Although there are already a handful of existing internet forums and knowledge base references to this topic, this post is my contribution regarding what has worked well for me. My main source on how to configure Backup Exec to work with firewalls can be found here: http://seer.entsupport.symantec.com/docs/299245.htm
The configuration and settings below are from an actual production environment. The network utilizing this configuration has Backup Exec 12.5 installed on a dedicated backup server on the LAN at 192.168.1.x with an external scsi connected LTO tape drive. The DMZ network 172.16.10.x contains several Windows based web servers. On the backup server, Backup Exec remote agent TCP dynamic port range was configured per Symantec's recommendation.
In Backup Exec select Tools > Options > Network and Security
The relevant PIX code:
ip address dmz 172.16.10.1 255.255.0.0
nat (dmz) 1 0.0.0.0 0.0.0.0 0 0
<- LAN based backup server static mapping ->
static (inside,dmz) 192.168.1.x 192.168.1.x netmask 255.255.255.255 0 0
<- Backup Exec server and remote agent port ranges ACL ->
access-list 102 permit tcp host 172.16.10.11 host 192.168.1.x range 6101 6106
access-list 102 permit tcp host 172.16.10.12 host 192.168.1.x range 6101 6106
access-list 102 permit tcp host 172.16.10.13 host 192.168.1.x range 6101 6106
access-list 102 permit tcp host 172.16.10.11 host 192.168.1.x range 10000 10500
access-list 102 permit tcp host 172.16.10.12 host 192.168.1.x range 10000 10500
access-list 102 permit tcp host 172.16.10.13 host 192.168.1.x range 10000 10500
<- Enable ACL ->
access-group 102 in interface dmz
Backup Exec remote agents installed successfully on the web servers via push. A DMZ backup job was then configured and scheduled.
Here's a screenshot of the DMZ backup job throughput:
; "Network Composer")
; "Spam Relief")
; "Virtual Server 2008")
; "Video Wall BSOD")
I know I am commenting on a blog post from a year ago. My expertise on Cisco is not that great. I am dealing with the ISA firewall instead of PIX but everything else is the same setup. Firewall type shouldn't matter. Sorry to say but the Symantec's KB article you listed above is a big joke. It was written by someone with no concept of firewalls. If you google "backup exec and DMZ backup", you see hundreds of hits. Symatec hadn't done a good job of explaining how the traffic flows. They just listed bunch of ports without explaining which way the traffic flows and if there is any secondary connections.
Is that the whole config for the PIX? Because from what I understand from the documentation and forums is that you need to allow Netbios, CIFS and 10000 from the media server to the DMZ and vice versa. Any light you can shed on this subject is greatly appreciated.
Thanks