VAST Data Network Ports

A VAST cluster consists of several components that require network connections between them to operate. This document outlines the network ports, their functions, and associated security risks.

From VAST Cluster 5.1.

Management Network

The Management network typically has the following attributes:

• It is a network or subnet provided by Top of Rack (ToR) switches that are fully managed by the customer.

• It is typically a fully routed subnet on the customer’s networking infrastructure.

  • Customer controls the IP address allocations, gateways, and all firewall rules.

• It is used to reach the customer’s internal services such as Active Directory, LDAP, and DNS. (VAST does not currently support reaching these services via the Data Network.)

• It is often able to reach the Internet if allowed by the customer’s firewall.

• It is used for delivering VAST CallHome log bundles to VAST’s S3 bucket.

• VMS is also running on the Management Network. It runs on one of the CNodes at a time, with its VIP being presented as a Secondary IP on the same interface as the regular Management Network address.

The Management Network is used by VAST CNodes, DNodes, and Cluster Switches.

Several services listen on the Management Network that are not specifically required for use by the VAST systems, but are currently configured to listen on all interfaces. These services are labeled as “Unnecessary” in blue below.

ℹ️ Info

The Docker network (default: 172.17.0.0/16) on each Node is not visible on any external network interface. However, due to the way that routing works, this network can conflict with customer networks that use the same address range. This potential issue should be identified during the Site Survey before deployment. It is being noted here for completeness.

Data Network (Protocols)

The Data Network is the network that the customer’s clients use to access storage services (NFS, S3, SMB) on a VAST cluster. The following generalities are true about this network:

• The customer fully manages the Data Network in terms of its IP address allocation, gateway, domain name, firewall rules, etc.

• There is no firewall on the Mellanox switches provided by VAST.

• The Mellanox switches' uplink connections physically connect to the customer’s switches, and the customer fully manages everything beyond those Mellanox uplink connections.

• The customer does NOT generally manage the physical network connections for the Data Network within the VAST cluster; these are often managed by VAST and implemented by using Mellanox switches.

DNS VIP

IPMI Network

The IPMI Network is the network used for OOB (Out-of-Band) control of the server, which typically utilizes an IPMI device (“Intelligent Platform Management Interface”). Each chassis type may have a different version of this, and different acronyms may be used to describe this functionality, such as “BMC” (“baseboard management controller”) or “iLO” (“Integrated Lights-Out” for HPE). This can be used for:

• Reading hardware sensor and log data

• Issuing power cycle, power-on, power-off, and reset commands to the hardware

• Serial console access (when configured)

• Remote visual console access (VNC)

These are typically placed in a dedicated section of the customer’s network using top-of-rack switches specifically designed for this purpose. However, the hardware that provides this functionality can use an outdated OS and is not kept up to date with the latest security patches. To mitigate this, when nodes share a common carrier chassis (CNodes and DNodes within CBoxes and DBoxes), the nodes will often be connected to each other via short Ethernet cables, so that one node can control its partner without connecting the IPMI Network to the customer’s network. This is referred to as Back-To-Back (b2b) IPMI or BMC and is configured during installation.

ℹ️ Info

Since each chassis type has a variation on the IPMI service, the associated open network port tables will be provided in the future. For b2b configurations, open ports are not exposed to any customer network, and this section can be ignored.

Cluster Internal Network

The VAST Cluster Internal Network refers to the private network, typically being assigned IP addresses from ranges such as:

• 172.16.1.x

• 172.16.2.x

• 172.16.3.x

This network is accessible only from CNodes and DNodes and is intended only for inter-node traffic.

App CNode applications

Spark On CNode

All the ports mentioned below are for a CNode node type.

Additional Resources:

Information on most of the ports can be found in the following links:

• Spark Standalone deploy mode

• Spark Thrift Server

• Spark Connect Server

• Spark History Server

• Spark SSL (for HTTPS) configurations