{"id":727,"date":"2022-03-15T19:53:30","date_gmt":"2022-03-15T19:53:30","guid":{"rendered":"https:\/\/robinplomp.com\/?p=727"},"modified":"2022-03-15T20:10:31","modified_gmt":"2022-03-15T20:10:31","slug":"nsx-t-required-network-ports","status":"publish","type":"post","link":"https:\/\/robinplomp.com\/?p=727","title":{"rendered":"NSX-T Data Center required network ports"},"content":{"rendered":"

\"nsxt\"In this blog post I will sum up all the network ports that are required to operate various capabilities that are within NSX-T Data Center. This blog is about current version of NSX-T Data Center, the current version is 3.2.0.0.1. Please acknowledge that not all features are available under each NSX-T Data Center Edition.
\nPlease verify which features are licensed for your deployment so you can check which features you can deploy under your license.<\/p>\n

<\/p>\n

List of NSX-T Data Center editions, and which features are included for these editions<\/a><\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Port<\/strong><\/td>\nProtocol<\/strong><\/td>\nSource<\/strong><\/td>\nDestination<\/strong><\/td>\nService Description<\/strong><\/td>\nPurpose<\/strong><\/td>\n<\/tr>\n
443<\/td>\nTCP<\/td>\nNSX Application Platform (NAPP)<\/td>\nNSX ATP Cloud Services<\/td>\nUsed by NAPP to cloud service deployed in the cloud for NSX NDR and NSX Malware Prevention<\/td>\nInvocation of NDR and Malware Prevention cloud service over https<\/td>\n<\/tr>\n
9092<\/td>\nTCP<\/td>\nNSX Unified Appliance \/ Transport Nodes<\/td>\nNSX Application Platform (NAPP)<\/td>\nIncoming messages from NSX Unified Appliance or Transport Nodes to NSX Intelligence Appliance<\/td>\nKafka broker for collecting data from NSX and hosts<\/td>\n<\/tr>\n
443<\/td>\nTCP<\/td>\nManagement Clients \/ NSX Unified Appliance<\/td>\nNSX Application Platform (NAPP)<\/td>\nNSX API Server<\/td>\nEntry point for APIs in NSX Intelligence<\/td>\n<\/tr>\n
22<\/td>\nTCP<\/td>\nManagement Clients<\/td>\nNSX Application Platform (NAPP)<\/td>\nSSH<\/td>\nHDFS and root login to appliance<\/td>\n<\/tr>\n
123<\/td>\nUDP<\/td>\nNTP Servers<\/td>\nNSX Application Platform (NAPP)<\/td>\nNTP<\/td>\nNTP Server connection<\/td>\n<\/tr>\n
10250<\/td>\nTCP<\/td>\nNSX Application Platform (NAPP)<\/td>\nKubelet API Server<\/td>\nInvocation of Kubelet API from NSX Unified Appliance<\/td>\nKubelet API<\/td>\n<\/tr>\n
443<\/td>\nTCP<\/td>\nNSX Application Platform (NAPP)<\/td>\nNSX Threat Intelligence Cloud Service (NTICS)<\/td>\nUsed by NSX Unified Appliance to NTICS service deployed in the cloud<\/td>\nInvocation of NTICS cloud service over https<\/td>\n<\/tr>\n
443<\/td>\nTCP<\/td>\nNSX Unified Appliance<\/td>\nNSX Threat Intelligence Cloud Service (NTICS)<\/td>\nUsed by NSX Unified Appliance to NTICS service deployed in the cloud<\/td>\nInvocation of NTICS cloud service over https<\/td>\n<\/tr>\n
10259<\/td>\nTCP<\/td>\nNSX Application Platform (NAPP)<\/td>\nKubernetes Cluster Server<\/td>\nUsed by Kubernetes server to self<\/td>\nkube-scheduler<\/td>\n<\/tr>\n
2379, 2380<\/td>\nTCP<\/td>\nNSX Application Platform (NAPP)<\/td>\nEtcd Kubernetes API Server<\/td>\nAPI invocation from NSX Intelligence to Etcd server<\/td>\nEtcd Kubernetes server<\/td>\n<\/tr>\n
10250<\/td>\nTCP<\/td>\nNSX Application Platform (NAPP)<\/td>\nkube-api-server<\/td>\nAPI invocation from NSX Intelligence to kube-api-server<\/td>\nInvocation of kube-api-server API<\/td>\n<\/tr>\n
10250<\/td>\nTCP<\/td>\nNSX Application Platform (NAPP)<\/td>\nkube-api<\/td>\nAPI invocation from NSX Intelligence to kupe-api<\/td>\nInnocation of kube API<\/td>\n<\/tr>\n
6443<\/td>\nTCP<\/td>\nNSX Application Platform (NAPP)<\/td>\nKubernetes API Server<\/td>\nAPI invocation from NSX Intelligence to Kubernette API server<\/td>\nInnocation of Kubernete API<\/td>\n<\/tr>\n
10257<\/td>\nTCP<\/td>\nNSX Unified Appliance<\/td>\nKubernetes Cluster Server<\/td>\nUsed by Kubernetes server to self<\/td>\nkube-controller-manager<\/td>\n<\/tr>\n
10259<\/td>\nTCP<\/td>\nNSX Unified Appliance<\/td>\nKubernetes Cluster Server<\/td>\nUsed by Kubernetes server to self<\/td>\nkube-scheduler<\/td>\n<\/tr>\n
