This article is intended for administrators wishing to leverage SvHCI 1.x.x in a secure networking environment.
SvHCI Networking and Required Ports
This article provides an overview of the networking requirements and service ports utilized by StorMagic SvHCI together with methods for validating network connectivity.
SvHCI Overview
StorMagic SvHCI Architecture
SvHCI provides a complete virtualization platform capable of running highly available virtual machines.
The platform supports NIC teaming into vSwitches, SvHCI interfaces and virtual machine port groups.
Virtual Machines on SvHCI can be protected, with their data mirrored and optionally cached and encrypted.
Virtual machines can then live migrate between nodes for non-disruptive maintenance while automatically failing over during a host failure.
SvHCI communicates with clients, peer SvHCI nodes, witnesses and other supporting services for management, quorum, notifications and live migration traffic.
Witness Communications
SvSAN mirrored disks and targets utilize a witness for quorum as detailed below:
StorMagic SvSAN Witness Data Sheet
SvHCI nodes (or SvSAN VSAs) heartbeat to the witness and communicate cluster state information, target and disk status, virtual machine failure scenarios and quorum decisions to provide enterprise-grade data protection.
Additional Network Services
SvHCI also integrates with common infrastructure services including SNMP, SYSLOG and PowerShell management.
Required Network Ports
The following ports are utilized by SvHCI for management, storage, clustering and supporting services.
| Item/Service | Communicating Between | Port | Protocol | Notes |
|---|---|---|---|---|
| iSCSI | SvHCI <--> iSCSI initiators | 3260 | TCP | iSCSI initiators could be ESXi hosts, Windows/Hyper-V hosts or Linux nodes. |
| KMIP |
SvHCI --> Key Management Server SvHCI nodes outgoing to KMIP server |
5696 | TCP | SvHCI can leverage encryption keys provided by KMS to encrypt to commodity drives. |
| Web Interface | Client <--> SvHCI nodes | 80/443 | TCP | Any requests the SvHCI node receives on port 80 are automatically redirected to 443. |
| Management Service |
PowerShell client --> SvHCI Incoming client to SvHCI nodes |
8000 | TCP | |
| iSNS |
SvHCI --> iSCSI Naming Server SvHCI outgoing to iSNS servers |
3205 | TCP/UDP | |
| NTP |
SvHCI --> NTP Time Server SvHCI outgoing to NTP server |
123 | UDP |
SvHCI nodes get time from the hardware BIOS, however can use NTP to get the correct time (default to pool.ntp.org). Correct time is required for licensing and clustering. |
| SMTP |
SvHCI --> Email Server SvHCI outgoing to SMTP server |
Configurable, default 25 | TCP | Email notifications |
| SNMP and SNMP Traps |
SvHCI --> SNMP Receiver SvHCI outgoing to SNMP server |
161 and 162 | UDP | SNMP notifications |
| RSYSLOG |
SvHCI --> Syslog Receiver SvHCI outgoing to SYSLOG server |
Configurable, default 514 | TCP or UDP | Syslog notifications out to Splunk for example. |
| SSH |
Client --> SvHCI Outgoing client to SvHCI nodes when in debug |
22 | TCP | SSH debug mode can be enabled by Support only for troubleshooting. |
| Discovery | Devices running StorMagic software | 4174 | UDP | SvHCI nodes, Witnesses, Windows hosts, Linux hosts etc. |
| Inter-node/mirror/witness | Witness <--> SvHCI | 4174 | TCP | SvHCI nodes, Witnesses, Windows hosts, Linux hosts etc. |
| VM Live Migration | SvHCI <--> SvHCI | 5093 | TCP | |
| VM Import (from vSphere) | SvHCI --> vSphere (vCSA or ESXi) | 902 | UDP/TCP | The SvHCI calls out to vSphere over 902 to check the VM config and trigger the import. |
Testing Connectivity
When validating firewall rules or network connectivity, common Linux networking tools may be used directly from an SvHCI node while SSH debug mode is enabled.
Examples include:
ping hostname_or_ipnc -vz hostname_or_ip porttelnet hostname_or_ip portcurl -vk https://hostname_or_ipThese utilities can be used to verify connectivity to services such as KMS, SMTP, NTP, Syslog servers and other infrastructure components.
Comments
0 comments
Article is closed for comments.