Requirements

Requirements for Ericom Shield

Hardware Requirements

Minimum hardware specifications are (per each shield server):

  • 16GB memory
  • 4 core processors
  • 64GB disk space

Note

Ericom Shield supports both horizontal and vertical scaling. Horizontal scaling means adding more machines to the system. Vertical scaling means adding more hardware to the system. A higher spec machine will host more virtual containers and therefore more browser sessions. For further information on scaling and how to determine the exact required hardware per usage, please contact Ericom Shield Professional Services.

Software Requirements

  • Linux Ubuntu Server 16.04 or 18.04 (64-bit, not workstation). Can be downloaded here
  • Has a fixed IP Address
  • Has SSH server installed
  • Has an internet connection (DNS and Proxy settings are configured properly)
  • Locale is EN-US

Note

It is recommended to turn on the Ubuntu Security Automatic Updates on the host server. Further details can be found here.

Ports and DNS

Ericom Shield requires these ports to be open on the network.

Proxy/ICAP - open inbound between End-Users/Proxy and Shield

  • 3128 (tcp)
  • 1344 (tcp)

Admin Console - open inbound between Admin and Shield

  • 8181 (tcp)

NetData - open inbound between Admin and any Shield server

  • 8383 (tcp)

Speedtest Page - open inbound between End-Users/Proxy and Shield

  • 8185 (tcp)

Orchestration and Cluster Management - open inbound/outbound between any Shield servers

  • 2376 (tcp)
  • 2377 (tcp)
  • 7946 (tcp/udp)
  • 4789 (udp)

Active Directory - open between the Shield Authentication Proxy and the AD Server

  • 389 (tcp)
  • 636 (tcp)
  • 88 (tcp/udp) - only required if using Kerberos authentication.

Shield/Internet - open between the Shield server(s) and the internet

  • 80 (tcp)
  • 443 (tcp)

Shield/DNS - open between the Shield Proxy and DNS

  • 53 (tcp/udp)

SSH - open inbound/outbound between all Shield Nodes

  • 22 (tcp)

SMTP - Optional. When SMTP server is used to send alerts and statistics, open between Browsers Farm server and the Internet

  • 25 (tcp)

Ericom Shield uses the Linux Host DNS configuration to identify which DNS server to use. Essentially this is the dns-nameservers entry that was defined in /etc/network/interfaces when setting a fixed IP address. If this entry is configured to use an external DNS such as Google, this will result in Shield being unable to resolve any internal names (e.g. server.company.local). It is therefore important to ensure that this entry is configured to use an internal DNS server.

DNS is also important between each server node. In other words, each server node will need to be able to resolve each of the other servers within the cluster. This can be achieved by ensuring that each node is registered with DNS, or by updating the host file on each machine.

Shield uses Subnet 10.20.0.0/16. In case the same range is already being used in the existing network, please contact Ericom Shield Professional Services.

Requirements for CDR Solution

Ericom Shield comes with a cloud-based file sanitization service. It is also possible to use an on-premise factory integrated CDR solution. Following are the requirements for a local file sanitization server.

Hardware Requirements

Minimum hardware specifications are (per 10,000 users):
  • 16GB memory
  • 4 core processors
  • 100GB disk space

Note

The file sanitization server must be installed on a dedicated server (physical or virtual).

Software Requirements

Windows Server 2012R2 and up.