2379, 2380<\/td>\nTCP<\/td>\nNSX Unified Appliance<\/td>\nEtcd Kubernetes API Server<\/td>\nAPI invocation from NSX Unified Appliance to Etcd Kubernetes server<\/td>\nEtcd Kubernetes server<\/td>\n<\/tr>\n
10250<\/td>\nTCP<\/td>\nNSX Unified Appliance<\/td>\nKubernetes\u00a0 API Server<\/td>\nAPI invocation from NSX Unified Appliance to Kubernette API server<\/td>\nInnocation of Kubernete API<\/td>\n<\/tr>\n
6443<\/td>\nTCP<\/td>\nNSX Unified Appliance<\/td>\nKubernetes API Server<\/td>\nAPI invocation from NSX Unified Appliance to Kubernette API server<\/td>\nInnocation of Kubernete API<\/td>\n<\/tr>\n
9092<\/td>\nTCP<\/td>\nNSX Application Platform (NAPP)<\/td>\nNSX Unified Appliance \/ NSX Transport Nodes<\/td>\nNSX Intelligence outgoing communication to NSX Unified Appliance or Transport Nodes<\/td>\nConnection to NSX Intelligence from hosts and NSX for kafka<\/td>\n<\/tr>\n
443<\/td>\nTCP<\/td>\nNSX Application Platform (NAPP)<\/td>\nvCenter Server \/ NSX Unified Appliance<\/td>\nNSX Intelligence to a compute manager (vCenter Server) communication and NSX Unified Appliance, when configured.<\/td>\nEntry point for NSX Intelligence to reach NSX Manager for certain API calls<\/td>\n<\/tr>\n
123<\/td>\nUDP<\/td>\nNSX Application Platform (NAPP)<\/td>\nNTP Servers<\/td>\nNTP<\/td>\nNTP Client connection<\/td>\n<\/tr>\n
22<\/td>\nTCP<\/td>\nNSX Application Platform (NAPP)<\/td>\nManagement SCP Servers<\/td>\nSSH (upload support bundle, backups, etc.)<\/td>\nSSH for backup<\/td>\n<\/tr>\n
53<\/td>\nUDP<\/td>\nNSX Application Platform (NAPP)<\/td>\nDNS Servers<\/td>\nDNS<\/td>\nDNS Client connection<\/td>\n<\/tr>\n
53<\/td>\nTCP<\/td>\nNSX Application Platform (NAPP)<\/td>\nDNS Servers<\/td>\nDNS<\/td>\nDNS Client connection<\/td>\n<\/tr>\n
443<\/td>\nTCP<\/td>\nNSX Unified Appliance<\/td>\nNSX Threat Intelligence Cloud Service (NTICS)<\/td>\nNSX Manager accesses NTICS over https<\/td>\nFor IDS Signature download<\/td>\n<\/tr>\n
80<\/td>\nTCP<\/td>\nCloud Service Manager (CSM)<\/td>\nPublic Cloud Gateway (PCG)<\/td>\nCSM configuration, such as upgrade workflow, over HTTPS.<\/td>\n<\/td>\n<\/tr>\n
443<\/td>\nTCP<\/td>\nCloud Service Manager (CSM)<\/td>\nNSX Manager<\/td>\nCSM to access NSX Manager.<\/td>\n<\/td>\n<\/tr>\n
443<\/td>\nTCP<\/td>\nNSX Manager<\/td>\nPublic Cloud Gateway (PCG)<\/td>\nNSX RPC channel(s)<\/td>\n<\/td>\n<\/tr>\n
7442<\/td>\nTCP<\/td>\nCloud Service Manager (CSM)<\/td>\nPublic Cloud Gateway (PCG)<\/td>\nCSM configuration, such as upgrade workflow, over HTTPS. Ensure your firewall allows SSL traffic over this non-standard port.<\/td>\n<\/td>\n<\/tr>\n
500,4500<\/td>\n50,51<\/td>\nNSX Edge Nodes<\/td>\nExternal IPSEC Peers<\/td>\nIPSEC VPN session<\/td>\n<\/td>\n<\/tr>\n
1236,443<\/td>\nTCP<\/td>\nNSX Local Manager(s)\/NSX Global Manager(s)<\/td>\nNSX Local Manager(s)\/NSX Global Manager(s)<\/td>\nFederation Management plane and control plane communication between locations (Async Replicator)<\/td>\n<\/td>\n<\/tr>\n
1167<\/td>\nTCP<\/td>\nNSX Edge nodes<\/td>\nNSX Edge nodes<\/td>\nDHCP Lease Info Sync for HA over secure channel on Edge Management port<\/td>\n<\/td>\n<\/tr>\n
9040<\/td>\nTCP<\/td>\nNSX Manager<\/td>\nNSX Manager<\/td>\nDistributed Datastore<\/td>\n<\/td>\n<\/tr>\n
4789<\/td>\nUDP<\/td>\nNSX Edge Nodes<\/td>\nExternal Routing Peers<\/td>\nVXLAN encap traffic<\/td>\n<\/td>\n<\/tr>\n
80<\/td>\nTCP<\/td>\nNSX Edge nodes<\/td>\nIntermediate and Root CA Servers<\/td>\nSyslog (export over TLS). To verify which TCP port must be used to retrieve the Certificate Revocation Lists (CRLs), verify against the CRL Distribution Point (CDP) URI of the certificate authority.<\/td>\n<\/td>\n<\/tr>\n
514<\/td>\nTCP<\/td>\nHost Transport Node<\/td>\nSyslog Servers<\/td>\nSyslog (Refer to the host syslog documenation)<\/td>\n<\/td>\n<\/tr>\n
514<\/td>\nUDP<\/td>\nHost Transport Node<\/td>\nSyslog Servers<\/td>\nSyslog (Refer to the host syslog documenation)<\/td>\n<\/td>\n<\/tr>\n
6514<\/td>\nTCP<\/td>\nHost Transport Node<\/td>\nSyslog Servers<\/td>\nSyslog (Refer to the host syslog documenation)<\/td>\n<\/td>\n<\/tr>\n
6514<\/td>\nUDP<\/td>\nHost Transport Node<\/td>\nSyslog Servers<\/td>\nSyslog (Refer to the host syslog documenation)<\/td>\n<\/td>\n<\/tr>\n
