Connectivity requirements

Existing Geneos components

Hostnames

Each server in the cluster must have a unique hostname, resolvable forward and backward with every other node with both normal and reverse DNS name lookup.

Logon method

You must decide to use either passwordless SSH, or an interactive logon, as the method to log in to any server that will form part of the Gateway Hub cluster.

Server to server access

Each Gateway Hub server must have access to the listed ports of all other Gateway Hub nodes in the cluster. You should configure your firewall to allow these connections.

Ports

All ports used are TCP ports unless otherwise specified. The table below shows the configuration for he default ports on each Gateway Hub node.

Service	Port (TCP)	Source IP	Destination IP	Purpose
DNS	53 (UDP)	Any Gateway Hub node	DNS server	Domain Name Service
Gateway Hub message bus (Kafka listener)	9092	Any external Gateway and any Gateway Hub Node	Any Gateway Hub node	Receives Gateway data
Gateway Hub REST API	8081	Any external client	Any Gateway Hub node	Gateway Hub REST API
Gateway Hub Web Console	8443	Any external client	Any Gateway Hub node	Gateway Hub Web Console
NTP (optional)	123 (UDP)	Any Gateway Hub node	NTP server	Network Time Protocol
SSH	22	Any external client	Any Gateway Hub node	Secure Shell, for Ansible install and troubleshooting
SSO Agent	8080	Any external client	Any Gateway Hub node	Gateway Hub SSO Agent
Zookeeper	5181	Any Gateway Hub node	Any Gateway Hub node	Zookeeper API calls
Zookeeper follow-the-leader	5188	Any Gateway Hub node	Any Gateway Hub node	Zookeeper server-to-server communication
Zookeeper leader election	5189	Any Gateway Hub node	Any Gateway Hub node	Zookeeper server-to-server communication
etcd cluster	2380	Any Gateway Hub node	Any Gateway Hub node	etcd member communication
Capacity Planner	9090	Any Gateway Hub node	Capacity Planner	Publishing to Capacity Planner
JMX	10974	Any Gateway Hub node	Any Gateway Hub node	JMX

Firewall access

You may need to update your firewall policies to open ports required by Gateway Hub. You should always consult with your local security policy and team before making firewall changes.

If you are installing on a CentOS 7.x or RHEL 7.x system you can use the firewall-cmd command to check and modify your firewall policy. For a full list of supported operating systems, see Operating Systems in Software requirements.

The following procedures are provided as an example, you will need to modify these steps to suit your local network configuration and security policies.

1. Check which ports are currently open:

   firewall-cmd --list-ports 

2. Open each of the ports that are required:

   sudo firewall-cmd --permanent --add-port={22/tcp,8080-8081/tcp,8443/tcp,9092/tcp,5181/tcp,5188-5189/tcp,2380/tcp,10974/tcp}

3. Restart the firewall:

   sudo firewall-cmd --reload

4. Check that the required ports are now open:

   firewall-cmd --list-ports 

Note: In the above example all listed ports are opened to external in addition to internal access.

PEM file requirements

In Gateway Hub versions 2.2.x, 2.4.x, and newer your PEM file must contain a full trust chain with content in the following order:

• Private key for server certificate. This key must be in PKCS#1 (not PKCS#8) format.

• Server certificate.

• Any intermediate CA certificates (zero or more).

• Root CA certificate.

Additionally, The server certificate must be suitable for all Gateway Hub nodes in your cluster. The commonName or subjectAltName fields need to contain either a suitable wildcard or a list of fully qualified DNS names.

A suitable PEM file should look similar to the following:

-----BEGIN RSA PRIVATE KEY-----
... private key for server certificate ...
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
... server certificate ...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... intermediate ca certificates (zero or more) ...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... root ca certificate ...
-----END CERTIFICATE-----