Network connectivity
3 minute read
The preconfigured application uses the following ports and services on a single appliance. Ensure that connectivity requirements are in place for internal network communication with the CMP appliance.
The appliance makes outbound network connections as required by your configured resource handlers and any other integrations. These are specific to each resource handler and are not detailed in the tables below.
Ports
Inbound
| TCP port | Protocol | Usage |
|---|---|---|
| 22 | SSH | Appliance management. Not required for end users |
| 80 | HTTP | HTTP to HTTPS redirect, optional HTTP access |
| 443 | HTTPS | Web UI and APIs. Also carries the RDP/SSH terminal and console sessions, which are proxied through the web server as WebSocket connections |
| 5900-6900 | VNC | Port range the appliance uses to give browsers access to VM consoles. Required only for consoles that are not proxied over HTTPS. Configurable through the LOW_CONSOLE_PORT and HIGH_CONSOLE_PORT settings |
The Guacamole services that support the RDP/SSH terminal, guacd and guacg, listen on the loopback interface only and sit behind the web server. They do not need firewall rules. If you relocate guacd to a secondary server, allow traffic between the nodes on the port you configure for it.
Outbound
| TCP port | Protocol | Usage |
|---|---|---|
| 22 | SSH | Remote command execution on managed Linux servers |
| 389 | LDAP | Insecure Active Directory or LDAP |
| 443 | HTTPS | CMP communicates with resource handlers (VMware and others such as OLVM, Acropolis, AWS, and Azure) using the standard HTTPS connection on port 443. Configure network rules to allow traffic on port 443 between the CMP server and all HTTPS endpoints, including vCenters and ESX hosts |
| 636 | LDAPS | Secure Active Directory or LDAP |
| 3389 | RDP | Remote Desktop Protocol to managed Windows servers |
| 5985 | HTTP | Insecure WinRM, Windows Remote Management |
| 5986 | HTTPS | Secure WinRM, Windows Remote Management |
High availability
For high-availability deployments (multiple servers and a remote database), add the following ports to the outbound rules. The remote servers also require inbound rules to allow communication from the CMP appliances.
| TCP port | Protocol | Usage |
|---|---|---|
| 111 | NFS | Remote Procedure Call services on Linux |
| 2049 | NFS | Remote Procedure Call (RPC) protocol for remote command execution, used by Network File System (NFS) |
| 5432 | PostgreSQL | Shared PostgreSQL database. Required from every web server and job engine node |
Depending on the resource handlers you connect to, additional ports may be required.
Application services
CMP services are managed by systemd and supervisord. You can use systemctl and supervisorctl to manage them respectively.
For example, to restart the web server, you can use: systemctl restart httpd.
The key application services running on the VM are:
httpdpostgresql-14(postgresql-18on PostgreSQL 18)sshdjobengineundersupervisordmemcachedguacd
Related
- Appliance security: Using network controls to limit what can reach the appliance.
- Hardware guidelines: Sizing for each deployment shape.
- Use SSL with an external PostgreSQL database: Encrypt the connection that runs over port 5432.