Central Management System deployment

To manage other Trellix appliances, the Central Management System appliance simply needs a connection that allows it to communicate with the managed appliances. This connection can be practically anywhere in the network. The diagram below illustrates the typical deployment of managed appliances and a CM 9400 connected to a typical network device.

When the Central Management System appliance or the managed appliance is behind a network address translation (NAT) gateway, it has an internal address that cannot be reached. NAT techniques hide the internal address, so requests appear to originate from the NAT gateway instead of the internal network. For details about the required address mapping and the procedures for establishing a connection between the Central Management System appliance and the appliances, see Configuring Network Address Translation (NAT) .

By default, the Central Management System appliance and a managed appliance use a single port (the SSH port, 22 by default) for the following types of communication:

The single-port configuration reduces the complexity of firewall rules, and provides an additional layer of security and privacy between the Central Management System appliance and the appliances it manages. In environments in which the Central Management System appliance is behind a Network Address Translation (NAT) gateway, using a single port also eliminates the need to open an additional HTTPS port (443) for the managed appliance to request software updates from the Central Management System appliance. (For details about NAT deployment, see Configuring Network Address Translation (NAT) .)

You can instead configure the dual-port address type, in which the management traffic uses the SSH port (22) and the DTI network service traffic uses the HTTPS port (443). If you change the configuration on an appliance that was already added to the Central Management System appliance using a client-initiated connection, that managed appliance will be briefly disconnected and then reconnected using the new configuration.

With Central Management System high availability (HA), you can cluster two Central Management System appliances for failover. The primary Central Management System appliance (or node) is available continuously. If the primary node fails, your entire configuration fails over automatically to the secondary node; the secondary node then becomes the primary appliance. Central Management System HA can be configured for high availability in local area network (LAN) environments and for disaster recovery in wide area network (WAN) environments. The following configurations fail over to the secondary node:

For details about Central Management System HA deployment, see the Central Management System High Availability Guide.

By default, both management and DTI traffic use the ether1 network interface, which needs Internet access for DTI network downloads and uploads. For security, you might want to isolate the management traffic by streaming it from an out-of-band network interface with no Internet access. For details, see DTI traffic and management traffic .