If you place a firewall between browsers and Access Manager Appliance, you need to open ports so that browsers can communicate with the Access Gateway and the Identity Server and the Identity Server can communicate with other identity providers.
See, Figure 3-1
Table 3-1 Ports to Open in the First Firewall
|
Port |
Purpose |
|---|---|
|
TCP 80 |
For HTTP communication. |
|
TCP 443 |
For HTTPS communication. |
|
Any TCP port assigned to a reverse proxy or tunnel. |
|
|
TCP 8080 |
For HTTP communication with the Identity Server. |
|
TCP 8443 |
For HTTPS communication with the Identity Server. |
|
TCP 8445 |
For HTTP Identity Provider introductions. If you do not enable Identity Provider introductions, you do not need to open this port. |
|
TCP 8446 |
For HTTPS Identity Provider introductions. If you do not enable Identity Provider introductions, you do not need to open this port. |
SSL VPN needs the following port opened on the first firewall if clients are accessing SSL VPN directly:
Table 3-2 Ports to Open in the First Firewall for SSL VPN
|
Port |
Purpose |
|---|---|
|
TCP 7777 |
For client communication. This is the default port, but it can be configured to use TCP 443. |
The second firewall separates Web servers, LDAP servers, and the Administration Console from the Identity Server and the Access Gateway. You need the following ports opened in the second firewall:
Table 3-3 Ports to Open in the Second Firewall
|
Port |
Purpose |
|---|---|
|
TCP 80 |
For HTTP communication with Web servers. |
|
TCP 443 |
For HTTPS communication with Web servers. |
|
Any TCP connect port assigned to a Web server or to a tunnel. |
|
|
TCP 1443 |
For communication from the Administration Console to the devices. |
|
TCP 8444 |
For communication from the devices to the Administration Console. |
|
TCP 1289 |
For communication from the devices to the Audit server installed on the Administration Console. If you do not enable auditing, you do not need to open this port. |
|
TCP 524 |
For NCP certificate management in NPKI. The port needs to be opened so that both the device and the Administration Console can use the port. |
|
TCP 636 |
For secure LDAP communication of configuration information. |
You need to open ports on the second firewall according to the offered services.
Table 3-4 Ports to Open in the Second Firewall for SSL VPN
|
Port |
Purpose |
|---|---|
|
TCP 22 |
For SSH |
|
TCP 23 |
For Telnet |