DataMiner 10.5 CU16: NATS Port Requirements for CORE/Leaf Topologies

33 viewsadl2099 BrokerGateway dual core NATS
3
0 Comments

Hi Dojo, this is a follow up question from this previous post on broker gateway tests:

we're now at the intermediate stage and running the upgraded broker gateway in staging with DataMiner 10.5 CU16 and a NATS topology with leaf & core nodes - I would like to clarify the expected port requirements and connection directions for CORE/Leaf topologies (source/destination ports for each DMA).

This staging system DMS has currently two COREs interconnected via NATS gateways, with a remote Leaf DMA: in this scenario we have one leaf node sample, originally connected to CORE 1 and I'd like to achieve confirmation of the ports & services that the leaf node should connect to in CORE1 and CORE2.
The goal is keeping 2 COREs active until the legacy CORE can be removed from the DMS cluster.

A confirmation of the following would also be helpful: (I'll try to edit later to add pictures)

  • Which ports must listen on which nodes for the current DataMiner/BrokerGateway implementation: 4222, 6222, 7222, 7422, 8222 and 9090
  • Connection direction and firewall requirements, distinguishing listening/destination ports from client-side dynamic source ports. Our netstat output shows the Leaf initiating a connection from a source port 1189 to port 7422 on the CORE.
  • Whether 7222 is required between the COREs for NATS gateway communication, regardless of the CORE/Leaf role of individual DMAs.
  • Whether 8222 should listen locally on the Leaf for NATS monitoring, and whether 9090 can be used on CORE nodes, Leaf nodes, or both under BrokerGateway-managed NATS (I understand that the BrokerGateway migration replaces the legacy NAS + NATS services with NATS-Server)
  • Whether the proposed transition topology, with the Leaf connected to both COREs, is supported.

A port-by-port matrix showing the expected listening node, initiating node and required firewall direction for each scenario would be particularly useful.

I know it's a lot for single question - so any steer will be helpful.

Thanks

Pieter Lust [SLC] [DevOps Advocate] Answered question

1 Answer

3
207 0 Comments

Hello Alberto,

The ports that are utilized by BrokerGateway managed NATS are:
4222, 6222, 7222, 7422 and 8222.
Port 9090 was used for NAS which is no longer necessary with the newer NATS version.

The ports have the following usage:

  • 4222: The client-server communication port. All processes that use NATS communication will try to connect to a server via this port. For redundancy purposes it is best to open port 4222 to all servers that run a client that uses NATS.
  • 6222: A server-server communication port. This port is used by all nodes in a (sub-)cluster of NATS. Which NATS node that utilizes the 6222 depends on which node initialized communication. It can even be bidirectional.
  • 7222: This is the Gateway port. This port is used for communication between two sub-clusters in a supercluster configuration.
  • 7422: This is the leaf-node port. Leaf nodes need to connect to a NATS node that isn't also a leaf node. Which nodes that open this port depends on your configuration. But any node in the cluster can open this port for leaf nodes. It is best to have multiple nodes to open this port for redundancy purposes.
  • 8222: The monitoring port. This port does not need to be available to other nodes. Brokergateway does access it, but always locally.

To answer your questions more specifically:

  • which ports where?
    4222: preferably everywhere, open for all servers that have clients.
    6222: on non-leaf node nodes. open for all other non-leaf nodes. In case of a supercluster, only open for other non-leaf nodes in the subcluster.
    7222: on nodes in a sub-cluster that are allowed to communicate to other sub-clusters. Make sure opening ports is bidirectional here. Also, make sure to have more than 1 node per subcluster that is a gateway, for redundancy puposes.
    7422: non-leaf nodes that allow communication from leaf-nodes.
    8222: not needed to open this port to other servers.
  • port 7422 will always be the port used on core servers. The other port on the leaf is dynamic (outbound)
  • 7222 is only required for gateway nodes between two or more subclusters.
  • 8222 locally only on all nodes is sufficient. port 9090 is no longer used.
  • you can configure as many core nodes to accept leaf communication.

I hope this answers all your questions.

If something isn't fully clear yet, let me know.

Pieter Lust [SLC] [DevOps Advocate] Answered question
You are viewing 1 out of 1 answers, click here to view all answers.