Backup Failing for Checkpoint Firewall Appliances in Azure?

Question

I created a backup for my Checkpoint Firewall appliances and they both failed after running. This is a linux image. The only info I can find is that the Source scan integration states - Not configured. I am not sure why it states this?

Answer 1

Hello Hardcastle, Phil,

Thank you for reaching out to the Microsoft Q&A forum. 

When investigated it looks like your Linux-based Checkpoint appliances are failing to back up because the Azure Backup extension hasn’t been properly configured or can’t scan the VM’s file system (“Source scan integration: Not configured”). Here’s what you can try:

1. Run the built-in disk backup diagnostic
   • In your Recovery Services vault, go to Backup Jobs → select your failed job → click Run Troubleshoot.
   • This runs the AzureBackupV2BackupFailingScenarioHelper checks and will surface any misconfigurations or errors.
   • Docs: https://docs.microsoft.com/azure/backup/disk-backup-troubleshoot#failure-diagnostics
2. Verify the VM Agent and Backup extension
   • SSH into the firewall VM and ensure the Azure Linux Agent (waagent) is up-to-date and running.
   • In the Azure portal under VM → Extensions, you should see Microsoft.Azure.RecoveryServices.VMSnapshotLinux installed.
   • If it’s missing or stuck, uninstall/re-install it and then re-run the backup.
   • Docs: https://docs.microsoft.com/azure/backup/backup-azure-vms-troubleshoot#common-issues
3. Check SELinux or other security policies
   • If you’re using Security-Enhanced Linux, exclude the agent path (/var/lib/waagent) so Azure can freeze the file system for the snapshot.
   • Docs: same as above (under “VMRestorePointInternalError” for Linux)
4. Confirm your VM’s state
   • The VM must be Running, Stopped, or Stopped (deallocated). Any other state (updating, starting, etc.) will block backups.
5. Validate permissions and roles
   • Ensure the Recovery Services vault has the right role assignments on the resource group or VM (Contributor or Backup Operator) so it can take snapshots.
   • Docs: https://docs.microsoft.com/azure/backup/disk-backup-faq#what-are-the-permissions-used-by-azure-backup-during-backup-and-restore-operation

If you still see “Not configured” or the backups continue to fail, please share:

• The exact error code or message from the vault job.
• Output of Get-AzRecoveryServicesBackupJob or screenshots of the failed job details
• Any logs under -> var -> log -> azure -> plugin for the VMSnapshot extension

With those details we can dig deeper. Hope this helps!

Reference list

• Troubleshoot common errors in Azure Disk Backup: https://docs.microsoft.com/azure/backup/disk-backup-troubleshoot
• Backup failure diagnostics: https://docs.microsoft.com/azure/backup/disk-backup-troubleshoot#failure-diagnostics
• Troubleshooting backup failures on Azure VMs: https://docs.microsoft.com/azure/backup/backup-azure-vms-troubleshoot
• Supported configurations for Azure Disk Backup: https://docs.microsoft.com/azure/backup/disk-backup-support-matrix
• Permissions for Azure Backup: https://docs.microsoft.com/azure/backup/disk-backup-faq#what-are-the-permissions-used-by-azure-backup-during-backup-and-restore-operation

Answer 2

Backup failures for Linux-based Azure VMs (such as Check Point firewall appliances) are typically related to the VM agent, backup extension, or the VM state rather than the “Source scan integration – Not configured” message. That message is not part of Azure Backup itself and is not listed as a cause of backup failure in the provided material.

From the available information, the following checks and fixes are supported for Linux VMs failing backup:

1. Verify the VM is in a valid state for backup
   • The VM must be in Running, Stopped, or Stopped (deallocated) state. If it is in Failed or a transient state, backups can fail.
   • If the VM is in Failed state, correct the VM/extension issues first, then retry backup.
2. Check backup job error details in the Recovery Services vault
   • In the Recovery Services vault, go to Monitoring → Backup jobs.
   • Filter for Failures, select the failed job, and review the underlying error code and message.
   • For errors like UserErrorCrpReportedUserError, follow the recommendations shown in the job error details page.
3. Validate the Azure VM Agent on the Linux appliance
   • Ensure the Linux VM agent is up to date using the distribution repository only. Follow the guidance for updating the Linux VM agent.
   • Confirm the agent is running:
     • Run ps -e and verify the waagent/walinuxagent process is present.
     • If not running, restart it using sudo systemctl restart walinuxagent (Ubuntu/Debian) or sudo systemctl restart waagent (other distros).
   • Optionally configure auto-restart for the agent as per the documented guidance.
4. Confirm VM-Agent configuration options for Linux
   • In /etc/waagent.conf, ensure:
     • Extensions.Enable=y
     • Provisioning.Agent=auto
   • These settings are required for the backup extension to function.
5. Basic Azure Backup troubleshooting for the VM
   • Ensure the VM OS and image are supported for IaaS VM backup (check the IaaS VM Backup Support Matrix).
   • Verify that no other backup product is interfering with snapshots.
   • Make sure the VM has internet connectivity so the backup extension can communicate with Azure.
   • If there are snapshot/extension issues, uninstall and let Azure reload the backup extension, then retry the backup.
6. Check for extension or provisioning failures
   • In the VM blade: Settings → Extensions and verify all extensions show Provisioning succeeded.
   • If any extension is failed, fix or remove/redeploy it, as failed extensions can block backup.
   • If the VM provisioning state is Failed or Updating, resolve that before retrying backup.
7. Network-related snapshot issues
   • If the error code is ExtensionSnapshotFailedNoNetwork, it indicates snapshot failure due to no network connectivity on the VM. Restore network connectivity and retry.
8. If backups still fail
   • Run a new test backup after the above checks.
   • If failure persists, collect logs from the Linux VM for deeper analysis:
     • /var/lib/waagent/*.xml
     • /var/log/waagent.log
     • /var/log/azure/*
   • Enable verbose logging in /etc/waagent.conf by setting Logs.Verbose=y and restarting the agent if more detail is needed.

The “Source scan integration – Not configured” message is not referenced as a backup failure cause in the provided material. The immediate next step is to look at the exact Azure Backup job error code in the Recovery Services vault and then apply the corresponding troubleshooting steps above (agent health, extension state, VM state, and network connectivity).

---

References:

• Troubleshooting backup failures on Azure virtual machines
• Troubleshoot Azure Backup failures caused by agent or extension issues