Searching...

Matching results

    Firewall Considerations

    The AM/AMM requires ports in the firewall to be open in order to function correctly. The sections below provide information on which ports need to be open and what their purpose is.

    Notes:

    • All firewall rules must be stateful.

    Deployment Diagram

    Firewall Port Requirements for AirLink OS, MGOS and ALEOS Deployments

    Firewall Port Requirements for AirLink OS, MGOS and ALEOS Deployments

    Source Host/Network Destination Host/Network Protocol/Port Service Notes
    AM/AMM Users
    AM/AMM Administrator Workstation AM/AMM Server TCP 2222 SSH for Admin access to CLI

    AM/AMM User Workstation AM/AMM Server TCP 443 HTTPS

    AM/AMM User Workstation maps.googleapis.com
    maps.google.com
    www.google.com     		TCP 443 Geolocation Srevices Map-based reporting and services
    AM/AMM System
    AM/AMM Server DNS Server UDP 53 DNS

    AM/AMM Server NTP Server UDP 123 NTP

    AM/AMM Server SMTP Server TCP 25 Mail relay service for system alerts

    AM/AMM Server LDAP Server TCP 636 or 389 Secure LDAP Integration

    AM/AMM Server maps.googleapis.com TCP 443 Geolocation Services Geocoding events/reports
    AM/AMM Server repo.airlink.com TCP 443 Ability to update your on-premise AMM repository for router firmware updates (Optional) Alternatively, firmware packages can be manually downloaded from Source and uploaded to the AM/AMM
    Optional High Availability Feature (Primary/Secondary Servers)
    AM/AMM Server peer 1 AM/AMM Server peer 2 UDP 5404, 5405 Corosync

    AM/AMM Server peer 1 AM/AMM Server peer 2 TCP 2224,3121,21064 Pacemaker

    AM/AMM Server peer 1 AM/AMM Server peer 2 TCP 2222 SSH

    AM/AMM Server peer 1 AM/AMM Server peer 2 TCP 80 Public Key Exchange

    AM/AMM Server peer 1 AM/AMM Server peer 2 TCP 3306 MySQL replication

    AM/AMM Server peer 1 AM/AMM Server peer 2 ICMP-Ping HA Heartbeat signal

    AirLink OS routers (XR, RX55 Wi-Fi Plus, RX400, EX400)
    AirLink OS router Networks (or 0.0.0.0/0) AM/AMM Server UDP 5684 LwM2M bootstrap service

    AirLink OS router Networks (or 0.0.0.0/0) AM/AMM Server UDP 5686 LwM2M device management service

    AirLink OS router Networks (or 0.0.0.0/0) AM/AMM Server UDP 1198 Management Tunnel SSL VPN

    ALEOS Routers (MP,RV,GX,LX,LS)
    ALEOS Router Networks (or 0.0.0.0/0) AM/AMM Server TCP 8083 MSCI over HTTPS If using a self-signed certificate, HTTPS can still be used by disabling “TLS Verify Peer Certificate” in the ALEOS router configuration.
    ALEOS Router Networks (or 0.0.0.0/0) AM/AMM Server UDP 1190-1193 Management Tunnel SSL VPN

    ALEOS Router Networks (or 0.0.0.0/0) AM/AMM Server TCP 44900 AirLink Application Framework (AAF) communication to AM/AMM

    ALEOS Router Networks (or 0.0.0.0/0) AM/AMM Server TCP 443 HTTPS Only required for ALEOS routers if the Management Tunnel is not in use (Ports 1190-1193 above).
    MG90 Routers
    MGOS Router Networks (or 0.0.0.0/0) AM/AMM Server UDP 1194-1197 Management Tunnel SSL VPN

    AM/AMM User Workstation AM/AMM Server TCP 5900-6000 (Optional) Access Console and Total Reach for MGOS

    Additional Requirements for MGOS gateways if Management Tunnel is not used (***Not common***)
    MGOS Router Networks (or 0.0.0.0/0) AM/AMM Server ICMP Ping Only required if the AM/AMM server will be used as a WAN monitor target for deployed routers, and can potentially be locked down to specific address ranges
    MGOS Router Networks (or 0.0.0.0/0) AM/AMM Server TCP 20-21
    TCP 49152-49252     		FTP Device to server log file FTP (Passive)
    MGOS Router Networks (or 0.0.0.0/0) AM/AMM Server TCP 9987 SFTP Device to server batchlogger log SFTP
    MGOS Router Networks (or 0.0.0.0/0) AM/AMM Server TCP 80 Software download Required for router software download from AM/AMM server if the management tunnel is not in use
    MGOS Router Networks (or 0.0.0.0/0) AM/AMM Server TCP/UDP 1501 Messages Device to server messages
    Additional Requirements for ALEOS routers if Management Tunnel is not used or Encrypted MSCI are not used(***Not common***)
    ALEOS Router Networks (or 0.0.0.0/0) AM/AMM Server TCP 80 Software download Required for ALEOS router software download from AM/AMM server
    ALEOS Router Networks (or 0.0.0.0/0) AM/AMM Server TCP 20-21
    TCP 49152-49252     		FTP Required if using Uploadlog for log file (FTP) upload
    ALEOS Router Networks (or 0.0.0.0/0) AM/AMM Server TCP 8082 MSCI over unsecured HTTP Required for ALEOS router communication to server (MSCI). Replaces the requirement for HTTP 8083. Allows plain text
    Remote Access for Implementation and Support (Optional)
    AM/AMM Server cproxy1.airlink.com
    cproxy2.airlink.com     		UDP 1194 Reverse Proxy SSL VPN

    TOP