PowerProtect Data Manager 19.11 Kubernetes User Guide

PDF

Port usage

This table summarizes the port requirements for PowerProtect Data Manager and its associated internal and external components or systems. PowerProtect Data Manager audits and blocks all ports that are not listed below.

The PowerProtect DD Security Configuration Guide provides more information about ports for DD systems and protocols.

Table 1. PowerProtect Data Manager port requirementsPowerProtect Data Manager port requirements
Source system	Destination system	Port	Protocol	TLS supported	Notes
Backup clients	DD system	111	TCP	No	Dynamic port detection and mapping. Used only for port verification, not for data.
Backup clients¹	DD system	2049	Proprietary	TLS 1.2	Optional DD Boost client TLS encryption.
Backup clients¹	DD system	2052	TCP	No	NFS mountd, not for data.
Backup clients	DD Global Scale	2053	TCP	TLS 1.2	DD Boost connection.
Backup clients¹	PowerProtect Data Manager	8443	HTTPS	TLS 1.2	REST API service.
Backup clients	VMAX SE server	2707	Proprietary	TLS 1.2	Backup clients require access to the default port 2707 on the VMAX SE server. Applies to Storage Direct.
Callhome (SupportAssist)	PowerProtect Data Manager	22	SSH	TLS 1.2	SSH for support and administration. Encrypted by private key or optional certificates.
Callhome (SupportAssist)	PowerProtect Data Manager	443	HTTPS	TLS 1.2	SSH for remote support.
ESXi	DD system	111	TCP	No	Dynamic port detection and mapping. Used only for port verification, not for data.
ESXi	DD system²	2049	Proprietary	TLS 1.2	NFS datastore and DD Boost. NFS is unencrypted. DD Boost is encrypted.
ESXi	DD system²	2052	TCP	No	NFS mountd, not for data.
Kubernetes cluster	DD system	111	TCP	No	Dynamic port detection and mapping. Used only for port verification, not for data.
Kubernetes cluster	DD system	2049	Proprietary	TLS 1.2	Optional DD Boost client TLS encryption.
Kubernetes cluster	DD system	2052	TCP	TLS 1.2	NFS mountd, not for data.
Kubernetes cluster	ESXi	902	TCP	TLS 1.2	vSphere client access for PVCs using VMware CSI. Not required for Tanzu Kubernetes Guest clusters.
Kubernetes cluster	Protection engine	9090	HTTPS	TLS 1.2/1.3	Required for Tanzu Kubernetes Guest clusters.
Kubernetes cluster	vCenter	443	HTTPS	TLS 1.2	Primary management interface for vSphere using the vCenter Server, including the vSphere client for PVCs using VMware CSI. Not required for Tanzu Kubernetes Guest clusters.
NAS protection engine	NAS appliance	443	HTTPS	TLS 1.2	Management access for Unity and PowerStore appliances.
NAS protection engine	NAS appliance	8080	HTTPS	TLS 1.2	Management access for PowerScale/Isilon appliances.
PowerProtect Data Manager	Backup clients	7000	HTTPS	TLS 1.2	Microsoft SQL Server, Oracle, Microsoft Exchange Server, SAP HANA, and file system. Requirement applies to Application Direct and VM Direct.
PowerProtect Data Manager	Callhome (SupportAssist)	25	SMTP	TLS 1.2	TLS version in use depends on the mail server. TLS used where possible.
PowerProtect Data Manager	Callhome (SupportAssist)	465	TCP	TLS 1.2
PowerProtect Data Manager	Callhome (SupportAssist)	587	TCP	TLS 1.2
PowerProtect Data Manager	Callhome (SupportAssist)	9443	HTTPS	TLS 1.2	REST API for service notification.
PowerProtect Data Manager	DD system	111	TCP	No	Dynamic port detection and mapping. Used only for port verification, not for data.
PowerProtect Data Manager	DD system	2049	Proprietary	No	Server DR NFS connections. Used only for metadata, client name, and indexing, not for backup data.
PowerProtect Data Manager	DD system	2052	TCP/UDP	No	NFS mountd, not for data.
PowerProtect Data Manager	DD system	3009	HTTPS	TLS 1.2	Communication with DDMC for configuration and discovery.
PowerProtect Data Manager	ESXi	443	HTTPS	TLS 1.2	Depends on ESXi configuration and version.
PowerProtect Data Manager	Kubernetes cluster	6443	Proprietary	TLS 1.2	Connects to the Kubernetes API server. Encryption depends on the Kubernetes cluster configuration. PowerProtect Data Manager supports TLS 1.2.
