Ports to open through the firewall by nodeType in a large cluster
I have seen a few questions posted, with regard to ports in use, but no answer that provides specific guidance.
we are aware of the ports in use, and we can certainly guess at which nodeTypes within a large scale cluster will require the port to be opened in the node level firewall (Linux), but does Pega not provide a comprehensive guide to this in the documentation somewhere ?
obviously 5701 is required on all nodes or the cluster will not communicate, DDS nodes will require 9042 for Cassandra to communicate, etc ...
but does Pega not provide a comprehensive list of ports required by node type?
Search, ADM, RTDG, BackgroundProcessing, Stream, Realtime, Batch ...
list of known ports:
Port IP Address Service detail
----- ---------- ------------------------------------------
80 all http 80/tcp # WorldWideWeb HTTP
5701 all PRPCcluster 5701/tcp # PRPC Hazelcast cluster
5751 all prpcVBD 5751/tcp # PRPC Visual Business Director
I have seen a few questions posted, with regard to ports in use, but no answer that provides specific guidance.
we are aware of the ports in use, and we can certainly guess at which nodeTypes within a large scale cluster will require the port to be opened in the node level firewall (Linux), but does Pega not provide a comprehensive guide to this in the documentation somewhere ?
obviously 5701 is required on all nodes or the cluster will not communicate, DDS nodes will require 9042 for Cassandra to communicate, etc ...
but does Pega not provide a comprehensive list of ports required by node type?
Search, ADM, RTDG, BackgroundProcessing, Stream, Realtime, Batch ...
list of known ports:
Port IP Address Service detail
----- ---------- ------------------------------------------
80 all http 80/tcp # WorldWideWeb HTTP
5701 all PRPCcluster 5701/tcp # PRPC Hazelcast cluster
5751 all prpcVBD 5751/tcp # PRPC Visual Business Director
7003 external PRPC 7003/tcp # PRPC (stream data)
9300 external PRPCsearch 9300/tcp # PRPC Elastic Search
7000 external prpcdNode 7000/tcp # PRPC DNode (cassandra)
9042 external cassandra 9042/tcp # PRPC Cassandra CQL3
7199 loopback cassandra 7199/tcp # PRPC Cassandra JMX
9092 external kafka 9092/tcp # PRPC kafka
2181 loopback kafka 2181/tcp # PRPC kafka zookeeper
9999 loopback kafka 9999/tcp # PRPC kafka JMX
Pegasystems Inc.
GB
Hi, here's the list of ports for DDS, Stream and VBD.
Stream service : Broker=9092,Internal Keeper=2181,9999, HTTP Streaming = 7003
VBD : Hazelcast=5751
DDS service : 7000/(7001) (if SSL is enabled), CQL=9042, JMX=7199
Hope this helps, let me know if there's anything else you need.
Regards
Nigel Peach
Updated: 31 Mar 2021 10:47 EDT
Ford Motor Company
CA
IHMO the documentation should have a diagram something like this ... so that you clearly understand when you are configuring a large scale environment and use local firewalls on each server, you know which ports to open up for inter-server or extra-environment communications ... all ports are NOT required on all servers, only for the individual servers where you expose that particular PRPC Service, while others are required to be open for ALL defined servers in an environment.
note: I am not 100% clear on ports 7000 and 7001, if they are connected as shown here or not ... (see the attached diagram)
IHMO the documentation should have a diagram something like this ... so that you clearly understand when you are configuring a large scale environment and use local firewalls on each server, you know which ports to open up for inter-server or extra-environment communications ... all ports are NOT required on all servers, only for the individual servers where you expose that particular PRPC Service, while others are required to be open for ALL defined servers in an environment.
note: I am not 100% clear on ports 7000 and 7001, if they are connected as shown here or not ... (see the attached diagram)
which clearly lays out the ports in use and what PROCESS is actually using that port ...
if you inspect the ports that are listening, you can see more clearly which IP address is used, to see if the communications are local.
Port IP Address Service detail
----- ---------- ------------------------------------------
5701 PRPCcluster 5701/tcp # PRPC Hazelcast cluster
5751 prpcVBD 5751/tcp # PRPC Visual Business Director
9300 Proprietary information hidden PRPCsearch 9300/tcp # PRPC Elastic Search
7000 Proprietary information hidden prpcdNode 7000/tcp # PRPC DNode (cassandra)
7199 Proprietary information hidden cassandra 7199/tcp # PRPC Cassandra JMX
9042 Proprietary information hidden cassandra 9042/tcp # PRPC Cassandra CQL3
7003 Proprietary information hidden PRPC 7003/tcp # PRPC (stream data)
2181 Proprietary information hidden kafka 2181/tcp # PRPC kafka zookeeper
9092 Proprietary information hidden kafka 9092/tcp # PRPC kafka
9999 Proprietary information hidden kafka 9999/tcp # PRPC kafka JMX
as you can see some of the communication is LOCAL to the host (using loopback) by default, although you can expose JMX to an external login if req'd with a configuration change.
some of the ports are for EXTERNAL communications to the ENV (Stream Service, Pega Exposed Services), while others are just for PRPC node to node communications (Hazelcast, Search, VBD)
I have also added the standard http and https ports when you expose a Customer Service endpoint in PRPC ... the ACTUAL ports will depend upon the configuration of your Application Server, i.e. tomcat would use 8080 and 8443 by default, WebSphere, WebLogic, etc. all have their own well-known defaults ...