Firewall and Port Requirements

Introduction

This document will guide you in configuring your network to install and configure the following products:

• Nasuni Edge Appliance.

• Nasuni Management Console (NMC).

• Nasuni Access Anywhere (NAA) .

• Nasuni File IQ Appliance.

Nasuni Edge Appliance

This section will guide you in configuring your network to install and configure the Nasuni Edge Appliance.

Note: The Nasuni Edge Appliance (NEA) port configurations also apply to the Nasuni File IQ Appliance.

• Each Nasuni Edge Appliance performs two main tasks:

• Securely transmits files to cloud object storage.

• Caches actively used files locally to provide high-performance file access.

• A Nasuni Edge Appliance can be a virtual machine that runs on hypervisors, or a Nasuni Edge Appliance can be a Nasuni hardware appliance.

• Nasuni Edge Appliances support NFS, SMB (CIFS), FTP/SFTP, and HTTP/ REST protocols.

• Each Nasuni Edge Appliance offers a Web-based interface that enables you to manage volumes and performance.

• To manage many Edge Appliances, you use the Nasuni Management Console (NMC).

Summary of frequently used firewall and port settings.
See below for detailed information that might apply to your site.

Port 443

Port 443 (HTTPS) is required to be open on your network (outbound only). This port is used when transferring data from the Nasuni Edge Appliance to the cloud storage provider. Port 443 is used for Nasuni Management Console Administrative Access and Web Access.

The Nasuni Edge Appliance must be able to talk to both Nasuni (to send alerts and metrics, download new versions, and so forth) and to the cloud (to reach cloud storage with Amazon S3 or Azure).

Because of the load-balancing nature of our systems, it is best to refrain from performing this using IP. Instead, we suggest you open HTTPS traffic (port 443) to *.nasuni.com and *.amazonaws.com.

Tip: Certain firewall manufacturers offer Nasuni application types for their safelists or allow lists, which should be enabled.

Important: The Nasuni Mobile Access app is scheduled for End-of-Life on May 1, 2024. After this date, the Nasuni Mobile Access app will no longer be supported or available from app stores.

We distinguish an Administrative path, a Control path, and a Data/Metadata path.

For the Data/Metadata path, ensure that port 443 is open to the FQDNs referenced in the cloud credentials.

For the Control path, ensure that port 443 is open to the following FQDNs:

Important: It is a best practice not to cache DNS entries for longer than the TTL that Nasuni specifies in DNS entries. For example, the TTL of the DNS entry globallock-virginia.api.nasuni.com is 60 seconds.

Note: Firewalls or any other security devices or software that process, inspect, or log port 443 traffic from the Nasuni Edge Appliance can affect performance when the Nasuni Edge Appliance is communicating with the cloud.

Tip: If you must use IP addresses (not recommended), note these considerations:

• For Amazon Web Services (AWS), the IP ranges are published here: https://ip-ranges.amazonaws.com/ip-ranges.json. For access to the NOC (Nasuni Orchestration Center), including if using NMC, add to your firewall all IP address ranges with a region value of “us-east-1” or “us-east-2” and a service value of “AMAZON”.

• For Microsoft Azure, the IP ranges are published here: https://www.microsoft.com/en-us/download/confirmation.aspx?id=41653. Download the Microsoft Azure Datacenter IP Ranges XML file.

• Additionally, for Global File Lock, add the "AMAZON" ranges for the following regions, depending on the lock servers you are using.

  • Virginia, US or Oregon, US: us-east-1 and us-west-2.

  • Sydney, Australia or Singapore: ap-southeast-2 and ap-northeast-1.

  • Frankfurt, Germany or Dublin, Ireland: eu-central-1 and eu-west-1.

Important: For zScaler devices with an Edge Appliance, it is important to include .amazonaws.com and .nasuni.com on safelists. A leading period (".") functions as a wildcard to the left of the named URL up to five subdomain levels deep, meaning that the same policies are applied to the subdomains. For details, see URL Format Guidelines.

Other Ports

Optional Ports

The Nasuni Edge Appliance has several ports that are optional to be open on your network:

25 – SMTP: You can configure the Nasuni Edge Appliance to use your local SMTP server. However, if you use the default settings, you must open port 25 on your network. This is so the Nasuni Edge Appliance can send you alerts via SMTP if you configure it to do so.

