- 5 minutes to read

Release Notes

The DataPower Monitoring Agent has the following prerequisites on the target environment

This page describes the prerequisites for installing and running the IBM DataPower Monitoring Agent.

Software Requirements

  • Windows Server 2008 R2 or later

Versions 6.0 and later make use of the .NET Framework 4.8 or later.
Versions 5.4 and subsequently make use of the .NET Framework 4.6.2 or later.
Versions before 5.4 make use of the .NET Framework 4.5.2 or later.

  • SQL Server
    • Either access to an existing SQL Server instance or the free SQL Express edition.
    • The Service account must have DBCreator, read and write access to the database.
    • See the Agent Database guide for SQL Server configuration and the SQL Server Connection Strings guide for connection string formats and security settings.

Firewall

Where you install the IBM DataPower Monitoring Agent in relation to the Nodinite Monitoring Service, your DataPower appliances, and the SQL Server that hosts the Agent Database determines your firewall configuration. The diagram shows every host involved, with the agent on its own server; each arrow starts at the side that opens the connection.

graph LR subgraph "Nodinite Core Services Server" roMonitoringService(fa:fa-watch-fitness Monitoring Service) end subgraph "Nodinite Agent Server" roNI(fa:fa-monitor-waveform DataPower Monitoring Agent) end subgraph "Target: IBM DataPower Gateway" roDP(fa:fa-server DataPower appliance) end subgraph "SQL Server (agent database)" roSQL(fa:fa-database Agent Database) end subgraph "Domain Controller" roDC(fa:fa-id-badge Active Directory) end subgraph "DNS Server" roDNS(fa:fa-signs-post DNS) end roMonitoringService --> |"Agent site port (v7) / 8000 (v6)"| roNI roNI --> |"UDP 161 (SNMP)"| roDP roNI --> |"5550 (SOMA)"| roDP roDP -.-> |"UDP 162 (SNMP traps)"| roNI roNI --> |"1433"| roSQL roNI -.-> |"88, 389, 636"| roDC roNI --> |"53"| roDNS

Network diagram: the Monitoring Service calls the agent; the agent polls DataPower over SNMP and the SOMA XML Management Interface and stores state in its SQL Server database. DataPower pushes SNMP traps to the agent. Dashed arrows are optional hops.

Note

When the agent runs on the Core Services Server (the typical installation), you need no firewall rule between the Monitoring Service and the agent.

Between the Monitoring Service and the DataPower Monitoring Agent

The Monitoring Service opens every connection; the agent never calls it. On Windows Server, Nodinite v7 hosts the agent as its own IIS web site, on a port you set per environment in the Nodinite Portal (Servers step).

Direction Source Destination Protocol Port(s) Purpose Notes
Inbound Core Services Server Agent Server TCP (HTTPS/HTTP) Agent site port Poll the agent, send configuration, run Remote Actions v7. No fixed default; use the port set in the Portal. Only when the agent is on a remote server
Inbound Core Services Server Agent Server TCP 8000 Same, for Windows Service agents ⚠️ v6 and earlier only (legacy MSI installer on remote servers)

Between the DataPower Monitoring Agent and IBM DataPower Gateway

The agent polls each appliance over SNMP (the Port in the Configuration Connection tab) and the SOMA XML Management Interface (status and Remote Actions), and listens for SNMP traps on the SNMP Trap Port.

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Agent Server Target (DataPower Gateway) UDP 161 SNMP requests Agent queries DataPower status and metrics. SNMP v2 or v3
Inbound Target (DataPower Gateway) Agent Server UDP 161 SNMP responses Automatically allowed by stateful firewall inspection
Outbound Agent Server Target (DataPower Gateway) TCP (HTTPS) 5550 SOMA XML Management Interface IBM default port; must be enabled on the appliance and can be changed. See Configuring the XML management interface
Inbound Target (DataPower Gateway) Agent Server UDP 162 SNMP traps DataPower sends unsolicited event notifications. Default SNMP Trap Port; a new connection, so it needs its own inbound rule

Tip

SNMP v3 Security: SNMP v3 provides authentication and encryption. Use SNMPv3 with authentication (authNoPriv) or authentication + encryption (authPriv) for production environments. Configure the agent with matching credentials.

Tip

Multiple DataPower Gateways and DMZ: Allow these ports for every appliance you monitor. For appliances in a DMZ, see Can I monitor DataPower appliances in DMZ without VPN?

Between the DataPower Monitoring Agent and SQL Server

The agent stores its state in its own Agent Database (see SQL Server Connection Strings).

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Agent Server SQL Server (agent database) TCP 1433 Read and write the agent database Default instance. Named instances use their dynamic or static port plus UDP 1434 (SQL Server Browser)
Inbound SQL Server (agent database) Agent Server TCP 1433 Response traffic Automatically allowed by stateful firewall inspection

Between the DataPower Monitoring Agent and the Domain Controller

Required when the agent connects to SQL Server with Windows authentication (domain service account).

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Agent Server Domain Controller TCP/UDP 88 Kerberos authentication Required for domain authentication
Outbound Agent Server Domain Controller TCP/UDP 389 LDAP Standard LDAP queries
Outbound Agent Server Domain Controller TCP 636 LDAPS (Secure LDAP) Required for LDAPS authentication
Inbound Domain Controller Agent Server TCP/UDP Same as outbound Response to Kerberos / LDAP Usually allowed by stateful firewall inspection

Between the servers and DNS

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Agent Server DNS Server TCP/UDP 53 Name resolution Resolve the DataPower appliances, SQL Server, the Domain Controller, and the Core Services Server. A local hosts file can replace DNS
Outbound Core Services Server DNS Server TCP/UDP 53 Name resolution Resolve the Agent Server

Important

Stateful Firewalls: Most Windows Firewall implementations are stateful, so response traffic for established outbound connections is allowed automatically. The inbound response rules above are for reference and troubleshooting; SNMP traps (UDP 162) are new inbound connections and always need a rule.

Windows Rights

Local named account or domain account (preferred). Follow this guide 'How to set Logon as a Service right' for more information.

DataPower SNMP Settings

  • SNMP V2

    • Read Community
    • Write Community

  • SNMP V3

    • Security Name
    • Security Level
    • Context Name
    • Context Engine ID

Next Steps