Deployment Firewall & Port Requirements
This page lists the host requirements for the console appliance, the vault agent, and the copy agent, and every network flow and port your firewall team must permit. It is written for network and security engineers, deployment architects and firewall teams.
Product Deployment Prerequisites
Console appliance — prerequisites
The console is delivered as an appliance image for VMware or Hyper-V. The host/cluster must be able to satisfy the following minimums for the deployed VM. These are hard minimums, not targets.
| Resource | Requirement |
|---|---|
| vCPU | 20 × vCPU |
| Memory | 100 GiB RAM |
| Disk | 680 GiB across four disks — OS 60, application 60, PostgreSQL 60, ClickHouse 500. The ClickHouse disk grows with the audit event rate. |
| Storage read latency | < 5 ms, sampled as a 5-second average |
| Storage write latency | < 5 ms, sampled as a 5-second average |
Storage latency is a gating requirement. Datastore read and write latency must stay
below 5 ms measured on a 5-second rolling average. Sustained latency above this
degrades ClickHouse ingest and copy-job throughput. Validate on the target datastore before
deployment (e.g. vCenter datastore performance charts, or esxtop disk latency GAVG).
Network / firewall prerequisites
All component-to-component flows are enumerated in the Complete Port & Flow Matrix, with the direction of each connection and the port opened. Connections are always initiated by the component in the From column.
Vault Agent — host requirements
The vault agent runs on its own customer-provided Linux VM inside the vault network. It is not deployed on the vault-side ObjectScale host.
| Resource | Requirement |
|---|---|
| vCPU | 8 × vCPU |
| Memory | 32 GB RAM |
| Operating system | Same list as the copy agent hosts below |
The Java, hostname, and time prerequisites listed for the copy agent apply to the vault agent too.
Copy Agent — host requirements
The copy agent runs on a customer-provided Linux host inside the vault network. Host sizing is driven by the JVM profile assigned to the agent (Setup & Settings > Diagnostics > JVM Profiles). Each profile sizes the JVM heap at ~75% of host RAM; the host's copy-job capacity is prorated on host RAM, anchored at a 48 GB host = 10 concurrent copy jobs.
Sizing by JVM profile:
| JVM profile | Host RAM | JVM heap (-Xmx) | Required vm.max_map_count | CPU cores | Concurrent copy jobs |
|---|---|---|---|---|---|
Default (8 GB host, default) | 8 GB | 6 GB | 11,059 | 4 | 2 |
16 GB Host (host-16g) | 16 GB | 12 GB | 22,118 | 8 | 3 |
24 GB Host (host-24g) | 24 GB | 18 GB | 33,177 | 8 | 5 |
32 GB Host (host-32g) | 32 GB | 24 GB | 44,236 | 16 | 7 |
48 GB Host (host-48g) | 48 GB | 36 GB | 66,355 ⚠ | 16 | 10 |
64 GB Host (host-64g) | 64 GB | 48 GB | 88,473 ⚠ | 16 | 13 |
- Concurrent copy jobs scale linearly with host RAM:
jobs = round(host_GB × 10 ÷ 48)(equivalentlyround(heap_GB × 10 ÷ 36)). Pick the profile that matches the host's RAM. - RAM: 8 GB is the practical minimum (Default profile); larger profiles require the host RAM shown above. The heap is ~75% of host RAM; the remainder covers off-heap direct memory (S3 buffers) and OS overhead.
- Required
vm.max_map_count: every profile uses the ZGC garbage collector, which needs a kernel memory-mapping limit of at leastfloor(heap MB × 1.8). The historical Linux default (65,530) is enough for every profile except the two marked ⚠ — raise the limit on those hosts withsysctl -w vm.max_map_count=<value>(persist via/etc/sysctl.d/) before assigning48 GB Hostor64 GB Host. - Disk: persistent storage for
/opt/argus-agent/— agent JAR ≈ 70 MB, logs ≈ 350 MB (7-day retention), GC logs ≈ 30 MB, plus an OOM heap dump up to the configured JVM heap max. - The same per-profile figures appear in Cyber Vault > Agent Fleet Management > Agent Installation > "JVM Profiles & Host Sizing Guide." Custom profiles defined in Setup & Settings > Diagnostics follow the same proration.
