UNSOLVED
Ports / Firewall
Hello,
I've been working with my Security team to get the right ports opened for OIVV. We have opened everything listed here:
With regards to ports 2049 and 4001-4004, they are listed as being UDP. However, we see them as TCP on our firewall. We would like to confirm which protocol these ports should be. Thanks!
Interesting...we didn't open 635, but it could be because 111 was open. We ended up having to open the following from the oivv appliance to the ESXi hosts:
UDP 162
HTTPS 443
TCP 111
TCP 4001-4003
TCP 2049
This seems to be working as I have been pushing out firmware updates and using the iDRAC functionality without any issues.
dougrowland
6 Posts
2687
0
Posted July 7th, 2014 14:00
ugh. Forum truncated my table. Let's try again:
Source Host Source IP address
or subnetTCP or UDP? Dest Host Dest IP Dest Port omvcenter 172.31.16.100 UDP ESXi hosts 162 omvcenter 172.31.16.100 UDP ESXi hosts 11620 omvcenter 172.31.16.100 TCP ESXi hosts 443 omvcenter 172.31.16.100 TCP iDracs 443 omvcenter 172.31.16.100 TCP iDracs 4433 omvcenter 172.31.16.100 UDP iDracs 2049 omvcenter 172.31.16.100 UDP iDracs 4001-4004 ESXi hosts UDP omvcenter 172.31.16.100 162 ESXi hosts UDP omvcenter 172.31.16.100 11620 ESXi hosts TCP omvcenter 172.31.16.100 443 iDracs TCP omvcenter 172.31.16.100 4433 iDracs UDP omvcenter 172.31.16.100 2049 iDracs UDP omvcenter 172.31.16.100 4001-4004 dougrowland
6 Posts
2687
0
Posted July 7th, 2014 14:00
I realize you are asking Z0nker, but here's what I originally requested:
Source Host Name
(If Applicable)Source IP address
or subnetTCP or UDP? Destination Host Name
(If Applicable)Destination Host IP Address
or subnetDestination Port omvcenter 172.31.16.100 UDP See list of ESXi hosts 162 omvcenter 172.31.16.100 UDP See list of ESXi hosts 11620 omvcenter 172.31.16.100 TCP See list of ESXi hosts 443 omvcenter 172.31.16.100 TCP See list of iDracs 443 omvcenter 172.31.16.100 TCP See list of iDracs 4433 omvcenter 172.31.16.100 UDP See list of iDracs 2049 omvcenter 172.31.16.100 UDP See list of iDracs 4001-4004 See list of ESXi hosts UDP omvcenter 172.31.16.100 162 See list of ESXi hosts UDP omvcenter 172.31.16.100 11620 See list of ESXi hosts TCP omvcenter 172.31.16.100 443 See list of iDracs TCP omvcenter 172.31.16.100 4433 See list of iDracs UDP omvcenter 172.31.16.100 2049 See list of iDracs UDP omvcenter 172.31.16.100 4001-4004 Everything seemed to work except mounting of the NFS shares, I now have another request into security to get port 111 opened up.
Source Host Name
(If Applicable)Source IP address
or subnetTCP or UDP? Destination Host Name
(If Applicable)Destination Host IP Address
or subnetDestination Port See list of iDracs UDP/TCP omvcenter 172.31.16.100 111
Hopefully it will work fine after that.
I'm still waiting on the firewall team to open the ports. Does oiw work in your environment?
This is the message I get when it breaks:
[Firmware Update] File: R810_BIOS_F6M82_WN32_2.9.0.EXE - Status: Failed - Message: iDRAC - The remote share location that has the ISO/DUP image did not mount correctly.
It works!
I asked the firewall team to allow me read-only access to the firewall logs and I noticed that port tcp111 and tcp 635 were being blocked on one of the two firewalls between the iDRAC and the virtual appliance. They just pushed the new rule set and bingo, it works now.Thanks everyone for your help and input! much appreciate.
Greevous
dougrowland
6 Posts
2687
0
Posted June 18th, 2014 14:00
At least you got that much. I went off an ealier document:
http://en.community.dell.com/techcenter/systems-management/w/wiki/3840.ports-used-by-the-openmanage-integration-for-vmware-vcenter.aspx
It didn't mention port 111 for NFS. So I got my firewall request approved and implemented, but it won't mount the directory for patch updates (or ESX installs). Anyway, I got the firewall guys to run a report. The firewall is blocking port 111 and port 635. I can't find a reference to 635 anywhere except that it is used for NFS. I wonder if 635 will still be needed if I get port 111 opened up?