Networking overview for Cloud Sync

Contributors netapp-bcammett

Networking for Cloud Sync includes connectivity between the data broker group and the source and target locations, and an outbound internet connection from data brokers over port 443.

Data broker location

A data broker group consists of one or more data brokers installed in the cloud or on your premises.

Data broker in the cloud

The following image shows a data broker running in the cloud, in either AWS, Google Cloud, or Azure. The source and target can be in any location, as long as there’s a connection to the data broker. For example, you might have a VPN connection from your data center to your cloud provider.

Note When Cloud Sync deploys the data broker in AWS, Azure, or Google Cloud, it creates a security group that enables the required outbound communication.

A diagram that shows the Cloud Sync service, the data broker running in the cloud, and connections to the source and target.

Data broker on your premises

The following image shows the data broker running on-prem, in a data center. Again, the source and target can be in any location, as long as there’s a connection to the data broker.

A diagram that shows the Cloud Sync service, the data broker running on-premises, and connections to the source and target.

Networking requirements

  • The source and target must have a network connection to the data broker group.

    For example, if an NFS server is in your data center and a data broker is in AWS, then you need a network connection (VPN or Direct Connect) from your network to the VPC.

  • A data broker needs an outbound internet connection so it can poll the Cloud Sync service for tasks over port 443.

  • NetApp recommends configuring the source, target, and data brokers to use a Network Time Protocol (NTP) service. The time difference between the three components should not exceed 5 minutes.

Networking endpoints

The NetApp data broker requires outbound internet access over port 443 to communicate with the Cloud Sync service and to contact a few other services and repositories. Your local web browser also requires access to endpoints for certain actions. If you need to limit outbound connectivity, refer to the following list of endpoints when configuring your firewall for outbound traffic.

Data broker endpoints

A data broker contacts the following endpoints:

Endpoints Purpose

To contact a repository for updating CentOS packages for the data broker host. This endpoint is contacted only if you manually install the data broker on a CentOS host.

To contact repositories for updating Node.js, npm, and other 3rd party packages used in development.

To access a repository for updating PM2, which is a 3rd party package used to monitor Cloud Sync.

To contact the AWS services that Cloud Sync uses for operations (queuing files, registering actions, and delivering updates to the data broker).

For example:
See AWS documentation for a list of S3 endpoints

To contact Amazon S3 when a sync relationship includes an S3 bucket.

When you download data broker logs from Cloud Sync, the data broker zips its logs directory and uploads the logs to a predefined S3 bucket in the us-east-1 region.

To contact the Cloud Sync service.

To contact NetApp support when using a BYOL license for sync relationships.

To install 7z on the data broker virtual machine during installation and updates. 7z is needed to send AutoSupport messages to NetApp technical support.

To verify AWS credentials when the data broker is deployed in AWS or when it’s deployed on your premises and AWS credentials are provided. The data broker contacts this endpoint during deployment, when it’s updated, and when it’s restarted.

To contact Cloud Data Sense when you use Data Sense to select the source files for a new sync relationship.

Web browser endpoints

Your web browser needs access to the following endpoint to download logs for troubleshooting purposes: