Network Requirements

ComponentsEnterprise

Availability2014.1 or later

Firewall and connectivity rules

On-Premise Deployment

Self-hosted connectivity needs

GermainUX Cloud Deployment

Outbound connections from components

Firewall-Rule Checklist

Rules to verify before go-live

Overview

GermainUX components must be able to communicate with GermainUX Enterprise and with the applications, databases, servers, and services they monitor. The exact firewall rules depend on:

Factor	Details
Deployment location	Whether GermainUX Enterprise is deployed on-premise or in GermainUX Cloud
Components deployed	Which GermainUX components are deployed
Monitored targets	Which applications and infrastructure are monitored
Protocols enabled	Which monitoring, integration, and automation protocols are enabled
Network topology	Whether proxies, load balancers, or network segmentation are used

Open only the connections required for your deployment. Restrict each rule by source, destination, port, and protocol according to your organization’s security policies.

Network-Flow Principles

Most GermainUX communication follows these patterns:

Source	Destination	Purpose
GermainUX users	GermainUX Enterprise	Access Workspace, dashboards, configuration, and reports
GermainUX Engines and Agents	GermainUX Enterprise	Retrieve configuration and transmit collected telemetry
GermainUX Engines	Monitored systems	Monitor or automate applications, databases, servers, and services
Browser and Windows RUM components	GermainUX Enterprise	Transmit real-user monitoring and Session Replay data
GermainUX Enterprise	Datastore	Store and retrieve monitoring data
GermainUX Enterprise	External services	Email, authentication, integrations, maps, or support features

Use encrypted protocols whenever available.

On-Premise Deployment

Core GermainUX Communication

Port	Protocol or use	Source	Destination	Requirement
`443`	HTTPS	GermainUX users and components	GermainUX Enterprise	Recommended for secured access and telemetry
`8080`	HTTP or application-specific HTTPS	GermainUX users or reverse proxy	GermainUX Enterprise	Conditional; depends on the Enterprise deployment
`61616`	ActiveMQ OpenWire/JMS	GermainUX Engines	GermainUX Enterprise messaging service	Required when this messaging architecture is used
`8005`	Tomcat internal management/shutdown port	GermainUX Enterprise services	Tomcat	Deployment-specific; do not expose to end users or untrusted networks
`8009`	AJP	Reverse proxy or application tier	GermainUX Enterprise	Deployment-specific; open only when AJP is explicitly used

For production environments, expose GermainUX Enterprise to users through HTTPS, normally on port 443. Ports such as 8080, 8005, and 8009 should remain internal and should be enabled only when required by the selected architecture.

Datastore Connectivity

Port	Protocol or use	Source	Destination
Datastore-specific port	Elasticsearch or database protocol	GermainUX Enterprise	GermainUX Datastore

The required port depends on the selected datastore technology and configuration. Examples may include:

Technology	Common default port
Elasticsearch HTTPS/HTTP API	`9200`
PostgreSQL	`5432`
MySQL	`3306`
Oracle Database	`1521`
Microsoft SQL Server	`1433`

These are common defaults only. Use the actual port configured in your environment.

Application and Database Monitoring

Port	Protocol or use	Source	Destination
Application database port	Database monitoring or repository analysis	GermainUX Engine	Monitored application database
`80` or `443`	HTTP or HTTPS monitoring and synthetic transactions	GermainUX Engine	Monitored website, web server, API, or application
Application-specific ports	Administration or management interface	GermainUX Engine	Monitored application server
`1099` or configured JMX port	JMX over TCP	GermainUX Engine	Monitored Java application or JVM

Examples of application-specific administration ports include Siebel Server Manager ports such as 2320 or 2321. Open only the ports required by the monitored technology.

Windows Infrastructure Monitoring

The required ports depend on whether GermainUX uses WMI, PowerShell remoting, SMB, or another Windows-management protocol.

Port	Protocol or use	Source	Destination
`135`	RPC Endpoint Mapper	GermainUX Engine	Monitored Windows system
Configured dynamic RPC range	WMI/DCOM	GermainUX Engine	Monitored Windows system
`445`	SMB	GermainUX Engine	Monitored Windows system
`5985`	PowerShell/WinRM over HTTP	GermainUX Engine	Monitored Windows system
`5986`	PowerShell/WinRM over HTTPS	GermainUX Engine	Monitored Windows system
`137`	NetBIOS Name Service over UDP	GermainUX Engine	Monitored Windows system
`138`	NetBIOS Datagram Service over UDP	GermainUX Engine	Monitored Windows system
`139`	NetBIOS Session Service over TCP	GermainUX Engine	Monitored Windows system

Ports 137–139 are generally required only for legacy NetBIOS-dependent monitoring. Do not open them unless the selected monitoring method requires them. For WMI/DCOM, define and restrict the dynamic RPC range according to your Windows and firewall standards rather than opening an unrestricted port range.

