Network security & port requirements

This page consolidates every network and firewall requirement of a bessa deployment at a customer site. It is written for IT administrators who need to decide — in a managed network with firewalls, segmented VLANs, or allowlists — which hosts and ports to open so that the sales point, the order channel, printers, payment terminals, and beverage dispensers all work as expected.

The content is grouped by product area. Each area has two subsections: outbound (internet) and internal (local network).

General notes

• Cloud connectivity: every outbound connection to a bessa service uses HTTPS / TCP 443. No additional outbound ports are required.

• DNS: standard system DNS resolution is sufficient. No bessa-specific DNS configuration is required.

• NTP: there is currently no mandatory NTP requirement on devices or on the network.

• IP allowlists: allow hostnames only. Concrete IP ranges (CIDR) are not stable — cloud services are delivered over CDN / load-balancer pools that change.

• Local devices: printers, payment terminals, and beverage dispensers need a static IP or a reserved DHCP lease. They must be reachable from the sales point on the same subnet, or routed between subnets.

• ICMP / PING: some devices (e.g. Brau Union Z1U dispenser) deliberately do not answer ICMP. Diagnose via the device's TCP/UDP port, not via ping.

1. bessa Kassa (sales point)

The sales point talks to the bessa cloud (Manager / API) and — depending on the country — to a certified signing component (RKSV / TSE / country-specific).

Outbound

Internal

Printers, payment terminals, and beverage dispensers are documented in the dedicated sections below — the sales point opens outbound TCP connections to these devices on the LAN.

2. Order channel (Connector)

The bessa Connector is the central order interface between external order channels (self-order tablets, ordering apps, web shop) and the sales point. It runs as a Windows service, on Android, or as a Sunmi-standalone — port requirements do not differ by platform but by the connected sales-point system.

Outbound

Internal

Connector ↔ sales point:

Order channels (self-order tablets, third-party order apps, web shop): communication runs exclusively via the cloud (HTTPS). No port allowance is required directly at the Connector on the LAN.

3. Customer loyalty

Customer loyalty (bonus / loyalty program) runs entirely through the bessa cloud. There is no LAN component.

Outbound

Internal

None. No dedicated LAN hardware (no Treuepass reader / NFC terminal) is required.

4. Vouchers

Voucher management runs entirely through the bessa cloud.

Outbound

External voucher providers (third-party in-house voucher platforms etc.) are not currently supported — no additional hosts need to be allowed.

Internal

None.

5. KPI app (Kennzahlen)

The KPI app delivers real-time reporting for a sales point. It talks locally to the sales point and outbound to the bessa cloud for sync and reporting.

Outbound

Internal

• KPI app ↔ sales point: TCP 1090

6. Printers

Printers are local devices only. No outbound internet connectivity is required.

Outbound

None.

Internal

AirPrint / IPP (TCP 631) is not used.

7. Payment terminals

Payment terminals fall into two classes: card-payment terminals (cards, NFC, SoftPOS) and cash-payment terminals (Cashmatic). Cloud-only terminals (Vivawallet, SumUp, GPTom cloud mode) do not need a LAN port allowance; classic network terminals use ZVT, TIM, or TECS.

Outbound

• Per vendor: HTTPS / TCP 443 to the vendor cloud (for backend log-in, transaction routing, terminal software updates).

• The exact vendor cloud hostnames need to be obtained from the respective vendor — they are subject to vendor-side changes and are deliberately not hard-coded here.

Internal

8. Beverage dispensers (Schankanlagen)

Beverage dispensers are typically vendor-certified and partially hardened devices that connect to the sales point — either directly via serial / USB or over the LAN.

Outbound

• Each dispenser vendor typically contacts a vendor cloud for telemetry and updates (e.g. Heineken / Brau Union). The exact hostnames need to be obtained from the respective vendor.

Internal

FAQ

Is outbound HTTPS sufficient for cloud connectivity? Yes. All bessa cloud endpoints are reachable over TCP 443 / HTTPS only. No additional outbound ports are required.

Do we need to allow specific IP ranges (CIDR)? No. Allow only the hostnames listed in the tables above. Cloud IPs are delivered over CDN / load-balancer pools and can change.

Is an outbound-only profile sufficient for the sales point? For cloud connectivity, outbound HTTPS is enough. For the sales point's communication with local devices (printers, payment terminals, beverage dispensers), the sales point must actively reach those devices over the LAN — see the per-area tables.

Do devices need to answer ICMP / PING? No, ICMP is not strictly required. Some devices (e.g. Brau Union Z1U dispenser) deliberately do not answer ICMP. Diagnose via the device's TCP / UDP port instead.

We run multiple sites behind an SD-WAN — what changes? The same requirements apply per site. There is no site-spanning network-level aggregation; each site communicates independently with the bessa cloud and with its local devices.

Which hostnames need to be allowed for the TSE / RKSV signing component? This depends on the customer's country: Austria (RKSV) requires rksv.a-trust.at and / or rksv.fiskaly.com, Germany (TSE) requires kassensichv-middleware.fiskaly.com, and other countries may require cloud-efr.efsta.net. Allow only the hostnames relevant to your site.

What if a vendor cloud hostname is missing for a payment terminal or beverage dispenser? These hostnames need to be obtained from the respective vendor — they are subject to vendor-side changes and are deliberately not hard-coded here.

Related topics

• Data protection

• Support

• bessa Connector

• KPI app

• Brau Union Z1U dispenser