execute.

The following error message is displayed:

When bptestnetconn -w -H <IPV6-only master server name> is run from a media host or client host, it takes much longer to connect to master server.

The nbutils vxul debug log entries show the following output:

Connecting to [10.210.71.166]:[1556].,35:nbclnt_curl_prefnet::helper_connect,5
NON-Blocking connect in progress. Watch WRITE.,35:nbclnt_curl_prefnet::helper_connect,5
New sockfd is [5].,35:nbclnt_curl_prefnet::helper_connect,5
Returning VN_STATUS_SUCCESS,35:nbclnt_curl_prefnet::helper_connect,5
Returning VN_STATUS_SUCCESS,42:nbclnt_curl_prefnet::tryeach_iface_connect,5
Returning rc,49:nbclnt_curl_prefnet::establish_initial_connection,5
Returning VN_STATUS_SUCCESS,33:nbclnt_curl_prefnet::nbio_connect,5
RC [0] STAT [-1] MAXFD [5] TIMEOUT [150].,32:nbclnt_curl_prefnet::bio_connect,5
Non-blocking connect attempt failed. errno=[110]=[Connection timed out],48:
   nbclnt_curl_prefnet::helper_check_connect_status,1
:For host [pdqebl26vm12.pne.ven.veritas.com] already tried connecting to [10.210.71.166],
   now trying[2620:128:f0a1:9006::167].,39:nbclnt_curl_prefnet::iterate_next_iface,5
[vnet_addrinfo.c:9125] vnet_configured_stacks(), remote_ipv4_supported flag:
   1 0x1,20:vnet_adjusted_family,1
[vnet_addrinfo.c:9126] vnet_configured_stacks(), remote_ipv6_supported flag:
   1 0x1,20:vnet_adjusted_family,1
[vnet_addrinfo.c:5173] using interface  ANY,27:vnet_get_pref_netconnection,4
Returning VN_STATUS_SUCCESS,44:nbclnt_curl_prefnet::usable_prefnet_settings,5
Returning VN_STATUS_SUCCESS,39:nbclnt_curl_prefnet::iterate_next_iface,5
Connecting to [2620:128:f0a1:9006::167]:[1556].,35:nbclnt_curl_prefnet::helper_connect,5

The DNS lookup of the IPv6-only master server gives two IP addresses - IPv4 and IPv6 - instead of only IPv6 address. This may be possible as the master server was once configured in dual stack mode. While connection is established between the media server (or client host) and the master server daemon, VNET APIs sort IP addresses. First, all IPv4 addresses are sorted and then IPv6 addresses are sorted irrespective of the IP address family set in the bp.conf file. Because of this, the media server (or client host) first tries with the IPv4 address, but times out as the master server is IPv6-only and then tries out the IPv6 address. But finally, the peer host validation operation is timed out before the successful IPv6 connection.

Workaround: Avoid IPv4 (unusable IP address for the IPV6-only master server) connection attempt by setting PREFERRED_NETWORK in media server's (or client host's) bp.conf file from where the connection is initiated. Set the PREFERRED_NETWORK parameter as follows:

PREFERRED_NETWORK = <master server ipv4-only address> PROHIBITED