Ports to enable on your firewall

Mist Cloud

Device to Mist Cloud Communication

Please note IP addresses for the terminators will change.  Please use FQDN based firewall rules.

Documentation Embedded URL

Some documentation pages when accessed , if it results in auth error;
Request to change the ‘Admin portal’ URL to include the right api or UI URL.

Example:
https://api.ac2.mist.com/api/v1/docs/Site?_ga=2.41192420.798341990.1655364635-1045699083.1655364635#insights

for Global3 instead of

https://api.mist.com/api/v1/docs/Site?_ga=2.41192420.798341990.1655364635-1045699083.1655364635#insights

which is for Global 1.

Mist APs need the following ports to be enabled on your Internet Firewall to work properly:

• 443/TCP to our cloud is required. It can optionally be tunneled in L2TP.
• DNS (53/UDP) to lookup our cloud hostname is required, but it does not need to be a public DNS server.
• DHCP (67&68/UDP) is required initially. After that you can configure a static IP if you would like.
• NTP (123/UDP) is suggested so the AP can retrieve time, which may be required in some environments. The AP will by default attempt to receive NTP from pool.ntp.org. It can also receive time via DHCP option 42.

Everything else (443/UDP to cloud, 80/TCP to cloud) is optional.  The AP does not require them to be enabled, but it does help.

Proxy settings are supported and the proxy setting is used if available, but if not the AP will still try and direct connect.

It is possible that some popular firewalls  (example – Palo Alto Networks) might not be able to accept the recently increased number of records (IP) returned for the FQDN ep-terminator.mistsys.net.  The AP’s DNS server may resolve different addresses than the PAN has stored, causing AP management traffic to be dropped, resulting in random AP disconnects.

Adding a line to the existing Mist rule on the PAN to “allow access to ep-terminator.mistsys.net based on HTTP(L7) address being accessed, for SSL traffic that is based on the SSL SNI” would help to mitigate this.

Where the AP’s need to reach?

ep-terminator.mistsys.net

The terminator is hosted on AWS and we cannot guarantee the IP addresses won’t change and it may resolve to something like this:

ep-terminator-production-839577302.us-west-1.elb.amazonaws.com.

but these change about once every 2 months or sometimes more frequently.

Additional hosts to allow are

• portal.mist.com for WiFi captive portal
• manage.mist.com/signin.html for Admin UI access
• api.mist.com for Admin API access
• api-ws.mist.com for Admin websocket API access
• support-portal.mist.com for Admin Support Portal access

THIS IS AS OF 8/1/2023 AND IS SUBJECT TO CHANGE. WE RECOMMEND YOU CHECK YOUR RELEASE NOTES OR THIS PAGE FOR UPDATES.

Along with Firewall, SSL cert checkers come into play and will be detected as a ‘man-in-the-middle” attack.

The AP’s will initially need an IP address using DHCP. Once APs are connected, the cloud pushes down the AP configuration (configured through UI or API) and APs will then switch (upon reboot) to use static IP addresses if so configured.

Port needed for Access Assurance

Firewall rule: Outbound connections destined to radsec.nac.mist.com over TCP Port 2083.