Ports
The following network ports must be open to ensure proper communication of components in the Veeam Backup for Microsoft Azure architecture.
From | To | Protocol | Port | Description |
---|---|---|---|---|
Workstation web browser | Backup appliance | TCP | 443 | Required to access the Web UI component from a user workstation. |
Required to communicate with the REST API service running on the backup appliance. | ||||
Worker instance | TCP | 443 | Required to access the Veeam File Level Recovery browser running on a worker instance during the file-level recovery process. | |
Backup appliance | Veeam Update Notification Server (repository.veeam.com) | TCP | 443 | Required to download information on available product updates. |
Ubuntu Security Update repository (security.ubuntu.com) | HTTP | 80 | Required to get OS security updates. | |
Ubuntu NTP Server (ntp.ubuntu.com) | UDP | 123 | Required to run a time sync service for Linux VMs. Note: This connection is required only if you updated Veeam Backup for Microsoft Azure from the Web UI. | |
Ubuntu Archive repository (azure.archive.ubuntu.com) | HTTP | 80 | Required to get APT updates when updating the backup appliance manually using the terminal. | |
APT repository of PostgreSQL packages (apt.postgresql.org) | HTTP | 80 | ||
DotNetCore Update Repository (packages.microsoft.com) | TCP | 443 | Required to get .NET updates. | |
SMTP server | TCP | 25 | Required to send email notifications. Note: The TCP 25 port is the port that is most commonly used by SMTP servers. | |
Azure AD | TCP | 443 | Required to add service and repository accounts. Note: If you use Azure Government, add a DNS name or an IP address of Microsoft Graph API (graph.microsoft.net) to the security rule. Otherwise, Veeam Backup for Microsoft Azure will not be able to add service and repository accounts. | |
Azure Resource Manager | TCP | 443 | ||
Azure Storage | TCP | 443 | Required to communicate with Azure storage accounts.
| |
ServiceBus service | TCP | 443 | Required to communicate with user workstations. | |
Azure Key Vault | TCP | 443 | Required to encrypt backup repositories using cryptographic keys. | |
Azure Virtual Network | HTTPS | 443 | Required to verify MD5 keys of Volume Shadow Copy Service binary files. Note: This connection is required to back up Azure resources that operate in private environment only. | |
Azure VMs | Backup appliance | TCP | 443 | Required to communicate with Windows-based Azure VMs with enabled guest processing option. For more information, see Performing Backup. |
ServiceBus service | TCP | 443 | ||
Azure Storage | TCP | 443 | ||
Worker instances | Ubuntu Security Update repository (security.ubuntu.com) | HTTP | 80 | Required to get OS security updates. |
Ubuntu Archive repository (azure.archive.ubuntu.com) | HTTP | 80 | Required to get APT updates. | |
ServiceBus service | TCP | 443 | Required to communicate with Windows-based Azure VMs with enabled guest processing option. For more information, see Performing Backup. | |
SQL Servers | TCP | 1433, 11000-11999 | Required to connect to SQL Servers. Note: The usage of the specified TCP ports depends on the networking settings of SQL Servers. If the Redirect option is selected, port 1433 is used to establish only the first connection. If the Proxy option is selected, port 1433 is used to establish all connections by default. For more information on networking settings of SQL Servers, see Microsoft Docs. | |
Azure SQL Managed Instances | TCP | 3342 | Required to connect to Azure SQL Managed Instances using public endpoints. | |
TCP | 1433, 11000-11999 | Required to connect to Azure SQL Managed Instances using private endpoints. Note: The usage of the specified TCP ports depends on the networking settings of SQL Servers. If the Redirect option is selected, port 1433 is used to establish only the first connection. If the Proxy option is selected, port 1433 is used to establish all connections by default. For more information on networking settings of SQL Servers, see Microsoft Docs. | ||
Azure Storage | TCP | 443 | Required to download worker binary files from Veeam storage accounts. | |
ServiceBus service | Worker instances | TCP | 443 | Required to perform image-level backup and restore operations. |
Backup appliance | TCP | 443 | Required to communicate with Windows-based Azure VMs with enabled guest processing option. For more information, see Performing Backup. |