Ports used by internal services of ACOS

By default, the local firewall is not enabled for ACOS. To ensure the proper functioning of ACOS internal services and features, you must open the following TCP or UDP ports in the firewall for the network connections between the hosts in the cluster.

Fixed ports

The following table lists the services running on ACOS and the open ports on the cluster nodes. To prevent conflicts, it is essential to ensure that these ports are not being used by other services.

Service name	Network used	Ports used
zbs-metad	Storage network	10100-10104
zbs-chunkd	Storage network	10200-10208, 11201 (used when RDMA is enabled), 20048, 3261, ​2049 (fixed port used by NFS), 111 (fixed port used by NFS)
zbs-taskd	Management network, Storage network	10600, 10601
zbs-iscsi-redirectord	Storage network, Access network	3260
zbs-aurorad	Storage network	None
zbs-aurora-monitord	Storage network	None
zbs-inspector	Storage network	10700, 10701
timemachine	Management network, Storage network	9912
zbs-watchdogd	Management network	10300
job-center-worker	Storage network	None
job-center-scheduler	Storage network	None
elf-vm-monitor	Storage network	10416
elf-vm-scheduler	Storage network	10443
master-monitor		None
elf-dhcp	Storage network	6767
elf-exporter	Management network, Storage network	10405
vmtools-agent	Management network, Storage network	10809
zbs-rest-server	Management network, Storage network	10402
zbs-deploy-server	Management network	10403
log-collector	Management network, Storage network	10406
cluster-upgrader	Management network, Storage network	10408, 8090 (used only during upgrades)
ntpm	Management network, Storage network	10414
tuna-exporter	Management network, Storage network	10404
disk-healthd	Management network, Storage network	10415, 10480 (UDP ports, storage network only)
turbot-server	Management network, Storage network	10409
network-monitor	Management network	10410
octopus	Management network, Storage network	9900
oscar	Management network, Storage network	9800, 20401
siren	Management network, Storage network	9903, 20701
aquarium	Management network, Storage network	9910
harbor	Management network, Storage network	9980, 20801-20803
crab	Management network, Storage network	9999
dolphin	Management network, Storage network	9909
amphi	Management network, Storage network	9904, 9943, 10800-10899
seal	Management network, Storage network	9923, 9924, 20900
fluent-bit	Storage network	5170, 20501
snmpd	Management network, Storage network	161
svcresctld	Management network, Storage network	10413
envoy-xds	Management network, Storage network	24680
consul	Management network, Storage network	8301, 8510
consul-server	Storage network	8300, 8311, 8510
mongod	Storage network	27017
nginx	Management network	80, 443
chronyd	Management network, Storage network	123 (UDP port)
zookeeper	Storage network	2181, 2888, 3888
envoy	Management network, Storage network	9943, 10001, 10900, ​10901, 10902
libvirtd		16509
prometheus	Storage network	9090
containerd	Management network	10000
everoute-agent	Management network	30002
sshd	Management network, storage network	22
vmagent	Management network, storage network	8429
vmagent-prod (observability)	Management network, storage network	8430 (only used when associated with an observability service)
vector (observability)	Management network, storage network	8686 (only used when associated with an observability service)
node-exporter	Management network, storage network	9100

Random ports

In actual scenarios, NFS services and local clients may also use some random ports. Details are as follows:

• In addition to using the two fixed ports 2049 and 111, the NFS service also starts other processes (such as status, nlockmgr, etc.), whose ports are randomly assigned by the RPC service. The ports used each time the NFS service starts are different.

  If you need to view all the ports currently used by NFS, or check which process corresponds to an unknown port, you can use the following methods:

  • View the random ports currently used by NFS: Execute the rpcinfo -p command on the host to view.
  • View the service process corresponding to a certain port: Execute the netstat -nlp command on the host to view.

• The local client may also enable some random ports to interface with cluster services. If such unknown local ports are scanned, you can execute the netstat -nlp command on the host to view the source port or destination port corresponding to that port, and determine the cluster service corresponding to the local port based on the fixed ports used by ACOS services.