Review firewall requirements

guides/common/assembly_major-project-components.adoc

@@ -12,6 +12,4 @@ include::modules/ref_list-of-key-open-source-components-of-foreman.adoc[leveloff
 
 include::modules/con_smartproxy-features.adoc[leveloffset=+1]
 
-include::modules/con_smartproxy-networking.adoc[leveloffset=+1]
-
 include::modules/con_major-project-components-additional-resources.adoc[leveloffset=+1]

guides/common/assembly_networking-considerations-in-project.adoc

@@ -0,0 +1,7 @@
+include::modules/con_networking-considerations-in-project.adoc[]
+
+include::modules/con_smart-proxy-networking.adoc[leveloffset=+1]
+
+include::modules/ref_project-server-port-and-firewall-requirements.adoc[leveloffset=+1]
+
+include::modules/ref_smart-proxy-port-and-firewall-requirements.adoc[leveloffset=+1]

guides/common/assembly_planning-project-server-installation.adoc

@@ -12,8 +12,6 @@ ifdef::katello,orcharhino,satellite[]
 include::modules/ref_best-practices-for-optimizing-storage.adoc[leveloffset=+1]
 endif::[]
 
-include::modules/ref_port-and-firewall-requirements.adoc[leveloffset=+1]
-
 ifeval::["{mode}" == "connected"]
 include::modules/ref_ipv6-and-ipv4-requirements.adoc[leveloffset=+1]
 endif::[]

guides/common/assembly_preparing-environment-for-capsule-installation.adoc

@@ -9,21 +9,15 @@ Review the following prerequisites before you install {SmartProxyServer}.
 
 include::modules/ref_operating-system-requirements.adoc[leveloffset=+1]
 
-// System Requirements
 include::modules/ref_system-requirements.adoc[leveloffset=+1]
 
 ifdef::katello,satellite[]
-// Storage requirements
 include::modules/ref_capsule-storage-requirements.adoc[leveloffset=+1]
 
 include::modules/ref_best-practices-for-optimizing-storage.adoc[leveloffset=+1]
 endif::[]
 
-// Port and Firewall Requirements
-include::modules/ref_smart-proxy-port-and-firewall-requirements.adoc[leveloffset=+1]
-
-// Enabling Connections from {ProjectServer} and Clients to a {SmartProxyServer}
-include::modules/proc_enabling-connections-to-capsule.adoc[leveloffset=+1]
+include::modules/proc_opening-required-ports.adoc[leveloffset=+1]
 
 ifdef::parent-context[:context: {parent-context}]
 ifndef::parent-context[:!context:]

guides/common/assembly_preparing-environment-for-project-server-installation.adoc

@@ -2,7 +2,7 @@
 
 include::modules/con_preparing-environment-for-project-server-installation.adoc[]
 
-include::modules/proc_enabling-client-connections-to-project-server.adoc[leveloffset=+1]
+include::modules/proc_opening-required-ports.adoc[leveloffset=+1]
 
 include::modules/proc_verifying-dns-resolution.adoc[leveloffset=+1]
 

guides/common/modules/con_http-booting-requirements-with-managed-dhcp.adoc

@@ -9,7 +9,7 @@ To provision machines through HTTP booting ensure that you meet the following re
 For HTTP booting to work, ensure that your environment has the following client-side configurations:
 
 * All the network-based firewalls are configured to allow clients on the subnet to access the {SmartProxy}.
-For more information, see xref:common/modules/con_smartproxy-networking.adoc#{smart-proxy-context}-networking_{context}[].
+For more information, see xref:common/modules/con_networking-considerations-in-project.adoc#networking-considerations-in-{project-context}[].
 * Your client has access to the DHCP and DNS servers.
 * Your client has access to the HTTP UEFI Boot {SmartProxy}.
 

guides/common/modules/con_http-booting-requirements-with-unmanaged-dhcp.adoc

@@ -12,7 +12,7 @@ To provision machines through HTTP booting without managed DHCP ensure that you
 * Ensure that your client has access to the DHCP and DNS servers.
 * Ensure that your client has access to the HTTP UEFI Boot {SmartProxy}.
 * Ensure that all the network-based firewalls are configured to allow clients on the subnet to access the {SmartProxy}.
-For more information, see xref:common/modules/con_smartproxy-networking.adoc#{smart-proxy-context}-networking_{context}[].
+For more information, see xref:common/modules/con_networking-considerations-in-project.adoc#networking-considerations-in-{project-context}[].
 