123 – NTP (Network Time Protocol): An NTP server must be accessible by the appliance. If the chosen NTP server is on the Internet, outbound port 123 outbound must be open. The default NTP servers are from time.nasuni.com.

161 – SNMP: You can configure the Nasuni Edge Appliance to use SNMP. However, if you use the default settings, you must open port 161 on your network.

8443 – Optional, for external management access direct or via NAT.

iDRAC Ports

The Integrated Dell Remote Access Controller (iDRAC) is a Dell controller that provides remote management capabilities for Nasuni Edge Appliance hardware appliances. Ports for iDRAC access, along with details about iDRAC features, are available at: https://www.dell.com/support/manuals/uk/en/ukbsdt1/poweredge-fx2/idrac8_2.30.30.30_ug/idrac-port-information.

Ports for internal network firewalls

In addition to the preceding, for environments with internal network firewalls and segmentation, the following port configurations between users and the Nasuni Edge Appliance might be necessary for the respective protocol to function.

Inbound (to Nasuni Edge Appliance)

Outbound (from Nasuni Edge Appliance)

Connecting Nasuni Edge Appliances to the Internet at large

Nasuni recommends the following:

• Close all ports that are not actively needed.

• Restrict access to only the client machines that are needed. For example, if you are connecting by using the HTTPS protocol, then do not open the unneeded SMB (CIFS) port also.

HTTPS proxy server configuration

The HTTPS proxy server acts as an intermediary between your client machine and external resources. This allows you to conceal the IP address of the client machine. All HTTPS traffic goes through the proxy server that you specify. HTTPS traffic includes:

• Storage traffic.

• Global File Lock server traffic.

• Antivirus definition files.

• Nasuni Management Console Administrative Access.

• Web Access.

• NOC traffic.

To configure the HTTPS proxy server for a Nasuni Edge Appliance, you need the hostname or IP address of the proxy server, as well as the port number used by the proxy server. If a username and password are required to authenticate with the proxy server, those are also necessary.

You can specify hostnames or IP addresses that need not be routed through the proxy server. These would include trusted hosts that do not require the protection of the proxy server. These hosts are still protected by HTTPS access.

Alternatively, instead of using the HTTPS proxy, you can allow outbound traffic from the IP address of the Nasuni Edge Appliance on port 443. That reduces the load on your HTTPS proxy.

Important: The Nasuni Mobile Access app is scheduled for End-of-Life on May 1, 2024. After this date, the Nasuni Mobile Access app will no longer be supported or available from app stores.

Configuring an Edge Appliance in the DMZ

A “DMZ” is a physical or logical subnetwork that exposes an organization's external-facing services to an untrusted network such as the Internet. The purpose of a DMZ is to add an additional layer of security to an organization's Intranet or LAN: an external network node can access only what is exposed in the DMZ, while the rest of the organization's network is firewalled.

An organization might want to configure a Nasuni Edge Appliance in the DMZ. With such an arrangement, the Edge Appliance can communicate with services that it needs, such as the Nasuni Orchestration Center (NOC), Microsoft Azure, and Amazon AWS. The Edge Appliance would have limited access to the organization’s Intranet, including Active Directory domain controllers there.

Configuring external firewall

The external firewall must allow outbound traffic to the following ports:

• TCP Port 443: allows the Edge Appliance to communicate with services, including the NOC, Microsoft Azure, and Amazon AWS.

If using Nasuni Web Access, the external firewall must allow inbound traffic to the following ports:

• TCP Port 443.

Otherwise, inbound traffic to TCP Port 443 is optional.

Configuring internal firewall

The internal firewall must open the following ports:

• TCP/UDP Port 88: for Kerberos authentication.

• TCP/UDP Port 111, 662, 875, 829, 2049, 2050: for NFS. NFS mounts using TCP are supported by default. NFS mounts using UDP are not supported by default.

• TCP/UDP Port 135: for Remote Procedure Call traffic.

• UDP Port 137: for Samba, Active Directory.

• TCP/UDP Port 389: for LDAP.

