It is common that the hosts with the Platform and EC’s are protected by one or more firewalls. In order for For the communication between the various components of the system to work, you may need to update your firewall settings.
Accessing Ports in Pico Instances
In MediationZone, it is always the client that establishes a connection to the Platform. Once a connection has been established, it is used as a two-way communication channel; the Platform never needs to open an outgoing connection. Typically, the Platform has the server role in the system, while
mzsh, Desktops, ECs and web browsers act as clients.
The common property property pico.rcp.platform.port specifies a port used by pico instances to communicate with Platform. The default value is 6790 in a standard installation. Use the following command to retrieve the value of this property:
...
The Platform property mz.webserver.port specifies specifies a port used to communicate with the Platform Web Interface. The default value is 9000 in a standard installation. Use the following command to retrieve the value of this property from the Platform Container:
| Code Block | ||
|---|---|---|
| ||
mzsh topo get topo://container:<container>/pico:platform/val:config.properties.mz.webserver.port |
The property propertyec.webserver.port specifies a port used to communicate with an EC Web Interface. The default value is 9090 in a standard ec-template. Use the following command to retrieve the value of this property for all ECs in a container:
| Code Block | ||
|---|---|---|
| ||
mzsh topo get --format data-only topo://container:<container>/pico:.*/val:config.properties.ec.webserver.port |
...
port |
...
| Code Block | |
|---|---|
| language | text|
mzsh topo get --format data-only topo://container:<container>/pico:.*/val:config.properties.mz.servicehost.port.range |
By default, the Platform uses the port range 5451-5500.
You can manage pico instances in one container from another by enabling remote access, using the mzsh command topo setupremote. SSH is used by the pico instances for remote access and the default port used by this protocol is 22. For further information about setting up remote access and how to configure the SSH port, see Remote Access to Containers.
...
Inter Workflow Communication
The server port used for Inter Workflow communication, when one EC contacts another EC, is specified by the EC property pico.rcp.server.port. If no port is set, a dynamic port will be used, and the port number will change each time the EC is restarted. To let the firewall allow a connect operation, the property the property pico.rcp.server.port has to be set to the same port number as the specific port opened by the firewall.
| Info |
|---|
Example - Inter Workflow Communication EC1 on Host1 is configured with To allow EC1 to open a connection to contact an Inter Workflow storage on EC2, EC1 will make a TCP connect connection from Host1 to Host2 on port " In this case, " |
Database Communication
For performance reasons, Audit information is logged directly from an EC to the database.
If the system is unable to log Audit information directly from the EC, Audit will instead be performed through the Platform. This might happen if an external EC is unable to connect to the database in case of, for example, a network failure or if the EC has problems to connect connecting through a firewall. To avoid this, configure the firewall so that the EC can communicate directly with the Audit database.
For information on how to setup set up the Audit Profile, refer to /wiki/spaces/MD82/pages/3771258 in the Desktop user's guidesee Audit Profile.
Firewall Setup
Listed below are The following lists the actions that should be taken to allow communication between hosts in the system. It is assumed that the standard installation ports are used. If the default ports have been changed, replace the port numbers with the ones you are using.
To allow
mzsh, Desktops and ECs to communicate with the Platform, incoming data to, and outgoing data from port6790in the Platform Container must be allowed.To allow the Platform Web Interface to be accessed from outside the firewall and for STR synchronization, incoming data to, and outgoing data from the Platform's port
9000must be allowed.To allow the EC Web Interface to be accessed from outside the firewall, incoming data to, and outgoing data from the EC's port
9090must be allowed.To enable external access to services on the Platform and the SC, ensure that incoming and outgoing data for the following port ranges are allowed through the firewall:
Platform default port range: 5451-5500 (configurable)
SC port range: xxxx-xxxx (configurable)To allow remote access to Execution Containers, outgoing data must be allowed on port 22.
Type | Port(s) | Open Internally | Open Externally |
|---|---|---|---|
Platform | 6790 9000 |
See Additional Platform Properties in install.xml for more information. | Default scenario where |
MediationZone is only used within an internal |
network. | If |
it is |
required to provide platform ports to external scenarios |
, such as |
Legacy Desktop (Java Swing |
) running on an external network. |
Desktop | 9001 |
See Desktop UI |
Properties for |
more information. | If all browser users are on an internal network. | Default scenario where |
the Desktop is running on browsers on an external network. | |
Execution Context(s) | 9090 |
See Execution Context Properties for more information. | Default scenario where services depending on EC |
are used within an internal network. | If |
it is |
required to provide access to ECs from an external network. |
It is required if the Prometheus server is deployed on a remote network and needs to work with EC in an internal network |
Service Contexts (optional)
Depends on required services.
Refer to Service Context properties for details
Default scenario where services depending on SC is used within internal network
, for example. |
Legacy |
Desktop | 6790 | Default scenario when |
the Legacy Desktop is used within an internal network. | If |
the Legacy Desktop requires to run from an external network. | |
Operations REST Interface | 9000 |
See Operations REST Interface for |
more information. | Default scenario where services depending on Operations REST Interface |
are used within an internal network. | If |
it is |
required to provide access to Operations REST Interface from an external network. |
...
Note!
It is recommended to enable client authentication is recommended for security. For more information, see Enabling Client Authentication.
Consider providing VPN access for MZ services that needs require access to be access port 6790 & 9000.
Example would be Legacy Java Swing Desktop remote access(for Platform Container) and 9000 (standard installation).
For example, providing VPN to access the Legacy Desktop remotely.