Prerequisites
Prerequisites
Before deploying a Local Broker, factor these requirements and recommendations:
Hardware Requirements
| CPU Cores | RAM | HDD |
|---|---|---|
| 8 | 8 GB (minimum) 16 GB (recommended) |
50 GB (minimum) 80 GB (recommended) |
The Local Broker OVA is built on top of Ubuntu 22.04.
Important
A Local Broker needs to be installed as a separate instance. Installing the Local Broker on a Publisher instance is not supported.
Software Requirements
- Client: v114 or above
- Publisher: v120 or above
- Local Broker: v123 or above
Connectivity Requirements
| Component | Source | Destination | Service | Action | Notes |
|---|---|---|---|---|---|
| Management Access | Admin IP subnets | Local Broker IPs/hostname | SSH (TCP/22) | Allow | Allow TCP 22 from sources where SSH connectivity (management) is required. |
| Client | Client IP subnets | Local Broker IPs/hostname | HTTPS (TCP/443) | Allow | Allow TCP 443 from internal subnets where clients would connect to the LBR Client Gateway. |
| Publisher | Publisher IPs | Local Broker IPs/hostname | TCP 1443 | Allow | Allow TCP 1443 from internal subnets from where Publishers would connect to the LBR Publisher Gateway (Stitcher). |
| Local Broker | LBR1, LBR2 | LBR1, LBR2 | TCP 5000 | Allow | Allow TCP 5000 bi-directional between Local Brokers for inter Local Broker connectivity. |
| Local Broker | LBR IPs | NTP Server(s) | NTP UDP 123 | Allow | Allow NTP outbound from a Local Broker. |
| Local Broker | LBR IPs | DNS Resolver | DNS | Allow | Allow DNS outbound from a Local Broker. |
| Local Broker | LBR IPs |
*.docker.com, Contact your Netskope SE, TSM, or Support for your tenant-ID and POP-name, and if IP subnets are needed instead of FQDNs. |
HTTPS
Note HTTP (for *.ubuntu.com only) |
Allow | Allow HTTPS and HTTP outbound from a Local Broker. Tenant-ID would be the typical ID, such as 1234, etc. POP-name represents the Home PoP Name. For example: MP-Name Variables:
For allowlisting ns-<tenant-ID>.<MP-name>.npa.<tenant-domain> based on IP addresses, refer to the Netskope Private Access List for Allowlisting. |
Note
A Local Broker needs reachability to the official Ubuntu Mirrors during the update process. Please review and allow the appropriate destinations for a successful Local Broker software update.
Local Broker Capacity
When factoring Local Broker capacity and scaling, consider these key points:
- Each Local Broker instance can handle up to 500 Mbps of throughput.
- Each Local Broker instance can accept up to 2000 unique client connections.
- Each tenant has the capability to enable a default maximum limit of 50 local brokers, with a default limit set at 2. If you require an increase in this limit, please reach out to your Netskope Account team.
- A notification will be displayed on the Local Brokers page as you near the maximum limit.
