# Prerequisites and Network Requirements for the Global Command Center

Verify that your environment meets the prerequisites and network connectivity requirements for integrating Service CommCells with the Global Command Center.

The Global Command Center supports two main types of functionality:

- Aggregation and switching let you view dashboards, jobs, alerts, reports, and Service CommCell entities from the Global Command Center. This uses the existing CommServe, Web Server, and Command Center communication path.

- Active Management and blueprints let you create configuration in the Global Command Center and synchronize it to Service CommCells. This additionally requires the Global Configuration Manager and Hub Service.

Important

If you only want aggregation, monitoring, switching, and direct entity operations, you can start by registering Service CommCells after the Command Center URLs and certificate trust are ready. Configure the Global Configuration Manager and Hub Service when you want to use Active Management and blueprints.

## General Requirements

Requirement | Required For | Why It Is Needed | How to Validate
--- | --- | --- | ---
Service CommCell Command Center availability from the Global Web Server | Registration, aggregation, reporting, monitoring, switching, and direct entity operations | The Global Command Center retrieves data and routes user actions through the Service CommCell Command Center URL. | From the Global Web Server, open each Service CommCell Command Center URL in a browser, for example `https://<service-commcell-host>/commandcenter`.
Matching user accounts and permissions | Switching, aggregation, direct entity operations, Active Management, and blueprint synchronization | Actions from the Global Command Center are authorized on the target Service CommCell by using the matching user account on that Service CommCell. If the user does not exist or does not have the required permissions, switching can fail and operations can return unauthorized or access denied errors. | Verify that the user exists on each target Service CommCell with the same email address or user principal name (UPN), and that the user has the permissions required for the operation.
Global Hub Service connectivity from Service CommCell Web Servers | Active Management and blueprint synchronization | After Active Management is enabled, Service CommCells use the Hub Service URL that is configured on the Global CommCell to receive and synchronize global configuration changes. | From each Service CommCell Web Server, open the Hub Service health URL. If you use a proxy, open the proxy health URL that is configured in `hubServiceBaseUrl`.
Global Web Server, Global Configuration Manager, and Hub Service connectivity | Active Management and blueprint processing | The Global Web Server, Global Configuration Manager, and Hub Service must be able to exchange configuration and synchronization requests. | Open the Global Configuration Manager and Hub Service health URLs from the relevant Global CommCell servers.
Valid certificates and JRE trust | Secure registration, switching, aggregation, and Active Management | Certificates must match the FQDNs used in Command Center, Global Configuration Manager, Hub Service, or proxy URLs. If Service CommCells use certificates from an internal CA or self-signed certificates, the Global CommCell must trust those certificates for dashboard aggregation and reports. | Confirm that the URLs open without certificate trust errors from the machines that must connect to them. Also import the required CA certificates into the Commvault JRE keystore on the Global CommCell.

Important

The software version of the Global Command Center should be the same as the Service CommCells. If the versions are different, the Global Command Center should be on the same or a later software version than the Service CommCells.

- The Global CommCell and Service CommCells must use fully qualified domain names (FQDNs) that match the certificates and the configured URLs.

- After you change Global Command Center URL settings (`globalConfigManagerBaseUrl` or `hubServiceBaseUrl`), restart the relevant Commvault services and run `IISRESET` before you retry Active Management.

  These settings include the Global Configuration Manager URL and Hub Service URL. You can also edit the Service CommCell URLs from the Service CommCell details page after registration.

## User and Permission Requirements

Before users switch to Service CommCells or perform operations from the Global Command Center, verify the following requirements:

- The user account exists on the Global CommCell and on each target Service CommCell.

- The user account has the same email address or user principal name (UPN) on the Global CommCell and on the target Service CommCell.

- The user has the required permissions on the target Service CommCell for the operation.

For example, if a user creates or synchronizes a blueprint from the Global Command Center, the matching user account on the Service CommCell must have permission to create or update that entity on the Service CommCell. If the permissions are missing, the operation can fail with an unauthorized or access denied error.

If users log on by using AD or SAML SSO and you want the user account to be created automatically on Service CommCells during switching or Global Command Center fanout operations, enable automatic user creation. For more information, see Automatically Create Users When AD or SAML SSO Login is Enabled on Service CommCells.

## Certificate Trust for Aggregation

If a Service CommCell uses a certificate that is signed by an internal CA, or uses a self-signed certificate, import the required CA certificate into the Commvault JRE keystore on the Global CommCell. Without this trust, dashboard aggregation and reports can fail.

On the Global CommCell:

1. Copy the Service CommCell CA certificate files to the certificates folder.

For Windows systems:

    C:\Program Files\Commvault\ContentStore\certificates\

1. Run the certificate import script.

For Windows systems:

    C:\Program Files\Commvault\ContentStore\certificates\importcert.cmd

1. Restart Tomcat.

For more information, see Adding CA Certificates to the Commvault JRE Keystore.

If dashboard aggregation still fails, review `CustomReportsEngine.log` for certificate trust errors, such as `PKIX path building failed` or `unable to find valid certification path to requested target`.

## Connectivity Validation

Use the following checks before you add Service CommCells or enable Active Management:

- From the Global Web Server, open each Service CommCell Command Center URL, for example `https://<service-commcell-host>/commandcenter`.

- On the Global Configuration Manager server, open `http://localhost:5005/globalconfig/health`.

- On the Hub Service server, open `http://localhost:5010/hub/health`.

- From each Service CommCell Web Server, open the Hub Service health URL, for example `http://<hub-service-host>:5010/hub/health`.

- If you use HTTPS for the Hub Service, verify the HTTPS port from `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\CommVault Systems\Galaxy\Instance001\CVContainer\DotNet`, and then open `https://<hub-service-host>:<https-port>/hub/health`.

- If you use a reverse proxy for the Hub Service, configure `hubServiceBaseUrl` with the proxy URL and validate the proxy URL from each Service CommCell Web Server. The URL configured in `hubServiceBaseUrl` is sent to the Service CommCell and is used for Active Management synchronization.

## Network Port Requirements

Port | Protocol | Component | Purpose | Notes | Where the Port Must Be Open
--- | --- | --- | --- | --- | ---
443 | HTTPS | Tomcat | Provides access to Command Center over HTTPS. | Default Tomcat port is 443. If a custom port is configured, open that port instead. The Global Web Server must be able to reach each Service CommCell Command Center URL. | Global CommCell and Service CommCells
8403 | TCP | Commvault Core Services (Tunnel/Forwarding) | Enables core Commvault communication required for Global Command Center operations. | -- | Global Command Center and Service CommCells
5010 | TCP | Hub Service | Enables Service CommCell Web Servers to connect to the Global Hub Service for Active Management and blueprint synchronization. | Open this port only if Service CommCell Web Servers connect directly to the Hub Service over HTTP. If you use HTTPS or a reverse proxy, open the HTTPS or proxy port instead and configure `hubServiceBaseUrl` with that reachable URL. | Service CommCell Web Servers to Global Hub Service or reverse proxy
5005 | TCP | Global Configuration Manager | Enables configuration and management communication between the Global Web Server and the Global Configuration Manager. | Typically installed with web server components. | Global Web Server to Global Configuration Manager

×

Loading...