AA Agent Port-Forwarding and Proxy Server and Client Deployment
In some environments, architectural configurations may prevent Armor services from properly communicating security updates and offering monitoring services.
If your network environment's servers are behind specific firewall controls that block regular outbound communication, then you may want to perform a port-forwarding / proxy server deployment, which will forward traffic between your servers and the Armor API and service endpoints.
This port-forwarding / proxy server sits within your environment to provide servers that do not have outbound network access to communicate with Armor Anywhere services.
This solution uses to forward service data out from the customer environment and into Armor.
Review Requirements
To be able to perform a port-forward / proxy server deployment, you will need the following resources or information:
Port-Forwarding / Proxy Server
Linux server with OS of choice (CentOS7 recommended)
Must be a standalone server
1vCPU/1GB RAM minimum
NGINX package installed
The installed Anywhere Agent on the server
External IP Address
Client Armor Anywhere Agent Servers (prior to installing the Armor Anywhere Agent)
Internal access from the port-forwarding server to download the configuration script
Host file modifications made on each subsequent Anywhere Agent install
Review Firewall Rules
Port-Forwarding / Proxy Server
The port-forwarding / proxy server will need outbound access for the following:
The following ports will need to be opened for each server registered with Armor Anywhere.
Service / Purpose | Inbound / Outbound | Source | Destination | Inbound / Outbound | Port | Destination |
---|---|---|---|---|---|---|
Armor Agent | Inbound | Client VM Private IP | Port Forwarding Server Private IP | Outbound | 443/tcp |
|
Malware Protection, FIM, IDS | Inbound | Client VM Private IP | Port Forwarding Server Private IP | Outbound | 4119/tcp 4120/tcp 4122/tcp |
|
DSM | Inbound | Client VM Private IP | Port Forwarding Server Private IP | Outbound | 4120/tcp |
|
Relay | Inbound | Client VM Private IP | Port Forwarding Server Private IP | Outbound | 4122/tcp |
|
Monitoring | Inbound | Client VM Private IP | Port Forwarding Server Private IP | Outbound | 8443/tcp |
|
Remote Access | Inbound | Client VM Private IP | Port Forwarding Server Private IP | Outbound | 443/tcp |
|
Vulnerability Scanning | Inbound | Client VM Private IP | Port Forwarding Server Private IP | Outbound | *443/tcp |
|
Log Relay (Logstash) | Outbound | Client VM Private IP | Port Forwarding Server Private IP | Inbound |
| The IP address for your virtual machine |
Log Relay (Armor's logging service (ELK)) | Inbound | Client VM Private IP | Port Forwarding Server Private IP | Outbound |
|
|
Log Management (Filebeat/Winlogbeat) | Outbound | Client VM Private IP | Port Forwarding Server Private IP | Inbound |
|
|
Proxy Software Configuration
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 |
|
Client Configuration
Servers with the Anywhere Agent
All servers that run the Anywhere Agent will need outbound access to the port-forwarding server's private IP, with the following ports allowed:
Purpose / Service | Port | Destination |
---|---|---|
Armor Agent Heartbeat | 443/tcp | Your port-forwarding server private IP |
Malware Protection, FIM, IDS | 4119/tcp | Your port-forwarding server private IP |
DSM | 4120/tcp | Your port-forwarding server private IP |
Relay | 4122/tcp | Your port-forwarding server private IP |
Monitoring | 8443/tcp | Your port-forwarding server private IP |
Remote Access | 443/tcp | Your port-forwarding server private IP |
Vulnerability Scanning | 443/tcp | Your port-forwarding server private IP |
Vulnerability Scanning | 443/tcp | Your port-forwarding server private IP |
Log Management | 515/tcp | Your port-forwarding Server Private IP |
Linux
Update the host file, replacing x.x.x.x with your private IP address.
## client (linux)
!note: xxx.xxx.xxx.xxx is the ip address of your proxy machine
# Update your hosts file
echo "xxx.xxx.xxx.xxx api.armor.com 3a.epsec.armor.com 1a.log.armor.com agent.api.secure-prod.services 1d.log.armor.com agent.armor.com agent.api.secure-prod.services qagpublic.qg3.apps.qualys.com" >> /etc/hosts
Windows
Update the host file, replacing x.x.x.x with your proxy server private IP address.
|
Related Documentation
To learn more about how to install the Anywhere agent, see Step 4 in the following documents: