Existing security groups

If you want to create your own security groups, two security groups need to be created:

The first security group will be used for all gateway nodes.

The gateway nodes communicate with the Cloudera Management Console and therefore require additional ports.
The second security group will be used for all other nodes. These security groups will be applied when creating FreeIPA during environment creation and when you create Cloudera Data Hub clusters.

Review the following guidelines before adding security group rules. The table describes all the inbound ports that need to be open, and provides guidelines for a source ranges.

Knox security group

These settings are used for gateway nodes.

Table 1. Knox security group inbound ports
Protocol	Port Range	Source	Description
TCP	22	Your CIDR.	This is an optional port for end user SSH access to cluster hosts. You should open it to your organization’s CIDR.
TCP	443	Your CIDR and CDP CIDR.	This port is used to access the Data Hub cluster UIs via the Knox gateway. You must open this port to your organization's CIDR to access cluster UIs. You only need to set this to your CIDR when CCM is enabled.
TCP	9443	CDP CIDR.	CDP uses this port to maintain management control of clusters and data lakes. By default, CDP opens this port to the correct IP address when it creates the security groups automatically. This port is not needed when CCM is enabled.
TCP, UDP	0-65535	Your internal VNet CIDR (for example, 10.10.0.0/16).	This is required for internal communication within the VNet.
ICMP	N/A	Your internal VNet CIDR (for example, 10.10.0.0/16).	This is required for internal communication within the VNet.

Default security group

These settings are used for all nodes except Knox gateway nodes.

Table 2. Default secuity group inbound ports
Protocol	Port Range	Source	Description
TCP	22	Your CIDR.	This is an optional port for end-user SSH access to the hosts. You should open it to your organization’s CIDR.
TCP	9443	CDP CIDR.	CDP uses this port to maintain management control of clusters and data lakes. By default, when CDP creates the security groups automatically, it opens this port to the correct IP. This port is not needed when CCM is enabled.
TCP, UDP	0-65535	Your VNet CIDR (for example, 10.10.0.0/16).	This is required for internal communication within the VNet. TCP port 5432 is used for communication with the attached database.
ICMP	N/A	Your internal VNet CIDR (for example, 10.10.0.0/16).	This is required for internal communication within the VNet.