How do Nebula devices communicate with Nebula Control Center? Which Ports are used? (NETCONF Information)

A lot of customer inquiries we receive are regarding connectivity issues between Nebula devices and the Nebula Control Center. In order to shed some light on this topic, we decided to create this knowledge base in order to let you know at least the way these devices intercommunicate with the Cloud. 

There are the following ports currently being used for communicating between NCC and the Nebula devices.

• Port 443 and 6667 are used in TCP for Nebula Cloud Management
• Since firmware version 5.50 on the Access points, also port 4335 is being used - as future passes by, eventually implemented onto other units(NETCONF_CALL_HOME)
• Port 123 is used in UDP for Network Time Protocol(NTP).

Ports information can be also obtained on NCC > Help > Firewall Information.

Communication between Nebula devices and NCC is named Call Home and comprised of 4 steps as below:

1. Get IP address/ DNS Server from local DHCP Server
   By default, Nebula devices are DHCP clients. When they are powered on, they will try to get IP address and DNS Server information from the local DHCP Server.
2. NETCONF over TLS
   Next, they will proceed TCP Handshake to Nebula Control Center and then Nebula Control Center will establish TLS (Transport Layer Security) Handshake to the devices. This phase is called NETCONF over TLS
3. Synchronization Time
   They will be provisioned by Nebula Control Center with NTP setting to synchronize time.
4. Configure and Monitor
   In the last phase, by sending get and edit-config requests from Nebula Control Center to Nebula devices, users can configure settings and monitor the status of the devices on the Nebula Control Center web GUI platform. The above two steps are the Cloud Connection between Nebula devices and Nebula Control Center.

Also interesting:
Do you want to have a look directly at one of our test devices? Have a look here in our virtual Lab:

Virtual Lab - Nebula Basic