Required TCP ports for Foglight for Virtualization Ent Edition 6.8?
Chris Walker made a vFoglight Visio diagram in 2011 (see below) showing required TCP ports that I would like to update for Foglight for Virtualization, Enterprise Edition 6.8.
I am removing GPI references so I believe that I should change the Guest Process Investigation (fglAM server) with the dotted lines to SSH and WMI to an Infrastructure Agent fglAM server.
My Questions:
1. Are the WMI, WinRM, and WinRM 2.0 default ports still correct?
2. In eDOCS for Foglight for Virtualization Ent Ed 6.8, the WIndows FIrewall Interference section states that these three ports listed below should be open between the Agent manager and the agent (WIndows assumed?). Should they be added to the diagram?
• TCP Port 135 (DCE/RPC Locator service, WindowsShellService, WMIConnectionService)
• TCP Port 139 (NetBIOS Session Service)
• TCP Port 445 (Windows shares)
If I update this diagram, who is willing to check it for accuracy?
GPI is still available in ver 6.8 We obviously prefer that customers start using IC agent to collect Processes data rather GPI since GPI will be retired at some point but we are not there yet.
John Maxwell advised me to drop GPI from my 6.8 courses even though it is still supported. He wanted me to focus on the Infrastructure cartridge instead.
One easy fix to the diagram is to leave what I have and add an Infrastructure Agent to the fglAM running GPI. I could then add a note that GPI is still supported but is going away and that the Infrastructure agent is preferred. However, I am not sure of the TCP ports for the Infrastructure Agent. Can anyone help me with the port numbers?
I will share what I know….. The ports for IC agent to monitored host are very similar to GPI agent since they both use the same collections methods.
IC agent by default tries WinRM method first over http/https protocol using ports either (80/443) or (5985/5986) depending upon version of WinRM. If this fails then it falls back to WMI/DCOM which uses the ports you already mentioned plus any Dynamic port. For Unix boxes it uses SSH over port 22.
Windows Firewall has a built-in Rule to allow WinRM communication, which can be enabled. So in scenarios where customers are using Windows Firewall or insist on secure communication, it is best to use WinRM rather than mucking around with configuring Dynamic ports for WMI/DCOM. Additionally, WinRM is usually much reliable in. Currently we use the same approach for GPI.
Thank you Prasad. This does help but I do have a WinRM question.
WIth GPI, we were recommending WMI, when possible, because WinRM had to be enabled/configured for every monitored host, a tedious task. The WInRM benefit was its ability to go through firewalls.
So has it changed in WIndows that WinRM is now automatically enabled? Because in your staqtement "Windows Firewall has a built-in Rule to allow WinRM communication, which can be enabled" I am not sure if WInRM must be enabled, the firewall rule must be enabled, or both.
Starting with Windows 2008, WinRM is enabled by default however we may have to tweak some of the settings for our agents to work successfully (we have a KB article for that on Supportlink).
Even for WMI/DCOM we do need to fix REG key permissions. So there is manual work involved regardless of using WinRM or WMI/DCOM.
As far as the Firewall Rule, I am not sure if he it is enable by default.
If so, it looks like other than already having WinRM with Windows 2008 and above so that you don't have to download it, you still have to do the same WinRM configuring that you always had to do (e.g., run the winrm quickcofig command or similar using Ruin as Administrator).Yes?
Looking at the Infrastructure Cartridige WindowsAgent wizard to add an unmonitored host, I didn't see any requiremens to run a WinRM command on that unmonitored host to make the monitoring work. So when my trainining course discusses configuring the Infrastructure Agent for a Windows server, must I mention WinRM?
michael.bennett
5 Posts
1804
1
Posted April 26th, 2013 17:00
Thanks Prasad for all of your help. Here is the revised diagram.-Michael