Note that TCP 22 (ssh) is not required for normal operations.
VNS3:ms has that same multi-party/multi-factor authentication system for Remote Support that all VNS3 products utilize. Each VNS3:ms instance is running a restricted SSH daemon, with access limited only to Cohesive Networks for debugging purposes controlled by the user via the Remote Support toggle and key exchange generation.
In the event Cohesive Networks needs to observe runtime state of a VNS3:ms instance in response to a tech support request, we will ask you to open Security Group access to SSH from our support IP range and Enable Remote Support via the Web UI. Cohesive Networks will send you an encrypted passphrase to generate a private key used by Cohesive Networks Support staff to access your Controller. Access to the restricted SSH daemon is completely controlled by the user. Once the support ticket has been closed you can disable remote support access and invalidate the access key.