2.4. Communication

2.4.1. Secure Internal Communication

The communication between suSSHi Gateways and suSSHi Chef is called “Secure Internal Communication” (SIC). This comprises three TCP protocols.

If a network firewall is installed between the gateways and suSSHi Chef, these protocols must be enabled according to the following table:

Source	Destination	Protocol	Port	Description	Purpose
End Point (Client)	suSSHi Gateway(s)	TCP	22 [1]	SSH	Standard SSH session between Client and suSSHi Gateway(s)
suSSHi Gateway(s)	suSSHi Chef	TCP	8443	HTTPS with mutual authentication	Configuration Synchronization Session Authentication and Authorization Session Reports
suSSHi Gateway(s)	Targets	TCP	22	SSH	Standard SSH session between suSSHi Gateway(s) and Targets
suSSHi Gateway(s)	suSSHi Chef	TCP	6514	RELP over TLS	System and Session Logging to suSSHi Chef
suSSHi Chef	suSSHi Gateway(s)	TCP	22 [2]	SSH	Status Gathering Host Key Scanning Configuration Reload Triggers Session Dropping

[1]

Standard SSH port, may differ if you plan to run your suSSHi Gateway on a non-standard port.

[2]

Standard SSH port, may differ if you plan to run your suSSHi Gateway on a non-standard port.

2.4.2. Secure Communication with suSSHi Sous Chef

If you plan to deploy suSSHi Sous Chef, the communication between suSSHi Chef and suSSHi Sous Chef is also secured using HTTPS.

If a network firewall is installed between suSSHi Sous Chef and suSSHi Chef, these protocols must be enabled according to the following table:

Source	Destination	Protocol	Port	Description	Purpose
End Point (Client)	suSSHi Sous Chef	TCP	443	HTTPS	Landing page for OIDC login
suSSHi Sous Chef	suSSHi Chef	TCP	443	HTTPS	Configuration API Access Session Authentication and Authorization User Key Management (optional)
suSSHi Sous Chef	OIDC Identity Provider	TCP	443	HTTPS	OIDC Communication for Authentication and Authorization

2.4.3. System Events

suSSHi Chef gets logging feeds for system and session messages from all suSSHi Gateways. These messages can be forwarded using the Syslog (RFC 5424) protocol.

suSSHi Chef supports UDP, TCP, and RELP (over TCP) connections to up to two external Syslog servers. If two Syslog servers are configured, both servers get the Syslog information in parallel. The port for UDP, TCP, and RELP can be configured as well.

For the available configuration options, please refer to System > Preferences.