Supported operating systems — Linux (x86_64 or aarch64), systemd-based:
- RHEL 8+
- Rocky Linux 8+
- Ubuntu 20.04+
- SUSE / OpenSUSE
- any other systemd-based Linux distribution
Prerequisites:
- Root / sudo access — the install script writes to
/etc/systemd/system/and runsuseradd. It creates a dedicatedargus-agentsystem user (no login shell) and runs the agent service as that unprivileged user; root is used for installation only. - SELinux must be disabled — the agent service cannot start while SELinux is Enforcing
(
SELINUX=disabledin/etc/selinux/config, thensetenforce 0). The install script exits with instructions if it detects Enforcing. - Java 25.0.5 — pre-install Java 25.0.5 in the VM template. The installer checks only for Java 25 or newer, not for 25.0.5. Run
java -versionand confirm 25.0.5 before you install. The agents run in the vault network, which has no internet access, so this is the default path. If Java is missing or older than 25, the script installs Amazon Corretto 25 instead, which requires outbound HTTPS tocorretto.aws. - Hostname — the agent's hostname must resolve to its interface IP address, not to a
loopback address such as
127.0.1.1. - Time — every VM syncs to NTP and runs in UTC. Clock drift places changes in the wrong window.
curl— required to download the agent JAR from the console.- Network — outbound to the console (443) and, for copy agents, to the source/target S3 endpoints, per the flow matrix in the Complete Port & Flow Matrix.
Installation — run as root on the target host:
curl -fsSL "<CONSOLE_URL>/api/agents/install.sh?type=copy-engine&key=<AGENT_KEY>" | bash
Replace the console's 443 and 8443 certificates with CA-issued certificates (TLS 1.2 or higher) before you install agents. Add -k to the curl command only while the console still uses its default certificate, because -k turns the TLS check off.
The script performs pre-flight checks (root, Java), then: creates the argus-agent user,
creates /opt/argus-agent/, downloads the agent JAR (authenticated with the agent key), writes
a systemd unit with Restart=always, and runs systemctl enable && start. Tail logs with
journalctl -u argus-copy-engine -f.
Purpose & Scope
This document specifies every network flow, port, transport, and direction a customer firewall team must permit to deploy AirGap for ObjectScale. The single authoritative reference is the Complete Port & Flow Matrix; every other section is derived from it.
Components:
- Console (the management appliance, reachable at
https://x.x.x.x(443)) - Copy Agent (agent service with embedded copy engine — runs inside the vault network)
- Vault Agent (runs on its own Linux VM inside the vault network)
- ObjectScale (Dell object storage — acts as both source and vault target)
- ClickHouse (copy-log / metrics analytics store)
- ACD (Airgap Control Device — managed switch that gates the vault network port)
Throughout, the console is host x.x.x.x serving standard HTTPS on 443/TCP
(TLS terminates at the console). Substitute your actual console and ClickHouse addresses.
Direction of trust: Console ↔ Agent traffic is agent-initiated — the agent
polls the console and all config/commands ride back in the heartbeat response. The console
never opens a connection toward an agent in the vault network. The only console connection into the
vault is the prep-mode call to the vault ObjectScale management API (4443), which you remove at lock-down.
Component Roles
| Component | Role | Location |
|---|---|---|
| Console | Management plane, REST API + GUI, job orchestration, audit analytics. It has no S3 flows and never copies data. | Management host x.x.x.x, HTTPS port 443. Outside the vault, on the production management network |
| Copy Agent | Data-mover inside the vault network; heartbeats console, runs copy jobs. Only copy agents copy data. | Vault network (isolated) |
| Vault Agent | Runs on its own Linux VM inside the vault network; heartbeats console, requests vault network open/close and incremental syncs, sends QTP events and log uploads, reads vault ObjectScale health over the management API (4443), and drives the air-gap control device (ACD) over SSH (22) or RESTCONF (HTTPS 443) | Vault network (isolated) |
| ObjectScale | Object storage — source (production) and vault target | Customer storage tier |
| ClickHouse | Copy-log / metrics analytics store | On the console appliance, reached over HTTPS on 8443 through the appliance's nginx |
| ACD (Airgap Control Device) | Managed switch that physically gates the vault network port. It is the air gap. | Vault network edge |
Network Segments
Each zone has a management network and a data network. The management network carries the console, agent, and management API traffic. The data network carries S3 traffic. The ObjectScale replication networks are not used by AirGap for ObjectScale. Do not route product traffic over them.
