Document toolboxDocument toolbox

ServiceMobility Firewall Requirements

Owned by Andrew Hill (Deactivated)
Oct 31, 2017

Introduction

This document outlines the ServiceMobility firewall requirements for each of the server components installed.

Notes:

  • It is assumed that the servers are in the network zones outlines in the ServiceMobility Architecture document
  • All of the port numbers are configurable

Disclaimer of Warranty

Unable to render {include} The included page could not be found.

Node.js Web Server

All data exchanges with ServiceMobility route through the Node.js server. The Node.js server will either handle the request directly or forward the request to the ESB.

Node.js should be installed in the DMZ network segment.

Public Ports

Port NumberDescriptionAccessing Servers
443

HTTPS Protocol

  • ServiceMobility Mobile HTML5 Application (Internet)
    • Application deployment
    • Uploading of diagnostic information
    • Online Product Catalog Lookup (if configured)
    • Credit Card Authorization
    • Asset Diagram Schematic Downloads
  • ServiceMobility Web Management Console (Internet/LAN)
  • Nexus Management Console
  • REST APIs

 

RedHat JBoss A-MQ Server

The A-MQ server should be installed in the DMZ network segment.

Public Ports

The following ports must be opened to the internet to allow mobile devices to connect to the system. 

An alternative option from opening the port to the internet would be to implement a VPN. Implementing a VPN is out of the scope of this document.

Port NumberDescriptionAccessing Servers
61614

Secure WebSockets

  • ServiceMobility Mobile HTML5 Application (Internet)

Internal Ports

This port is used internally to allow the A-MQ and ESB servers to communicate with each other. This port should not be opened to the internet.

Port NumberDescriptionAccessing Servers
61616

Native A-MQ protocol over SSL connection

  • ESB (LAN)


RedHat JBoss FUSE ESB

The ESB Server should be installed in the LAN network segment.

Internal Ports

Port NumberDescriptionAccessing Servers

8081

8082

Exposes HTTP REST API services to Node.js.

(warning) These ports must only be accessible from Node.js

  • Node.js (DMZ)
9191

SOAP protocol used to communicate with ServiceScheduling.

(info) This port is only required if ServiceMobility is integrated with ServiceScheduling

  • ServiceScheduling (LAN)

 

ServiceScheduling Server

The ServiceScheduling Server should be installed in the LAN network segment.

Internal Ports

Port NumberDescriptionAccessing Servers
6502

SOAP

  • ServiceScheduling APIs
  • ESB (LAN)


Microsoft SQL Server

The Microsoft SQL Server should be installed in the LAN network segment.

Internal Ports

PortsDescriptionAccessing Servers
1433SQL Server Internal Protocol
  • ESB (LAN)
  • A-MQ (DMZ)
  • NodeJS (DMZ)


Cassandra Server

Cassandra is still in active development and is currently not required for production. However, Cassandra will be introduced in an future release so plans should be made to support it.

The Cassandra Server should be installed in the LAN network segment. 

Public Ports

The public ports are typically accessed from the LAN network only including VPN access. 

Port NumberDescriptionAccessing Servers
22SSH port 
8888

OpsCenter website

  • The opscenterd daemon listens on this port for HTTP requests coming directly from the browser.
  • Standard web browser access to OpsCenter website


Cassandra Inter-node Ports

 The inter-node ports are required in order for Cassandra clustering.

Port NumberDescriptionAccessing Server
7000Cassandra inter-node cluster communication
  • Cassandra Cluster
7001Cassandra SSL inter-node cluster communication
  • Cassandra Cluster
7199Cassandra JMX monitoring port
  • IT Monitoring

Cassandra Client Ports

The client ports must be opened in order to allow the other components to access Cassandra.

Port NumberDescriptionAccessing Servers
9042Cassandra client port
  • NodeJS (DMZ)
9160Cassandra client port (Thrift)
  • ESB (LAN)

Cassandra OpsCenter Ports

Port NumberDescriptionAccessing Servers
61620

OpsCenter monitoring port

  • The opscenterd daemon listens on this port for TCP traffic coming from the agent.
  • Cassandra Cluster (LAN)
61621

OpsCenter agent port

  • The agents listen on this port for SSL traffic initiated by OpsCenter.
  • Cassandra Cluster (LAN)

 

ElasticSearch Server

Internal Ports

Port NumberDescriptionAccessing Servers
9300

Native ElasticSearch Protocol

  • Used by Java Client
  • Used by ElasticSearch Cluster
  • A-MQ (DMZ)
  • ESB (LAN)
9200

ElasticSearch REST API

 

  • NodeJS (DMZ)
  • A-MQ (DMZ)
  • ESB (LAN)

Unable to render {include} The included page could not be found.