Installing a managed Backup Exec server across a firewall

Last published : Apr 02, 2026
A managed Backup Exec server may be installed outside the firewall that the central administration server is installed in or in a different firewall.
The following rules apply to the managed Backup Exec servers that are installed across a firewall:
  • Port 3527 must be open in both directions to enable communication for the Backup Exec Server service.
  • Port 10000 must be open for the Agent for Windows, which allows browsing for remote selections.
  • A SQL port must be open in both directions to the central administration server's database to enable database connections.
  • A static port must be used.
The Backup Exec SQL instance is configured by default to use a dynamic port. Each time SQL Server is started, the port number can change. You must change the dynamic port to a static port. After you change the configuration of the port from dynamic to static, you must add the static port to the Windows Firewall Exceptions list.
See your Windows operating system documentation.
See “To change the dynamic port for a SQL Express instance to a static port and create an alias for the managed Backup Exec server”.
See “To open a SQL port for a SQL 2008 instance and create an alias for a managed Backup Exec server”.
To change the dynamic port for a SQL Express instance to a static port and create an alias for the managed Backup Exec server
  1. On the central administration server, click Start > All Programs > Microsoft SQL Server 2014 > Configuration Tools > SQL Server Configuration Manager.
  2. Expand SQL Server Network Configuration.
  3. Click Protocols for BKUPEXEC, and then in the right pane, double-clickTPC/IP.
  4. On the TCP/IP Properties dialog box, click the IP Addresses tab.
  5. Under IPAll, in TCP Dynamic Ports, remove the value and leave the field blank.
  6. Under IPAll, type in a port number in TCP Port.
The port number can be between 1025 and 65535 and must not be in use by another application.
  1. Under the heading for the specific network interface card that is being used, such as IP1 or IP2, change Enabled from NotoYes.
  2. Under that same heading, in TCP Dynamic Ports, remove the value of 0, and type the same port number you entered for TCP Port.
  3. Click Apply.
  4. Restart the Backup Exec and SQL services.
  5. On the managed Backup Exec server, click Start > All Programs > Microsoft SQL Server 2014 > Configuration Tools > SQL Server Configuration Manager.
  6. Expand SQL Native Client Configuration.
  7. Click Aliases , and then double-click the alias name that contains the central administration server name and the Backup Exec SQL instance name.
  8. On the alias properties dialog box, enter the appropriate information as described in the following table:
    Alias Name Type the name of the central administration server and the Backup Exec SQL instance name using the format server name\instance name.
    Port No Type the port number of the remote Backup Exec SQL Server instance that you noted in the previous procedure.
    Protocol Select TCP/IP .
    Server Type the name of the central administration server and the Backup Exec SQL instance name using the format server name\instance name.
  9. Click Apply, and then clickOK.
  10. Close the SQL Server Configuration Manager utility.
To open a SQL port for a SQL 2008 instance and create an alias for a managed Backup Exec server
  1. On the central administration server, click Start > All Programs > Microsoft SQL Server 2014 > Configuration Tools > SQL Server Configuration Manager.1. Expand SQL Server Network Configuration, and then clickProtocols for the SQL Server instance that is in use for the central administration server.
  2. Under Enabled Protocols, select TCP/IP, and then clickProperties.
  3. Double-click TCP/IP , and then click the IP Addresses tab.
  4. Write down the TCP Dynamic port number.
  5. On the managed Backup Exec server, to create an alias for the managed Backup Exec server, go to \Windows\System32 and double-click cliconfg.exe.
  6. On the Alias tab, click Add.
  7. In the Server alias field, type:server name\instance name
  8. Under Network libraries, select TCP/IP.
  9. In the Server name field, type:server name\instance name
  10. Uncheck Dynamically determine port.
  11. In the Port number field, type the port number of the remote Backup Exec SQL Server instance.