• TCP Port 443: for HTTPS: NMC, Web Access, Antivirus.

• TCP Port 445: for SMB/CIFS, Active Directory.

• TCP/UDP Port 464: for Kerberos Password Change.

• TCP Port 3268 and 3269: for Global Catalog.

• TCP Port 8443: for Edge Appliance administration.

An NTP server must be accessible by the appliance. If the chosen NTP server is on the Internet, outbound port 123 must be open.

Platform-specific considerations for installing appliances

Certain platforms require specific configurations for installing appliances.

Microsoft Azure

For installing on Microsoft Azure, follow these suggestions:

• Running the Nasuni Edge Appliance or NMC on the Microsoft Azure platform is like running these systems outside of your business. Unused ports should not be exposed to the public Internet, including the SSH port, port 222.

• Outbound ports: Microsoft Azure does not enable restricting outbound traffic. Nasuni recommends allowing outgoing traffic on all ports to all hosts for the Nasuni Edge Appliance and NMC.

• Inbound: Here are recommendations for the following ports:

  • Ports 111, 662, 875, 892, 2049, and 32803 TCP or UDP: Open to clients needing NFS. NFS mounts using TCP are supported by default. NFS mounts using UDP are not supported by default.

  • Port 123 UDP: An NTP server must be accessible by the appliance. If the chosen NTP server is on the Internet, outbound port 123 must be open.

  • Ports 139 and 445 TCP: Open to clients that need to use SMB/CIFS.

  • Port 161 UDP: Open to clients that need to use SNMP.

  • Port 222 SSH: Close this port. If Nasuni Customer Support requests you to open this port, open this port temporarily to all clients/ranges.

  • Port 443 TCP: Used for administration access to the NMC, and Web Access. If these features are in use, Nasuni recommends opening this port to all clients/ranges. Note that these features must be enabled on the Nasuni Edge Appliance.

  • Port 8443 TCP: Used to administer the Nasuni Edge Appliance. Open to clients that need to use the Nasuni administration interface.

Amazon EC2

For installing on Amazon EC2, follow these suggestions:

• Running the Nasuni Edge Appliance or NMC on the Amazon EC2 platform is similar to running these systems outside of your business. Unused ports should not be exposed to the public Internet, including the SSH port, port 222.

• Outbound ports: Amazon EC2 does not enable restricting outbound traffic. Nasuni recommends allowing outgoing traffic on all ports to all hosts for the Nasuni Edge Appliance and NMC.

• Inbound: Here are recommendations for the following ports:

  • Ports 111, 662, 875, 892, 2049, and 32803 TCP or UDP: Open to clients that need to use NFS. NFS mounts using TCP are supported by default. NFS mounts using UDP are not supported by default.

  • Port 123 UDP: N/A

  • Ports 139 and 445 TCP: Open to clients that need to use SMB/CIFS.

  • Port 161 UDP: Open to clients that need to use SNMP.

  • Port 222 SSH: Close this port. If Nasuni Customer Support requests you to open this port, open this port temporarily to all clients/ranges.

  • Port 443 TCP: Used for administration access to the NMC, and Web Access. If these features are in use, Nasuni recommends opening this port to all clients/ranges. Note that these features must be enabled on the Nasuni Edge Appliance.

  • Port 8443 TCP: Used to administer the Nasuni Edge Appliance. Open to clients that need to use the Nasuni administration interface.

Platform-specific considerations for accessing on-premises storage

If your storage is not in the cloud, it is necessary to ensure that the Nasuni Edge Appliance can reach the storage location. Be sure that the proper port is open between the Nasuni Edge Appliance and the object storage solution.

Platform-specific considerations for accessing storage

Certain platforms require specific configurations for accessing storage.

For all storage platforms, ensure that port 443 (HTTPS) is open between the Nasuni Edge Appliance and the object storage solution.

Amazon

While our IP list for *.nasuni.com is limited to just a few machines, the distributed nature of Amazon S3 means that there are many IP addresses in multiple large blocks, to the point that Amazon does not recommend or offer IP address recommendations.

Tip: If you must use IP addresses (not recommended), note these considerations:

• For Amazon Web Services (AWS), the IP ranges are published here: https://ip-ranges.amazonaws.com/ip-ranges.json.