Plan the firewall rules per segment, so that a rule on one network does not open a path on another.
| Segment | Zone | What attaches | Routing needed |
|---|---|---|---|
| Production management | Production | Console, Eyeglass, production cluster management interfaces | Reachable from the vault management and vault data segments on 443 and 8443 (console) |
| Production data | Production | Production S3 endpoint or load balancer VIP | Reachable from the vault data segment on 9021 |
| Vault management | Vault | Vault agent, vault ObjectScale management, vault switch management interface | Outbound route to production management through the vault firewall. Reachable from the console on 4443 during prep mode only |
| Vault data | Vault | Copy agents, vault S3 endpoint or load balancer VIP | Outbound route to production management and production data through the vault firewall. Reachable from the vault agent on 9091 |
Once vault mode is active, no route is needed from any production segment into the vault. Administrators reach vault VMs from a vault-side jump host.
Complete Port & Flow Matrix
All ports are destination ports. "Source" is the component that opens the TCP connection — the firewall must permit the source to reach the destination port. This table is the complete and authoritative set of flows.
| # | Source | Destination | Port | Transport | Protocol | Purpose | Required |
|---|---|---|---|---|---|---|---|
| 1a | Copy Agent | Console x.x.x.x | 443 | TCP | HTTPS¹ | Registration, heartbeat, job fetch and job status callbacks, copy-log push, alarms, self-upgrade download | ✅ Mandatory |
| 1b | Vault Agent | Console x.x.x.x | 443 | TCP | HTTPS¹ | Registration, heartbeat, group fetch, vault network open/close, start-sync, sync status, abandon-window, QTP events, log upload, device health and node inventory reports, self-upgrade | ✅ Mandatory (Vault Mode) |
| 2 | Console | ObjectScale management API (source) | 4443 | TCP | HTTPS | Inventory, version detection, namespace/bucket/ACL provisioning | ✅ Mandatory |
| 3 | Console | Vault ObjectScale management API | 4443 | TCP | HTTPS | Provisioning on the vault | ✅ Prep mode only. Remove this rule at lock-down² |
| 4 | Copy Agent | ObjectScale S3 (source read) | 9021³ | TCP | S3 (HTTPS) | Copy engine reads source | ✅ Mandatory |
| 5 | Copy Agent | Vault Target S3 (write) | 9021³ | TCP | S3 (HTTPS) | Copy engine writes to vault | ✅ Mandatory |
| 6 | Copy Agent | ClickHouse | 8443 (HTTPS)⁴ | TCP | HTTPS POST | Copy-log writes (smart-skip baseline, progress) | ✅ Mandatory |
| 7 | Vault Agent | ACD switch | 22 (SSH) or 443 (RESTCONF) | TCP | SSH or HTTPS | Open/close air-gap port, per the protocol you choose | ✅ Mandatory — the switch is the air gap |
| 8 | Console | Every production ObjectScale node, management IP | 22 | TCP | SSH/SFTP | Audit-log ingest. Never through a load balancer VIP | ✅ Mandatory |
| 9 | Vault Agent | Vault ObjectScale mgmt API | 4443 | TCP | HTTPS | Vault device health, node inventory, namespace provisioning on the vault | ✅ Mandatory (Vault Mode) |
| 10 | Vault Agent | Copy workers | 9091 | TCP | HTTP (plaintext) | Tells the copy workers the vault network is opening or closing. Flow stays inside the vault network | ✅ Mandatory |
| 11 | Console | Eyeglass | 443 | TCP | HTTPS | Ransomware-detection status polling | ✅ Mandatory when the threat check is enabled |
| 12 | Console and agents | DNS servers | 53 | TCP/UDP | DNS | Name resolution in each zone | ✅ Mandatory |
| 13 | Console and agents | NTP servers | 123 | UDP | NTP | Time sync. Every VM runs in UTC | ✅ Mandatory |
| 14 | Vault-side jump host | Vault agent and copy worker VMs | 22 | TCP | SSH | Administrator access to vault VMs | ➕ As needed |
| 15 | Console | openSUSE mirrors | 443 | TCP | HTTPS | Weekly operating system patching of the console | ✅ Mandatory for patching |
Legend: ✅ mandatory · ➕ optional / as needed.
¹ Standard HTTPS terminates at the console; in addition, every console↔agent payload is
ML-KEM-1024 encrypted at the application layer (QTP). Endpoints (all to https://x.x.x.x):
POST /api/agents/heartbeat, POST /api/vault-agents/{id}/log-upload,
POST /api/vault-agents/{id}/qtd-vault-event,
POST /api/vault-agent/groups/{id}/network-open|network-close|start-sync|abandon-window,
GET /api/vault-agent/groups/{id}/sync-status, GET /api/vault-agents/{id}/upgrade-manifest.
