No ports are required to be opened at the edge (i.e., source and destination). The OpenZiti edge makes outbound connections using the strong identity into the fabric mesh network. Therefore its only the fabric dataplane which needs inbound ports but it does not listen to any connections other than those of edge components which are authenticated and authorised.
Vs standard MQTT there are several advantages incl. (not limited):
- mTLS connections rather than just TLS
- least privilege and microsegmentation
- outbound only (authenticate and authorise before connect) meaning we can close or deny inbound connections at source and destination
- private DNS with unique naming (e.g., instead of xxx.xxx.xx.xx to antoher IP, you could say MQTT client to MQTT server
- smart routing on the overlay to reduce latency, increase availability and in general increase visibilty without owning the underlay network
Vs standard MQTT there are several advantages incl. (not limited): - mTLS connections rather than just TLS - least privilege and microsegmentation - outbound only (authenticate and authorise before connect) meaning we can close or deny inbound connections at source and destination - private DNS with unique naming (e.g., instead of xxx.xxx.xx.xx to antoher IP, you could say MQTT client to MQTT server - smart routing on the overlay to reduce latency, increase availability and in general increase visibilty without owning the underlay network