How to check if the LDAP Broker connects to the cloud

In this topic, you will learn how to check if the Portnox™ LDAP Broker connects to the Portnox™ Cloud service.

Important:

The checks described in this topic only test whether the LDAP Broker machine can establish a network (TCP) connection to the required cloud endpoints and ports, and whether those ports are reachable and open. They do not test whether LDAP Broker communication with the Portnox Cloud will succeed once the network connection has been established. Treat this topic as the first step in troubleshooting LDAP Broker cloud connectivity issues: it lets you rule out firewall, DNS, and general Internet connectivity problems before you look further.

The following configurations must be done on the firewall for the broker to be able to communicate with the cloud:

FQDN or IP range Protocol Ports Direction
20.85.190.232/29 TCP 80, 443, 8081 Outbound
20.67.6.144/29 TCP 80, 443, 8081 Outbound
mobilecentraal.portnox.com TCP 8081 Outbound
cloudcentraalstoreprodus.blob.core.windows.net TCP 443 Outbound
cloudcentraalstoreprod.blob.core.windows.net TCP 443 Outbound
pnxeusprdclrinstallers.blob.core.windows.net TCP 443 Outbound
pnxweuprdclrinstallers.blob.core.windows.net TCP 443 Outbound
pnxweuprdclrpublic.blob.core.windows.net TCP 443 Outbound
pnxeusprdclrpublic.blob.core.windows.net TCP 443 Outbound
*.servicebus.windows.net TCP 80, 443, 5671, 5672, 9350, 9351, 9352 Outbound
Warning:
Since Microsoft services can change their public IP addresses (as has happened in the past), we recommend avoiding the use of static IP addresses. Instead, use fully qualified domain names (FQDNs) as listed above, except for the two IP ranges.

If your firewall software does not support FQDNs or encounters issues, such as failing to recognize some IP addresses resolved from the FQDNs, you can use this official Azure script to retrieve the IP addresses associated with an Azure FQDN. You can then add all these IP addresses to the firewall instead of the FQDNs. However, be sure to regularly monitor connectivity and check for any updates, as Microsoft may add or remove IP addresses over time.

Note:
If you’re using a Check Point firewall, you should allow the LDAP Broker’s outbound Azure Service Bus traffic by using Check Point Updatable Objects instead of manually maintaining Azure IP address allowlists. Check Point automatically maintains the associated Azure IP ranges. For instructions, see the Check Point documentation: Updatable Objects.

To check whether every endpoint and port listed in the table above is reachable from the LDAP Broker machine, run the following PowerShell script. It walks through each row of the table (using one example address from each /29 Azure range) and reports whether each port is reachable:

Note:
If the check against an example range address fails, or if you still suspect a connectivity problem after all checks pass, repeat the test against other IP addresses within the same /29 range.
$targets = @(
  @{ Endpoint = "20.85.190.232/29";                                    Host = "20.85.190.232";                                Ports = 443 }
  @{ Endpoint = "20.67.6.144/29";                                      Host = "20.67.6.144";                                  Ports = 443 }
  @{ Endpoint = "mobilecentraal.portnox.com";                          Host = "mobilecentraal.portnox.com";                   Ports = 8081 }
  @{ Endpoint = "cloudcentraalstoreprodus.blob.core.windows.net";      Host = "cloudcentraalstoreprodus.blob.core.windows.net"; Ports = 443 }
  @{ Endpoint = "cloudcentraalstoreprod.blob.core.windows.net";        Host = "cloudcentraalstoreprod.blob.core.windows.net";   Ports = 443 }
  @{ Endpoint = "pnxeusprdclrinstallers.blob.core.windows.net";        Host = "pnxeusprdclrinstallers.blob.core.windows.net";   Ports = 443 }
  @{ Endpoint = "pnxweuprdclrinstallers.blob.core.windows.net";        Host = "pnxweuprdclrinstallers.blob.core.windows.net";   Ports = 443 }
  @{ Endpoint = "pnxweuprdclrpublic.blob.core.windows.net";            Host = "pnxweuprdclrpublic.blob.core.windows.net";       Ports = 443 }
  @{ Endpoint = "pnxeusprdclrpublic.blob.core.windows.net";            Host = "pnxeusprdclrpublic.blob.core.windows.net";       Ports = 443 }
  @{ Endpoint = "*.servicebus.windows.net (via portnox-centraal-prod)"; Host = "portnox-centraal-prod.servicebus.windows.net"; Ports = 80,443,5671,5672,9350,9351,9352 }
)
           
$results = foreach ($target in $targets) {
  foreach ($port in $target.Ports) {
    $reachable = Test-NetConnection -ComputerName $target.Host -Port $port -InformationLevel Quiet
    [PSCustomObject]@{
      Endpoint  = $target.Endpoint
      Port      = $port
      Reachable = $reachable
    }
  }
}
$results | Format-Table -AutoSize

Alternatively, for the endpoints reachable over HTTPS (port 443) or port 8081, you can try to open the corresponding URL in a browser and check whether you receive a server response, for example:

  • https://portnox-centraal-prod.servicebus.windows.net:443
  • https://mobilecentraal.portnox.com:8081 (a 503 response code means that there is connectivity)

If any of these checks fail, you need to check DNS, firewall, and proxy settings for that specific endpoint and port.