Prerequisites and Network Requirements for the Global Command Center

Verify that your environment meets the prerequisites and network connectivity requirements for integrating Service CommCells with the Global Command Center.

The Global Command Center supports two main types of functionality:

Aggregation and switching let you view dashboards, jobs, alerts, reports, and Service CommCell entities from the Global Command Center. This uses the existing CommServe, Web Server, and Command Center communication path.
Active Management and blueprints let you create configuration in the Global Command Center and synchronize it to Service CommCells. This additionally requires the Global Configuration Manager and Hub Service.

Important

If you only want aggregation, monitoring, switching, and direct entity operations, you can start by registering Service CommCells after the Command Center URLs and certificate trust are ready. Configure the Global Configuration Manager and Hub Service when you want to use Active Management and blueprints.

General Requirements

Requirement	Required For	Why It Is Needed	How to Validate
Service CommCell Command Center availability from the Global Web Server	Registration, aggregation, reporting, monitoring, switching, and direct entity operations	The Global Command Center retrieves data and routes user actions through the Service CommCell Command Center URL.	From the Global Web Server, open each Service CommCell Command Center URL in a browser, for example `https://<service-commcell-host>/commandcenter`.
Matching user accounts and permissions	Switching, aggregation, direct entity operations, Active Management, and blueprint synchronization	Actions from the Global Command Center are authorized on the target Service CommCell by using the matching user account on that Service CommCell. If the user does not exist or does not have the required permissions, switching can fail and operations can return unauthorized or access denied errors.	Verify that the user exists on each target Service CommCell with the same email address or user principal name (UPN), and that the user has the permissions required for the operation.
Global Hub Service connectivity from Service CommCell Web Servers	Active Management and blueprint synchronization	After Active Management is enabled, Service CommCells use the Hub Service URL that is configured on the Global CommCell to receive and synchronize global configuration changes.	From each Service CommCell Web Server, open the Hub Service health URL. If you use a proxy, open the proxy health URL that is configured in `hubServiceBaseUrl`.
Global Web Server, Global Configuration Manager, and Hub Service connectivity	Active Management and blueprint processing	The Global Web Server, Global Configuration Manager, and Hub Service must be able to exchange configuration and synchronization requests.	Open the Global Configuration Manager and Hub Service health URLs from the relevant Global CommCell servers.
Valid certificates and JRE trust	Secure registration, switching, aggregation, and Active Management	Certificates must match the FQDNs used in Command Center, Global Configuration Manager, Hub Service, or proxy URLs. If Service CommCells use certificates from an internal CA or self-signed certificates, the Global CommCell must trust those certificates for dashboard aggregation and reports.	Confirm that the URLs open without certificate trust errors from the machines that must connect to them. Also import the required CA certificates into the Commvault JRE keystore on the Global CommCell.

Important

The software version of the Global Command Center should be the same as the Service CommCells. If the versions are different, the Global Command Center should be on the same or a later software version than the Service CommCells.

The Global CommCell and Service CommCells must use fully qualified domain names (FQDNs) that match the certificates and the configured URLs.
After you change Global Command Center URL settings (globalConfigManagerBaseUrl or hubServiceBaseUrl), restart the relevant Commvault services and run IISRESET before you retry Active Management.

These settings include the Global Configuration Manager URL and Hub Service URL. You can also edit the Service CommCell URLs from the Service CommCell details page after registration.

User and Permission Requirements

Before users switch to Service CommCells or perform operations from the Global Command Center, verify the following requirements:

The user account exists on the Global CommCell and on each target Service CommCell.
The user account has the same email address or user principal name (UPN) on the Global CommCell and on the target Service CommCell.
The user has the required permissions on the target Service CommCell for the operation.

For example, if a user creates or synchronizes a blueprint from the Global Command Center, the matching user account on the Service CommCell must have permission to create or update that entity on the Service CommCell. If the permissions are missing, the operation can fail with an unauthorized or access denied error.

If users log on by using AD or SAML SSO and you want the user account to be created automatically on Service CommCells during switching or Global Command Center fanout operations, enable automatic user creation. For more information, see Automatically Create Users When AD or SAML SSO Login is Enabled on Service CommCells.

Certificate Trust for Aggregation

If a Service CommCell uses a certificate that is signed by an internal CA, or uses a self-signed certificate, import the required CA certificate into the Commvault JRE keystore on the Global CommCell. Without this trust, dashboard aggregation and reports can fail.

On the Global CommCell:

Copy the Service CommCell CA certificate files to the certificates folder.

For Windows systems:

C:\Program Files\Commvault\ContentStore\certificates\

Run the certificate import script.

For Windows systems:

C:\Program Files\Commvault\ContentStore\certificates\importcert.cmd

Restart Tomcat.

For more information, see Adding CA Certificates to the Commvault JRE Keystore.

If dashboard aggregation still fails, review CustomReportsEngine.log for certificate trust errors, such as PKIX path building failed or unable to find valid certification path to requested target.

Connectivity Validation

Use the following checks before you add Service CommCells or enable Active Management:

From the Global Web Server, open each Service CommCell Command Center URL, for example https://<service-commcell-host>/commandcenter.
On the Global Configuration Manager server, open http://localhost:5005/globalconfig/health.
On the Hub Service server, open http://localhost:5010/hub/health.
From each Service CommCell Web Server, open the Hub Service health URL, for example http://<hub-service-host>:5010/hub/health.
If you use HTTPS for the Hub Service, verify the HTTPS port from Computer\HKEY_LOCAL_MACHINE\SOFTWARE\CommVault Systems\Galaxy\Instance001\CVContainer\DotNet, and then open https://<hub-service-host>:<https-port>/hub/health.
If you use a reverse proxy for the Hub Service, configure hubServiceBaseUrl with the proxy URL and validate the proxy URL from each Service CommCell Web Server. The URL configured in hubServiceBaseUrl is sent to the Service CommCell and is used for Active Management synchronization.

Network Port Requirements

Port	Protocol	Component	Purpose	Notes	Where the Port Must Be Open
443	HTTPS	Tomcat	Provides access to Command Center over HTTPS.	Default Tomcat port is 443. If a custom port is configured, open that port instead. The Global Web Server must be able to reach each Service CommCell Command Center URL.	Global CommCell and Service CommCells
8403	TCP	Commvault Core Services (Tunnel/Forwarding)	Enables core Commvault communication required for Global Command Center operations.	--	Global Command Center and Service CommCells
5010	TCP	Hub Service	Enables Service CommCell Web Servers to connect to the Global Hub Service for Active Management and blueprint synchronization.	Open this port only if Service CommCell Web Servers connect directly to the Hub Service over HTTP. If you use HTTPS or a reverse proxy, open the HTTPS or proxy port instead and configure `hubServiceBaseUrl` with that reachable URL.	Service CommCell Web Servers to Global Hub Service or reverse proxy
5005	TCP	Global Configuration Manager	Enables configuration and management communication between the Global Web Server and the Global Configuration Manager.	Typically installed with web server components.	Global Web Server to Global Configuration Manager