Challenge
A job fails with an error related to NFC (Network File Copy) connectivity. For example:
Cause
The cause of most NFC errors fall into 4 primary categories:
DNS (The proxy or Veeam server cannot resolve the ESXi host)
Port (902) (The proxy can resolve the IP, but port 902 is blocked)
Permissions* (The account specified in [Backup Infrastructure] for the vCenter does not have permissions)
File Locks
(The file Veeam is trying to read is locked within the vSphere environment)
*If the account that Veeam Backup & Replication is using to communicate with the VMware Environment has granular permissions set, please confirm all permissions are set according to the Granular Permissions Guide.
Due to the nature of NFC as a client<->server type connection, there is also potential that all things may be correct on the Veeam client-side, and there exists an issue within the VMware Infrastructure itself.
Solution
Troubleshooting Tip
When investigating this issue, it is advisable to reconfigure the job to use a specific proxy. This is done to isolate the issue to a single proxy being the culprit. This also makes it easier to identify which server the logs will be found on.
More Information
The proxy being used to process a VM can be identified by opening the “Task” log specific to the VM from inside the folder named after the job in %programdata%\Veeam\Backup. Searching the Task log for the words “starting agent” will allow for the identification of which server performed the task.
Further information can be found in this forum post: http://forums.veeam.com/veeam-backup-replication-f2/failed-to-create-nfc-download-stream-t2991-15.html#p69806The NFC connection requires the following:
DNS Resolution of the target host
Port 902 is open to/from Backup Server/Proxy to ESX(i) host
Permissions to download files via ESX(i) host and/or vCenter
An issue with Port 902 may represent an issue with a firewall on the ESXi host, Veeam Proxy, or the connection between the two.
