Egress to M.A.R.C.U.S. Cloud
This is the only external firewall rule required. Every connection uses TLS 1.2 or higher. Each request is also signed with an HMAC-SHA256 key unique to the Collector, so messages are authenticated independently of the transport.
If your allow-list needs specific hostnames rather than a wildcard, Involve will give you the exact hostnames for your tenant on request.
Collector to devices
For an on-premises Collector, this is ordinary LAN traffic. A cloud-hosted Collector needs a routed path from your cloud tenant into each site’s AV VLAN.
Inbound to the Collector
Nothing inbound is required from the internet. No customer location needs public-facing ports. An optional local-network port is available:
The cloud does not use this port. Allow it only from your internal network.