---
title: "Prepare your network"
description: "A checklist for your infrastructure team: scanning services, service accounts, and the firewall rules and ports each Connection Manager needs."
product: "Guardian"
edition: "Classic"
type: "get-started"
url: "https://docs.cloudhouse.com/guardian/classic/getting-started/prepare-your-network/"
---
# Prepare your network

Stage 2 of [getting started](https://docs.cloudhouse.com/guardian/classic/getting-started/index.md). Guardian's scanning services run on your network, whether your instance is hosted or on-premises. This checklist gets them installed, signed in and able to reach what they need.

Applies to: `Guardian Classic` `Infrastructure teams`

## Set up scanning services

Guardian scans a node by running commands on it, either through an **Agent** installed on the node or agentlessly through a **Connection Manager**. The results are the same, so you can mix the two; we recommend a combination. See [Agent-based or agentless?](https://docs.cloudhouse.com/guardian/classic/getting-started/agent-based-or-agentless/index.md) and [Supported Devices](https://docs.cloudhouse.com/guardian/classic/account/settings/supported-devices/index.md).

### Agent-based

Install the Agent on each node you want to scan. It polls the Guardian instance over HTTPS on port 443 every 10 seconds for work, and scans only the node it's installed on. Agent nodes appear under **Inventory** > **Monitored** once they're set up. See [Guardian Agent](https://docs.cloudhouse.com/guardian/classic/getting-started/agents/index.md).

### Agentless

A Connection Manager connects to your nodes remotely over SSH, WinRM or an API, and one Connection Manager can scan more than a hundred nodes. It can run on the Guardian appliance or as a satellite on your network. See [Connection Managers](https://docs.cloudhouse.com/guardian/classic/inventory/connection-managers/connection-managers/index.md).

!!! tip "Group your Connection Managers first"
    If you'll run more than one Connection Manager, set up [Connection Manager groups](https://docs.cloudhouse.com/guardian/classic/inventory/monitored/connection-manager-group/connection-manager-groups/index.md) before you add nodes. Connection Managers in a group share the load of scans and integration syncs.

## Provision service accounts

Applies to: `Agentless scanning`

Agentless scans sign in to each node with a service account. Without one that can use SSH or WinRM, scans fail with **Access Denied**; without enough permissions, they're incomplete. You need a service account even if you only use the built-in [default Linux Connection Manager](https://docs.cloudhouse.com/guardian/classic/inventory/connection-managers/connection-managers/linux/linux-connection-manager/index.md#default-linux-connection-manager).

Linux
:   - Can sign in over SSH.
    - Optionally, a local or domain administrator on the node. To scan [CIS benchmarks](https://docs.cloudhouse.com/guardian/classic/control/benchmarks/benchmarks/index.md), it needs root.

Windows
:   - Can sign in over WinRM, with **Execute (Invoke)** permission. To grant it, run `Set-PSSessionConfiguration -Name Microsoft.PowerShell -ShowSecurityDescriptorUI` in PowerShell and add the service user.
    - Optionally, a local or domain administrator on the node.
    - Optionally, [run the Connection Manager service as this user](https://docs.cloudhouse.com/guardian/classic/inventory/connection-managers/connection-managers/windows/windows-connection-manager-installer/index.md#configure).

Database
:   - The [user permissions](https://docs.cloudhouse.com/guardian/classic/inventory/add-nodes/add-a-single-node/agentless/database-node/index.md#user-permissions) for your database type.

## Open your firewall

Scanning services can't scan until your firewalls let them reach the instance and your nodes.

| Scanning service | Must reach |
| --- | --- |
| Every Agent and Connection Manager | The Guardian instance on port **443**, to collect scan jobs and return results. |
| Linux Connection Manager | Target nodes (Linux and Unix servers, SSH-capable network devices) on port **22**, or whichever port their SSH servers use. |
| Windows Connection Manager | Target Windows nodes on WinRM ports **5985** and **5986**, and database nodes on the ports you use for ODBC. |

## Next

- [*Stage 3* **Add and scan your first nodes** Add nodes, scan them and see the results.](https://docs.cloudhouse.com/guardian/classic/getting-started/add-and-scan-nodes/index.md)