What firewall ports does Sendense need?

Reference

What firewall ports does Sendense need?

One outbound port from each SNA covers normal operation. Direct site-to-site replication and the recovery-site Controller hop need their own rules.

ReadyCurrentfirewallconnectivitysnareplicationdirect-p2p

The Short Answer

TCP 443 outbound from each SNA covers enrollment, control, health, backup and hub-routed replication. Direct P2P additionally requires each eligible source SNA to reach each eligible destination SNA on that destination appliance's assigned replication ingress range. The destination SNA must also reach the Sendense Controllers inside the recovery site on the Controller replication ports used for their replica disks.

At A Glance

Each connection is initiated by the appliance named first. Stateful return traffic follows each established connection, so no separate reverse rule is needed.

SNA to SHA - TCP 443 outbound - always

Enrollment, control, health heartbeats, backup data and hub-routed replication all travel inside this one connection. The SNA always initiates it; SHA never dials into the customer site. No inbound rule is needed at the site for this.

Source SNA to destination SNA - the destination appliance's assigned replication ingress range - Direct P2P, or Automatic when the direct route is selected

Inter-site replication data. The source SNA initiates it and the destination SNA listens on ports leased from its own assigned range. This is the only rule that crosses the site boundary, and the Via SHA route does not need it.

Destination SNA to Sendense Controller - TCP 10810 upward, one successive port per replica disk - every controller-backed route

Writes the replica disks. Stays inside the recovery site, is initiated by the destination SNA, and is required on the hub route as well as the direct route.

Multi-SNA Warning

SHA may select any healthy eligible SNA at the source site and any healthy eligible SNA at the recovery site for a given sync, skipping appliances that are offline, stale on heartbeat, or in maintenance mode. Firewall policy must therefore cover every permitted source-SNA-to-destination-SNA pairing, and each destination SNA's own assigned ingress range.

A rule that covers only one pairing makes Direct P2P work on some syncs and fall back or fail on others, depending on which appliances were selected.

Where To Find Your Assigned Range

In the SHA GUI, open DenseView, select the Appliances tab in the left rail, expand the site, and select the SNA. The Port allocations section shows Restore slots, which is that appliance's assigned replication ingress range.

Through the API, call GET /api/v1/appliances/{id}/ports with the settings.read permission and read nbd_restore_range. That is the assigned replication ingress range. The separate nbd_backup_range field is a SHA-side backup allocation and is not the Direct P2P rule.

Example values are not defaults

Any numeric range in Sendense documentation is illustrative. Ranges are assigned per appliance at enrollment, differ between SNAs including two SNAs at the same site, and are leased per active job rather than permanently open. Always build rules from the range your own destination SNA reports.

Full Planning Guide

For the complete connectivity matrix, diagrams, worked firewall examples with multiple SNAs, route-policy behaviour, security characteristics, validation steps and troubleshooting, see Replication Network And Firewall Planning.