Firewall ports discussion

[Marius Nitu]

Hello,

We have a requirement from a client to limit as much as possible the number of ports required to monitor with robots a number of servers situated on a restricted network and I'm trying to make a list of the ports.

I know the documentation page, but some parts are confusing. So I made the list bellow. Please let me know if this is correct or I am missing something.

• On the robots:
  • Every probe port for probe configuration and communication, including 48000 for controller and 48001 for spooler
• On the hub:
  • The spooler port, 48001, and the hub port, 48002, for robot to hub communication
  • The controller port, 48000, to receive status updates from robots?
  • If using MCS then the configuration_reader_service port
  • The distsrv port?

I am not able to install a hub in the restricted network and build a tunnel, but if it was an option would it be enough to open port 48003 on both the primary hub and remote hub?

Also, there is a part in the documentation that is confusing. Can you explain?

A port must be set in the controller configuration for Infrastructure Manager (IM) and Admin Console to connect to remote tunnels through the tunnel server and client IPs: for example, 192.168.1.10:50003.
For tunnel hubs, set the First Probe port number in Setup > Advanced for the controller to 50000 or higher. If necessary, open the same port and higher in the firewall.

Thank you!

Marius

[Lawrence Atlas]

Hi Marius,

 You can use the robot proxy setting which sets all probes to use the same port as the controller. 

setting proxy mode on a robot

Thanks
Lawrence

[Marius Nitu]

Hello,

Thank you, this is great! Just what I needed!

Can the setting be used on hubs or is it only for the robots?

Marius

[Jason Allen]

Proxy Mode is for robots only.

In order to keep hub port usage to a minimum, I would strongly recommend the use of tunnels between the hubs.

In a non-tunnel environment there is a presumption of cross-communication, in other words if 'Hub A' and 'Hub B' are connected via a Name Services/Static Hub entry without a hub tunnel, it is presumed that Hub A can freely communicate with all of Hub B's robots directly, and vice versa.

If the communication for a particular robot (or set of robots) needs to be "funneled" through that robot's  hub, then you should set up a tunnel to that hub from the primary, that will force all the communication to be done at the local hub<>robot level and "proxied" across the tunnel, so the hub will serve as a sort of routing point.

[Stephen Danseglio]

Hi Marius,

If you/the customer doesn't choose to use proxy mode, check out my KB article and search on 'port' for tips on ports and protocols, and let me know if you still have any questions/concerns.

Troubleshooting UIM Robot-Hub connectivity or communication issues and errors

Best Regards,
Steve

------------------------------
Steve Danseglio
Senior Principal Support Engineer (Technical Support Engineer 5)
Broadcom Software-IMS Division
UIM Certified Expert
KCSv6 Practices Certified
Certified Customer Success Manager (CCSM) Level 1
------------------------------

[Stephen Danseglio]

Some other helpful basics/tips on tunnels and ports:

 

• The tunnel server listens on port 48003, so clients must be able to connect outbound to this port.
• In a NAT environment, the 48003 port must be forwarded to the same port internally on the tunnel server.
• netstat command should show the hub process LISTENING on port 48003 on the tunnel server.
• You can run a telnet command from client to server:port 48003 to ensure the port is open on the server

Examples of log messages indicating a comm failure - these are usually related to a firewall blocking the tunnel server on port 48003:

hub: TSESS-A-0 could not connect to tunnel 10.252.156.254:48003 (-2)

hub: CTRL Tunnel-Server-Hub could not connect to server 10.252.156.254/48003

Best Regards,
Steve

------------------------------
Steve Danseglio
Senior Principal Support Engineer (Technical Support Engineer 5)
Broadcom Software-IMS Division
UIM Certified Expert
KCSv6 Practices Certified
Certified Customer Success Manager (CCSM) Level 1
------------------------------