Firewall Configuration

In order for your Monitoring Point to access AppNeta Performance Manager (APM) and perform the monitoring you require, you must configure your firewall rules to allow this access. At a minimum, the Monitoring Point must be able to connect to APM. Additional configuration beyond this is based on your monitoring needs. In addition to setting firewall rules, you can create Access Control Lists (ACLs) on some Monitoring Point models to restrict inbound access.

Note that the firewall configuration for a Container-based Monitoring Point (CMP) and the Native Monitoring Point (NMP) on Windows have separate requirements.

A summary of the firewall rules described below is available in a separate spreadsheet. To create a PDF version, navigate to File > Download > PDF document (.pdf) within the Google Sheet.

Overview

The following diagram shows all the services and applications that the Monitoring Point may need access to.

The following table outlines the firewall rules required to access the various services and applications. Click the links for details.

Connecting to APM servers

Access to APM is mandatory.

Configuring for Delivery monitoring

Delivery monitoring is a fundamental feature of the AppNeta solution so ports related to Delivery monitoring should be opened. In addition, in cases where the Monitoring Point is a target behind a NAT device (for example, a video test target), port forwarding is required on the remote firewall to route traffic to the target Monitoring Point.

Configuring for Path Plus

Part of Delivery monitoring, the Path Plus tools are used for basic network investigation so related ports should be opened.

Configuring for Voice/Video

As optional Delivery monitoring components, if the voice and video tools are being used, related ports should be opened.

Configuring for Experience monitoring

Experience monitoring is a fundamental feature of the AppNeta solution so ports related to Experience monitoring should be opened. Outbound TCP connections on port 80 are essential to Experience monitoring. Allow outbound connections on port 443 if a workflow includes logging in to the target site.

Configuring for optional services

There a number of services that you need access to only if required.

Configuring for a proxy server

If HTTP traffic is directed to a proxy server, make sure that no ACLs prevent the Monitoring Point from connecting to it (for example, permit tcp host device-ip host proxy-ip eq proxy-port). This might be the case if the Monitoring Point is deployed in a subnet reserved for network infrastructure rather than end-stations. If the proxy service requires authentication, it must use either basic or digest authentication; NTLM and Kerberos are not supported.
See the proxy setup page: physical and virtual Monitoring Points or native Monitoring Points.
For the Container-based Monitoring Point (CMP), proxy configuration is done on the Docker host. Newer versions of Docker can be configured to pass the proxy through to containers. See Configure Docker to use a proxy server.

Configuring for a DNS server

Domain Name System (DNS) is required for hostname to IP resolution. Firewall rules allowing access to a DNS resolver are only required if the resolver is external.

Configuring for an NTP server

The Monitoring Point needs inbound and outbound connections for Network Time Protocol (NTP) to ensure precise timestamping. Firewall rules allowing access to a NTP server are only required if the server is external.

Configuring for an SNMP NMS

Firewall rules allowing access to a Simple Network Management Protocol (SNMP) Network Management System (NMS) server are only required if the Monitoring Point is configured for SNMP notification forwarding and the server is external.

Configuring for a CMP

Additional firewall rules may be required depending on where you are deploying the Container-based Monitoring Point (CMP).

AKS

If you are installing a CMP in Azure using AKS, there are no additional firewall rules to configure. The install process takes care of the firewall rules.

Docker Compose

If you are installing the CMP using Docker Compose, you need to configure the following firewall rules for Delivery monitoring. All the other (non-Delivery) firewall rules shown above still apply:

Azure - If you are deploying within Azure, the Azure firewalls and Network Security Groups should be configured with “Allow Inbound ICMP”.
AWS - If you are deploying within AWS, the default security group needs a rule to allow inbound ICMP Echo Requests.

Configuring for an NMP on Windows

When you install the AppNeta Native Monitoring Point (NMP) on a Windows machine, firewall rules are automatically added during the installation process. They are all inbound rules and include:

• Allow ICMPv4 “Echo Reply” (Type 0, Code Any) packets to the NMP
• Allow ICMPv4 “Destination Unreachable” packets to the NMP
• Allow UDP packets to the NMP
• Allow ICMPv4 “Time Exceeded” packets to any program

Additional rule required for single-ended path target use case

If the Windows NMP is to serve as a target for single-ended paths, you need to add an inbound rule to allow ICMPv4 “Echo Request” packets to any program. You can do this from the command line or via the Windows Firewall app.

Use the command line

1. In the Windows search box (lower left), type “command prompt”.
2. Click ​Run as administrator.
   
3. If you receive the message Do you want to allow this app to make changes to your device?, click Yes.
   
   • The ​Administrator Command Prompt app appears.

4. In the Administrator Command Prompt app, enter the following command:

   netsh.exe advfirewall firewall add rule name="AppNeta Native Monitoring Point (ICMP-Echo-Request)" profile=any action=allow dir=in protocol=icmpv4:8,any
   

   • Inbound ICMPv4 “Echo Request” packets are now allowed.

Use the Windows Firewall app

1. In the Windows search box (lower left), type “windows defender firewall”.
2. Click ​Windows Defender Firewall​.
   
   • The ​Windows Defender Firewall ​page appears.
3. In the Windows Defender Firewall window, click Advanced settings.
   
4. If you receive the message Do you want to allow this app to make changes to your device?, click Yes.
   
5. Click Inbound Rules.
   
6. Click New Rule.
   
7. Select Custom and click Next.
   
8. Select All programs and click Next.
   
9. In the Protocol type dropdown select ICMPv4 and click Customize.
   
10. Select Specific ICMP types, select Echo Request, then click OK.
    
11. Click Next.
    
12. Click Next.
    
13. Click Next.
    
14. Make sure Domain, Private, and Public are checked and click Next.
    
15. In the Name field, enter “AppNeta NMP ICMP Echo Requests” and click Finish.
    
    • Inbound ICMPv4 “Echo Request” packets are now allowed.
16. Close the Windows Defender Firewall windows.