Firewall Configuration

Open Ports to Access Ops Manager

Ops Manager requires the following minimum network port requirements:

• Both Ops Manager users and MongoDB Agents must be able to connect to the Ops Manager application over HTTP or HTTPS.

• Ops Manager must be able to connect to the mongod running the Ops Manager application MongoDB databases.

• For each Ops Manager project, MongoDB Agents must be able to connect to all client MongoDB processes (mongod or mongos).

• The Ops Manager application must also be able to send email to Ops Manager users.

To use Ops Manager, open the following ports to the specified hosts.

http://127.0.0.1:8090/health

{
  "mms_db": "OK",
  "backup_db": "OK"
}

Open Ports to Access Ops Manager and MongoDB Hosts

Most Ops Manager administration can be performed through the user interface. Some procedures require access to the operating system. To permit your administrators to access your Ops Manager as well as MongoDB hosts, open the following ports to those hosts.

Open Ports to Back Up, Restore, and Query MongoDB Instances using Ops Manager

Ops Manager can back up MongoDB databases to one or more storage systems:

• A MongoDB database (blockstore)

• An S3-compatible storage bucket (S3-compatible storage blockstore)

• A file system (file system store).

To back up MongoDB hosts, open the following ports to the preferred backup hosts (blockstore, S3-compatible storage snapshot store and/or file system snapshot store):

Snapshots can also be restored using the link displayed in the Ops Manager application. The same ports needed to use Ops Manager would need to be open for the user to download the snapshot.

To find the download link, click Continuous Backup, then the Restore History tab, then click the download link next to the snapshot.

MongoDB 3.4.2 Enterprise and later provides the ability to query backup snapshots. Ops Manager provisions these queryable snapshots as read-only MongoDB instances, as described in Query a Backup. To query a backup snapshot, open the following ports:

Open Ports to Integrate Ops Manager with SNMP

Open the following ports between Ops Manager and your SNMP Manager to send and receive SNMP trap notifications from your MongoDB deployments to Ops Manager.

Ops Manager uses community-based SNMPv2 (SNMPv2c).

You can configure the Ops Manager Application with two different types of SNMP Traps:

To configure the Ops Manager Application to send SNMPv2c Heartbeat or Alert Traps:

1. Download the MIB file.

2. To configure SNMPv2c Traps:

   1. For SNMPv2c Heartbeat Traps:

      • Follow the Modify a Custom Setting procedure.

        Set the following key/value pairs:

        Key	Value
        snmp.default.heartbeat.interval	Number of seconds between heartbeat notifications.
        snmp.default.hosts	Hosts that receive heartbeat traps on port 162.

   2. For SNMPv2c Alert Traps:

      • Follow the Manage Alert Configurations procedure to configure System, Global, or Project Alerts.

      • Use SNMP Host as the delivery method.

Open Ports to Authenticate Ops Manager Users using LDAP

MongoDB Enterprise users can authenticate Ops Manager users using LDAP. To authenticate using LDAP, open the following ports on Ops Manager and your LDAP host.

To configure the Ops Manager LDAP URI strings, including configuring a non-standard port, see User Authentication.

Open Ports to Authenticate with MongoDB

MongoDB Enterprise users can use Kerberos or LDAP to authenticate MongoDB users. To authenticate using LDAP or Kerberos, open the following ports between the MongoDB client databases, Ops Manager, and the Kerberos or LDAP host(s).

To configure Kerberos for authentication to the Ops Manager application database, see Configure Ops Manager to Authenticate with Application Databases.

Open Ports to Manage Encryption Keys using KMIP

MongoDB Enterprise deployments using the WiredTiger storage engine supports a native encryption option. You can use a KMIP service to manage the master encryption key. To support the encrypted storage engine via KMIP, open the following ports between the Backup Daemon hosts, the MongoDB hosts, and the KMIP hosts.