csa ports to open

shawn.s · ‎10-04-2004

I have my "field laptops" communicating to the management server through my firewall on tcp port 5401. I was wondering if this is a best practice, I have thought about having them just vpn in to communicate with the management server. What are the pro's/cons to this?. Is the communication on tcp 5401 secure?.

tsteger1 · ‎10-04-2004

We chose to use our DMZ instead of coming all the way in through the firewall. We didn't go the vpn route because they'd need to be connected to talk to the MC. Now they can always talk whether or not the are connected to us. I think that is also what Cisco recommends.

pcomeaux · ‎10-04-2004

Yes - TCP 5401 is the default port that the clients use to communicate to the CSA MC over SSL with. If 5401 is not available, the agent tries 443, still using SSL. A certificate of the CSA MC is provided to the Agent to for securing the conversation at install.

So the conversation is as secure as SSL offers, which most of us count on for securing our on-line transactions, etc.

I agree that placing the server on a DMZ reduces risk as mentioned in the other post.

thanks for using CSA -

peter

rvaguilera · ‎10-06-2004

Does CSA also need ports opened for DNS to resolve the CSA MC computer name?

For example, in an environment where the client is in a segment of the network that only has access to the CSA MC and nothing else.

tsteger1 · ‎10-06-2004

Any type of name resolution should work but DNS is preferred. I have a test MC on the same segment as a client and it uses NetBIOS to find the MC.

pcomeaux · ‎10-06-2004

Yes - CSA does require name resolution to reach the CSA MC.

So if clients are located outside of the network, say at home on a high speed link, the CSA MC would need to be configured in the externally advertised DNS server with an address that is translated to the inside network. Besides the translation, the firewall would need to have the ports I mentioned above open (tcp 5401 or tcp 443).

If the users are inside the network, then DNS should resolve them to an internal address for the CSA MC.

This is a good reason why DNS is preferred in lieu of hosts files.

Hope this helps,

peter