Skip to main content

Network Requirements

This page lists every network connection the FireMon Connector (native binary or OVA appliance) needs to make. Use it with your network team to provision firewall rules and DNS for the Connector's network segment.

Connection direction​

The Connector only initiates outbound connections. Nothing connects to it, so no inbound firewall rules are required. The OVA appliance additionally runs a host firewall with a default-deny inbound policy and ships with SSH disabled, so it opens no listening ports of its own.

Required outbound destinations​

Every destination below is tcp/443 (HTTPS or secure WebSocket over TLS).

PurposeHostnamePort
API (jobs, accounts)api.prod.firemon.cloud443
WebSocket (push)ws.connect.prod.firemon.cloud443
Updater (release feed)releases.prod.firemon.cloud443

DNS​

The Connector must be able to resolve every hostname above. If you use split-horizon or internal-only DNS, either:

  • Forward queries for *.firemon.cloud to a public resolver, or
  • Allow the Connector to query a public resolver (e.g. 1.1.1.1, 8.8.8.8) on udp/53 and tcp/53.

These hostnames resolve to IP addresses that change over time. Static /etc/hosts entries are not supported; they fail without warning when the IPs change.

Time (NTP)​

TLS certificate validation requires the system clock to be within a few minutes of real time. The appliance's operating system keeps its clock synced over NTP; if the network blocks NTP, the clock can drift and TLS handshakes fail with misleading certificate errors.

Allow either:

  • Outbound udp/123 to Ubuntu's default time server (ntp.ubuntu.com), which the appliance uses unless DHCP supplies one, or
  • Outbound udp/123 to your internal NTP servers, provided via DHCP option 42. The static IP settings have no NTP field, so an appliance on a static IP uses ntp.ubuntu.com.

Operating system updates (OVA appliance)​

The appliance installs Ubuntu security updates on its own (see Security & Data Protection), which needs outbound tcp/80 and tcp/443 to Ubuntu's package mirrors, archive.ubuntu.com and security.ubuntu.com. Without them the Connector keeps working, but the operating system stops receiving security updates.

Outbound to your on-prem integrations​

The Connector also needs to reach whatever on-prem systems it's integrating with, such as your Panorama, NSX Manager, Firewall Management Center, FortiManager, or Infoblox Grid Manager. Those addresses are specific to your deployment, so allow outbound access from the Connector's network segment to each integration's management API. See Integrations for what each one needs.

Verifying connectivity​

OVA appliance: open the console wizard and choose Test cloud connectivity (available from either the pairing menu or the status menu). It runs DNS + tcp/443 checks against every endpoint above and reports a per-line pass/fail.

Either deployment, from a shell:

firemon-connector --check-connectivity

The command exits 0 if all checks pass, 1 otherwise. Example output:

  API        api.prod.firemon.cloud                   DNS OK | 443 OK
  WebSocket  ws.connect.prod.firemon.cloud            DNS OK | 443 OK
  Updater    releases.prod.firemon.cloud              DNS FAIL | 443 FAIL
    DNS resolution failed

If a check fails, Troubleshooting: Connectivity maps each symptom to its likely cause.

firemon-connector --print-endpoints prints the environment and the three URLs the Connector uses, so you can check a firewall rule against them.

Last updated on