Auth: X-Agent-Key header (the agent key).
² Prep-mode rule (#3). The console calls the vault ObjectScale management API only while the vault is in prep mode. Once you switch to Vault Mode, remove this rule. See Locking down the vault.
³ S3 ports. 9021 (HTTPS) is the requirement. Open 9020 only where your policy allows unencrypted S3.
⁴ ClickHouse port (#6). The console composes the agent's
ClickHouse URL in the heartbeat as {scheme}://{host}:{port} from the ClickHouse host, port
and SSL settings in Setup & Settings > Database (HTTPS when SSL is on, HTTP when it is off)
and delivers it to the agent verbatim as the clickhouseUrl setting — the agent holds no port
of its own. Standard deployed value is 8443 (HTTPS) (SSL on); the fallback if unset is
8123/HTTP. Wherever the console's inbound rules are listed, include copy workers → console 8443.
Job cancel. The console never opens a connection toward the vault network. Job cancels reach agents on the heartbeat. Never open an inbound port to the vault for this.
Direction of Trust
┌────────────────┐ ◄── HTTPS heartbeat ─── agent-initiated ──┐
│ Console │ (config, commands, retry signals, │
│ x.x.x.x : 443 │ credentials all returned in response) │
│ │ ┌────────────┐
└────────────────┘ │ Agents │
└────────────┘
- Primary flows (#1a, #1b): Copy agent and vault agent > Console
x.x.x.x:443. The agent polls; the console answers commands and pushes configuration only as the heartbeat response body. - Prep mode (#3): the console reaches the vault ObjectScale management API on 4443 for provisioning. This is the only console connection into the vault, and you remove it at lock-down.
- Vault firewall posture: once vault mode is active, nothing is inbound to the vault network. Open outbound from the vault to the console (443), to ClickHouse (#6), to storage (#4, #5, #9), and to the ACD switch (#7).
Consolidated Firewall Rules by Zone Boundary
The same flows as the Complete Port & Flow Matrix, grouped the way a firewall team implements them.
Vault network > Management plane (egress from vault)
| Allow | From | To | Port | Proto | Flow |
|---|---|---|---|---|---|
| ✅ | Copy Agent | Console x.x.x.x | 443 | TCP/HTTPS | #1a |
| ✅ | Vault Agent | Console x.x.x.x | 443 | TCP/HTTPS | #1b |
| ✅ | Copy Agent | ClickHouse | 8443 (HTTPS) ⁴ | TCP/HTTPS | #6 |
Vault network > Storage (egress from vault)
| Allow | From | To | Port | Proto | Flow |
|---|---|---|---|---|---|
| ✅ | Copy Agent | Source S3 (ObjectScale) | 9021 ³ | TCP/S3 | #4 |
| ✅ | Copy Agent | Vault Target S3 | 9021 ³ | TCP/S3 | #5 |
| ✅ | Vault Agent | Vault ObjectScale Management API | 4443 | TCP/HTTPS | #9 |
| ✅ | Vault Agent | ACD switch | 22 (SSH) or 443 (RESTCONF) | TCP | #7 |
Use the copy worker and vault agent IP addresses as the source of these rules. Do not open them to the whole vault network.
Within the vault network
| Allow | From | To | Port | Proto | Flow |
|---|---|---|---|---|---|
| ✅ | Vault Agent | Copy workers | 9091 | TCP/HTTP | #10 |
| ➕ | Vault-side jump host | Vault agent and copy worker VMs | 22 | TCP/SSH | #14 |
Management plane > Storage (egress from console)
| Allow | From | To | Port | Proto | Flow |
|---|---|---|---|---|---|
| ✅ | Console | ObjectScale Management API | 4443 | TCP/HTTPS | #2 |
| ✅ (prep mode only) | Console | Vault ObjectScale Management API | 4443 | TCP/HTTPS | #3 |
| ✅ | Console | Every production ObjectScale node (management IP) | 22 | TCP/SSH | #8 |
Management plane > Other services (egress from console)
| Allow | From | To | Port | Proto | Flow |
|---|---|---|---|---|---|
| ✅ | Console | Eyeglass | 443 | TCP/HTTPS | #11 |
| ✅ | Console and agents | DNS servers | 53 | TCP/UDP | #12 |
| ✅ | Console and agents | NTP servers | 123 | UDP | #13 |
| ✅ | Console | openSUSE mirrors | 443 | TCP/HTTPS | #15 |
Inbound to management plane (ingress to console)
| Allow | From | To | Port | Proto | Flow |
|---|---|---|---|---|---|
| ✅ | Operators / Copy Agent / Vault Agent | Console x.x.x.x | 443 | TCP/HTTPS | #1a, #1b |
| ✅ | Copy Agent | Console x.x.x.x (ClickHouse via the appliance nginx) | 8443 | TCP/HTTPS | #6 |
| ➕ | Operators | Console x.x.x.x | 80 | TCP/HTTP | redirect to 443 only |
Console > ClickHouse is intentionally absent — the console and ClickHouse are internal to the management/DB tier and need no customer firewall rule. Only the copy agent > ClickHouse flow (#6) crosses a zone boundary.
