Firewall Ports and Protocols Requirements for vSphere with NSX-T

Page last updated:

Warning: VMware Enterprise PKS v1.7 is no longer supported because it has reached the End of General Support (EOGS) phase as defined by the Support Lifecycle Policy. To stay up to date with the latest software and security updates, upgrade to a supported version.

This topic describes the firewall ports and protocols requirements for using VMware Enterprise PKS on vSphere with NSX-T integration.

Firewalls and security policies are used to filter traffic and limit access in environments with strict inter-network access control policies.

Apps frequently require the ability to pass internal communication between system components on different networks and require one or more conduits through the environment’s firewalls. Firewall rules are also required to enable interfacing with external systems such as with enterprise apps or apps and data on the public Internet.

For Enterprise PKS, VMware recommends that you disable security policies that filter traffic between the networks supporting the system. To secure the environment and grant access between system components with Enterprise PKS, use one of the following methods:

• Enable access to apps through standard Kubernetes load-balancers and ingress controller types. This enables you to designate specific ports and protocols as a firewall conduit.
  
• Enable access using the NSX-T load balancer and ingress. This enables you to configure external addresses and ports that are automatically mapped and resolved to internal/local addresses and ports.

For information on ports and protocol requirements for vSphere without NSX-T, see Firewall Ports and Protocols Requirements for vSphere without NSX-T

If you are unable to implement your security policy using the methods described above, refer to the following table, which identifies the flows between system components in a typical Enterprise PKS deployment.

Note: To control which groups access deploying and scaling your organization’s Enterprise PKS-deployed Kubernetes clusters, configure your firewall settings as described on the Operator –> PKS API server lines below.

Enterprise PKS Ports and Protocols

The following tables list ports and protocols required for network communications between Enterprise PKS v1.5.0 and later, and vSphere 6.7 and NSX-T 2.4.0.1 and later.

Enterprise PKS Users Ports and Protocols

The following table lists ports and protocols used for network communication between Enterprise PKS user interface components.

Note: The type:NodePort Service type is not supported for Enterprise PKS deployments on vSphere with NSX-T. Only type:LoadBalancer and Services associated with Ingress rules are supported on vSphere with NSX-T.

Enterprise PKS Core Ports and Protocols

The following table lists ports and protocols used for network communication between core Enterprise PKS components.

VMware Ports and Protocols

The following tables list ports and protocols required for network communication between VMware components.

VMware Virtual Infrastructure Ports and Protocols

The following table lists ports and protocols used for network communication between VMware virtual infrastructure components.

VMware Optional Integration Ports and Protocols

The following table lists ports and protocols used for network communication between optional VMware integrations.