Reference

The port matrix, the endpoints, and the config fragments that encode the network model’s invariants — the page to open when you’re actually configuring a firewall rule, a sd.xml, or an ego.conf, not reading the story behind it.

Symphony port matrix (7.3.2 defaults)

Same base port on every host is mandatory (burst walkthroughs may use a custom BASEPORT, e.g. 30600 — the defaults below are what this build runs).

Port Component Notes

7869 TCP+UDP

lim (EGO_LIM_PORT)

Base port; 7 consecutive ports from here

7870 TCP

vemkd (EGO_KD_PORT)

Clients connect here first

7871 TCP

pem (EGO_PEM_PORT)

7872 TCP

egosc (ESC_PORT)

7873 TCP

repository service

Service-package distribution

7874/7875 TCP

session director (SD_ADMIN_PORT/SD_SDK_PORT)

dynamic → pin in sd.xml

SSM

OS-random by default, reassigned each restart; pin SSM_SDK_ADDR/SSM_SIM_ADDR (symphony/config/sd-ssm-ports.xml)

8443 (8080 no-TLS)

Web GUI

mgmt only

8180

REST

mgmt only

9090

Web service gateway

mgmt only

9443 TLS / 9080

Host Factory REST

mgmt only

1527

Derby DB

mgmt only

4046

Loader controller (plc)

9200-9202 / 9300-9302

Elasticsearch

mgmt only

Connection flow: client → vemkd (7870) → SD → SSM. Compute side: LIM starts PEM locally and reports to the master LIM; long-lived idle TCP channels run vemkd<→PEM and SSM<→SIM.

IBM’s docs do not state which side initiates every channel. Allow bidirectional establishment on the base-port range and SSM ranges between management and compute hosts — see Network model for the failure mode this protects against.

Verified live: what’s actually listening

Verified on the master pair via ss (phase-log.md 2026-07-10 "EGO master verified alive"):

Host Listening ports

sym-master1 (primary)

Full 7-port block 7869-7875 + UDP 7869

sym-master2 (non-primary)

7869 + 7871 + UDP 7869 (lim/pem only — correct for a non-primary management host)

symphony/config/ fragment reference

Source of truth for grid configuration; rolled onto hosts by mgmt cloud-init (apply-config.sh) and baked into the Windows firstboot script’s assumptions. Every value encodes a verified constraint from the reference architecture — change with care.

File What Why

ego.conf.fragment

Keepalives, dynamic-host settings

WAN survival + dynamic join (detail)

sd-ssm-ports.xml.fragment

Pinned SSM port ranges

Firewalls/NLB need fixed ports; OS-random by default

ego.conf.fragment (appended to $EGO_CONFDIR/ego.conf):

EGO_DYNAMIC_HOST_WAIT_TIME=120
EGO_DYNAMIC_HOST_TIMEOUT=15M
EGO_ENABLE_CHAN_KEEPALIVE=y
EGO_CHAN_KEEPALIVE_TIME=180

sd-ssm-ports.xml.fragment (merged into the SD parameter section of sd.xml):

<ego:EnvironmentVariable name="SSM_SDK_ADDR">31000-31019</ego:EnvironmentVariable>
<ego:EnvironmentVariable name="SSM_SIM_ADDR">31020-31039</ego:EnvironmentVariable>

Ranges are deliberately small (20 ports each) to fit an NLB-style listener budget for cross-cloud exposure — size must be >= the number of SSMs (apps) on the management host; 20 is ample at PoC scale.

Endpoints (management plane, mgmt-only ports)

Endpoint Port Notes

Web GUI

8443 (TLS) / 8080 (no-TLS)

Symphony admin console

REST

8180

Symphony REST API

Web service gateway

9090

Host Factory REST

9443 (TLS) / 9080

Burst provider integration point (detail)

Derby DB

1527

Embedded management database

Elasticsearch

9200-9202 / 9300-9302

Related

  • Network model — the invariant, the MTU lesson, the story behind each of these rules.

  • Symphony management — how the RHEL masters apply these fragments.

  • Windows compute pool — how the firstboot join script opens the compute-side firewall rules.

Continue to SWOT & sign-off.