Firewall Configuration

In order for your monitoring point to access AppNeta Performance Manager (APM) and perform the monitoring you require, you must configure your firewall rules to allow this access. At a minimum, the monitoring point must be able to connect to APM. Additional configuration beyond this is based on your monitoring needs. In addition to setting firewall rules, you can create Access Control Lists (ACLs) on some monitoring point models to restrict inbound access.

Overview

The following diagram shows all the services and applications that the monitoring point may need access to.

The following table outlines the firewall rules required to access the various services and applications. Click the links for details.

APM servers

Access to APM is mandatory.

Delivery monitoring

Delivery monitoring is a fundamental feature of the AppNeta solution so ports related to Delivery monitoring should be opened. In addition, in cases where the monitoring point is a target behind a NAT device (for example, a video test target), port forwarding is required on the remote firewall to route traffic to the target monitoring point.

Path Plus

Part of Delivery monitoring, the Path Plus tools are used for basic network investigation so related ports should be opened.

Voice/Video

As optional Delivery monitoring components, if the voice and video tools are being used, related ports should be opened.

Experience monitoring

Experience monitoring is a fundamental feature of the AppNeta solution so ports related to Experience monitoring should be opened. Outbound TCP connections on port 80 are essential to Experience monitoring. Allow outbound connections on port 443 if a workflow includes logging in to the target site.

Optional services

There a number of services that you need access to only if required.

Proxy server

If HTTP traffic is directed to a proxy server, make sure that no ACLs prevent the monitoring point from connecting to it (for example, permit tcp host device-ip host proxy-ip eq proxy-port). This might be the case if the monitoring point is deployed in a subnet reserved for network infrastructure rather than end-stations. If the proxy service requires authentication, it must use either basic or digest authentication; NTLM and Kerberos are not supported. See the proxy setup page: physical and virtual monitoring points or software monitoring points (software sequencers).

DNS server

Domain Name System (DNS) is required for hostname to IP resolution. Firewall rules allowing access to a DNS resolver are only required if the resolver is external.

NTP server

The monitoring point needs inbound and outbound connections for Network Time Protocol (NTP) to ensure precise timestamping. Firewall rules allowing access to a NTP server are only required if the server is external.

SNMP NMS

Firewall rules allowing access to a Simple Network Management Protocol (SNMP) Network Management System (NMS) server are only required if the monitoring point is configured for SNMP notification forwarding and the server is external.

s35 on Windows

If you are installing the s35 Software Sequencer on a Windows machine, you need to to configure the Windows firewall to allow the s35 to communicate with APM. You can do this as follows:

1. On your Windows machine, navigate to Control Panel > Windows Firewall.
   
   
   
2. Click Allow a program or feature through Windows Firewall.
   
   
   
3. Click Allow another program.
   
   
   
4. Click Browse….
   
   
   
5. Navigate to the install location of the s35. By default this is C:\Program Files (x86)\AppNeta\Sequencer\sequencer.exe.
   
   
   
6. Once added, make sure all the boxes next to the “AppNeta Sequencer” entry are selected, and click OK.
   
   
   
7. At this point, the s35 is not blocked by your Windows firewall.