PowerProtect Data Manager	LDAP server	389	TCP/UDP	No	Insecure LDAP port, outbound only. Use port 636 for encryption.
PowerProtect Data Manager	LDAP server	636	TCP	TLS 1.2	LDAPS, depending on LDAP configuration in use. Outbound only.
PowerProtect Data Manager	NAS appliance	443	HTTPS	TLS 1.2	Management access for Unity and PowerStore appliances.
PowerProtect Data Manager	NAS appliance	8080	HTTPS	TLS 1.2	Management access for PowerScale/Isilon appliances.
PowerProtect Data Manager	NAS share	139	TCP	TLS 1.2	Windows file server shares (CIFS).
PowerProtect Data Manager	NAS share	443	HTTPS	TLS 1.2	NetApp shares (NFS and CIFS). Also used for NAS share verification check.
PowerProtect Data Manager	NAS share	445	TCP	TLS 1.2	Windows file server shares (CIFS).
PowerProtect Data Manager	NAS share	2049	TCP	TLS 1.2	Linux file server shares (NFS).
PowerProtect Data Manager	NTP server	123	NTP	No	Time synchronization.
PowerProtect Data Manager	PowerProtect Data Manager - Catalog	9760	TCP		Internal only. Blocked by firewall.
PowerProtect Data Manager	PowerProtect Data Manager - Configuration Manager	55555	TCP		Internal only. Blocked by firewall.
PowerProtect Data Manager	PowerProtect Data Manager - Elastic Search	9200	TCP		Internal only.
PowerProtect Data Manager	PowerProtect Data Manager - Elastic Search	9300	TCP		Internal only.
PowerProtect Data Manager	PowerProtect Data Manager - Embedded VM proxy	9095	TCP		Internal only. Blocked by firewall.
PowerProtect Data Manager	PowerProtect Data Manager - Quorum peer	2181	TCP		Internal only. Blocked by firewall.
PowerProtect Data Manager	PowerProtect Data Manager - RabbitMQ	5672	TCP		Internal only. Blocked by firewall.
PowerProtect Data Manager	PowerProtect Data Manager - Secrets manager	9092	TCP		Internal only.
PowerProtect Data Manager	PowerProtect Data Manager - VM Direct infrastructure manager	9097	TCP		Internal only. Blocked by firewall.
PowerProtect Data Manager	PowerProtect Data Manager - VM Direct orchestration	9096	TCP		Internal only. Blocked by firewall.
PowerProtect Data Manager	Protection engine	22	SSH	TLS 1.2	SSH for support and administration. Encrypted by private key or optional certificates.
PowerProtect Data Manager	Protection engine	9090	HTTPS	TLS 1.2	REST API service.
PowerProtect Data Manager	Protection engine	9613³	Proprietary	TLS 1.2
PowerProtect Data Manager	Reporting engine	9002	TCP	TLS 1.2	REST API service.
PowerProtect Data Manager	Search Engine	9613	Proprietary	TLS 1.2	Infrastructure node agent management of Search Engine nodes.
PowerProtect Data Manager	Search Engine	14251	Proprietary	TLS 1.2	Search query REST API endpoint.
PowerProtect Data Manager	SMI-S	5989	HTTPS	TLS 1.2	Communication with SMI-S provider. Discovery.
PowerProtect Data Manager	Storage Direct system	3009	HTTPS	TLS 1.2	Discovery.
PowerProtect Data Manager	Syslog server	514	TCP/UDP	TLS 1.2	Log forwarding to Syslog server.
PowerProtect Data Manager	Syslog server	6514	TCP	TLS 1.2	Log forwarding to Syslog server.
PowerProtect Data Manager	Syslog server	10514	TCP	TLS 1.2	Log forwarding to Syslog server.
PowerProtect Data Manager	UI	443	HTTPS	TLS 1.2	Between the browser host and the PowerProtect Data Manager system.
PowerProtect Data Manager	Update Manager UI	14443	HTTPS	TLS 1.2	Connects the host that contains the update package to the PowerProtect Data Manager system.
PowerProtect Data Manager	vCenter	443	HTTPS	TLS 1.2	vSphere API for direct restore, discovery, initiating Hot Add transport mode, and restores including Instant Access restore. Depends on vCenter configuration.
PowerProtect Data Manager	vCenter	7444	Proprietary	TLS 1.2	vCenter single sign-on.
PowerProtect Data Manager	VMAX Solutions Enabler server	2707	Proprietary	TLS 1.2	Storage Direct functionality. PowerProtect Data Manager uses the Solutions Enabler default server port for configuration steps and to control active snapshot management for SnapVX, including for PP-VMAX.
Protection engine	DD system	111	TCP	No	Dynamic port detection and mapping. Used only for port verification, not for data.