Unix and Linux Monitoring

Port	Protocol or use	Source	Destination
`22` or configured SSH port	SSH	GermainUX Engine	Monitored Unix or Linux system

Use the actual SSH port configured for the monitored host.

GermainUX Cloud Deployment

In a cloud deployment, GermainUX Enterprise is hosted and managed by Germain Software. Engines, Agents, profilers, and RUM components deployed within your environment normally initiate outbound connections to the cloud service.

Required Cloud Connectivity

Port	Protocol or use	Source	Destination
`443`	HTTPS configuration and telemetry	GermainUX Engines, Agents, profilers, and RUM components	Your assigned GermainUX Cloud URL
`443`	HTTPS user access	GermainUX users	Your assigned GermainUX Cloud URL

The GermainUX Cloud URL is provided when your environment is provisioned. Inbound connectivity from GermainUX Cloud to your internal network is generally not required when local components initiate outbound HTTPS connections.

Connectivity to Monitored Systems

GermainUX Engines deployed inside your environment may also require access to monitored systems.

Port	Protocol or use	Source	Destination
Database-specific port	Database monitoring	GermainUX Engine	Monitored application database
`80` or `443`	HTTP or HTTPS monitoring	GermainUX Engine	Monitored website, API, or application
Application-specific port	Administration or management interface	GermainUX Engine	Monitored application server
`22` or configured port	SSH	GermainUX Engine	Monitored Unix or Linux system
`135`, dynamic RPC range, and optionally `445`	WMI/DCOM	GermainUX Engine	Monitored Windows system
`5985` or `5986`	PowerShell/WinRM	GermainUX Engine	Monitored Windows system
`1099` or configured port	JMX	GermainUX Engine	Monitored Java application or JVM

These connections remain inside your environment even when GermainUX Enterprise is hosted in GermainUX Cloud.

Optional External Services

GermainUX Support Chat

If the embedded support-chat feature is enabled, user browsers require outbound HTTPS access on port 443 to:

https://api-iam.intercom.io/*
https://app.helphero.co/*
https://js.intercomcdn.com/*

This access is optional if the support-chat feature is not used.

Geographic Maps

If geographic map visualization is enabled, user browsers require outbound HTTPS access on port 443 to:

https://www.google.com/*
https://ajax.googleapis.com/*
https://www.gstatic.com/*
https://maps.gstatic.com/*
https://maps.googleapis.com/*
https://csi.gstatic.com/*

These domains are optional when geographic maps are not used.

Proxy Requirements

If outbound communication must pass through a corporate proxy:

Requirement	Details
Allow assigned URL	Allow access to the assigned GermainUX Enterprise URL.
Configure proxy	Configure the proxy for each applicable GermainUX component.
Permit HTTPS	Permit HTTPS traffic on port 443.
TLS inspection	Confirm that TLS inspection does not prevent certificate validation.
Exclude internal traffic	Exclude internal or GermainUX communication from monitoring interception where required.
Proxy permissions	Verify that service accounts and interactive users have the necessary proxy permissions.

Test connectivity using the same account and execution context as the GermainUX component.

Firewall-Rule Checklist

Before deployment:

Checklist item	Action
Identify components	Identify every GermainUX component and its host.
Enterprise URL/IP	Identify the GermainUX Enterprise URL and IP information.
Identify monitored targets	Identify each monitored application, server, database, and service.
Select protocols	Select only the monitoring protocols required for those systems.
Document rules	Document each source, destination, port, and direction.
Prefer encrypted	Prefer HTTPS, WinRM over HTTPS, and other encrypted protocols.
Restrict access	Restrict access by IP address, hostname, security group, or network segment.
Avoid public exposure	Avoid exposing internal Tomcat, messaging, datastore, or management ports publicly.
Validate proxy & TLS	Validate proxy and TLS-certificate behavior.
Test flows	Test each network flow before configuring application monitoring.
Cleanup	Review and remove rules that are no longer required.

Because network requirements vary by architecture and monitored technology, confirm the final rules with Germain Software and your network-security team before production deployment. Contact Germain Software to discuss an on-premise deployment or request assistance.

Get Help

Contact GermainUX Support

The GermainUX team helps you get up and running faster, empower your team, turn data into actionable insights, and optimize performance to deliver measurable business outcomes.

Can't find what you need?

Search all GermainUX docs with Ctrl + K, or use the feedback buttons at the bottom of this page to tell us what is missing.

The content of this document is proprietary to GERMAIN SOFTWARE.