Change elastic agent ports

[Pelican9091]

Version

2.4.10

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

16

Storage for /

500GB

Storage for /nsm

500GB

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I'm trying to change the ports of the Elastic agents configuration. I change the settings in Configuration > Firewall > Portgroups > Elastic_Agent_Data / Control on the Fleet-Node. Do i need to rebuild the Elastic packages to use the port configuration?

And if i check the open ports on the fleetnode the default port 8220 is still used. Am i missing some settings?

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[InfosecGoon]

May I ask what the use case is here? Why do you want to change the default ports?

I don't believe that they can be changed; they're hardcoded for communication with different parts of our platform.

[Pelican9091]

The use case is to use a domain with cloudflare proxy and waf rules. So I can limit the firewall ports to only accept traffic from cloudflare to the fleethost in the DMZ. But cloudflare proxy only can use specific ports to forward.