Ports and firewall rules
Open these
Section titled “Open these”| From | To | Port | For |
|---|---|---|---|
| Analysts’ browsers | Appliance | TCP 443 | The console and dashboards |
| Enrolled systems | Appliance | TCP 8080 | Agent connections, installers, log and metric ingest |
| Administrators | Appliance | TCP 22 | SSH for installation and maintenance |
| Appliance | Internet | TCP 443 | Installation and model downloads; cloud, SIEM and threat-intelligence APIs you connect |
| Appliance | Your SIEM, firewalls, WAFs, clusters | Their API ports | Connectors |
| New boxes | Appliance | TCP 8443 | Joining a box to the cluster |
Enrolled systems need no inbound port: the agent connects out to the appliance.
On the appliance
Section titled “On the appliance”| Port | Listens on | What |
|---|---|---|
| 443 | All interfaces | Console (nginx), Grafana under /grafana/ |
| 8080 | All interfaces | Garrison backend: agents, installers, ingest (TLS) |
| 8443 | All interfaces | Cluster control plane (mutual TLS); joining boxes |
| 7701 | All interfaces | Node agent of the AI platform (mutual TLS between boxes) |
| 4000 | Appliance network | AI gateway (key required) |
| 3000 | Appliance network | Langfuse (traces) |
| 3001, 9090, 3100 | Docker bridge only | Grafana, Prometheus, Loki (reached through the console) |
| 5432, 6379 | Localhost only | Garrison’s database and cache |
| 5050 | All interfaces | Image registry for the cluster’s boxes (TLS) |
| 9100 | All interfaces | Host metrics, scraped by Prometheus |
| 8000+ | Appliance network | Model servers |
Between boxes of a pair, the QSFP cables carry model traffic only, on their own addresses (10.200.0.0/16), and are not routed.