80<\/td>\nTCP<\/td>\nHost Transport Node<\/td>\nIntermediate and Root CA servers<\/td>\nSyslog (export over TLS). To verify which TCP port must be used to retrieve the Certificate Revocation Lists (CRLs), verify against the CRL Distribution Point (CDP) URI of the certificate authority.<\/td>\n<\/td>\n<\/tr>\n
5671, 1234, 1235, 443<\/td>\nTCP<\/td>\nNSX Managers, NSX Edge nodes, Transport nodes<\/td>\nNSX Manager<\/td>\nNSX messaging<\/td>\n<\/td>\n<\/tr>\n
8080<\/td>\nTCP<\/td>\nNSX Managers, NSX Edge nodes, Transport nodes, vCenter Server<\/td>\nNSX Manager<\/td>\nInstall-upgrade HTTP repository<\/td>\n<\/td>\n<\/tr>\n
389,636<\/td>\nTCP<\/td>\nNSX Manager<\/td>\nExternal LDAP server<\/td>\nActive Directory\/LDAP<\/td>\n<\/td>\n<\/tr>\n
6081<\/td>\nUDP<\/td>\nGENEVE Remote Tunnel End Point (RTEP)<\/td>\nGENEVE Remote Tunnel End Point (RTEP)<\/td>\nFederation Cross-location communication between Edge nodes in Federation<\/td>\n<\/td>\n<\/tr>\n
443<\/td>\nTCP<\/td>\nManagement Clients<\/td>\nNSX Autonomous Edge Nodes<\/td>\nHTTPS<\/td>\n<\/td>\n<\/tr>\n
3784, 3785, 4784<\/td>\nUDP<\/td>\nNSX Edge nodes, Transport nodes<\/td>\nNSX Edge nodes<\/td>\nBFD between the Transport node TEP IP address in the data.<\/td>\n<\/td>\n<\/tr>\n
3784, 3785, 4784<\/td>\nUDP<\/td>\nNSX Edge Nodes<\/td>\nExternal Routing Peers<\/td>\nBFD for static routes and BGP peers.<\/td>\n<\/td>\n<\/tr>\n
443<\/td>\nTCP<\/td>\nNSX Edge Nodes<\/td>\napi.nsx-sec-prod.com & *.amazonaws.com<\/td>\nEdge uses management network to download URL Categories\/Reputation from cloud for NSX URL Analysis<\/td>\n<\/td>\n<\/tr>\n
443<\/td>\nTCP<\/td>\nNSX Managers<\/td>\ngithub.com<\/td>\nDownload IDS Signature from Trustwave Signature Repository.<\/td>\n<\/td>\n<\/tr>\n
1235<\/td>\nTCP<\/td>\nNSX Edge nodes<\/td>\nNSX Manager<\/td>\nLower Control Plane (LCP) to Central Control Plane (CCP) communication<\/td>\n<\/td>\n<\/tr>\n
2480<\/td>\nTCP<\/td>\nNSX Edge nodes<\/td>\nNSX Edge nodes<\/td>\nNestdb<\/td>\n<\/td>\n<\/tr>\n
6666<\/td>\nTCP<\/td>\nNSX Edge nodes<\/td>\nNSX Edge nodes<\/td>\nNSX Cloud – NSX Edge local communication.<\/td>\n<\/td>\n<\/tr>\n
50263<\/td>\nUDP<\/td>\nNSX Edge nodes<\/td>\nNSX Edge nodes<\/td>\nHigh-Availability<\/td>\n<\/td>\n<\/tr>\n
443<\/td>\nTCP<\/td>\nNSX Edge nodes<\/td>\nNSX Manager<\/td>\nHTTPS<\/td>\n<\/td>\n<\/tr>\n
1234<\/td>\nTCP<\/td>\nNSX Edge nodes<\/td>\nNSX Manager<\/td>\nNSX Messaging channel to NSX Manager<\/td>\n<\/td>\n<\/tr>\n
8080<\/td>\nTCP<\/td>\nNSX Edge nodes<\/td>\nNSX Manager<\/td>\nNAPI, NSX-T Data Center upgrade<\/td>\n<\/td>\n<\/tr>\n
123<\/td>\nUDP<\/td>\nNSX Edge nodes<\/td>\nNTP Servers<\/td>\nNTP<\/td>\n<\/td>\n<\/tr>\n
3000 – 9000<\/td>\nTCP<\/td>\nNSX Edge nodes<\/td>\nOpenStack Nova API Server<\/td>\nMetadata proxy<\/td>\n<\/td>\n<\/tr>\n
161, 162<\/td>\nTCP<\/td>\nNSX Edge nodes<\/td>\nSNMP Servers<\/td>\nSNMP<\/td>\n<\/td>\n<\/tr>\n
161, 162<\/td>\nUDP<\/td>\nNSX Edge nodes<\/td>\nSNMP Servers<\/td>\nSNMP<\/td>\n<\/td>\n<\/tr>\n
514<\/td>\nTCP<\/td>\nNSX Edge nodes<\/td>\nSyslog Servers<\/td>\nSyslog<\/td>\n<\/td>\n<\/tr>\n
514<\/td>\nUDP<\/td>\nNSX Edge nodes<\/td>\nSyslog Servers<\/td>\nSyslog<\/td>\n<\/td>\n<\/tr>\n
6514<\/td>\nTCP<\/td>\nNSX Edge nodes<\/td>\nSyslog Servers<\/td>\nSyslog<\/td>\n<\/td>\n<\/tr>\n
6514<\/td>\nUDP<\/td>\nNSX Edge nodes<\/td>\nSyslog Servers<\/td>\nSyslog<\/td>\n<\/td>\n<\/tr>\n
33434 – 33523<\/td>\nUDP<\/td>\nNSX Edge nodes<\/td>\nTraceroute Destination<\/td>\nTraceroute<\/td>\n<\/td>\n<\/tr>\n
123<\/td>\nUDP<\/td>\nNTP Servers<\/td>\nNSX Edge nodes<\/td>\nNTP<\/td>\n<\/td>\n<\/tr>\n
161<\/td>\nUDP<\/td>\nSNMP Servers<\/td>\nNSX Edge nodes<\/td>\nSNMP<\/td>\n<\/td>\n<\/tr>\n
53<\/td>\nTCP<\/td>\nNSX Manager<\/td>\nDNS Servers<\/td>\nDNS<\/td>\n<\/td>\n<\/tr>\n
53<\/td>\nUDP<\/td>\nNSX Manager<\/td>\nDNS Servers<\/td>\nDNS<\/td>\n<\/td>\n<\/tr>\n
22<\/td>\nTCP<\/td>\nNSX Manager<\/td>\nManagement SCP Servers<\/td>\nSSH (upload support bundle, backups, etc.)<\/td>\n<\/td>\n<\/tr>\n
123<\/td>\nUDP<\/td>\nNSX Manager<\/td>\nNTP Servers<\/td>\nNTP<\/td>\n<\/td>\n<\/tr>\n
161, 162<\/td>\nTCP<\/td>\nNSX Manager<\/td>\nSNMP Servers<\/td>\nSNMP<\/td>\n<\/td>\n<\/tr>\n
161, 162<\/td>\nUDP<\/td>\nNSX Manager<\/td>\nSNMP Servers<\/td>\nSNMP<\/td>\n<\/td>\n<\/tr>\n
