Skip to content

Network Between WxCDI and Kubed

This page ports the old Network_kubed_wxcdi guide and documents the expected connectivity between WxCDI device networks and observability services deployed in Webex Kubed.

Key Components

  • Management VRF — the Webex backbone management network facing the WxCDI environment.
  • Shared Management Firewall (SHM-FW) — connects the relevant VRFs, enforces policy, and provides address translation between Kubed and WxCDI networks.
  • Managed Load Balancer — exposes resilient virtual addresses for pushed telemetry and distributes traffic to Kubernetes Services.
  • Kubernetes Service — forwards accepted traffic to the appropriate syslog, trap, collectd, or SFTP workload.

High-Level Flow

graph LR
    subgraph DI["WxCDI Environment"]
        A["UC Applications"]
        B["Network and Security Devices"]
        C["Infrastructure Devices"]
    end

    subgraph Network["Management Network"]
        D["Management VRF"]
        E["Shared Management Firewall"]
        F["Managed Load Balancer"]
    end

    subgraph Kubed["Webex Kubed"]
        G["Syslog Service"]
        H["SNMP Trap Service"]
        I["Collectd Service"]
        J["SFTP Service"]
        K["Prometheus and Exporters"]
    end

    A --> D
    B --> D
    C --> D
    D --> E
    E --> F
    F --> G
    F --> H
    F --> I
    F --> J
    K --> E
    E --> A
    E --> B
    E --> C

Ingress Traffic: WxCDI to Kubed

Ingress represents device-initiated traffic sent to the observability platform. It passes through the SHM-FW and managed load-balancing path before reaching a Kubernetes Service.

Source direction Use case Protocol/port Kubernetes destination
WxCDI to Kubed Syslog UDP/514 syslog-ng receiver
WxCDI to Kubed SNMP traps UDP/162 Telegraf trap receiver
WxCDI to Kubed SFTP TCP/22 Managed SFTP/CDR service
WxCDI to Kubed Expressway collectd UDP/25826 Telegraf collectd listener

Ingress troubleshooting should follow the path in order: device destination → SHM-FW/NAT → virtual address/load balancer → Kubernetes Service endpoints → receiver pod → downstream storage.

Egress Traffic: Kubed to WxCDI

Egress represents pull-based collection initiated by Prometheus exporters or other Kubed services. The SHM-FW translates the Kubed source to the approved Management VRF address and applies the access policy.

Source direction Use case Protocol/port Typical collector
Kubed to WxCDI HTTPS API TCP/443 Custom exporter/API collector
Kubed to WxCDI PerfMon API TCP/8443 CUCM-family exporter
Kubed to WxCDI SSH/CLI TCP/22 Custom exporter or automation job
Kubed to WxCDI SNMP polling UDP/161 SNMP Exporter

Egress troubleshooting should distinguish DNS/routing, firewall policy, translated source address, device access control, credentials, and application response.

Firewall Request Evidence

Before requesting or changing connectivity, capture:

  • source cluster, namespace, workload, and egress identity;
  • translated source range expected at the device;
  • exact destination address or approved subnet;
  • protocol and destination port;
  • direction and business use case;
  • non-sensitive connection evidence;
  • owning service and rollback/removal condition.

Do not use the port table alone as authorization for a firewall rule.

Design References