 .Network requirements
 * An unmanaged DHCP server available for clients.

guides/common/modules/con_networking-considerations-in-project.adoc

@@ -0,0 +1,4 @@
+[id="networking-considerations-in-{project-context}"]
+= Networking considerations in {Project}
+
+For the components of {Project} architecture to communicate, the required network ports must be open and free to enable incoming and outgoing traffic between the components.

guides/common/modules/con_pxe-booting-requirements.adoc

@@ -10,7 +10,7 @@ To provision machines using PXE booting, ensure that you meet the following requ
 
 .Client requirements
 * Ensure that all the network-based firewalls are configured to allow clients on the subnet to access the {SmartProxy}.
-For more information, see xref:common/modules/con_smartproxy-networking.adoc#{smart-proxy-context}-networking_{context}[].
+For more information, see xref:common/modules/con_networking-considerations-in-project.adoc#networking-considerations-in-{project-context}[].
 
 * Ensure that your client has access to the DHCP and TFTP servers.
 

guides/common/modules/con_smart-proxy-networking.adoc

@@ -0,0 +1,43 @@
+[id="{smart-proxy-context}-networking"]
+= {SmartProxy} networking
+
+The communication between {ProjectServer} and hosts registered to a {SmartProxyServer} is routed through that {SmartProxyServer}.
+{SmartProxyServer} also provides {Project} services to hosts.
+
+[NOTE]
+====
+Some outgoing traffic returns to {Project} to enable internal communication and security operations.
+====
+
+ifndef::satellite[]
+In a topology with hosts connecting to a {SmartProxyServer}, 
+endif::[]
+ifdef::satellite[]
+In xref:{project-context}-topology-with-hosts-connecting-to-a-{smart-proxy-context}[], 
+endif::[]
+{SmartProxy} provides a single endpoint for all host network communications so that in remote network segments, only firewall ports to the {SmartProxy} itself must be open.
+Hosts do not need direct access to the {ProjectServer} itself.
+
+// TODO: Replace graphic with simpler graphic and reference to "Port and firewall requirements"
+ifdef::satellite[]
+[id="{project-context}-topology-with-hosts-connecting-to-a-{smart-proxy-context}"]
+.{Project} topology with hosts connecting to a {SmartProxy}
+image::common/topology-isolated-satellite.png[{ProjectName} topology with a host]
+endif::[]
+
+ifndef::satellite[]
+In a topology with hosts connecting directly to {ProjectServer}, 
+endif::[]
+ifdef::satellite[]
+In xref:{project-context}-topology-with-hosts-connecting-directly-to-{project-context}-server[], 
+endif::[]
+hosts connect to {ProjectServer} rather than a {SmartProxy}.
+This applies also to {SmartProxies} themselves because the {SmartProxyServer} is a host of {ProjectServer}.
+Hosts need direct network access to {ProjectServer}.
+
+// TODO: Replace graphic with simpler graphic and reference to "Port and firewall requirements"
+ifdef::satellite[]
+[id="{project-context}-topology-with-hosts-connecting-directly-to-{project-context}-server"]
+.{Project} topology with hosts connecting directly to {ProjectServer}
+image::common/topology-direct-satellite.png[{ProjectName} topology with a direct host]
+endif::[]

guides/common/modules/proc_configuring-capsule-default-certificate.adoc

@@ -14,7 +14,7 @@ endif::[]
 * {SmartProxyServer} packages are installed.
 For more information, see xref:installing-{smart-proxy-context}-server-packages[].
 * The required ports are open.
-For more information, see xref:{smart-proxy-context}-port-and-firewall-requirements_{context}[].
+For more information, see xref:common/modules/proc_opening-required-ports.adoc#opening-required-ports[].
 
 .Procedure
 

guides/common/modules/proc_deploying-a-custom-ssl-certificate-to-smart-proxy-server.adoc

@@ -15,7 +15,7 @@ For more information, see xref:Registering_Proxy_to_Server_{smart-proxy-context}
 * {SmartProxyServer} packages are installed.
 For more information, see xref:installing-{smart-proxy-context}-server-packages[].
 * The required ports are open.
-For more information, see xref:{smart-proxy-context}-port-and-firewall-requirements_{context}[].
+For more information, see xref:common/modules/proc_opening-required-ports.adoc#opening-required-ports[].
 
 .Procedure
 . On your {ProjectServer}, generate a certificate bundle:

guides/common/modules/proc_installing-postgresql.adoc

@@ -13,8 +13,6 @@ ifndef::foreman-deb[]
 {Project} supports PostgreSQL version 13.
 endif::[]
 
