Both static reflectors and patch servers deployed outside the cluster behave like ICE Desktop and ICE Mobile endpoint devices: They establish SSL (7443/tcp) connections to one or more Rallypoints (depending on the configuration of the system), plus a single secure web socket (443/tcp) to the ICE Server in order to receive provisioning messages.