514<\/td>\nTCP<\/td>\nNSX Manager<\/td>\nSyslog Servers<\/td>\nSyslog<\/td>\n<\/td>\n<\/tr>\n
514<\/td>\nUDP<\/td>\nNSX Manager<\/td>\nSyslog Servers<\/td>\nSyslog<\/td>\n<\/td>\n<\/tr>\n
6514<\/td>\nTCP<\/td>\nNSX Manager<\/td>\nSyslog Servers<\/td>\nSyslog<\/td>\n<\/td>\n<\/tr>\n
6514<\/td>\nUDP<\/td>\nNSX Manager<\/td>\nSyslog Servers<\/td>\nSyslog<\/td>\n<\/td>\n<\/tr>\n
80<\/td>\nTCP<\/td>\nNSX Manager<\/td>\nIntermediate and Root CA Servers<\/td>\nSyslog (export over TLS).Note: To verify which TCP port must be used to retrieve the Certificate Revocation Lists (CRLs), verify against the CRL Distribution Point (CDP) URI of the certificate authority.<\/td>\n<\/td>\n<\/tr>\n
33434-33523<\/td>\nUDP<\/td>\nNSX Manager<\/td>\nTraceroute Destination<\/td>\nTraceroute<\/td>\n<\/td>\n<\/tr>\n
80<\/td>\nTCP<\/td>\nNSX Manager<\/td>\nvCenter Server<\/td>\nNSX Manager to compute manager (vCenter Server) communication, when configured.<\/td>\n<\/td>\n<\/tr>\n
443<\/td>\nTCP<\/td>\nNSX Manager<\/td>\nvCenter Server<\/td>\nNSX Manager to compute manager (vCenter Server) communication, when configured.<\/td>\n<\/td>\n<\/tr>\n
123<\/td>\nUDP<\/td>\nNTP Servers<\/td>\nNSX Manager<\/td>\nNTP<\/td>\n<\/td>\n<\/tr>\n
22<\/td>\nTCP<\/td>\nManagement Clients<\/td>\nNSX Manager<\/td>\nSSH (Disabled by default)<\/td>\n<\/td>\n<\/tr>\n
443<\/td>\nTCP<\/td>\nManagement Clients<\/td>\nNSX Manager<\/td>\nNSX API server<\/td>\n<\/td>\n<\/tr>\n
161<\/td>\nUDP<\/td>\nSNMP Servers<\/td>\nNSX Manager<\/td>\nSNMP<\/td>\n<\/td>\n<\/tr>\n
22<\/td>\nTCP<\/td>\nManagement Clients<\/td>\nNSX Edge nodes<\/td>\nSSH (Disabled by default)<\/td>\n<\/td>\n<\/tr>\n
5555<\/td>\nTCP<\/td>\nNSX Agent<\/td>\nNSX Edge nodes<\/td>\nNSX Cloud – Agent on instance communicates to NSX Cloud Gateway.<\/td>\n<\/td>\n<\/tr>\n
53<\/td>\nUDP<\/td>\nNSX Edge nodes<\/td>\nDNS Servers<\/td>\nDNS<\/td>\n<\/td>\n<\/tr>\n
22<\/td>\nTCP<\/td>\nNSX Edge nodes<\/td>\nManagement SCP or SSH Servers<\/td>\nSSH<\/td>\n<\/td>\n<\/tr>\n
1235<\/td>\nTCP<\/td>\nESXi host<\/td>\nNSX Manager<\/td>\nLocal Control Plane (LCP) to Central Control Plane (CCP) communication<\/td>\n<\/td>\n<\/tr>\n
443<\/td>\nTCP<\/td>\nESXi and KVM host<\/td>\nNSX Manager<\/td>\nManagement and provisioning connection<\/td>\n<\/td>\n<\/tr>\n
443<\/td>\nTCP<\/td>\nESXi and KVM host<\/td>\nNSX Manager<\/td>\nInstall and upgrade HTTP repository<\/td>\n<\/td>\n<\/tr>\n
6081<\/td>\nUDP<\/td>\nGENEVE Termination End Point (TEP)<\/td>\nGENEVE Termination End Point (TEP)<\/td>\nTransport network<\/td>\n<\/td>\n<\/tr>\n
1234<\/td>\nTCP<\/td>\nKVM host<\/td>\nNSX Manager<\/td>\nNSX Messaging channel to NSX Manager. AMPQ Communication channel to NSX Manager<\/td>\n<\/td>\n<\/tr>\n
5671, 1235, 1234, 8080<\/td>\nTCP<\/td>\nBare Metal server host<\/td>\nNSX Manager<\/td>\nAMPQ Communication channel to NSX Manager<\/td>\n<\/td>\n<\/tr>\n
1235<\/td>\nTCP<\/td>\nKVM host<\/td>\nNSX Manager<\/td>\nLocal Control Plane (LCP) to Central Control Plane (CCP) communication<\/td>\n<\/td>\n<\/tr>\n
8080<\/td>\nTCP<\/td>\nKVM host<\/td>\nNSX Manager<\/td>\nInstall and upgrade HTTP repository<\/td>\n<\/td>\n<\/tr>\n
443<\/td>\nTCP<\/td>\nNSX Manager<\/td>\nESXi host<\/td>\nManagement and provisioning connection<\/td>\n<\/td>\n<\/tr>\n
443<\/td>\nTCP<\/td>\nNSX Manager<\/td>\nKVM host<\/td>\nManagement and provisioning connection<\/td>\n<\/td>\n<\/tr>\n
3784, 3785<\/td>\nUDP<\/td>\nNSX-T Data Center transport node<\/td>\nNSX-T Data Center transport node<\/td>\nBFD Session between TEPs, in the datapath using TEP interface<\/td>\n<\/td>\n<\/tr>\n
1234<\/td>\nTCP<\/td>\nESXi host<\/td>\nNSX Manager<\/td>\nNSX Messaging channel to NSX Manager. AMPQ Communication channel to NSX Manager<\/td>\n<\/td>\n<\/tr>\n
<\/td>\n103<\/td>\nNSX Edge Nodes<\/td>\nExternal Routing Peers<\/td>\nPIM Routing session<\/td>\n<\/td>\n<\/tr>\n
179<\/td>\nTCP<\/td>\nNSX Edge Nodes<\/td>\nExternal Routing Peers<\/td>\nBGP Routing session<\/td>\n<\/td>\n<\/tr>\n
9000, 9040, 5671, 1234, 443, 8080<\/td>\nTCP<\/td>\nNSX Manager<\/td>\nNSX Manager<\/td>\nDistributed Datastore<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u00a0<\/span><\/p>\n

