Search <book_title>...

Veritas NetBackup™ Administrator's Guide, Volume I

Last Published: 2018-09-19

Product(s): NetBackup (8.1.2)

Platform: Linux,UNIX,Windows

PREFERRED_NETWORK examples

Table: Basic examples

Description	Entry
Allows connectivity to the host names that resolve to 12.34.0.0 through 12.34.255.255. It does not affect outbound interface selection:	PREFERRED_NETWORK = 12.34.0.0/16 MATCH
Allows connectivity to the host name that resolves to 12.34.56.78, and requests that the operating system use 98.76.54.32 as the outbound interface.	PREFERRED_NETWORK = 12.34.56.78 MATCH 98.76.54.32
Instructs the host to use the interface IPs of Host_A for all IPv4 and IPv6 addresses.	PREFERRED_NETWORK = 0/0 MATCH Host_A
Prevents NetBackup from connecting to any destination address outside the range of 12.34.56.0 through 12.34.56.255. The source interface will be ANY unless one or more are PROHIBITED.	PREFERRED_NETWORK = 12.34.56.78/24 ONLY
Prevents NetBackup from connecting to any destination address outside the range of 12.34.56.0 through 12.34.56.255. Requests that the operating system use 98.76.54.32 as the outbound interface.	PREFERRED_NETWORK = 12.34.56.78/24 ONLY 98.76.54.32
Prevents NetBackup from connecting to any destination addresses outside of the indicated IPv6 subnet. The source interface will be ANY unless one or more are PROHIBITED.	PREFERRED_NETWORK = 2001:1234:1efc::/48 ONLY
Prevents NetBackup from using any address between 12.34.0.0 and 12.34.255.255 as the source or destination for a connection. If it matches a local interface, NetBackup will provide an ordered list of the remaining interfaces as the source binding list for the outbound interface when other entries do not specify a source. Using PROHIBITED with local interfaces is discouraged. See the details in the following topic: See directive.	PREFERRED_NETWORK = 12.34.56.78/16 PROHIBITED
Prevents the host from using IPv4 addresses.	PREFERRED_NETWORK = 0.0.0.0 PROHIBITED
Prevents the host from using IPv6 addresses.	PREFERRED_NETWORK = 0::0 PROHIBITED
Prevents the host from using the address of the production_server.	*PREFERRED_NETWORK = production_server* PROHIBITED**

Using bplocaladdrs to troubleshoot

Use the bplocaladdrs command to observe the local interfaces that are provided to NetBackup by the operating system and the order in which they are provided.

bplocaladdrs returns the following output for the host (bob) in the examples in the following topics.

$ bplocaladdrs
10.82.105.11
10.82.105.8
10.82.10.10

Using bptestnetconn to troubleshoot

Use the bptestnetconn command to observe the order in which entries are evaluated and the evaluation results. The TGT or SRC indicates whether the destination is permitted and which source binding list NetBackup provides to the operating system. A value of ANY indicates that the outbound interface is not constrained by NetBackup.

$ bptestnetconn -asp -v6
...
FL:  mymaster -> 10.82.105.14  :  5 ms FAST (< 5 sec) TGT PROHIBITED
FL:  mymedia -> 10.81.40.61  :  6 ms FAST (< 5 sec) SRC: 
10.82.10.10
...

PREFERRED_NETWORK rules are applied in this order:

[0] PREFERRED_NETWORK = 10.82.105.14 PROHIBITED
[1] PREFERRED_NETWORK = 10.81.40.0/24 MATCH 10.82.10.10

$ bptestnetconn -asp -v6 -H myclient
...
FL:  myclient -> 10.81.40.127  :  6 ms FAST (< 5 sec) SRC: ANY

PREFERRED_NETWORK rules are applied in this order:

[0] PREFERRED_NETWORK = 10.82.105.15/32 MATCH 10.82.105.0/24
[1] PREFERRED_NETWORK = 10.82.105.0/29 PROHIBITED
[2] PREFERRED_NETWORK = 10.82.104.0/24 MATCH 10.82.105.5

Complex examples

The following examples are more complex and use a NetBackup server (bob), that uses the following network interfaces:

eri0: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 2
   inet 10.82.105.11 netmask fffff800 broadcast 10.82.111.255

eri0:1: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 2
   inet 10.82.105.8 netmask fffff800 broadcast 10.255.255.255

eri1: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 3
   inet 10.82.10.10 netmask fffff800 broadcast 10.82.15.255

Normal outbound connectivity to the following four hosts (billcat, muzzy, beetle, lilo), uses the first interface. Internal connections use the destination interface as the source interface.

