Preparing Required Resources

Overview

Before creating a ROMA Connect instance, you need to ensure availability of resources, including a virtual private cloud (VPC), subnet, and security group. Each ROMA Connect instance is deployed in a VPC and bound to specific subnets and security groups. In this way, ROMA Connect provides an isolated virtual network environment and security protection policies that can be easily configured and managed by users.

Required Resources

The following table lists the resources required by a ROMA Connect instance.

**Table 1** ROMA Connect resources
Resource	Requirement	Operations
VPC and subnet	Different ROMA Connect instances can use the same or different VPCs and subnets based on site requirements. Note the following when creating a VPC and subnet: The created VPC and ROMA Connect must be in the same region. Retain the default settings unless otherwise specified.	For details about how to create a VPC and subnet, see "Creating a VPC and Subnet" in the Virtual Private Cloud User Guide.
Security group	Different ROMA Connect instances can use the same security group or different security groups. Note the following when creating a security group: Set Template to Custom. After a security group is created, retain the default inbound and outbound traffic rules. To use ROMA Connect, you must add the security group rules described in Table 2. Other rules can be added based on site requirements.	For details about how to create a security group, see "Creating a Security Group" and "Adding a Security Group Rule" in the Virtual Private Cloud User Guide.
(Optional) EIP	If you want to access ROMA Connect through a public network, apply for an EIP.	For details about how to apply for an EIP, see "Assigning an EIP" in the Elastic IP User Guide.

**Table 2** Security group rules
Direction	Protocol	Port	Source IP Address	Description
Inbound	TCP	80	0.0.0.0/0	Access APIC through a public network (without SSL encryption).
Inbound	TCP	443	0.0.0.0/0	Access APIC through a public network (with SSL encryption).
Inbound	TCP	1883	0.0.0.0/0	Access device integration through a public network (without SSL encryption).
Inbound	TCP	7443	0.0.0.0/0	Access device integration through a public network (using RESTful APIs).
Inbound	TCP	8443	0.0.0.0/0	Access device integration through a public network (with SSL encryption).
Inbound	TCP	9092	0.0.0.0/0	Access MQS through an intranet (without SASL authentication).
Inbound	TCP	9093	0.0.0.0/0	Access MQS through an intranet (with SASL authentication).
Inbound	TCP	9094	0.0.0.0/0	Access MQS through a public network (without SASL authentication).
Inbound	TCP	9095	0.0.0.0/0	Access MQS through a public network (with or without SASL authentication).
Inbound	TCP	9096	0.0.0.0/0	Access MQS through a public network (with or without SASL authentication).
Inbound	TCP	9097	0.0.0.0/0	Access MQS through a public network (with SASL authentication).
Inbound	TCP	9292	0.0.0.0/0	Access MQS through a public network (using RESTful APIs).