Nebula [Information] - How Devices Communicate with NCC & Ports used for NETCONF

This article will show how Nebula devices communicate with Nebula Control Center and which Ports are used [NETCONF Information], Nebula Cloud Control TCP ports, Call home process, what Nebula servers are used for NETCONF, NCC, NTP, Zero Touch Provisioning, USG FLEX service, Monitor service for USG FLEX, also the Access point (AP) onboarding process enhancement for 6.50 and how APs come online in Nebula.

Introduction

A lot of customer inquiries we receive are regarding connectivity issues between Nebula devices and the Nebula Control Center. In order to shed some light on this topic, we decided to create this knowledge base to let you know at least the way these devices intercommunicate with the Cloud. 

Ports needed for devices to come online in NCC

There are the following ports currently being used for communicating between NCC and the Nebula devices.

• Port 443 and 6667 are used in TCP for Nebula Cloud Management
• Since firmware version 5.50 is on the Access points, also port 4335 is being used - as the future passes by, eventually be implemented onto other units(NETCONF_CALL_HOME)
• Port 123 is used in UDP for Network Time Protocol(NTP).

Ports information can be also obtained on NCC > Help > Firewall Information.

Communication Process (Call Home)

Communication between Nebula devices and NCC is named Call Home and comprised of 4 steps as below:

Get IP address/ DNS Server from local DHCP Server
By default, Nebula devices are DHCP clients. When they are powered on, they will try to get IP address and DNS Server information from the local DHCP Server.

NETCONF over TLS
Next, they will proceed TCP Handshake to Nebula Control Center and then Nebula Control Center will establish TLS (Transport Layer Security) Handshake to the devices. This phase is called NETCONF over TLS

Synchronization Time
They will be provisioned by Nebula Control Center with an NTP set to synchronize time.

Configure and Monitor
In the last phase, by sending get and edit-config requests from Nebula Control Center to Nebula devices, users can configure settings and monitor the status of the devices on the Nebula Control Center web GUI platform. The above two steps are the Cloud Connection between Nebula devices and Nebula Control Center.

AP Onboarding Enhancement (from 6.50)

In the old communication process, the Access point (AP) needed to apply the cloud mode default settings to successfully go online in Nebula. Additional process are then required to reset the device information, which takes about 90 seconds as seen below: 

In firmware 6.50 and forward, the AP can now skip the process to show "up to date" status in Nebula much faster. This applies only when the device has: 

• Default (factory) setting
• Changed Management IP (Interface) or;
• Admin password

In our internal testing, we can see that the process now takes around 6-8 minutes before the device has gone online and shown "up-to-date":