Firewall ports 编辑
The App Layering appliance communicates with your hypervisor, provisioning service, and the App Layering agent. This article details the ports that the appliance uses to communicate both internally with other App Layering-related services, and externally with servers, such as NTP servers. Be sure to open the necessary ports in your firewall before you install the App Layering appliance.
During App Layering installation, you open ports that the appliance uses to interact with services on the virtual server where it is hosted. If there is a firewall between the App Layering appliance and the machine on which you are running the App Layering agent or one of the App Layering connectors, you must manually open the port in the firewall used for that purpose. If during installation you changed any of the ports from the default setting, be sure to open the correct port.
The App Layering appliance uses the TCP/IP protocol, and IPv4 is required. There are three main classes of communication:
- Accessing and managing the appliance.
- Talking to other App Layering agent service.
- Talking directly to hypervisors that don’t require the agent.
Note:
The App Layering appliance must be connected to a network file share.
Admin user
By default, App Layering uses the following ports in your firewall for the Admin User to interact with the Management console on the App Layering appliance virtual machine.
App Layering appliance
The connector services for the various hypervisors and provisioning services listed below all run on the App Layering appliance.
App Layering Destination | Activity | Protocol | Ports |
---|---|---|---|
Appliance | Management console | TCP | 80, 443 |
Appliance | Administrator log download | TCP | 8888 |
Azure connector service | Communication | TCP | 3000 (HTTP), 3500 (HTTPS) |
BITS Server | Disk upload | TCP | 3015 (HTTP), 3515 (HTTPS) |
Citrix Hypervisor connector service | Communication | TCP | 3002 (HTTP), 3502 (HTTPS) |
Citrix Provisioning connector service | Communication | TCP | 3009 (HTTP), 3509 (HTTPS) |
Google connector service | Communication | TCP | 3016 (HTTP), 3516 (HTTPS) |
Hyper-V connector service | Communication | TCP | 3012 (HTTP), 3512 (HTTPS) |
Nutanix connector service | Communication | TCP | 3006 (HTTP), 3506 (HTTPS) |
vSphere connector service | Communication | TCP | 3004 (HTTP), 3504 (HTTPS) |
Internal connections
By default, the App Layering service uses the following ports in your firewall for internal connections between the appliance and each of its destinations.
In the table, the following shorthand is used:
- Appliance - The App Layering virtual appliance.
- Agent - refers to the App Layering agent.
- Admin user - A management console user who is assigned the App Layering Admin role.
- Compositing machine - A virtual machine used to create and update layers using the App Layering compositing engine, including:
- Virtual machine created when you use a connector with Offload compositing enabled to create a layer, add a version to a layer, or publish a layered image.
- Virtual machine in which the
ImportOsLayer.ps1
script runs to import the OS image as a new OS layer.
App Layering Source | App Layering Destination | Activity | Protocol | Ports |
---|---|---|---|---|
Agent | Appliance | Initial registration | TCP | 443 |
Appliance | Agent | Communication | TCP | 8016 |
Agent | Appliance | Log deliveries from agent | TCP | 8787 |
Appliance | vCenter, ESXI hosts | Communication with datastore via ESXI host | TCP | 443 |
Admin user | Appliance | Log download | TCP | 8888 |
Appliance | Active directory | LDAP | TCP | 389, 636 |
Appliance | Compositing machine | Communication | TCP | 443 |
Compositing machine | Appliance | Communication | TCP | 443 |
Compositing machine | Appliance | Layer disk access via iSCSI | TCP | 3260 |
Admin user | Appliance | Azure connector communication | TCP | 3000 (HTTP), 3500 (HTTPS) |
Appliance | Azure | Communication | TCP | 443 |
Admin user | Appliance | Citrix Provisioning connector communication | TCP | 3009 (HTTP), 3509 (HTTPS) |
Agent on Citrix Provisioning server | Appliance | Disk download | TCP | 3009 (HTTP), 3509 (HTTPS) |
Admin user | Appliance | Hyper-V connector communication | TCP | 3012 (HTTP), 3512 (HTTPS) |
Agent on Hyper-V server | Appliance | Disk download | TCP | 3012 (HTTP), 3512 (HTTPS) |
Agent on Hyper-V server | Appliance | Disk upload | TCP | 3015 (HTTP), 3515 (HTTPS) |
Admin user | Appliance | vSphere connector communication | TCP | 3004 (HTTP), 3504 (HTTPS) |
Appliance | vSphere | Communication | TCP | 443 |
Admin user | Appliance | Citrix Hypervisor connector communication | TCP | 3002 (HTTP), 3502 (HTTPS) |
Appliance | Citrix Hypervisor | Communication | TCP | 5900 |
Admin user | Appliance | Nutanix connector communication | TCP | 3006 (HTTP), 3506 (HTTPS) |
Appliance | Prism | Communication | TCP | 9440 |
External connection
By default, uses the following port in your firewall for external connections between the App Layering appliance and the destination listed below.
Note:
These URLs are only accessible by the appliance using the credentials defined for it. Attempting to browse these sites will result in an error message.
App Layering Destination | Activity | Protocol | Ports |
---|---|---|---|
<https://applayeringwebapi.azurewebsites.net> | API Access | TCP | 443 |
<http://alcdn.citrix.com/> | Download upgrade media | TCP | 80 |
OS image, a Citrix Hypervisor requirement
Destination | Activity | Protocol | Ports |
---|---|---|---|
Citrix Hypervisor | Communication | TCP | 5900 |
Key ports
Basic appliance management and access (always required)
- HTTP - Port 80
- HTTPS - Port 443
- SSH - Port 22
- Log downloads - Port 8888
Servers
- Active Directory server - Port 389 - LDAP protocol
- Active Directory server - Port 636 - LDAPS protocol
- Active Directory server - Port 53 - DNS protocol
- Windows file servers, SMB - Port 445 - SMB protocol
- Network time servers - Port 123 - NTP protocol
- Unix file servers - Port 2049 - NFS protocol
- DHCP server, DHCP - Port 67 - UDP protocol
- App Layering appliance - Port 68 - DHCP protocol
App Layering agent
The agent uses the following ports for communications with itself and the appliance.
Appliance to agent server:
- Commands from appliance/SOAP - Port 8016
Agent server to appliance:
- Registration - Port 443 HTTPS
- Log export - Port 8787
- Citrix Provisioning disk download - Ports 3009 HTTP, 3509 HTTPS
- Hyper-V disk download - Ports 3012 HTTP, 3512 HTTPS
- Hyper-V disk upload - Ports 3015 HTTP, 3515 HTTPS
Connectors to hypervisors and provisioning services
Connectors on the appliance allow the appliance to communicate directly with the supported hypervisors and provisioning services using the following ports.
- Citrix Hypervisor - Port 5900
- Citrix Provisioning - Port 8016 (App Layering agent)
- Google Cloud - Port 443
- Microsoft Azure management - Port 443
- Microsoft Hyper-V - Port 8016 (App Layering agent)
- Nutanix AHV - Port 9440
- VMware vSphere - Port 443 (Virtual Center, and ESX hosts for disk transfers)
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论