Legend: ✅ mandatory · ➕ optional / as needed.
Load balancers
If a load balancer sits in front of the production or vault ObjectScale S3 endpoints, apply the following:
- TLS. Pass TLS through, or re-encrypt to the nodes. Do not terminate TLS and forward plain HTTP.
- Health check. Use
GET /?pingon port 9021. - Timeouts. Set long idle and request timeouts. Multipart uploads of large parts keep a connection open for a long time.
- Capacity. Size the production VIP for the TPS budget you set in Setup & Settings > TPS Rate Limiting.
- Audit-log SFTP. Never send the audit-log SFTP session (flow #8) through a VIP. Connect to each node directly.
Port Reference (defaults & where configured)
| Port | Used by | Configurable? | Where it is set |
|---|---|---|---|
| 443 | Console HTTPS service (external) — flow #1. This is the appliance nginx, which proxies to the console on 127.0.0.1:9090 (not exposed). Also the ACD RESTCONF port (#7) and the Eyeglass port (#11) | Fixed by the appliance | Appliance |
| 8443 (HTTPS; fallback 8123/HTTP) | ClickHouse — flow #6 | host/port/SSL in Setup & Settings > Database, delivered as clickhouseUrl | Setup & Settings > Database |
| 9091 | Copy engine enginePort — flow #10 (vault agent notification and agent API/SSE) | agent-reported (default 9091) | Reported by the copy agent at registration |
| 4443 | ObjectScale Management API — flows #2, #3, #9 | per-device | ObjectScale device settings (Setup & Settings > Storage) |
| 9021 / 9020 | ObjectScale S3 HTTPS / HTTP — flows #4, #5 | per-endpoint | Source device and vault target endpoint settings |
| 22 | SSH — flow #7 (ACD) / flow #8 (ObjectScale audit-log ingest) / flow #14 (jump host) | per-device (acdSshPort, sshPort) | ACD settings of the vault agent; ObjectScale device SSH settings |
Security Notes
- QTP application-layer encryption is mandatory on every console↔agent payload (flow #1, ML-KEM-1024), with separate keys for console-to-agent responses, agent-to-console messages and credential delivery. This protects payloads independently of transport TLS.
- TLS certificate validation for ObjectScale management (#2, #3, #9), S3 endpoints (#4, #5), and ClickHouse
(#6) defaults to trust-all (
ignoreCerts=true) to accept self-signed certs. Replace the console's 443 and 8443 certificates with CA-issued certificates (TLS 1.2 or higher), supply valid certificates for each device, and turn off the bypass per device in production. - Nothing inbound to the vault once vault mode is active. The vault network needs only egress; keep all inbound rules to the vault closed. The prep-mode rule (#3) is the only exception, and you remove it at lock-down.
- Air-gap enforcement is performed by the ACD (a commanded switch), driven by the vault agent: the vault agent opens the vault network (#7), the copy agents run the copies (#4–#6), then the vault agent closes it — one cycle per sync.
Caveats
- ACD (#7) is the air gap. The vault agent reaches it over SSH (22) or RESTCONF (HTTPS 443), per the protocol you choose.
- Copy path (#4, #5): copy jobs run only on the copy agents, so open the source/target S3 flows from the copy agents. The console has no S3 flows.
- ClickHouse (#6): confirm the actual endpoint your environment exposes (standard 8443/HTTPS)
and set it in Setup & Settings > Database so the agent receives the
correct
clickhouseUrl. - Audit-log ingest (#8) is required, always. Point it at each production node's management IP, never at a VIP.