Data Center Assurance Port Requirements
This topic provides a comprehensive reference of all ports, endpoints, and network connectivity requirements for Data Center Assurance. Use this information to configure firewalls, security groups, and network policies in your environment.
The following table lists all required outbound and inbound ports that must be configured on your firewall for Data Center Assurance to function correctly.
| Direction | Service Type | Portal/Endpoint | Port | Description |
|---|---|---|---|---|
| Outbound | Data Center Assurance Admin Portal | dc.ai.juniper.net | TCP 443 | Opens the HPE Mist Networking Data Center Assurance GUI |
| Outbound | Apstra Edge to Cloud | ep-term.ai.juniper.net | TCP 443 | Secure connection to cloud termination service |
| Outbound | Apstra Edge to AWS S3 | usw2-ai-prod-dc-payloads.s3.us-west-2.amazonaws.com | TCP 443 | Download edge binaries and upload telemetry |
| Outbound | Apstra Edge to AWS S3 | usw2-ai-prod-apstra-edge-repo.s3.us-west-2.amazonaws.com | TCP 443 | Repository for edge software |
| Outbound | Apstra Edge to Apstra Controller | Apstra Instance IP | TCP 443 | Retrieve blueprints and anomalies |
| Inbound | Anomalies Stream Receivers | localhost | TCP 9595 | Receive pushed anomalies data |
| Inbound | Metrics Stream Receivers | localhost | TCP 9797 | Receive pushed metrics data |
| Inbound | Local Admin Server | localhost / 0.0.0.0 | TCP 8081 | Health checks, metrics, and REST API |
| Outbound | Apstra Edge to OpenSearch | Flow Server OpenSearch endpoint | TCP 9200 | Query flow and analytics data |
| Outbound | Apstra Edge to Metrics | Metrics endpoint | TCP 8080 | Retrieve metrics from controller |
| Outbound | Apstra Edge to vCenter | vCenter Server API | TCP 443 | Query VM inventory via vSphere SDK |
| Outbound | Apstra Edge to Slurm | Slurm REST API Server IP | TCP 6820 | Fetch workload and job information |
AWS S3 Firewall Configuration
Apstra Edge requires access to AWS S3 buckets for downloading edge binaries and uploading telemetry data. AWS S3 uses dynamic IP addresses, so configure firewall rules using FQDN-based rules rather than IP-based rules where possible.
- FQDN-Based Rules (Recommended)
- IP-Based Rules (If FQDN Rules Are Not Supported)
- For the Latest Port Information
FQDN-Based Rules (Recommended)
Configure outbound HTTPS (TCP 443) to the following S3 bucket FQDNs:
- usw2-ai-prod-dc-payloads.s3.us-west-2.amazonaws.com
- usw2-ai-prod-apstra-edge-repo.s3.us-west-2.amazonaws.com
This approach automatically tracks IP address changes and restricts access to the specific S3 buckets only, requiring no ongoing maintenance.
IP-Based Rules (If FQDN Rules Are Not Supported)
If your firewall does not support FQDN-based rules, you can configure IP-based rules. However, AWS S3 uses dynamic IP addresses, so these rules require periodic review and maintenance as IP addresses may change. Consult AWS documentation for the current IP ranges assigned to the us-west-2 region.
For the Latest Port Information
Port configurations and connectivity requirements may change with new releases. For the most current and complete information, refer to the official Juniper documentation at: https://www.juniper.net/documentation/us/en/software/juniper-data-center-assurance/user-guide/topics/concept/configure-ports.html