\u00a0<\/strong><\/p>\n

\u00a0<\/strong><\/p>\n

\u00a0<\/strong><\/p>\n

\u00a0<\/strong><\/p>\n

\u00a0<\/strong><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n\n\n<\/colgroup>\n\n<\/colgroup>\n\n<\/colgroup>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Port<\/strong><\/span><\/td>\nProtocol<\/strong><\/span><\/td>\nSource<\/strong><\/span><\/td>\nDestination<\/strong><\/span><\/td>\nService Description<\/strong><\/span><\/td>\nPurpose<\/strong><\/span><\/td>\n<\/tr>\n
443<\/span><\/td>\nTCP<\/span><\/td>\nNSX Application Platform (NAPP)<\/span><\/td>\nNSX ATP Cloud Services<\/span><\/td>\nUsed by NAPP to cloud service deployed in the cloud
\nfor NSX NDR and NSX Malware Prevention<\/span><\/td>\n		Invocation of NDR and Malware Prevention cloud service
\nover https<\/span><\/td>\n<\/tr>\n
9092<\/span><\/td>\nTCP<\/span><\/td>\nNSX Unified Appliance \/ Transport
\nNodes<\/span><\/td>\n		NSX Application Platform (NAPP)<\/span><\/td>\nIncoming messages from NSX Unified Appliance or
\nTransport Nodes to NSX Intelligence Appliance<\/span><\/td>\n		Kafka broker for collecting data from NSX and
\nhosts<\/span><\/td>\n<\/tr>\n
443<\/span><\/td>\nTCP<\/span><\/td>\nManagement Clients \/ NSX Unified
\nAppliance<\/span><\/td>\n		NSX Application Platform (NAPP)<\/span><\/td>\nNSX API Server<\/span><\/td>\nEntry point for APIs in NSX
\nIntelligence<\/span><\/td>\n<\/tr>\n
22<\/span><\/td>\nTCP<\/span><\/td>\nManagement Clients<\/span><\/td>\nNSX Application Platform (NAPP)<\/span><\/td>\nSSH<\/span><\/td>\nHDFS and root login to appliance<\/span><\/td>\n<\/tr>\n
123<\/span><\/td>\nUDP<\/span><\/td>\nNTP Servers<\/span><\/td>\nNSX Application Platform (NAPP)<\/span><\/td>\nNTP<\/span><\/td>\nNTP Server connection<\/span><\/td>\n<\/tr>\n
10250<\/span><\/td>\nTCP<\/span><\/td>\nNSX Application Platform (NAPP)<\/span><\/td>\nKubelet API Server<\/span><\/td>\nInvocation of Kubelet API from NSX Unified
\nAppliance<\/span><\/td>\n		Kubelet API<\/span><\/td>\n<\/tr>\n
443<\/span><\/td>\nTCP<\/span><\/td>\nNSX Application Platform (NAPP)<\/span><\/td>\nNSX Threat Intelligence Cloud Service
\n(NTICS)<\/span><\/td>\n		Used by NSX Unified Appliance to NTICS service
\ndeployed in the cloud<\/span><\/td>\n		Invocation of NTICS cloud service over
\nhttps<\/span><\/td>\n<\/tr>\n
443<\/span><\/td>\nTCP<\/span><\/td>\nNSX Unified Appliance<\/span><\/td>\nNSX Threat Intelligence Cloud Service
\n(NTICS)<\/span><\/td>\n		Used by NSX Unified Appliance to NTICS service
\ndeployed in the cloud<\/span><\/td>\n		Invocation of NTICS cloud service over
\nhttps<\/span><\/td>\n<\/tr>\n
10259<\/span><\/td>\nTCP<\/span><\/td>\nNSX Application Platform (NAPP)<\/span><\/td>\nKubernetes Cluster Server<\/span><\/td>\nUsed by Kubernetes server to self<\/span><\/td>\nkube-scheduler<\/span><\/td>\n<\/tr>\n
2379, 2380<\/span><\/td>\nTCP<\/span><\/td>\nNSX Application Platform (NAPP)<\/span><\/td>\nEtcd Kubernetes API Server<\/span><\/td>\nAPI invocation from NSX Intelligence to Etcd
\nserver<\/span><\/td>\n		Etcd Kubernetes server<\/span><\/td>\n<\/tr>\n
10250<\/span><\/td>\nTCP<\/span><\/td>\nNSX Application Platform (NAPP)<\/span><\/td>\nkube-api-server<\/span><\/td>\nAPI invocation from NSX Intelligence to
\nkube-api-server<\/span><\/td>\n		Invocation of kube-api-server API<\/span><\/td>\n<\/tr>\n
10250<\/span><\/td>\nTCP<\/span><\/td>\nNSX Application Platform (NAPP)<\/span><\/td>\nkube-api<\/span><\/td>\nAPI invocation from NSX Intelligence to
\nkupe-api<\/span><\/td>\n		Innocation of kube API<\/span><\/td>\n<\/tr>\n
6443<\/span><\/td>\nTCP<\/span><\/td>\nNSX Application Platform (NAPP)<\/span><\/td>\nKubernetes API Server<\/span><\/td>\nAPI invocation from NSX Intelligence to Kubernette API
\nserver<\/span><\/td>\n		Innocation of Kubernete API<\/span><\/td>\n<\/tr>\n
10257<\/span><\/td>\nTCP<\/span><\/td>\nNSX Unified Appliance<\/span><\/td>\nKubernetes Cluster Server<\/span><\/td>\nUsed by Kubernetes server to self<\/span><\/td>\nkube-controller-manager<\/span><\/td>\n<\/tr>\n
10259<\/span><\/td>\nTCP<\/span><\/td>\nNSX Unified Appliance<\/span><\/td>\nKubernetes Cluster Server<\/span><\/td>\nUsed by Kubernetes server to self<\/span><\/td>\nkube-scheduler<\/span><\/td>\n<\/tr>\n
2379, 2380<\/span><\/td>\nTCP<\/span><\/td>\nNSX Unified Appliance<\/span><\/td>\nEtcd Kubernetes API Server<\/span><\/td>\nAPI invocation from NSX Unified Appliance to Etcd
\nKubernetes server<\/span><\/td>\n		Etcd Kubernetes server<\/span><\/td>\n<\/tr>\n
10250<\/span><\/td>\nTCP<\/span><\/td>\nNSX Unified Appliance<\/span><\/td>\nKubernetes\u00a0 <\/span>API Server<\/span><\/td>\nAPI invocation from NSX Unified Appliance to
\nKubernette API server<\/span><\/td>\n		Innocation of Kubernete API<\/span><\/td>\n<\/tr>\n
6443<\/span><\/td>\nTCP<\/span><\/td>\nNSX Unified Appliance<\/span><\/td>\nKubernetes API Server<\/span><\/td>\nAPI invocation from NSX Unified Appliance to
\nKubernette API server<\/span><\/td>\n		Innocation of Kubernete API<\/span><\/td>\n<\/tr>\n
9092<\/span><\/td>\nTCP<\/span><\/td>\nNSX Application Platform (NAPP)<\/span><\/td>\nNSX Unified Appliance \/ NSX Transport
\nNodes<\/span><\/td>\n		NSX Intelligence outgoing communication to NSX Unified
