Globus Connect Server FIrewall Exceptions on 443

[Joshua Brown]

Hi,

I'm trying to understand in a little bit more detail why, there is a requirement to have port 443 open to bidirectional any traffic for a GCS. Is there any way to reduce the scope of the allowed IP addresses to a set of IP addresses that are white listed?

best,

Joshua

[Joshua Brown]

Is the requirement for any on port 443 to allow control traffic from another GCS instance. If that is the case and there are two GCS instances and both are behind the same firewall and you are only concerned with moving data between the two internal GCS instances is it necessary to have a firewall exception on port 443 to any for both instnaces?

[Kaufman, Ian]

https://docs.globus.org/globus-connect-server/v5/gcsv54-restricted-firewall-policy/impact-of-restricting-gcsv54-firewall-policy/

Ian Kaufman
Principal Systems Integration Engineer

UC San Diego, Research IT Services

ikaufman AT ucsd DOT edu

---

From: dis...@globus.org <dis...@globus.org> on behalf of Joshua Brown <joshbr...@gmail.com>
Sent: Tuesday, March 4, 2025 10:27 AM
To: Discuss <dis...@globus.org>
Cc: Joshua Brown <joshbr...@gmail.com>
Subject: [Globus Discuss] Re: Globus Connect Server FIrewall Exceptions on 443

 

To unsubscribe from this group and stop receiving emails from it, send an email to discuss+u...@globus.org.

[Joshua Brown]

[Karl Kornel]

Hi Joshua,

 

The link Ian sent (Ian, you beat me to it!) gives the details on what ports are used for what.  And thanks much for the diagram!  If you don’t mind, could you please update the diagram to show where the user (the entity doing directory listings, initiating transfers, etc.) would be?  Also, could you please let us know if the user would be downloading data directly (that is, from GCS A or GCS B to their own computer) over HTTPS?

 

~ Karl

 

From: dis...@globus.org <dis...@globus.org> on behalf of Joshua Brown <joshbr...@gmail.com>
Date: Tuesday, March 4, 2025 at 10:34 AM
To: Discuss <dis...@globus.org>
Cc: Joshua Brown <joshbr...@gmail.com>
Subject: [Globus Discuss] Re: Globus Connect Server FIrewall Exceptions on 443

To unsubscribe from this group and stop receiving emails from it, send an email to discuss+u...@globus.org.

[Joshua Brown]

Thanks Ian. I'm still not clear on some of the implications of this, but it clarifies a lot. 

[Kaufman, Ian]

In the most simplistic case, Globus uses port 443 to phone home ... i.e. talk to the Globus management infrastructure. Without that, nothing will work properly.

Ian Kaufman
Principal Systems Integration Engineer

UC San Diego, Research IT Services

ikaufman AT ucsd DOT edu

---

From: Joshua Brown <joshbr...@gmail.com>
Sent: Tuesday, March 4, 2025 10:43 AM
To: Discuss <dis...@globus.org>
Cc: Kaufman, Ian <ikau...@ucsd.edu>; Joshua Brown <joshbr...@gmail.com>
Subject: Re: [Globus Discuss] Re: Globus Connect Server FIrewall Exceptions on 443

 

[Joshua Brown]

It looks like from what I am seeing on the AWS documentation, it would be a pretty big headache to whitelist the AWS IP address ranges as there is no guarantee that they won't change.

[Joshua Brown]

Hi Karl,

Here you go, I didn't see your response until today. We are wanting to do this in a CI env, so pretty much everything is an internal network including the client.