Protection engine	DD system	2049	Proprietary	TLS 1.2	Optional DD Boost client TLS encryption.
Protection engine	DD system	2052	TCP	No	NFS mountd, not for data.
Protection engine	DD system	3009	HTTPS	TLS 1.2	DD REST API service.
Protection engine	ESXi	443	HTTPS	TLS 1.2	Client connections.
Protection engine	ESXi	902	TCP	TLS 1.2	vSphere client access.
Protection engine	Guest VM	9613³	Proprietary	TLS 1.2	VM Direct Agent provides capabilities for file-level restore and application-aware protection.
Protection engine	NAS agent Docker container	443	HTTPS	TLS 1.2	Applies for NAS only. Internal only. Blocked by firewall.
Protection engine	Search Engine	14251	TCP	TLS 1.2	Search query REST API endpoint.
Protection engine	vCenter	443	HTTPS	TLS 1.2	Primary management interface for vSphere using the vCenter server, including the vSphere client.
Protection engine	vCenter	7444	TCP	TLS 1.2	Secure token service.
Protection engine	Protection engine - RabbitMQ	4369	TCP		Internal only. Blocked by firewall.
Protection engine	Protection engine - RabbitMQ	5672	TCP		Internal only. Blocked by firewall.
Reporting engine	PowerProtect Data Manager	8443	TCP	TLS 1.2	REST API service for collecting reporting data.
Search Engine	DD system	111	TCP	No	Server DR. Dynamic port detection and mapping. Used only for port verification, not for data.
Search Engine	DD system	2049	Proprietary	No	Server DR NFS connections. Used only for metadata, client name, and indexing, not for backup data.
Search Engine	DD system	2052	TCP/UDP	No	Server DR. NFS mountd, not for data.
Source DD system	Target DD system	111	TCP	No	Dynamic port detection and mapping. Used only for port verification, not for data.
Source DD system	Target DD system	2049	Proprietary	TLS 1.2
Source DD system	Target DD system	2051	Proprietary	TLS 1.2
Source DD system	Target DD system	2052	TCP	No	NFS mountd, not for data.
Target DD system	Source DD system	111	TCP	No	Dynamic port detection and mapping. Used only for port verification, not for data.
Target DD system	Source DD system	2049	Proprietary	TLS 1.2
Target DD system	Source DD system	2051	Proprietary	TLS 1.2
Target DD system	Source DD system	2052	TCP	No	NFS mountd, not for data.
Update Manager UI	PowerProtect Data Manager	14443	HTTPS	TLS 1.2	Connects the host that contains the update package to the PowerProtect Data Manager system.
User	PowerProtect Data Manager	22	SSH	TLS 1.2	SSH for support and administration. Encrypted by private key or optional certificates.
User	PowerProtect Data Manager	80	HTTP	No	Redirect to HTTPS.
User	PowerProtect Data Manager	443	HTTPS	TLS 1.2	Connects the browser host to the PowerProtect Data Manager system.
User	PowerProtect Data Manager	8443	HTTPS	TLS 1.2	REST API service.
User	Search Engine	22	SSH	TLS 1.2	SSH for support and administration. Encrypted by private key or optional certificates.
User	Protection engine	22	SSH	TLS 1.2	SSH for support and administration. Encrypted by private key or optional certificates.
vCenter	ESXi	443	HTTPS	TLS 1.2	vSphere client to ESXi/ESX host management connection.
vCenter	PowerProtect Data Manager	443	HTTPS	TLS 1.2	vCenter plug-in UI.
vCenter	PowerProtect Data Manager	8443	HTTPS	TLS 1.2	REST API service.
vCenter	PowerProtect Data Manager	9009	HTTPS	TLS 1.2/1.3	vSphere APIs for Storage Awareness (VASA) provider, storage policy based management (SPBM) service within PowerProtect Data Manager.

The term "protection engine" in this table refers to all types of protection engine: VM Direct, NAS, and Kubernetes, unless otherwise specified.

For VM application-aware backups, open the ports for the protection engine and for the backup clients on the guest VM.

For NAS assets, open any custom ports between PowerProtect Data Manager, the NAS protection engine, and the NAS that may be required for access to specific shares. You can supply custom port information for connections to NAS appliances and shares as part of the process for adding NAS asset sources.