Using Traverse Behind Firewalls

If any component of Traverse is going to be installed behind a firewall, depending on the existing policies, some changes may be necessary to the rules to accommodate the requirements. In the following requirements, "remote" host implies a host that is outside of the firewall while a "local" host is a device on the secure side of the firewall. Also, note that the requirements are not applicable for cases where the two hosts in question are on the same side of the firewall (i.e. packets are not crossing the firewall).

Requirements for the BVE Provisioning Database

The provisioning server stores all device, test, action, threshold, authentication and other provisioning information. This information is retrieved on-demand by both the web servers and DGEs. This is accomplished by creating connections to the database server on specific TCP ports running on the provisioning host. The following firewall rules will need to be applied for a provisioning server which is behind a firewall:

Firewall Rules for a Provisioning Server that is Behind a Firewall

Requirements for Web Servers

The web servers provide an interface for displaying all collected information as well as reports generated from those information. If a location is served by more than one web server, a load balancer is installed to distribute the load and the load balancer will need the same firewall rule changes as the web servers themselves. The load balancer might have additional firewall specific requirements. You must apply the following firewall rules for web servers which are behind a firewall:

Firewall Rules for a Web Server that is Behind a Firewall

Requirements for DGE (monitors)

The DGEs perform actual monitoring of all provisioned devices and store the data on a local database. The web servers will need access to this stored data on-demand for report generation. The provisioning server also needs access to the data to fulfill requests made via the BVE socket API. Since the DGE perform monitoring tasks, it will need outbound access via a multitude of ports and protocols. The following firewall rules will need to be applied for a DGE server which is behind a firewall:

Firewall Rules for a DGE that is Behind a Firewall

Firewall ports for DGE-extensions

The DGE-extensions make all outbound connections to an upstream DGE and BVE, and there are no incoming connections to the DGE-extension. The following TCP ports need to be opened on the upstream DGE location to all the DGE-extensions to connect: