Troubleshooting File Level Recovery (FLR) communication issues

Summary

This article details what N2W configuration settings are required and AWS settings to allow File Level Configuration (FLR) and what to check when issues arise.

Description

CPM Configuration

File-level recovery requires N2WS to recover volumes in the background and attach them to a temporary EC2 ‘worker’ launched for the operation,

The worker will be launched in the same account and region as the snapshots being explored, using a pre-defined worker configuration. the N2WS server use this configuration to know which VPC/subnet/SG to use for the temporary worker need to make sure that you have a worker configured for the account/region where you 

are using FLR:

AWS Configuration 

File Level Restore Worker needs to be able to connect to the N2WS Server over ports 22(SSH) and 443(HTTPS).

1. You need to make sure that these ports are opened outbound in the AWS security group of the workers.
2. You also need to make sure that these ports are opened inbound for the N2WS server
3. If the worker does not have public IP, you need to make sure it has a way to reach the N2WS server (for example VPC peering)

CPM Configuration

File-level recovery requires N2WS to recover volumes in the background and attach them to a temporary EC2 ‘worker’ launched for the operation,

The worker will be launched in the same account and region as the snapshots being explored, using a pre-defined worker configuration. the N2WS server use this configuration to know which VPC/subnet/SG to use for the temporary worker

You need to make sure that you have a worker configured for the account/region where you are using FLR

Troubleshooting
 

1. Communication 
 

The most common issue is communication, You can test connectivity using UI or manually using SSH
 

To test from the UI you can read this KB:

https://n2ws.zendesk.com/hc/en-us/articles/28814872001949-How-to-test-a-worker-configuration-from-the-N2W-console
 

You can test connectivity from the Worker by connecting to it over SSH (using "ubuntu" username) and running these commands:

For port 22:
ssh cpm_server_ip_address

 

The result should be "cpmuser@cpmserveripaddress: Permission denied (publickey)."
 

If connection is blocked, you will receive (after a delay) "ssh: connect to host cpmserveripaddress port 22: Connection timed out"
 

For port 443:

wget --no-check-certificate https://cpmserveripaddress/

 

This command should result in status 302 (redirecting to "/signin/") followed by status 200

 

2. FLR and ELB

ELB can cause issue with the FLR due to timeout: https://n2ws.zendesk.com/hc/en-us/articles/28909217458077--AWS-File-Level-Recovery-may-fail-if-Elastic-Load-Balancing-ELB-is-in-use