Start a proof of value Book a demo
Preview: under engineering review. This documentation is a working draft prepared from the security packet and reference architecture. Items marked to confirm are placeholders for REAP engineering to verify before publication. Not indexed by search engines.

Documentation

Network requirements

Flows between devices, the connector cluster, your systems and the REAP platform. Direction is always stated from the initiator.

Reading this table Values marked Typical default are the standard ports for the protocol and apply unless your environment differs; values marked to confirm are REAP-specific and must be taken from the security packet.

Flows

FromToProtocol / portPurposeStatus
ConnectorNetwork devicesSSH TCP/22Configuration retrieval, show commands (read-only)Typical default
ConnectorNetwork devicesSNMP UDP/161Metric pollingTypical default
Network devicesConnector VIPSyslog UDP/514 or TCP/6514 (TLS)Telemetry pushTypical default
Network devicesConnector VIPSNMP trap UDP/162Event notificationTypical default
ConnectorNetwork devicesgNMI (opens in a new tab) TCP/57400 (dial-in)Streaming telemetry subscriptionTypical default
Network devicesConnector VIPgNMI (opens in a new tab) dial-out on the collector port Where the platform supports dial-out
Network devices (exporters)Connector VIPNetFlow UDP/2055 or IPFIX UDP/4739Flow records, where you configure themTypical default · collector port
ConnectorControllers and cloud APIs (Mist (opens in a new tab), Aruba Central (opens in a new tab), Meraki (opens in a new tab), AWS (opens in a new tab), Azure (opens in a new tab))HTTPS TCP/443API collectionTypical default
ConnectorPAM (CyberArk (opens in a new tab) CCP/AAM; HashiCorp Vault (opens in a new tab) planned)HTTPS TCP/443 or vendor-specific portCredential brokering
ConnectorREAP platform (SaaS or customer-hosted)HTTPS TCP/443, outbound only mTLS?Data forwarding, control channelendpoints
PlatformITSM, on-call, collaboration, knowledge, identity systemsHTTPS TCP/443Read and write integrationsTypical default (systems listed on the integrations page)
UsersPlatform consoleHTTPS TCP/443Web console, SSOTypical default

Principles

  • No inbound firewall rule to your network is required: connectors open an outbound TLS tunnel, and once it is established the platform reaches devices only through the connector confirm for customer-hosted models.
  • Device credentials never leave your network unencrypted; brokered credentials are obtained per session.
  • All flows are encrypted in transit (TLS 1.2 or higher); legacy UDP syslog can be replaced by TLS syslog where devices support it.
Engineering to confirm
  • Platform endpoints (hostnames/IPs) per region for allow-listing
  • Whether mTLS is used connector ↔ platform
  • gNMI (opens in a new tab) dial-in vs dial-out default
  • Flow-record collector port and the flow versions accepted (NetFlow v5/v9, IPFIX, sFlow)
  • PAM connectivity specifics per broker

Last reviewed: October 7, 2026 (draft) · Owner: solutions engineering · Corrections: security@reapnet.ai