\nAppliance or Transport Nodes<\/span><\/td>\n		Connection to NSX Intelligence from hosts and NSX for
\nkafka<\/span><\/td>\n<\/tr>\n
443<\/span><\/td>\nTCP<\/span><\/td>\nNSX Application Platform (NAPP)<\/span><\/td>\nvCenter Server \/ NSX Unified
\nAppliance<\/span><\/td>\n		NSX Intelligence to a compute manager (vCenter Server)
\ncommunication and NSX Unified Appliance, when configured.<\/span><\/td>\n		Entry point for NSX Intelligence to reach NSX Manager
\nfor certain API calls<\/span><\/td>\n<\/tr>\n
123<\/span><\/td>\nUDP<\/span><\/td>\nNSX Application Platform (NAPP)<\/span><\/td>\nNTP Servers<\/span><\/td>\nNTP<\/span><\/td>\nNTP Client connection<\/span><\/td>\n<\/tr>\n
22<\/span><\/td>\nTCP<\/span><\/td>\nNSX Application Platform (NAPP)<\/span><\/td>\nManagement SCP Servers<\/span><\/td>\nSSH (upload support bundle, backups,
\netc.)<\/span><\/td>\n		SSH for backup<\/span><\/td>\n<\/tr>\n
53<\/span><\/td>\nUDP<\/span><\/td>\nNSX Application Platform (NAPP)<\/span><\/td>\nDNS Servers<\/span><\/td>\nDNS<\/span>\u00a0<\/span><\/span><\/td>\nDNS Client connection<\/span><\/td>\n<\/tr>\n
53<\/span><\/td>\nTCP<\/span><\/td>\nNSX Application Platform (NAPP)<\/span><\/td>\nDNS Servers<\/span><\/td>\nDNS<\/span>\u00a0<\/span><\/span><\/td>\nDNS Client connection<\/span><\/td>\n<\/tr>\n
443<\/span><\/td>\nTCP<\/span><\/td>\nNSX Unified Appliance<\/span><\/td>\nNSX Threat Intelligence Cloud Service
\n(NTICS)<\/span><\/td>\n		NSX Manager accesses NTICS over https<\/span><\/td>\nFor IDS Signature download<\/span><\/td>\n<\/tr>\n
80<\/span><\/td>\nTCP<\/span><\/td>\nCloud Service Manager (CSM)<\/span><\/td>\nPublic Cloud Gateway (PCG)<\/span><\/td>\nCSM configuration, such as upgrade workflow, over
\nHTTPS.<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
443<\/span><\/td>\nTCP<\/span><\/td>\nCloud Service Manager (CSM)<\/span><\/td>\nNSX Manager<\/span><\/td>\nCSM to access NSX Manager.<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
443<\/span><\/td>\nTCP<\/span><\/td>\nNSX Manager<\/span><\/td>\nPublic Cloud Gateway (PCG)<\/span><\/td>\nNSX RPC channel(s)<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
7442<\/span><\/td>\nTCP<\/span><\/td>\nCloud Service Manager (CSM)<\/span><\/td>\nPublic Cloud Gateway (PCG)<\/span><\/td>\nCSM configuration, such as upgrade workflow, over
\nHTTPS. Ensure your firewall allows SSL traffic over this non-standard
\nport.<\/span>\u00a0<\/span><\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
500,4500<\/span><\/td>\n50,51<\/span><\/td>\nNSX Edge Nodes<\/span><\/td>\nExternal IPSEC Peers<\/span><\/td>\nIPSEC VPN session<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
1236,443<\/span><\/td>\nTCP<\/span><\/td>\nNSX Local Manager(s)\/NSX Global
\nManager(s)<\/span><\/td>\n		NSX Local Manager(s)\/NSX Global
\nManager(s)<\/span><\/td>\n		Federation Management plane and control plane
\ncommunication between locations (Async Replicator)<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
1167<\/span><\/td>\nTCP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nDHCP Lease Info Sync for HA over secure channel on
\nEdge Management port<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
9040<\/span><\/td>\nTCP<\/span><\/td>\nNSX Manager<\/span><\/td>\nNSX Manager<\/span><\/td>\nDistributed Datastore<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
4789<\/span><\/td>\nUDP<\/span><\/td>\nNSX Edge Nodes<\/span><\/td>\nExternal Routing Peers<\/span><\/td>\nVXLAN encap traffic<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
80<\/span><\/td>\nTCP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nIntermediate and Root CA Servers<\/span><\/td>\nSyslog (export over TLS). To verify which TCP port
\nmust be used to retrieve the Certificate Revocation Lists (CRLs), verify
\nagainst the CRL Distribution Point (CDP) URI of the certificate
\nauthority.<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
514<\/span><\/td>\nTCP<\/span><\/td>\nHost Transport Node<\/span><\/td>\nSyslog Servers<\/span><\/td>\nSyslog (Refer to the host syslog
\ndocumenation)<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
514<\/span><\/td>\nUDP<\/span><\/td>\nHost Transport Node<\/span><\/td>\nSyslog Servers<\/span><\/td>\nSyslog (Refer to the host syslog
\ndocumenation)<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
6514<\/span><\/td>\nTCP<\/span><\/td>\nHost Transport Node<\/span><\/td>\nSyslog Servers<\/span><\/td>\nSyslog (Refer to the host syslog
\ndocumenation)<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
6514<\/span><\/td>\nUDP<\/span><\/td>\nHost Transport Node<\/span><\/td>\nSyslog Servers<\/span><\/td>\nSyslog (Refer to the host syslog
\ndocumenation)<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
80<\/span><\/td>\nTCP<\/span><\/td>\nHost Transport Node<\/span><\/td>\nIntermediate and Root CA servers<\/span><\/td>\nSyslog (export over TLS). To verify which TCP port
\nmust be used to retrieve the Certificate Revocation Lists (CRLs), verify
\nagainst the CRL Distribution Point (CDP) URI of the certificate
\nauthority.<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
5671, 1234, <\/span><\/p>\n

