Deployment

Firewall Ports

View as Markdown

Firewalls, security groups, and ACLs between the device network and Config Manager must permit both device-initiated provisioning traffic and Config Manager-initiated management traffic. The exact device-facing bootstrap port depends on the selected transport and platform.

Protocol / PortDirectionPurpose
UDP 67Bidirectional (DHCP relay ↔ Config Manager)Relayed DHCP requests and server responses (DISCOVER / REQUEST / OFFER / ACK)
TCP 80Device → Config ManagerPrivate-network HTTP bootstrap-script and firmware downloads, where HTTP is configured
TCP 443Device → Config ManagerHTTPS bootstrap and HTTP-compatible downloads, where HTTPS is configured
TCP 2222Device → Config ManagerDefault encrypted SFTP transport for Cumulus rendered configuration and platform-specific SFTP downloads
TCP 443Config Manager cluster → managed device or BMCStandard HTTPS management APIs, including NVOS, Arista eAPI, and Redfish where those platforms or workflows are used
TCP 8765Config Manager cluster → Cumulus Linux deviceCumulus NVUE REST API used by deployment, validation, reprovisioning, backup, and other lifecycle workflows
UDP/TCP 53Device → DNS resolverDNS resolution when ZTP/DHCP targets are referenced by hostname (e.g. ztp.<hostname>, dhcp.<hostname>)