Firewall Ports for remote collecters

[sxnxr]

We have deployed a vrops 6.6.1 RC into our PCI environment and opened all the required ports from a vrops POV and all is working well. As part of deploying vrops we also update the vRLI agent on each node to 4.5 and configure the .ini file.

According to VMware Documentation Library  and Log Insight: Port Requirements - SFlanders.net  i have worked out that i need the below one way for the agent to send the logs to login sight

Realize Log Insight Agents	vRealize Log Insight appliance	9000	TCP	Log Insight Ingestion API
vRealize Log Insight Agents	vRealize Log Insight appliance	9543	TCP	Log Insight Ingestion API over SSL

The question i have is how does log insight auto update the agents if there is no port requirement to go from vRLI to the agents?

Thanks in advance

[daphnissov]

There is a separate daemon which is the update service and responsible for fetching the updated binaries and installing them. To my knowledge, this just uses the same port 9000, but you do need to check or add the setting in the INI file to allow auto-updates to occur.

[admin]

The existing agent installation polls the Log Insight server (on the same port 9000 or 9543) periodically for new versions of itself. The server does not push new agent bits unaided. Connections are always agent-to-server.

[sxnxr]

I still dont understand how the agent gets to the remote collector. In log insight you can set auto update agent. How does the update files get from the log insight server to the target server if there is a one way firewall rule from the agent to log insight.

[daphnissov]

The agent packages are stored on the vRLI server. The agent checks into the server to see if a newer version is available. If auto_update=yes is set in the INI, the agent downloads the package from the server. Through the use of a separate service on the client side, the update package is installed effectively upgrading the agent on the client. The communication is handled over the same ports as mentioned above.

[sxnxr]

But the firewall rules are only one way (agent to vRLI) not bi-directional. How can the agent download the client to do the update if the vRLI doesn't not have any firewall rules to allow it to talk to the agent

[daphnissov]

I see what you mean. Yeah, you're going to have to have bidirectional rules to allow that to happen. There's just no other way.

[sxnxr]

You would think they would have that in there firewall rule documentation. Thanks for the help all

[admin]

There is no connection ever established from Lof Insight Server to Agent. All connections are established from Agent to Server. Rules are unidirectional.

[sxnxr]

That is my point. If there is no connection from the vRLI to the agent how does the agent auto update?

[admin]

Th Agent connects to the server, downloads the new Agent, and installs it.

[sxnxr]

But how does it download it when there is no communication between the vRLI and the agent.

I get that the agent can talk to vRLI on the one way communication based on the documentation, vRLI has an update, How does vRLI push the update (Or the agent pull) if vRLI cant talk to the agent.

If i am told that you cant use the auto update feature with firewalls that is fine i wont but the documentation is very light on this matter

[daphnissov]

I think you're over-thinking this. The agent can and does talk to vRLI server. The agent will pull the new package from the server. In your firewall rules, just enable comm on the ports listed between source and destination and don't worry about direction, because it doesn't really matter.