Microsoft Azure

Tip: If you must use IP addresses (not recommended), note these considerations:

• For Microsoft Azure, the IP ranges are published here: https://www.microsoft.com/en-us/download/confirmation.aspx?id=41653. Download the Microsoft Azure Datacenter IP Ranges XML file.

Google

For accessing Google Cloud Storage, safelist the service IP addresses, as specified in https://www.gstatic.com/ipranges/goog.json.

Nasuni Management Console (NMC)

This section will guide you in configuring your network to install and configure the Nasuni Management Console (NMC).

The Nasuni Management Console (NMC) enables you to monitor and manage many Nasuni Edge Appliances from one central Web-based interface. Using the Nasuni Management Console, you can view the status of all of your Nasuni Edge Appliances, as well as configure their settings. Using the Nasuni Management Console, you can also ensure consistent settings by applying changes to all appliances with one operation.

Summary of frequently used firewall and port settings.
See below for detailed information that might apply to your site.

Port 443

Port 443 (HTTPS) is required to be open on your network (outbound only). Port 443 is used for Nasuni Management Console Administrative Access and for NMC API.

Tip: Certain firewall manufacturers offer Nasuni application types for their safelists or allow lists, which should be enabled.

We distinguish an Administrative path, a Control path, and a Data/Metadata path.

For the Control path, ensure that port 443 is open to the following FQDNs:

Important: It is a best practice not to cache DNS entries for longer than the TTL that Nasuni specifies in DNS entries.

Note: Firewalls or any other security devices or software that process, inspect, or log port 443 traffic from the NMC can affect performance when the NMC is communicating with the cloud.

Tip: If you must use IP addresses (not recommended), note these considerations:

• For Amazon Web Services (AWS), the IP ranges are published here: https://ip-ranges.amazonaws.com/ip-ranges.json. For access to the NOC (Nasuni Orchestration Center), including if using NMC, add to your firewall all IP address ranges with a region value of “us-east-1” or “us-east-2” and a service value of “AMAZON”.

• For Microsoft Azure, the IP ranges are published here: https://www.microsoft.com/en-us/download/confirmation.aspx?id=41653. Download the Microsoft Azure Datacenter IP Ranges XML file.

• Additionally, for Global File Lock, add the "AMAZON" ranges for the following regions, depending on the lock servers you are using.

  • Virginia, US or Oregon, US: us-east-1 and us-west-2.

  • Sydney, Australia or Singapore: ap-southeast-2 and ap-northeast-1.

  • Frankfurt, Germany or Dublin, Ireland: eu-central-1 and eu-west-1.

Other Ports

Optional Ports

The NMC has several ports that are optional to be open on your network:

25 – SMTP: You can configure the Nasuni Edge Appliance to use your local SMTP server. However, if you use the default settings, you must open port 25 on your network. This is so the Nasuni Edge Appliance can send you alerts via SMTP if you configure it to do so.

123 – NTP (Network Time Protocol): An NTP server must be accessible by the appliance. If the chosen NTP server is on the Internet, outbound port 123 must be open. The default NTP servers are from time.nasuni.com.

161 – SNMP: You can configure the Nasuni Edge Appliance to use SNMP. However, if you use the default settings, you must open port 161 on your network.

Ports for internal network firewalls

In addition to the preceding, for environments with internal network firewalls and segmentation, the following port configurations between users and the Nasuni Edge Appliance might be necessary for the respective protocol to function.

Inbound (to NMC)

Outbound (from NMC)

HTTPS proxy server configuration

The HTTPS proxy server acts as an intermediary between your client machine and external resources. This allows you to conceal the IP address of the client machine. All HTTPS traffic goes through the proxy server that you specify. HTTPS traffic includes:

• Nasuni Management Console Administrative Access.

• NOC traffic.

To configure the HTTPS proxy server, you need the hostname or IP address of the proxy server, as well as the port number used by the proxy server. If a username and password are required to authenticate with the proxy server, those are also necessary.

You can specify hostnames or IP addresses that need not be routed through the proxy server. These would include trusted hosts that do not require the protection of the proxy server. These hosts are still protected by HTTPS access.

