topic Re: Balance Proxy Server in Active IQ Unified Manager Discussions

Balance Proxy Server

gabrielc — Thu, 05 Jun 2025 06:03:51 GMT

Can we setup a Proxy Server in the firewall zone to discover all the servers in the controlled/DMZ area or do we need to setup two Balance Servers ?

The documentation says that for the return communication, it will use any random port. However, the customer does not wish to open up a range of ports. That is the reason why I am asking whether it is possible to setup a Proxy Server to discover all the servers or do we need to setup another Balance Server in the DMZ area ?

"OnCommand Balance communicates to the NetAppProxy through port 9443 (configurable). The NetAppProxy communicates to all other Windows servers via Windows Management Instrumentation (WMI) through port 445. However, for the return communication, WMI ports are assigned by DCOM and they can use any random port from 1024 and up."

The documentation only mentions that the Proxy Server can only discover storage array ?

If we need to setup two Balance Servers, do we need two licenses or does the license cover the entire site ?

Thanks

Gabriel

Re: Balance Proxy Server

dmilliro — Mon, 29 Apr 2013 21:13:25 GMT

Hi Gabriel,

Yes. That is a perfectly supported option. You will then only need to open 443 and 9443 between the proxy server and the Balance appliance for the DMZ servers.

Thanks, Daniel

Re: Balance Proxy Server

plauterb — Mon, 29 Apr 2013 21:34:01 GMT

Not only is using the proxy through the firewall an option, it is highly recommended. This way you can have all the inventory on one Balance node, which is most likely what you want.

Re: Balance Proxy Server

ploufg — Wed, 05 Feb 2014 18:17:37 GMT

Great info

Is there an official document available from netapp about this configuration.

thanks

Re: Balance Proxy Server

plauterb — Wed, 05 Feb 2014 21:35:55 GMT

There should be details in the sysadmin guide about deploying proxies, and the ports that need to be opened. This knowledge base has similar info:

What port does Windows Management Instrument use in OnCommand Balance?

Basically, deploy a Balance proxy on the far side of the firewall, on the same side as the Windows guests. The dynamic ports opened by WMI between the guest and the proxy all happen on the far side of the firewall, so no firewall changes are needed for this.

But now the Balance VA and proxy are on different sides of the firewall, and you need to open the 443 and 9443 ports to allow them to communicate.

Since Balance can handle several proxies, a single Balance VA can monitor multiple groups of servers and storage behind different firewalls.