VMware Communities: Message List - Opening addtional ports in ESX 3.0 service console for NetWorker 7.2

Re: Opening addtional ports in ESX 3.0 service console for NetWorker 7.2

bbshaw — Fri, 20 Oct 2006 20:17:57 GMT

I figured out that the ports needed for Networker are inbound tcp on 7937 and 7938 and outbound on 7937 - 9936. I didn't know how to put in a range of ports for the firewall so I contacted support on this and here is his reply:

Unfortunately the esxcfg-firewall command cannot add a range of ports, as strange as this may sound.

I have done some investigating on this however, and found that edit the /etc/vmware/firewall/services.xml file and add a new service to so this. I have no documentation on the proper syntax for this, however by reviewing the file you can get a picture of what exactly it should look like. In general you will want to go to the bottom of the file and add a section that looks like this:

<service id='00xx'>
<id>NAME_OF_SERVICE</id>
<rule id='0000'>
<direction>inbound</direction>
<protocol>tcp</protocol>
<port type='dst'>
<begin>PORT_BEGIN</begin>
<end>PORT_END</end>
</port>
</rule>
<rule id='0001'>
<direction>outbound</direction>
<protocol>tcp</protocol>
<port type='dst'>
<begin>PORT_BEGIN</begin>
<end>PORT_END</end>
</port>
</rule>
</service>

WHERE:
-service id='00xx' - is the next available service ID when you are looking at the last service entry in the services.xml file.
-NAME_OF_SERVICE - the name of the new service/ports you want to open
-PORT_BEGIN - the beginning port number
-PORT_END - the ending port number

This generates a rule that opens the ports you have in PORT_BEGIN and PORT_END for both incoming and outgoing tcp communication. Once this is saved, do a service firewall restart, and once this is done, you should be able to go into the VI client - Select the server that you made the configuration change on, Click Configuration-->Security Profile and then hit the properties button. On this page you will be able to select the newly added service and click to enable.

Once this is done you can than use esxcfg-firewall -q command to see if the port configuration was successfully added, and also test the backup software.

Now those directions are great, but the one thing missing is that you also have to do a service mgmt-vmware command on the server to make the service show up in the console. Also the last service ID changes from ESX3.0 to ESX3.0.1. The last service ID in 3.0 is 25 and the last one in 3.0.1 is 27, they added two services in there. So I started thinking what happens with the next release if they decide to add more services, so I made the ID 50. That is assuming that they don't just overwrite that file during the upgrade.

Hope this helps someone!

Brian Shaw

Re: Opening addtional ports in ESX 3.0 service console for NetWorker 7.2

bbshaw — Thu, 12 Oct 2006 17:20:58 GMT

What was the resolution? Was it just the disable of the firewall? What ports did you have to open up for Legato?

Thanks!

Re: Opening addtional ports in ESX 3.0 service console for NetWorker 7.2

mittell — Tue, 12 Sep 2006 16:00:16 GMT

You're welcome.

Thanks for the correct/helpful post points.

Re: Opening addtional ports in ESX 3.0 service console for NetWorker 7.2

uwoengin — Tue, 12 Sep 2006 15:55:13 GMT

It's solved..
Thanks!

Re: Opening addtional ports in ESX 3.0 service console for NetWorker 7.2

mittell — Tue, 12 Sep 2006 15:45:59 GMT

Try temporarily stopping the firewall to see if it resolves the problem, that way you'll know if it's your ESX firewall that's mis-configured or something else.

/etc/init.d/firewall stop from the service console.

Re: Opening addtional ports in ESX 3.0 service console for NetWorker 7.2

uwoengin — Tue, 12 Sep 2006 15:43:38 GMT

I tried that method.. It says the ports are opened but I still cannot have access to NetWorker.

Re: Opening addtional ports in ESX 3.0 service console for NetWorker 7.2

mittell — Tue, 12 Sep 2006 15:32:29 GMT

At the service console type: esxcfg-firewall -o <port,tcp|udp,in|out,name> to open whatever ports you need.

Opening addtional ports in ESX 3.0 service console for NetWorker 7.2

uwoengin — Tue, 12 Sep 2006 14:59:48 GMT

I am testing NetWorker 7.2 in Linux system with ESX 3.0.
And I have some problem opening ports between ESX 3.0 and NetWorker 7.2. How do I open additional ports in the serice console firewall in ESX server 3.0 for Legato NetWorker 7.0 - 7.3?