Network Connections#

A network connections schema provides a comprehensive overview of the network. It allows for quick identification of network issues, making diagnosing and resolving connection problems easier.

If an issue arises and you see error messages indicating that one component can't connect to another, refer to the connection table to identify the failing connection. First, verify that the connections are intact by logging into the controller or the replication agent and checking the connection for the specific scenario.

Warning

Access to network ports 22, 443, and 12201 must be restricted by security group rules or firewalls and opened only to trusted IP addresses or CIDR ranges.

Please make sure that the required security rules are configured appropriately when deploying the application.

Single-node Migration#

Controller traffic#

Table 1: Single-node: Controller traffic.
Initiator	Target	Port	Data flow	Description
Operator	Controller	tcp/443	UI/API	User access
Operator	Controller	tcp/4443	UI/API	User access for initial configuration
Controller	Controller	tcp/443	Control only	Controller API calls
Controller	Controller	tcp/4443	Control only	Initial configuration API/UI
Controller	Controller	tcp/6443	Control only	Kubernetes API for cluster coordination
Controller	Controller	udp/12201	Initiator→ Target	Logs

Replication (initial and incremental)#

This section lists the network connections between system components that are required for control, data transfer, and service communication.

The connections in the table below do not depend on the Receiver Mesh setting or the protocol used to communicate with Cloud Agents. Whether an individual connection is required depends on the scenario.

Table 2: Additional connections.
Connection	Port	When required
Controller → Target cloud APIs	tcp/*	Target cloud API calls
Replication Agent → Controller	udp/12201	Logs
Replication Agent → Source cloud APIs	tcp/*	External replication agents only

The set of ports for communication with Cloud Agents is determined by the target cloud settings. In particular, it depends on whether Receiver Mesh is enabled and whether the HTTPS server is used on Cloud Agents. By default, communication with Cloud Agents uses HTTP.

The HTTPS server is enabled or disabled in the additional parameters of the target cloud with the Use HTTPS server on cloud agent parameter. For instructions on enabling Receiver Mesh, see Enable Receiver Mesh.

Standard mode with HTTP between the Controller and the Cloud Agent

Table 3: Standard mode with HTTP between the Controller and the Cloud Agent.
Connection	Port
Replication Agent → Controller	tcp/443 — control, heartbeat, and data transfer
Controller → Cloud Agent	tcp/80 — control and data transfer
Cloud Agent → Controller	tcp/443 — heartbeat

Standard mode with HTTPS between the Controller and the Cloud Agent

Table 4: Standard mode with HTTPS between the Controller and the Cloud Agent.
Connection	Port
Replication Agent → Controller	tcp/443 — control, heartbeat, and data transfer
Controller → Cloud Agent	tcp/443 — control and data transfer
Cloud Agent → Controller	tcp/443 — heartbeat

Receiver Mesh enabled with HTTP between the Controller and the Cloud Agent

Table 5: Receiver Mesh enabled with HTTP between the Controller and the Cloud Agent.
Connection	Port
Replication Agent → Controller	tcp/443 — control and heartbeat
Controller → Cloud Agent	tcp/80 — control
Replication Agent → Cloud Agent	tcp/8899 — data transfer
Cloud Agent → Controller	tcp/443 — heartbeat

Receiver Mesh enabled with HTTPS between the Controller and the Cloud Agent

Table 6: Receiver Mesh enabled with HTTPS between the Controller and the Cloud Agent.
Connection	Port
Replication Agent → Controller	tcp/443 — control and heartbeat
Controller → Cloud Agent	tcp/443 — control
Replication Agent → Cloud Agent	tcp/8899 — data transfer
Cloud Agent → Controller	tcp/443 — heartbeat

Receiver Mesh

When Receiver Mesh is enabled, Replication Agents send replication data directly to Cloud Agents over TCP 8899, bypassing the Controller. The Controller is still used for control communication.

The ports required for the HTTP and HTTPS configurations are listed in the tables above.

See Receiver Mesh.

Recovery#

Table 7: Single-node: Recovery.
Initiator	Target	Port	Data flow	Description
Controller	Target cloud APIs	tcp/*	Control only	Target cloud API calls
Controller	Cloud Agent	tcp/80	Control only	Control
Cloud agent	Controller	tcp/443	Control only	Heartbeat
Cloud agent	Controller	udp/12201	Logs	Logs

HA Migration#