How to set up the firewall for Portnox Docker containers to connect to Portnox Cloud
In this topic, you will learn how to configure your firewall to make sure that the Portnox Docker containers can communicate with Portnox Cloud.
You need to open the following ports on your firewall:
| Container | Address | Protocol | Ports | Direction |
|---|---|---|---|---|
| All containers | 20.85.190.232/29 | TCP | 80, 443, 8081 | Outbound |
| All containers | 20.67.6.144/29 | TCP | 80, 443, 8081 | Outbound |
| All containers | 20.15.0.121/32 | TCP | 443 | Outbound |
| All containers | 98.71.112.122/32 | TCP | 443 | Outbound |
| Additionally: | ||||
| portnox-siem | portnox-centraal-prod.servicebus.windows.net | TCP | 443, 5671, 5672 | Outbound |
| portnox-siem | portnox-centraal-prod-eastus.servicebus.windows.net | TCP | 443, 5671, 5672 | Outbound |
| portnox-siem | siem-events-clear-prod-westeu.servicebus.windows.net | TCP | 443, 5671, 5672 | Outbound |
| portnox-siem | siem-events-clear-prod-eastus.servicebus.windows.net | TCP | 443, 5671, 5672 | Outbound |
| portnox-dhcp | 20.241.131.45 | UDP | 167 | Outbound |
| portnox-dhcp | 20.4.128.229 | UDP | 167 | Outbound |
| ztna-gateway | Any | TCP | 443 | Outbound |
| ztna-gateway | Any | UDP | 3478 | Outbound |
In addition to the rules above, some Portnox Docker containers, such as the portnox-siem container, use Azure Web PubSub as a real-time communication channel (for example, to report the status of test/health-check probes back to Portnox Cloud). Azure Web PubSub does not expose static public IP addresses, so this traffic must also be allowed by domain name:
| FQDN | Protocol | Ports | Direction |
|---|---|---|---|
| pubsub-clear-prod-weu.webpubsub.azure.com | TCP | 443 | Outbound |
| pubsub-clear-prod-eus.webpubsub.azure.com | TCP | 443 | Outbound |
If your firewall software does not support FQDNs or encounters issues, such as failing to recognize some IP addresses resolved from the FQDNs, you can use this official Azure script to retrieve the IP addresses associated with an Azure FQDN. You can then add all these IP addresses to the firewall instead of the FQDNs. However, be sure to regularly monitor connectivity and check for any updates, as Microsoft may add or remove IP addresses over time.