Deployment Guide: Network Architecture and Ports

 

Refer to the following diagram and port table to ensure that all the relevant ports are opened for components in your NetWitness Platform deployment to communicate with each other.

See NetWitness Endpoint Architecture at the end of this topic for individual Endpoint Architectural diagrams.

NetWitness Platform Network Architecture Diagram

The following diagram illustrates the NetWitness Platform network architecture including all of its component products.

Note: NetWitness Platform core hosts must be able to communicate with the NetWitness Server (Primary Server in a multiple server deployment) through UDP port 123 for Network Time Protocol (NTP) time synchronization.

 

 

NetWitness Network (Packets) Architecture Diagram with Ports

NetWitness Logs Architecture Diagram with Ports

Event Stream Analysis Network (Packets) Architecture Diagram with Ports

The following diagram illustrates the Event Stream Analysis network architecture with packet capture.

Event Stream Analysis (Logs) Architecture Diagram with Ports

The following diagram illustrates the Event Stream Analysis network architecture with log collection.

NetWitness Platform Firewall Requirements Summary

The following table lists all the ports that need to be open in your firewall by host.

                                                                                                                                                                                          

Comprehensive List of NetWitness Platform Host, Service, and iDRAC Ports

Note: For ports used in event collection through the NetWitness Logs, see the "The Basics" in the RSA NetWitness Suite Log Collection Deployment Guide. Go to the Master Table of Contents to find all NetWitness Platform Logs & Network 11.x documents.

This section contains the port specifications for the following hosts.

                                     

NW Server Host

                                                                                                               

Archiver Host

                                                                     

Broker Host

                                                                           

Concentrator Host

                                                                                 

Endpoint Log Hybrid

                                                                     

Relay Server

                           

Event Stream Analysis (ESA) Host

Note: The ports in this table are for the ESA Primary an ESA Secondary hosts. The Content Hub, Correlation and ESA Analytics services are co-located on the ESA Primary host. The Correlation and ESA Analytics services are co-located on the ESA Secondary host.

                                                                                                               

iDRAC Ports

                                      

Log Collector Host

                                                                                             

Log Decoder Host

                                                                                       

Log Hybrid Host

                                                                                             

Malware Host

                                                                                       

Network Decoder Host

                                                               

Network Hybrid Host

                                                                     

UEBA Host

                                                         

NetWitness Endpoint Architecture

NetWitness Endpoint 4.4 Integration with NetWitness Platform

NetWitness Endpoint 11.3.1 Architecture with Ports

 

For more information on the services running on Endpoint Log Hybrid, see RSA NetWitness Endpoint Configuration Guide.

How to Change UDP Port for Endpoint Log Hybrid

The following steps tell you how to change the Endpoint Log Hybrid default UDP port 444 if it is not acceptable in your environment. 555 is the example this procedures uses as a replacement for 444 UDP port.
There are two tasks you need to o change the Endpoint Log Hybrid default UDP port 444:

Task 1 - Tell All Agents to Use a New UDP Port

Task 2 - Update the Port on All Endpoint Log Hybrid Hosts in Your Environment

Note: If you did not select the custom firewall rules option when you ran the nwsetup-tui, NetWitness platform overwrites the firewall rules are overwritten after a period of time. Please refer to the following Knowledge Base Article 00036446 (https://community.rsa.com/docs/DOC-93651) if this is the case.

Task 1 - Tell All Agents to Use a New UDP Port

Complete the following steps to update the UDP port in the default Enterprise Data Replication (EDR) policy, and all other policies you have, to tell all agents to use a new UDP port.

1. In the NetWitness Platform menu, select ADMIN > Endpoint Sources > Policies.
   The Policies view is displayed.

2. Select the Default EDR Policy and click Edit from the toolbar.
3. roll down to find the UDP PORT and change the value (for example, change from 444 to 555).
4. Click Publish Policy at the bottom of the view.

Task 2 - Update the Port on All Endpoint Log Hybrid Hosts in Your Environment

SSH to each Endpoint Log Hybrid host in your environment with admin credentials and make the following updates.

1. Update the iptables rules to allow 555 in place of 444.
   1. Replace 444 with 555 in the following file.
      vi /etc/sysconfig/iptables
   2. Restart iptables with the following command string.
      systemctl restart iptables
   3. Verify the change with the following command string.
      iptables -L -n
      The following is an example of what is displayed for a correct change.
      ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp multiport dports 555 /* EndpointNginxPort */ ctstate NEW
2. Update the SELinux policy. 555 is a privileged port, so you must update SELinux policy to allow this port.
   1. Run the following command string.
      semanage port -a -t http_port_t -p udp 555
      If you received any python errors or warnings, ignored them.
   2. Verify the change with the following command string.
      semanage port -l | grep http_port_t
      The following is an example of what is displayed for a correct change.
      http_port_t udp 555, 444
   3. (Optional) Remove 444.
3. Update nginx config.
   1.  Edit the following file.
      vi /etc/nginx/nginx.conf
   2.  Search for the following string.
      listen 444 udp;
   3.  Replace 444 with 555.
   4.  Restart nginx with the following command string.
      systemctl restart nginx
4. Verify that agents are communicating over the new port.
   1. Run the following command string.
      tcpdump -i eth0 port 555
   2. Wait for 30 seconds because the port sends out a beacon every 30 seconds. If t everything is working correctly, information similar to the following will be displayed.
      09:20:12.571316 IP 10.40.15.103.60807 > EPS1.rsa.lab.emc.com.dsf: UDP, length 20
      09:20:12.572433 IP EPS1.rsa.lab.emc.com.dsf > 10.40.15.103.60807: UDP, length 1
      Both lines must be returned. One is the size request (20 bytes) and the other is the response size (1 byte).