Firewall traffic direction between DA and DC

Products

• Network Observability
• CA Performance Management

Issue/Introduction

What is the traffic direction between DA (Data Aggregator) ↔ DC (Data Collector) - AMQ SSL ports.

The documentation link below does not the direction of the traffic. It is mentioned that port 61623 is used for large data transfers. Is it the case the DA initiates a connection on this port to the DC for pushing out large amount of data? 

https://techdocs.broadcom.com/us/en/ca-enterprise-software/it-operations-management/dx-netops/25-4/securing-dx-netops/securing-performance-monitoring/authenticate-and-encrypt-activemq-communication.html

Another question concerning ports and DCs - one of the ports in the past that was used on the DCs was TCP/8681. It looks like these days it is only used for interaction between the Portal and the Data Sources - in particular NFA (it also used to be used for ADA but that is no longer supported).

The URL I am referring to for this is here:

https://techdocs.broadcom.com/us/en/ca-enterprise-software/it-operations-management/performance-management/25-4/installing/review-installation-requirements-and-considerations.html#concept.dita_669f11a1a7b734ff07869f266794dc77910ebbf3_FirewallandConnectivityConsiderations 

Environment

DX NetOps Performance Management: Any version

Resolution

• DA AMQ listens
• DC will initiate connections to 61616/18/20/22 (TCP) or 61617/19/21/23 (SSL) on DA AMQ. DC is always the initiator across ports regardless of TCP or SSL.
• DC AMQ uses random source ports
• DA sends a request across port 61623 to tell DC it's sending the DC installer. But first DC connects to DA port 8581 or 8582 and tries to download DC installer, if it can't, DA sends it over 61623.
• Port 8681 is now blocked to localhost only, unless you add a white list of IPs to allow it to listen on