Consolidated Deployment Firewall and Port Matrix

This guide provides a single-page reference for all ports that must be open across a Cisco Crosswork Assurance deployment. It consolidates platform, collector, agent, and browser-access ports into a single matrix, including the additional rows required for no-DNS mode.

Before You Begin

You need:

• Deployment inventory: install type (VM or Kubernetes), which collectors, which agents, and whether the deployment runs in DNS mode or no-DNS mode.
• Access to your firewall's rule set to add or verify rules.

Quick Reference

For per-component detail, including internal service health endpoints and a network topology diagram, see Complete Port Matrix and Firewall Rules.

External Access Ports

External access ports must be reachable from outside the cluster for user and administrative access. The specific ports depend on whether you use DNS mode or no-DNS mode.

DNS Mode (Recommended)

In DNS mode, all applications share port 443 and are differentiated by hostname. This is the recommended configuration for production deployments.

No-DNS Mode

In no-DNS mode, each application uses a different port and is accessed by IP.

Admin Console

The KOTS Admin Console is always accessible on port 30000 regardless of DNS mode.

Inter-Node Ports

These ports must be open bidirectionally between all cluster nodes.

Local Process Ports

These ports are local only and should not need firewall rules unless you have host-based filtering.

Sensor Agent Ports

Sensors send telemetry to the platform and receive configuration updates over port 443.

For installation-specific requirements, see Assurance Sensor Agent Installation Guidelines.

Firewall Rule Examples

iptables (Linux)

# External access (DNS mode)
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 30000 -j ACCEPT

# Inter-node communication (replace with your node IPs)
NODE_IPS="<node-1-ip> <node-2-ip> <node-3-ip>"
for NODE_IP in $NODE_IPS; do
  iptables -A INPUT -s $NODE_IP -p tcp --dport 2380 -j ACCEPT
  iptables -A INPUT -s $NODE_IP -p udp --dport 4789 -j ACCEPT
  iptables -A INPUT -s $NODE_IP -p tcp --dport 6443 -j ACCEPT
  iptables -A INPUT -s $NODE_IP -p tcp --dport 9091 -j ACCEPT
  iptables -A INPUT -s $NODE_IP -p tcp --dport 9443 -j ACCEPT
  iptables -A INPUT -s $NODE_IP -p tcp --dport 10249 -j ACCEPT
  iptables -A INPUT -s $NODE_IP -p tcp --dport 10250 -j ACCEPT
  iptables -A INPUT -s $NODE_IP -p tcp --dport 10256 -j ACCEPT
done

firewalld (RHEL / CentOS)

# External access
firewall-cmd --permanent --add-port=443/tcp
firewall-cmd --permanent --add-port=30000/tcp

# Inter-node (create zone for cluster)
firewall-cmd --permanent --new-zone=pca-cluster
firewall-cmd --permanent --zone=pca-cluster --add-source=<node-cidr>
firewall-cmd --permanent --zone=pca-cluster --add-port=2380/tcp
firewall-cmd --permanent --zone=pca-cluster --add-port=4789/udp
firewall-cmd --permanent --zone=pca-cluster --add-port=6443/tcp
firewall-cmd --permanent --zone=pca-cluster --add-port=9091/tcp
firewall-cmd --permanent --zone=pca-cluster --add-port=9443/tcp
firewall-cmd --permanent --zone=pca-cluster --add-port=10249/tcp
firewall-cmd --permanent --zone=pca-cluster --add-port=10250/tcp
firewall-cmd --permanent --zone=pca-cluster --add-port=10256/tcp

firewall-cmd --reload

Cloud Security Groups (AWS / GCP / Azure)

# Inbound Rules
Type        Protocol  Port    Source
HTTPS       TCP       443     0.0.0.0/0 (or restricted CIDR)
Custom TCP  TCP       30000   Admin IP range
Custom TCP  TCP       2380    Cluster security group (self)
Custom UDP  UDP       4789    Cluster security group (self)
Custom TCP  TCP       6443    Cluster security group (self)
Custom TCP  TCP       9091    Cluster security group (self)
Custom TCP  TCP       9443    Cluster security group (self)
Custom TCP  TCP       10249   Cluster security group (self)
Custom TCP  TCP       10250   Cluster security group (self)
Custom TCP  TCP       10256   Cluster security group (self)

Verification

For each row, verify the port is reachable from the source host to the destination:

# from source host, replace <dst> and <port>
nc -vz <dst> <port>

To see which ports are listening on a host:

ss -tlnp

If a check fails, follow the Network Connectivity Checklist.

Related Documentation

• Complete Port Matrix and Firewall Rules — per-component detail, topology diagram, and internal service health endpoints
• Firewall and Port Requirements
• Network Connectivity Checklist
• Assurance Sensor Agent Installation Guidelines
• Browser and Connectivity Requirements