-include::snip_firewalld.adoc[]
-
 .Prerequisites
 * The prepared host has base operating system repositories enabled.
 * The prepared host has sufficient disk space available for the `{postgresql-lib-dir}` directory.
@@ -85,13 +83,20 @@ password_encryption=scram-sha-256
 ----
 # systemctl enable --now postgresql
 ----
-. Open the *postgresql* port:
+. Update the firewall configuration.
+For example, using the `firewall-cmd` command:
+.. Open the *postgresql* port:
 +
 [options="nowrap" subs="verbatim,quotes"]
 ----
 # firewall-cmd --add-service=postgresql
 ----
-include::snip_make-firewall-settings-persistent.adoc[]
+.. Make the changes persistent:
++
+[options="nowrap", subs="+quotes,verbatim,attributes"]
+----
+# firewall-cmd --runtime-to-permanent
+----
 . Switch to the `postgres` user and start the PostgreSQL client:
 +
 [options="nowrap" subs="verbatim,quotes"]

guides/common/modules/proc_opening-required-ports.adoc

@@ -0,0 +1,83 @@
+:_mod-docs-content-type: PROCEDURE
+
+[id="opening-required-ports"]
+= Opening required ports
+
+For the components of {Project} architecture to communicate, ensure that the required network ports are open and free on the base operating system.
+You must also ensure that the required network ports are open on any network-based firewalls.
+
+[NOTE]
+====
+Some cloud solutions must be specifically configured to allow communications between machines because they isolate machines similarly to network-based firewalls.
+If you use an application-based firewall, ensure that the application-based firewall permits all applications that are listed in the tables and known to your firewall.
+If possible, disable the application checking and allow open port communication based on the protocol.
+====
+
+ifndef::satellite,orcharhino[]
+If you do not use `firewall-cmd` to configure the Linux firewall, implement using the command of your choice.
+endif::[]
+
+.Procedure
+. Optional: If you need to prevent the DHCP {SmartProxy} from pinging hosts to check for available IP addresses, disable DHCP IP address pinging:
++
+[options="nowrap", subs="+quotes,attributes"]
+----
+# {foreman-installer} --foreman-proxy-dhcp-ping-free-ip false
+----
++
+By default, a DHCP {SmartProxy} performs ICMP ping and TCP echo connection attempts to hosts in subnets with DHCP IPAM set to find out if an IP address considered for use is free.
+ifdef::katello,satellite,orcharhino[]
+ifeval::["{context}" == "{project-context}"]
+. Open the ports for clients on {ProjectServer}:
+endif::[]
+ifeval::["{context}" == "{smart-proxy-context}"]
+. Open the ports for clients on {SmartProxyServer}:
+endif::[]
++
+[options="nowrap"]
+----
+# firewall-cmd \
+--add-port="8000/tcp" \
+--add-port="9090/tcp"
+----
+endif::[]
+ifeval::["{context}" == "{project-context}"]
+. Allow access to services on {ProjectServer}:
+endif::[]
+ifeval::["{context}" == "{smart-proxy-context}"]
+. Allow access to services on {SmartProxyServer}:
+endif::[]
++
+[options="nowrap"]
+----
+# firewall-cmd \
+--add-service=dns \
+--add-service=dhcp \
+--add-service=tftp \
+--add-service=http \
+--add-service=https \
+ifndef::katello,satellite,orcharhino[]
+--add-service=foreman-proxy \
+endif::[]
+--add-service=puppetmaster
+----
+. Make the changes persistent:
++
+[options="nowrap", subs="+quotes,verbatim,attributes"]
+----
+# firewall-cmd --runtime-to-permanent
+----
+
+.Verification
+* Enter the following command:
++
+[options="nowrap"]
+----
+# firewall-cmd --list-all
+----
+
+.Additional resources
+* {PlanningDocURL}networking-considerations-in-a-{project-context}-deployment[Networking considerations in a {Project} deployment]
+ifndef::foreman-deb[]
+* https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/configuring_firewalls_and_packet_filters/using-and-configuring-firewalld_firewall-packet-filters/9/html/configuring_firewalls_and_packet_filters/using-and-configuring-firewalld_firewall-packet-filters[Using and configuring firewalld in _{RHEL}{nbsp}9 Configuring firewalls and packet filters_]
+endif::[]

guides/common/modules/proc_registering-capsule-to-satellite-server.adoc

@@ -18,6 +18,11 @@ For more information on manifests and repositories, see {ContentManagementDocURL
 ** Ensure HTTPS connection using client certificate authentication is possible between {SmartProxyServer} and {ProjectServer}.
 HTTP proxies between {SmartProxyServer} and {ProjectServer} are not supported.
 ** You must configure the host and network-based firewalls accordingly.
-For more information, see {InstallingSmartProxyDocURL}{smart-proxy-context}-port-and-firewall-requirements_{smart-proxy-context}[Port and firewall requirements] in _{InstallingSmartProxyDocTitle}_.
+ifeval::["{context}" == "load-balancing"]
+For more information, see {InstallingSmartProxyDocURL}opening-required-ports[Opening required ports in _{InstallingSmartProxyDocTitle}_].
+endif::[]
+ifeval::["{context}" == "installing-capsule-server"]
+For more information, see xref:common/modules/proc_opening-required-ports.adoc#opening-required-ports[].
+endif::[]
 
 include::snip_host-registration-steps.adoc[]