1.5. Ports and Firewalls Requirements
For the components of Satellite architecture to communicate, ensure that the required network ports are open and free on the base operating system. You must also ensure that the required network ports are open on any network-based firewalls.
The installation of a Capsule Server fails if the ports between Satellite Server and Capsule Server are not open before installation starts.
Use this information to configure any network-based firewalls. Note that some cloud solutions must be specifically configured to allow communications between machines because they isolate machines similarly to network-based firewalls. If you use an application-based firewall, ensure that the application-based firewall permits all applications that are listed in the tables and known to your firewall. If possible, disable the application checking and allow open port communication based on the protocol.
Integrated Capsule
Satellite Server has an integrated Capsule and any host that is directly connected to Satellite Server is a Client of Satellite in the context of this section. This includes the base operating system on which Capsule Server is running.
Clients of Capsule
Hosts which are clients of Capsules, other than Satellite’s integrated Capsule, do not need access to Satellite Server. For more information on Satellite Topology, see Capsule Networking in Planning for Red Hat Satellite 6.
Required ports can change based on your configuration.
A matrix table of ports is available in the Red Hat Knowledgebase solution Red Hat Satellite List of Network Ports.
The following tables indicate the destination port and the direction of network traffic:
| Port | Protocol | Service | Required For |
|---|---|---|---|
| 5646 | TCP | amqp | Capsule’s Qpid dispatch router to Qpid dispatch router in Satellite |
| Port | Protocol | Service | Required for |
|---|---|---|---|
| 80 | TCP | HTTP | Anaconda, yum, and for obtaining Katello certificate updates |
| 443 | TCP | HTTPS | Anaconda, yum, Telemetry Services, and Puppet |
| 5647 | TCP | AMQP | Katello agent to communicate with Capsule’s Qpid dispatch router |
| 8000 | TCP | HTTPS | Anaconda to download kickstart templates to hosts, and for downloading iPXE firmware |
| 8140 | TCP | HTTPS | Puppet agent to Puppet master connections |
| 8443 | TCP | HTTPS | Subscription Management Services and Telemetry Services |
| 9090 | TCP | HTTPS | Sending SCAP reports to the Capsule and for the discovery image during provisioning |
| 53 | TCP and UDP | DNS | Client DNS queries to a Capsule’s DNS service (Optional) |
| 67 | UDP | DHCP | Client to Capsule broadcasts, DHCP broadcasts for Client provisioning from a Capsule (Optional) |
| 69 | UDP | TFTP | Clients downloading PXE boot image files from a Capsule for provisioning (Optional) |
| 5000 | TCP | HTTPS | Connection to Katello for the Docker registry (Optional) |
| Port | Protocol | Service | Required For |
|---|---|---|---|
| 7 | TCP and UDP | ICMP | DHCP Capsule to Client network, ICMP ECHO to verify IP address is free (Optional) |
| 68 | UDP | DHCP | Capsule to Client broadcasts, DHCP broadcasts for Client provisioning from a Capsule (Optional) |
| 8443 | TCP | HTTP | Capsule to Client "reboot" command to a discovered host during provisioning (Optional) |
Any managed host that is directly connected to Satellite Server is a client in this context because it is a client of the integrated Capsule. This includes the base operating system on which a Capsule Server is running.
| Port | Protocol | Service | Required For |
|---|---|---|---|
| 22 | TCP | SSH | Satellite and Capsule originated communications, for Remote Execution (Rex) and Ansible. |
| 7911 | TCP | DHCP |
|
A DHCP Capsule sends an ICMP ECHO to confirm an IP address is free, no response of any kind is expected. ICMP can be dropped by a networked-based firewall, but any response prevents the allocation of IP addresses.
