We have an HDP cluster which is managed by Ambari. We have been asked to put a firewall and block unknown ports. We have noticed there is an interaction between Ambari Metrics collector and all of the nodes exactly in the opposite direction of Ambari Metrics designed architecture! Based on the architecture, the interaction should be from all of the machines in HDP cluster as a source to Ambari Metrics machine port 6188 as a destination. However, we've found out in addition to this connectivity, there is another type of interaction from source port 6188 on Ambari Metrics machine to all of the machines in HDP cluster with an ephemeral port as the destination port. I was wondering what the purpose of this interaction is and whether it makes sense to have such an interaction or not?