Your surmise is correct, there is a connection made purely for the
metadata and further connections made for the backup data itself. Normally
there is no traffic on the meta data link except at the beginning and end
of a filesystem/partion backup.
There are 2 ways I know of to get round this :-
1) which we use, set the tcp_keepalive_interval to less than the firewall
timeout - this will send a packet if there has been no traffic for this
interval (to check the connection is still there). This packet is
interpreted by the firewall as being traffic and resets its timeout timer.
2) make the backup verbose - the additional verbose traffic goes along the
meta data connection and again keeps the connection made. However I have
seen incremental backups through a firewall where nothing is backed up for
60 minutes or more in which case there would no verbose trafic and the
firewall will timeout.

both have been described before on the list so search there for details if
you need them.

--
Note: To sign off this list, send a "signoff networker" command via email
to listserv AT listserv.temple DOT edu or visit the list's Web site at
http://listserv.temple.edu/archives/networker.html where you can
also view and post messages to the list. Questions regarding this list
should be sent to stan AT temple DOT edu
=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=