Administering or Configuring Catalyst Center
|
TCP 443
|
UI, REST, HTTPS
|
GUI, REST, HTTPS management port.
|
Port must be open.
|
TCP 2222
|
Catalyst Center shell
|
Connect to the Catalyst Center shell.
|
Port must be open. Restrict the known IP address to be the source.
|
TCP 9004
|
Web UI installation
|
Serves the GUI based installation page (required only if you choose to install Catalyst Center using the web-based option).
|
Port must be open until the installation of the node is complete.
|
TCP 9005
|
Web UI installation API service
|
Serves the API for the web-based installation (connected by the browser client from port 9004; no external agent requires
access).
|
Port must be open until the cluster formation is complete.
|
Administering or Configuring Cisco IMC
|
TCP 22
|
Catalyst Center shell
|
Connects to the Catalyst Center shell.
|
Port must be open. Configure the known IP address as the source.
|
UDP and TCP 53
|
DNS
|
Used to resolve a DNS name to an IP address.
|
Port must be open if DNS names are used instead of IP addresses for other services (such as an NTP DNS name).
|
UDP and TCP 389
|
LDAP
|
Cisco IMC user management LDAP.
|
Optional if external user authentication via LDAP is needed.
|
TCP 443
|
UI, REST, HTTPS
|
Web UI, REST, HTTPS management port.
|
Port must be open.
|
UDP and TCP 636
|
LDAPS
|
Cisco IMC user management via LDAP over SSL.
|
Optional if external user authentication via LDAPS is needed.
|
TCP 2068
|
HTTPS
|
Remote KVM console redirect port.
|
Port must be open until installation of the node is complete.
|
UDP 123
|
NTP
|
Synchronize the time with an NTP server.
|
Port must be open.
|
UDP 161
|
SNMP polling/config
|
SNMP server polling and configurations.
|
Optional for SNMP server polling and configurations.
|
UDP 162
|
SNMP traps
|
Send SNMP traps to an external SNMP server.
|
Optional for a SNMP server collector.
|
UDP 514
|
Syslog
|
View faults and logs on an external server.
|
Optional for sending message logs to an external server.
|
Catalyst Center Outbound to Device and Other Systems |
—
|
ICMP
|
Catalyst Center uses ICMP messages to discover network devices and troubleshoot network connectivity issues.
|
Enable ICMP.
|
TCP 22
|
SSH
|
Catalyst Center uses SSH to connect to network devices so that it can:
|
SSH must be open between Catalyst Center and the managed network.
|
TCP 23
|
Telnet
|
We strongly discourage the use of Telnet.
Note that although Telnet is discouraged, Catalyst Center can use Telnet to connect to devices in order to read the device configuration for discovery, and make configuration changes.
|
Telnet can be used for device management, but we do not recommend it because Telnet does not offer security mechanisms such
as SSH.
|
TCP 49
|
TACACS+
|
Needed only if you are using external authentication such as Cisco ISE with a TACACS+ server.
|
Port must be open only if you are using external authentication with a TACACS+ server.
|
TCP 80
|
HTTP
|
Catalyst Center uses HTTP for trust pool updates.
|
To access Cisco-supported trust pools, configure your network to allow outgoing traffic from the appliance to the following
URL:
http://www.cisco.com/security/pki/
|
TCP 80
|
OCSP/CRL
|
Catalyst Center checks SSL/TLS certificate revocation status using OCSP/CRL.
|
These URLs must be reachable both directly and through the proxy server that's configured for Catalyst Center. Otherwise, certificate revocation check will be skipped when Catalyst Center connects to cisco.com.
http://validation.identrust.com
http://commercial.ocsp.identrust.com
|
UDP 53
|
DNS
|
Catalyst Center uses DNS to resolve hostnames.
|
Port must be open for DNS hostname resolution.
|
UDP 123
|
NTP
|
Catalyst Center uses NTP to synchronize the time from the source that you specify.
|
Port must be open for time synchronization.
|
UDP 161
|
SNMP
|
Catalyst Center uses SNMP to discover network devices; to read device inventory details, including device type; and for telemetry data purposes,
including CPU and RAM.
|
Port must be open for network device management and discovery.
|
TCP 443
|
HTTPS
|
Catalyst Center uses HTTPS for cloud-tethered upgrades.
|
Port must be open for cloud tethering, telemetry, and software upgrades.