$ bptestbpcd -host billcat
10.82.105.11:54129 -> 10.82.105.15:13724

$ bptestbpcd -host muzzy
10.82.105.11:54152 -> 10.82.105.14:13724

$ bptestbpcd -host beetle
10.82.105.11:54135 -> 10.82.104.249:13724

$ bptestbpcd -host lilo  
10.82.105.11:54139 -> 10.82.56.79:1556
$ bptestbpcd -host 10.82.105.11
10.82.105.11:54144 -> 10.82.105.11:1556
$ bptestbpcd -host 10.82.105.8
10.82.105.8:52148 -> 10.82.105.8:1556

Example 1

Using a local interface as the target for MATCH entries has no affect. In this example, the source interface is unaffected by the local MATCH entry.

PREFERRED_NETWORK = 10.82.105.8/32 MATCH 

$ bptestbpcd -host billcat

10.82.105.11:54202 -> 10.82.105.15:13724

$ bptestbpcd -host muzzy
10.82.105.11:54206 -> 10.82.105.14:13724

$ bptestbpcd -host beetle
10.82.105.11:54300 -> 10.82.104.249:13724

$ bptestbpcd -host lilo
10.82.105.11:54302 -> 10.82.56.79:1556
$ bptestbpcd -host 10.82.105.11
10.82.105.11:54306 -> 10.82.105.11:1556
$ bptestbpcd -host 10.82.105.8
10.82.105.8:54309 -> 10.82.105.8:1556

Example 2

Similar to Example 1, using a local interface as the target for ONLY entries has no affect on source binding. It does, however, prevent connections to destination addresses (in the absence of other directives that more closely MATCH the destinations). Connections internal to the host are not affected.

PREFERRED_NETWORK = 10.82.105.8/32 ONLY

$ bptestbpcd -host billcat
<16> bptestbpcd main: ConnectToBPCD(billcat) failed: 
25 cannot connect on socket

$ bptestbpcd -host muzzy
<16> bptestbpcd main: ConnectToBPCD(muzzy) failed: 
25 cannot connect on socket

$ bptestbpcd -host beetle
<16> bptestbpcd main: ConnectToBPCD(beetle) failed: 
25 cannot connect on socket

$ bptestbpcd -host lilo
<16> bptestbpcd main: ConnectToBPCD(lilo) failed: 
25 cannot connect on socket

$ bptestbpcd -host 10.82.105.11
10.82.105.11:54306 -> 10.82.105.11:1556

$ bptestbpcd -host 10.82.105.8
10.82.105.8:54309 -> 10.82.105.8:1556

Example 3

Using MATCH entries, the outbound connections to a specific host or network can be preferred over the defaults. In this example, connections to a specific host and a separate network are requested to use the second outbound network interface.

PREFERRED_NETWORK = 10.82.105.15/32 MATCH 10.82.105.8
PREFERRED_NETWORK = 10.82.104.0/24 MATCH 10.82.105.8

$ bptestbpcd -host billcat (Preferred by the first entry)

10.82.105.8:54192 -> 10.82.105.15:13724

$ bptestbpcd -host muzzy (Implicitly permitted using defaults)

10.82.105.11:54196 -> 10.82.105.14:13724

$ bptestbpcd -host beetle (Preferred by the second entry)

10.82.105.8:54200 -> 10.82.104.249:13724

$ bptestbpcd -host lilo (Implicitly permitted using defaults)

10.82.105.11:54202 -> 10.82.56.79:1556

Example 4

Adding an ONLY entry prevents connections to any other hosts that are not on the specified network, or matched by prior entries.