1235, 443<\/span><\/td>\n

TCP<\/span><\/td>\nNSX Managers, NSX Edge nodes, Transport
\nnodes<\/span><\/td>\n		NSX Manager<\/span><\/td>\nNSX messaging<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
8080<\/span><\/td>\nTCP<\/span><\/td>\nNSX Managers, NSX Edge nodes, Transport nodes, vCenter
\nServer<\/span><\/td>\n		NSX Manager<\/span><\/td>\nInstall-upgrade HTTP repository<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
389,636<\/span><\/td>\nTCP<\/span><\/td>\nNSX Manager<\/span><\/td>\nExternal LDAP server<\/span><\/td>\nActive Directory\/LDAP<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
6081<\/span><\/td>\nUDP<\/span><\/td>\nGENEVE Remote Tunnel End Point (RTEP)<\/span><\/td>\nGENEVE Remote Tunnel End Point (RTEP)<\/span><\/td>\nFederation Cross-location communication between Edge
\nnodes in Federation<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
443<\/span><\/td>\nTCP<\/span><\/td>\nManagement Clients<\/span><\/td>\nNSX Autonomous Edge Nodes<\/span><\/td>\nHTTPS<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
3784, 3785, 4784<\/span><\/td>\nUDP<\/span><\/td>\nNSX Edge nodes, Transport nodes<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nBFD between the Transport node TEP IP address in the
\ndata.<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
3784, 3785, 4784<\/span><\/td>\nUDP<\/span><\/td>\nNSX Edge Nodes<\/span><\/td>\nExternal Routing Peers<\/span><\/td>\nBFD for static routes and BGP peers.<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
443<\/span><\/td>\nTCP<\/span><\/td>\nNSX Edge Nodes<\/span><\/td>\napi.nsx-sec-prod.com &
\n*.amazonaws.com<\/span><\/td>\n		Edge uses management network to download URL
\nCategories\/Reputation from cloud for NSX URL Analysis<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
443<\/span><\/td>\nTCP<\/span><\/td>\nNSX Managers<\/span><\/td>\ngithub.com<\/span>\u00a0<\/span><\/span><\/td>\nDownload IDS Signature from Trustwave Signature
\nRepository.<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
1235<\/span><\/td>\nTCP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nNSX Manager<\/span><\/td>\nLower Control Plane (LCP) to Central Control Plane
\n(CCP) communication<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
2480<\/span><\/td>\nTCP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nNestdb<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
6666<\/span><\/td>\nTCP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nNSX Cloud – NSX Edge local
\ncommunication.<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
50263<\/span><\/td>\nUDP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nHigh-Availability<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
443<\/span><\/td>\nTCP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nNSX Manager<\/span><\/td>\nHTTPS<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
1234<\/span><\/td>\nTCP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nNSX Manager<\/span><\/td>\nNSX Messaging channel to NSX Manager<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
8080<\/span><\/td>\nTCP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nNSX Manager<\/span><\/td>\nNAPI, NSX-T Data Center upgrade<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
123<\/span><\/td>\nUDP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nNTP Servers<\/span><\/td>\nNTP<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
3000 – 9000<\/span><\/td>\nTCP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nOpenStack Nova API Server<\/span><\/td>\nMetadata proxy<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
161, 162<\/span><\/td>\nTCP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nSNMP Servers<\/span><\/td>\nSNMP<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
161, 162<\/span><\/td>\nUDP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nSNMP Servers<\/span><\/td>\nSNMP<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
514<\/span><\/td>\nTCP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nSyslog Servers<\/span><\/td>\nSyslog<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
514<\/span><\/td>\nUDP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nSyslog Servers<\/span><\/td>\nSyslog<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
6514<\/span><\/td>\nTCP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nSyslog Servers<\/span><\/td>\nSyslog<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
6514<\/span><\/td>\nUDP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nSyslog Servers<\/span><\/td>\nSyslog<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
33434 – 33523<\/span><\/td>\nUDP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nTraceroute Destination<\/span><\/td>\nTraceroute<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
123<\/span><\/td>\nUDP<\/span><\/td>\nNTP Servers<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nNTP<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
161<\/span><\/td>\nUDP<\/span><\/td>\nSNMP Servers<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nSNMP<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
53<\/span><\/td>\nTCP<\/span><\/td>\nNSX Manager<\/span><\/td>\nDNS Servers<\/span><\/td>\nDNS<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
53<\/span><\/td>\nUDP<\/span><\/td>\nNSX Manager<\/span><\/td>\nDNS Servers<\/span><\/td>\nDNS<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
22<\/span><\/td>\nTCP<\/span><\/td>\nNSX Manager<\/span><\/td>\nManagement SCP Servers<\/span><\/td>\nSSH (upload support bundle, backups,
\netc.)<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
123<\/span><\/td>\nUDP<\/span><\/td>\nNSX Manager<\/span><\/td>\nNTP Servers<\/span><\/td>\nNTP<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
161, 162<\/span><\/td>\nTCP<\/span><\/td>\nNSX Manager<\/span><\/td>\nSNMP Servers<\/span><\/td>\nSNMP<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
161, 162<\/span><\/td>\nUDP<\/span><\/td>\nNSX Manager<\/span><\/td>\nSNMP Servers<\/span><\/td>\nSNMP<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
514<\/span><\/td>\nTCP<\/span><\/td>\nNSX Manager<\/span><\/td>\nSyslog Servers<\/span><\/td>\nSyslog<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
514<\/span><\/td>\nUDP<\/span><\/td>\nNSX Manager<\/span><\/td>\nSyslog Servers<\/span><\/td>\nSyslog<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
6514<\/span><\/td>\nTCP<\/span><\/td>\nNSX Manager<\/span><\/td>\nSyslog Servers<\/span><\/td>\nSyslog<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
6514<\/span><\/td>\nUDP<\/span><\/td>\nNSX Manager<\/span><\/td>\nSyslog Servers<\/span><\/td>\nSyslog<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
80<\/span><\/td>\nTCP<\/span><\/td>\nNSX Manager<\/span><\/td>\nIntermediate and Root CA Servers<\/span><\/td>\nSyslog (export over TLS).Note: To verify which TCP
\nport must be used to retrieve the Certificate Revocation Lists (CRLs), verify
\nagainst the CRL Distribution Point (CDP) URI of the certificate
\nauthority.<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
33434-33523<\/span><\/td>\nUDP<\/span><\/td>\nNSX Manager<\/span><\/td>\nTraceroute Destination<\/span><\/td>\nTraceroute<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
80<\/span><\/td>\nTCP<\/span><\/td>\nNSX Manager<\/span><\/td>\nvCenter Server<\/span><\/td>\nNSX Manager to compute manager (vCenter Server)
\ncommunication, when configured.<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
443<\/span><\/td>\nTCP<\/span><\/td>\nNSX Manager<\/span><\/td>\nvCenter Server<\/span><\/td>\nNSX Manager to compute manager (vCenter Server)
\ncommunication, when configured.<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
123<\/span><\/td>\nUDP<\/span><\/td>\nNTP Servers<\/span><\/td>\nNSX Manager<\/span><\/td>\nNTP<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
22<\/span><\/td>\nTCP<\/span><\/td>\nManagement Clients<\/span><\/td>\nNSX Manager<\/span><\/td>\nSSH (Disabled by default)<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
443<\/span><\/td>\nTCP<\/span><\/td>\nManagement Clients<\/span><\/td>\nNSX Manager<\/span><\/td>\nNSX API server<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
161<\/span><\/td>\nUDP<\/span><\/td>\nSNMP Servers<\/span><\/td>\nNSX Manager<\/span><\/td>\nSNMP<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
22<\/span><\/td>\nTCP<\/span><\/td>\nManagement Clients<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nSSH (Disabled by default)<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
5555<\/span><\/td>\nTCP<\/span><\/td>\nNSX Agent<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nNSX Cloud – Agent on instance communicates to NSX
\nCloud Gateway.<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
53<\/span><\/td>\nUDP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nDNS Servers<\/span><\/td>\nDNS<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
22<\/span><\/td>\nTCP<\/span><\/td>\nNSX Edge nodes<\/span><\/td>\nManagement SCP or SSH Servers<\/span><\/td>\nSSH<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
1235<\/span><\/td>\nTCP<\/span><\/td>\nESXi host<\/span><\/td>\nNSX Manager<\/span><\/td>\nLocal Control Plane (LCP) to Central Control Plane
\n(CCP) communication<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
443<\/span><\/td>\nTCP<\/span><\/td>\nESXi and KVM host<\/span><\/td>\nNSX Manager<\/span><\/td>\nManagement and provisioning
\nconnection<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
443<\/span><\/td>\nTCP<\/span><\/td>\nESXi and KVM host<\/span><\/td>\nNSX Manager<\/span><\/td>\nInstall and upgrade HTTP repository<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
6081<\/span><\/td>\nUDP<\/span><\/td>\nGENEVE Termination End Point (TEP)<\/span><\/td>\nGENEVE Termination End Point (TEP)<\/span><\/td>\nTransport network<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
1234<\/span><\/td>\nTCP<\/span><\/td>\nKVM host<\/span><\/td>\nNSX Manager<\/span><\/td>\nNSX Messaging channel to NSX Manager. AMPQ
\nCommunication channel to NSX Manager<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
5671, 1235, <\/span><\/p>\n

