Know the default communication direction of the Deep Security Manager (DSM) to the Agent/Appliance.
For Cloud One Workload Security, Agent-initiated Communication (AIA) is enabled by default. This means that the Deep Security Agent initiates all interactions with the manager and establish an encrypted TCP connection over the manager heartbeat port (443).
You may find this setting in the Cloud One Workload Security console.