PREFERRED_NETWORK = 10.82.105.15/32 MATCH 10.82.105.8
PREFERRED_NETWORK = 10.82.104.0/24 MATCH 10.82.105.8
PREFERRED_NETWORK = 10.82.56.0/24 ONLY

$ bptestbpcd -host billcat (Preferred by first entry)

10.82.105.8:54209 -> 10.82.105.15:13724

<16> bptestbpcd -host 10.82.105.14 (Does not match 1 or 2, excluded by 3)

<16> bptestbpcd main: ConnectToBPCD(muzzy) failed: 25 cannot connect on socket

$ bptestbpcd -host beetle (Preferred by second entry)

10.82.105.8:54214 -> 10.82.104.249:13724 (Required by third entry)

10.82.105.11:54216 -> 10.82.56.79:1556

Example 5

Changing the ONLY to PROHIBITED explicitly excludes connections with those destination hosts and implicitly allows connections to unspecified hosts. The PROHIBITED network is non-local and does not affect source binding.

PREFERRED_NETWORK = 10.82.105.15/32 MATCH 10.82.105.8
PREFERRED_NETWORK = 10.82.104.249/32 MATCH 10.82.105.8
PREFERRED_NETWORK = 10.82.56.0/24 PROHIBITED

$ bptestbpcd -host billcat (Preferred by the first entry)

10.82.105.8:54224 -> 10.82.105.15:13724

$ bptestbpcd -host muzzy (Implicitly permitted)

10.82.105.11:54228 -> 10.82.105.14:13724

$ bptestbpcd -host beetle (Preferred by the second entry)

10.82.105.8:54232 -> 10.82.104.249:13724

$ bptestbpcd -host 10.82.56.79 (Does not match 1 or 2, prohibited by 3)

<16> bptestbpcd main: ConnectToBPCD(lilo) failed: 25 cannot connect on socket

Example 6

Conversely, moving the ONLY to the top of the list does not prevent the MATCH entries from being evaluated because the ONLY is for a less restrictive IP range than the MATCH entries. The latter are evaluated first for those hosts.

PREFERRED_NETWORK = 10.82.104.0/24 ONLY
PREFERRED_NETWORK = 10.82.105.15/32 MATCH 10.82.105.11
PREFERRED_NETWORK = 10.82.104.249/32 MATCH 10.82.105.8

$ bptestbpcd -host billcat (Preferred by the second entry)

10.82.105.11:54392 -> 10.82.105.15:13724

$ bptestbpcd -host 10.82.105.14 (Does not match 2 or 3, excluded by 1)

<16> bptestbpcd main: ConnectToBPCD(muzzy) failed: 25 cannot connect on socket

$ bptestbpcd -host beetle (Preferred by 3 before required by 1)

10.82.105.8:54396 -> 10.82.104.249:13724

$ bptestbpcd -host 10.82.56.79 (Does not match 2 or 3, excluded by 1)

<16> bptestbpcd main: ConnectToBPCD(lilo) failed: 25 cannot connect on socket

Example 7

The subnet on this ONLY entry matches both billcat and muzzy, but does not affect the outbound interface confirming that ONLY is used for destination address filtering and not source address filtering. Otherwise, all connections would fail because both local interfaces, 10.82.105.11 and 10.82.105.8, are not in that subnet.

PREFERRED_NETWORK = 10.82.105.14/31 ONLY
PREFERRED_NETWORK = 10.82.105.15/32 MATCH 10.82.105.8

$ bptestbpcd -host billcat (Preferred by second entry)

10.82.105.8:54209 -> 10.82.105.15:13724

$ bptestbpcd -host muzzy (Preferred by first entry)

10.82.105.11:45662 -> 10.82.105.14:13724

$ bptestbpcd -host 10.82.104.249 (Excluded by first entry)

<16> bptestbpcd main: ConnectToBPCD(beetle) failed: 25 cannot connect on socket

Example 8

Here, all three remote hosts are reachable, but notice that the source interface is the one remaining after 10.82.105.11 is PROHIBITED. This includes the apparent target MATCH for billcat, which actually failed to match because the source was previously PROHIBITED. Notice that internal connections are not affected by PROHIBITED.