1234, 8080<\/span><\/td>\n

TCP<\/span><\/td>\nBare Metal server host<\/span><\/td>\nNSX Manager<\/span><\/td>\nAMPQ Communication channel to NSX
\nManager<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
1235<\/span><\/td>\nTCP<\/span><\/td>\nKVM host<\/span><\/td>\nNSX Manager<\/span><\/td>\nLocal Control Plane (LCP) to Central Control Plane
\n(CCP) communication<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
8080<\/span><\/td>\nTCP<\/span><\/td>\nKVM host<\/span><\/td>\nNSX Manager<\/span><\/td>\nInstall and upgrade HTTP repository<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
443<\/span><\/td>\nTCP<\/span><\/td>\nNSX Manager<\/span><\/td>\nESXi host<\/span><\/td>\nManagement and provisioning
\nconnection<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
443<\/span><\/td>\nTCP<\/span><\/td>\nNSX Manager<\/span><\/td>\nKVM host<\/span><\/td>\nManagement and provisioning
\nconnection<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
3784, 3785<\/span><\/td>\nUDP<\/span><\/td>\nNSX-T Data Center transport node<\/span><\/td>\nNSX-T Data Center transport node<\/span><\/td>\nBFD Session between TEPs, in the datapath using TEP
\ninterface<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
1234<\/span><\/td>\nTCP<\/span><\/td>\nESXi host<\/span><\/td>\nNSX Manager<\/span><\/td>\nNSX Messaging channel to NSX Manager. AMPQ
\nCommunication channel to NSX Manager<\/span><\/td>\n		\u00a0<\/span><\/td>\n<\/tr>\n
\u00a0<\/span><\/td>\n103<\/span><\/td>\nNSX Edge Nodes<\/span><\/td>\nExternal Routing Peers<\/span><\/td>\nPIM Routing session<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
179<\/span><\/td>\nTCP<\/span><\/td>\nNSX Edge Nodes<\/span><\/td>\nExternal Routing Peers<\/span><\/td>\nBGP Routing session<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n
9000, 9040, 5671, <\/span><\/p>\n

1234, 443, 8080<\/span><\/td>\n

TCP<\/span><\/td>\nNSX Manager<\/span><\/td>\nNSX Manager<\/span><\/td>\nDistributed Datastore<\/span><\/td>\n\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n\n
<\/td>\n<\/td>\n<\/td>\n<\/td>\n<\/td>\n<\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/td>\n<\/td>\n<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"

In this blog post I will sum up all the network ports that are required to operate various capabilities that are within NSX-T Data Center. This blog is about current version of NSX-T Data Center, the current version is 3.2.0.0.1. Please acknowledge that not all features are available under each NSX-T Data Center Edition. Please … Lees verder NSX-T Data Center required network ports<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[39,22],"tags":[56,62],"class_list":["post-727","post","type-post","status-publish","format-standard","hentry","category-nsx-t","category-vmware","tag-nsx-t","tag-ports"],"_links":{"self":[{"href":"https:\/\/robinplomp.com\/index.php?rest_route=\/wp\/v2\/posts\/727","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/robinplomp.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/robinplomp.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/robinplomp.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/robinplomp.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=727"}],"version-history":[{"count":5,"href":"https:\/\/robinplomp.com\/index.php?rest_route=\/wp\/v2\/posts\/727\/revisions"}],"predecessor-version":[{"id":734,"href":"https:\/\/robinplomp.com\/index.php?rest_route=\/wp\/v2\/posts\/727\/revisions\/734"}],"wp:attachment":[{"href":"https:\/\/robinplomp.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=727"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/robinplomp.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=727"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/robinplomp.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=727"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}