Alternatively, instead of using the HTTPS proxy, you can allow outbound traffic from the IP address of the NMC on port 443. That reduces the load on your HTTPS proxy.

Configuring internal firewall

The internal firewall must open the following ports:

• TCP/UDP Port 88 (Optional): for Kerberos authentication.

• TCP/UDP Port 135 (Optional): for Remote Procedure Call traffic.

• TCP/UDP Port 389 (Optional): for LDAP.

• TCP Port 443: for HTTPS: NMC.

• TCP/UDP Port 464 (Optional): for Kerberos Password Change.

An NTP server must be accessible by the appliance. If the chosen NTP server is on the Internet, outbound port 123 must be open.

Platform-specific considerations for installing appliances

Certain platforms require specific configurations for installing appliances.

Microsoft Azure

For installing on Microsoft Azure, follow these suggestions:

• Running the Nasuni Edge Appliance or NMC on the Microsoft Azure platform is like running these systems outside of your business. Unused ports should not be exposed to the public Internet, including the SSH port, port 222.

• Outbound ports: Microsoft Azure does not enable restricting outbound traffic. Nasuni recommends allowing outgoing traffic on all ports to all hosts for the Nasuni Edge Appliance and NMC.

• Inbound: Here are recommendations for the following ports:

  • Port 123 UDP: N/A

  • Port 161 UDP: Open to clients that need to use SNMP.

  • Port 222 SSH: Close this port. If Nasuni Customer Support requests you to open this port, open this port temporarily to all clients/ranges.

  • Port 443 TCP: Used for administration access to the NMC. If these features are in use, Nasuni recommends opening this port to all clients/ranges.

Amazon EC2

For installing on Amazon EC2, follow these suggestions:

• Running the Nasuni Edge Appliance or NMC on the Amazon EC2 platform is similar to running these systems outside of your business. Unused ports should not be exposed to the public Internet, including the SSH port, port 222.

• Outbound ports: Amazon EC2 does not enable restricting outbound traffic. Nasuni recommends allowing outgoing traffic on all ports to all hosts for the Nasuni Edge Appliance and NMC.

• Inbound: Here are recommendations for the following ports:

  • Port 123 UDP: N/A.

  • Port 161 UDP: Open to clients that need to use SNMP.

  • Port 222 SSH: Close this port. If Nasuni Customer Support requests you to open this port, open this port temporarily to all clients/ranges.

  • Port 443 TCP: Used for administration access to the NMC. If these features are in use, Nasuni recommends opening this port to all clients/ranges.

Nasuni Access Anywhere (NAA)

This section documents the inbound ports and outbound services for Nasuni Access Anywhere Server.

External Service Connectivity

The NAA Appliance requires connectivity to the following external services.

Note the following:

• “Ingress” refers to traffic originating from outside of the NAA Server and being routed to the NAA Server.

• “Egress” refers to traffic originating from the NAA Server and being routed to another listed service.

This list DOES NOT include:

• Storage Connectors — that the customers are using. The customer should consult with their storage vendor regarding these.

• SMTP or Mail Relay Services — Customers are required to bring their own. This would be egress access, but the destination is unknown to Nasuni.

• Integrations such as NAA’s Microsoft Teams integration happen directly between the User and NAA Server. It is assumed that the users can reach the NAA Server without restriction through their web browser.

• It is assumed that local user machines are not restricted in terms of hosts that they can connect to directly. For example, NAA’s AutoCAD Viewer renders pages hosted at autocad-viewer.storagemadeeasy.com.

Nasuni File IQ Appliance

This section documents the inbound ports and outbound services for Nasuni File IQ.

Note: The Nasuni Edge Appliance (NEA) port configurations also apply to the Nasuni File IQ Appliance.

Port 9093 (Outbound)

Ensure that port 9093 is open to the following FQDNs:

Other Ports (Inbound)

Port 443

Port 443 is used for NIQ.

We distinguish an Administrative path, a Control path, and a Data/Metadata path.

For the Control path, ensure that port 443 is open to the following FQDNs:

Technical Support

Online self-help resources and Technical Support are available at www.nasuni.com/support.

Copyright © 2010-2024 Nasuni Corporation. All rights reserved.