PREFERRED_NETWORK = 10.82.105.11/32 PROHIBITED
PREFERRED_NETWORK = 10.82.105.15/32 MATCH 10.82.105.11

$ bptestbpcd -host billcat (Matched second, but first prohibited that source)

10.82.105.8:54202 -> 10.82.105.15:13724

$ bptestbpcd -host muzzy (Implicit match and pruned source)

10.82.105.8:54206 -> 10.82.105.14:13724

$ bptestbpcd -host beetle (Implicit match and pruned source)

10.82.105.8:54300 -> 10.82.104.249:13724

$ bptestbpcd -host 10.82.105.11 (Not affected by first entry)

10.82.105.11:54306 -> 10.82.105.11:1556
$ bptestbpcd -host 10.82.105.8
10.82.105.8:54309 -> 10.82.105.8:1556

Example 9

This example demonstrates two nuances of source binding evaluation that result in the use of ANY interface instead of the non-prohibited interfaces. The second entry removes the 10.82.10.10 local interface from the source binding list before the third entry is processed making that source unavailable. The source on the first entry causes the shortened list created by the second entry to be ignored during all evaluations.

PREFERRED_NETWORK = 10.82.104.249 MATCH 10.82.105.0/24
PREFERRED_NETWORK = 10.82.10.10 PROHIBITED
PREFERRED_NETWORK = 10.82.56.0/24 MATCH 10.82.10.10

FL: billcat -> 10.82.105.15 ... SRC: ANY (First source implicitly negates second target)

FL: muzzy -> 10.82.105.14 ... SRC: ANY (First source implicitly negates second target)

FL: beetle -> 10.82.104.249 ... SRC: 10.82.105.11 (Matched first, used first in range)

FL: lilo -> 10.82.56.79 ... SRC: ANY (Second target explicitly negates third source)

In Example 8, the source on the first entry matches two local interfaces. The 10.82.105.11 interface was chosen over 10.82.105.8 as the source when connecting to beetle because that interface was returned first by the operating system as shown in the bplocaladdrs output for this example. (See Using bplocaladdrs to troubleshoot.)

Example 10

This example shows how the binding list is shortened by prohibiting a local interface. When ANY was the default source binding list, the outbound interface for these destinations was 10.82.105.11. (See Example 1.) Prohibiting a different local interface causes NetBackup to provide a shortened list and the operating system selected 10.82.10.10 as the source IP. Because this operating system uses the strong host model, that interface is not valid for these destination IPs and the connection attempts fail.

PREFERRED_NETWORK = 10.82.105.8 PROHIBITED

FL:  billcat -> 10.82.105.15  ... SRC: 10.82.10.10,10.82.105.11
FL:     lilo -> 10.82.56.79   ... SRC: 10.82.10.10,10.82.105.11
 
$ bptestbpcd -host billcat
<16> bptestbpcd main: ConnectToBPCD(billcat) failed: 
25 cannot connect on socket
$ bptestbpcd -host lilo
<16> bptestbpcd main: ConnectToBPCD(lilo) failed: 
25 cannot connect on socket

If the operating system is changed to the weak host model, the TCP SYN for each connection is transmitted out the default interface (10.10.82.105.11) onto the 10.82.104.0 network, but with a source IP of 10.82.10.10. If there is a network route from the 10.82.104.0 network to the destination hosts, then the SYN will reach the destinations. But the reply is only successful if there is an asymmetrical route back to the 10.82.8.0 network from the destination host. Notice the spoofed source IP in the successful connection which does not reflect the network onto which the TCP SYN packet was actually sent.

$ bptestbpcd -host billcat
<16> bptestbpcd main: ConnectToBPCD(billcat) failed: 
25 cannot connect on socket
$ bptestbpcd -host lilo
10.82.10.10:52842 -> 10.82.56.79:1556