The following table lists the ports that need to be opened when a firewall separates Access Manager Appliance from Internet.
With these tables, you should be able to place Access Manager Appliance of your system anywhere within your existing firewalls and know which ports need to be opened in the firewall.
|
Component |
Port |
Description |
|---|---|---|
|
NTP Server |
UDP 123 |
Access Manager components must have time synchronized or authentication fails. We highly recommend that all components be configured to use an NTP (network time protocol) server. Depending upon where your NTP server is located in relationship to your firewalls, you might need to open UDP 123 so that the Access Manager component can use the NTP server. |
|
DNS Servers |
UDP 53 |
Access Manager components must be able to resolve DNS names. Depending upon where your DNS servers are located, you might need to open UDP 53 so that the Access Manager component can resolve DNS names. |
|
Remote Linux Administration Workstation |
TCP 22 |
If you use SSH for remote administration and want to use it for remote administration of Access Manager components, you need to open TCP 22 to allow communication from your remote administration workstation to your Access Manager components. |
|
Access Manager Appliance |
TCP 1443 |
For communication from the Administration Console to the devices. |
|
TCP 8444 |
For communication from the devices to the Administration Console. |
|
|
TCP 1289 |
For communication from the devices to the Audit server on the Administration Console. |
|
|
TCP 524 |
For NCP certificate management with NPKI. The port needs to be opened so that both the device and the Administration Console can use the port. |
|
|
TCP 636 |
For secure LDAP communication from the devices to the Administration Console. |
|
|
TCP 524 |
Required to synchronize the configuration data store. |
|
|
TCP 636 |
Required for secure LDAP communication. |
|
|
TCP 8080, 8443 |
Used for Tomcat communication. |
|
|
LDAP User Store |
TCP 524 |
Required only if the user store is eDirectory. When configuring a new eDirectory user store, NCP is used to enable Novell SecretStore by adding a SAML authentication method and storing a public key for the Administration Console. It is not used in day-to-day operations. |
|
Browsers |
TCP 8080 |
For HTTP communication from browsers to the Administration Console. |
|
TCP 8443, 2443, 2080. |
For HTTPS communication from browsers to the Administration Console. |
|
|
TCP 8028, 8030 |
To use iMonitor or DSTrace from a client to view information about the configuration store on the Administration Console. |
|
|
TCP 80 |
For HTTP communication from the client to the Access Gateway. This is configurable. |
|
|
TCP 443 |
For HTTPS communication from the client to the Access Gateway. This is configurable. |
|
|
Web Servers |
TCP 80 |
For HTTP communication from the Access Gateway to the Web servers. This is configurable. |
|
TCP 443 |
For HTTPS communication from the Access Gateway to the Web servers. This is configurable. |
|
|
OpenVPN |
UDP 7777 |
For OpenVPN server communication. This is the default port for access to the SSL VPN, but it can be configured to use UDP 443. |
|
Application Servers (E-mail, Telnet, Thin Client) |
TCP 22 |
For SSH communication from the SSL VPN to the application server. |
|
TCP 23 |
For Telnet communication from the SSL VPN to the application server. |
|
|
Application ports |
Specific to the application that SSL VPN is providing access to. |
|
|
Firewall on same machine as the SSL VPN |
tun0 |
SSL VPN creates a tunnel that needs to be open on the internal networks list of the machine. For configuration information, see the following Note. |
NOTE:On SLES 11, you can edit this file or use YaST to configure UDP ports and internal networks.