Port must also be open for Cisco ISE.
|
TCP 830
|
NETCONF
|
Catalyst Center uses NETCONF for device inventory, discovery, and configuration.
|
Port must be open for network device management and discovery of devices that support NETCONF.
|
UDP 1645 or 1812
|
RADIUS
|
Needed only if you are using external authentication with a RADIUS server.
|
Port must be open only if an external RADIUS server is used to authenticate user login to Catalyst Center.
|
TCP 5222, 8910
|
Cisco ISE
|
Catalyst Center uses Cisco ISE XMP for PxGrid.
|
Port must be open for Cisco ISE.
|
TCP 9060
|
Cisco ISE
|
Catalyst Center uses Cisco ISE ERS API traffic.
|
Port must be open for Cisco ISE.
|
Device to Catalyst Center |
—
|
ICMP
|
Devices use ICMP messages to communicate network connectivity issues.
|
Enable ICMP.
|
TCP 22, 80, 443
|
HTTPS, SFTP, HTTP
|
Software image download from Catalyst Center through HTTPS:443, SFTP:22, HTTP:80.
Certificate download from Catalyst Center through HTTPS:443, HTTP:80 (Cisco 9800 Wireless Controller, PnP), Sensor/Telemetry.
Note
|
Block port 80 if you don't use Plug and Play (PnP), Software Image Management (SWIM), Embedded Event Management (EEM), device
enrollment, or Cisco 9800 Wireless Controller.
|
|
Ensure that firewall rules limit the source IP of the hosts or network devices allowed to access Catalyst Center on these ports.
For more information on HTTP 80 usage, see the "HTTP Port 80 Exception List" topic in the Cisco Catalyst Center Security Best Practices Guide.
|
UDP 67
|
BOOTP
|
Used to initiate communication between a network device and Catalyst Center.
|
Port must be open.
|
111
|
NFS
|
Used for Assurance backups.
|
Port must be open.
|
UDP 123
|
NTP
|
Devices use NTP for time synchronization.
|
Port must be open to allow devices to synchronize the time.
|
UDP 162
|
SNMP
|
Catalyst Center receives SNMP network telemetry from devices.
|
Port must be open for data analytics based on SNMP.
|
UDP 514
|
Syslog
|
Catalyst Center receives syslog messages from devices.
|
Port must be open for data analytics based on syslog.
|
2049
|
NFS
|
Used for Assurance backups.
|
Port must be open.
|
UDP 6007
|
NetFlow
|
Catalyst Center receives NetFlow network telemetry from devices.
|
Port must be open for data analytics based on NetFlow.
|
TCP 9991
|
Wide Area Bonjour Service
|
Catalyst Center receives multicast Domain Name System (mDNS) traffic from the Service Discovery Gateway (SDG) agents using the Bonjour Control
Protocol.
|
Port must be open on Catalyst Center if the Bonjour application is installed.
|
20048
|
NFS
|
Used for Assurance backups.
|
Port must be open.
|
UDP 21730
|
Application Visibility Service
|
Application Visibility Service CBAR device communication.
|
Port must be open when CBAR is enabled on a network device.
|
TCP 25103
|
Cisco 9800 Wireless Controller and Cisco Catalyst 9000 switches with streaming telemetry enabled
|
Used for telemetry.
|
Port must be open for telemetry connections between Catalyst Center and Catalyst 9000 devices.
|
TCP 32626
|
Intelligent Capture (gRPC) collector
|
Used for receiving traffic statistics and packet - capture data used by the Cisco Catalyst Assurance Intelligent Capture (gRPC) feature.
|
Port must be open if you are using the Cisco Catalyst Assurance Intelligent Capture (gRPC) feature.
|
TCP and UDP 32767
|
NFS
|
Used for Assurance backups.
|
Port must be open.
|