Network Requirements

This page lists every network connection the FireMon Connector (native binary or OVA appliance) needs to make. Use it with your network team to provision firewall rules and DNS for the Connector's network segment.

Connection direction

The Connector only initiates outbound connections. Nothing connects to it, so no inbound firewall rules are required. The OVA appliance additionally runs a host firewall with a default-deny inbound policy and ships with SSH disabled, so it opens no listening ports of its own.

Required outbound destinations

Every destination below is tcp/443 (HTTPS or secure WebSocket over TLS).

Purpose	Hostname	Port
API (jobs, accounts)	api.prod.firemon.cloud	443
WebSocket (push)	ws.connect.prod.firemon.cloud	443
Updater (release feed)	releases.prod.firemon.cloud	443

DNS

The Connector must be able to resolve every hostname above. If you use split-horizon or internal-only DNS, either:

• Forward queries for *.firemon.cloud to a public resolver, or
• Allow the Connector to query a public resolver (e.g. 1.1.1.1, 8.8.8.8) on udp/53 and tcp/53.

These hostnames resolve to CloudFront edge IPs that rotate. Static /etc/hosts entries are not supported — they will silently break the day the IP rotates.

Time (NTP)

TLS certificate validation requires the system clock to be within a few minutes of real time. The appliance attempts NTP at boot; if the network blocks it, the clock can drift and every TLS handshake will fail with a confusing certificate error.

Allow either:

• Outbound udp/123 to a public NTP pool (pool.ntp.org), or
• Outbound udp/123 to your internal NTP servers (provided via DHCP option 42 or your static network configuration).

Outbound to your on-prem integrations

The Connector also needs to reach whatever on-prem systems it's integrating with — your Panorama, your Infoblox Grid Manager, etc. Those addresses are specific to your deployment; allow outbound access from the Connector's network segment to each integration's management API. See Integrations for what each one needs.

Verifying connectivity

OVA appliance: open the console wizard and choose Test cloud connectivity (available from either the pairing menu or the status menu). It runs DNS + tcp/443 checks against every endpoint above and reports a per-line pass/fail.

Either deployment, from a shell:

firemon-connector --check-connectivity

The command exits 0 if all checks pass, 1 otherwise. Example output:

  API        api.prod.firemon.cloud                   DNS OK | 443 OK
  WebSocket  ws.connect.prod.firemon.cloud            DNS OK | 443 OK
  Updater    releases.prod.firemon.cloud              DNS FAIL | 443 FAIL
    DNS resolution failed

Troubleshooting common failures

Symptom	Likely cause
All hostnames fail DNS	Resolver unreachable, or *.firemon.cloud isn't allowed through
DNS resolves, but 443 fails for every host	Egress firewall blocks all outbound 443
API works, WebSocket fails	Firewall allows the API hostname but not WebSocket Secure (WSS)
Registration succeeds, but runtime errors appear afterward	NTP failure → clock drift → TLS failures