ActiveMQ port 61616 Configuration and Traffic Restriction

Products

• VMware Smart Assurance
• Network Observability

Issue/Introduction

Restrict network traffic on port 61616 (ActiveMQ) to localhost or specific network masks for security hardening.

Environment

All Supported NCM versions

Resolution

In NCM, Apache ActiveMQ is integrated into the core application to facilitate messaging. The following JAR files are typically located in the $VOYENCE_HOME/ncmcore/webapps/ncm-webapp/WEB-INF/lib directory:

• activemq-client
• activemq-broker
• activemq-kahadb-store
• activemq-protobuf
• activemq-openwire-legacy

Restricting this port would result in core NCM functionality failure specifically in distributed environment also auto-refresh of job/task status in thick client would fail and needs manual refresh i.e real time events are not received by Thick client. 

As this configuration is through JAR, changing port and configuration related to activeMQ needs code change and product rebuild.