1.3 Security and Privacy

PlateSpin Protect provides several features to help you safeguard your data and increase security.

1.3.1 Encryption of Data in Transmission

Transfer encryption makes the transmission of your workload data more secure during workload replication. When encryption is enabled, over-the-network data transfer from the source to the target is encrypted by using AES (Advanced Encryption Standard).

NOTE:Data encryption has a performance impact and might significantly slow down the data transfer rate by up to 30%.

You can enable or disable encryption individually for each workload by selecting the Encrypt Data Transfer option. See Workload Protection Details.

1.3.2 Security of Client/Server Communications

The PlateSpin Server enables SSL on the PlateSpin Server host, providing secure data transmission between your web browser and the PlateSpin Server with HTTPS (Hypertext Transfer Protocol Secure). The installation also adds a self signed certificate if no valid certificates are found.

1.3.3 Security of Credentials

PlateSpin Protect protects credentials by using an SSL connection for communications and the Windows cryptographic library to encrypt passwords.

Credentials that you use to access various systems (such as workloads and failback targets) are stored in the PlateSpin Protect database and are therefore covered by the same security safeguards that you have in place for your PlateSpin Server host.

In addition, credentials are included within diagnostics, which are accessible to accredited users. You should ensure that workload protection projects are handled by authorized staff.

1.3.4 User Authorization and Authentication

PlateSpin Protect provides a comprehensive and secure user authorization and authentication mechanism based on user roles, and controls application access and operations that users can perform. See Configuring User Authorization and Authentication.

1.3.5 Windows Authentication for Microsoft SQL Server Database

PlateSpin Protect provides the ability to use Windows Authentication for access to the Microsoft SQL Server database. See Requirements for Windows Authentication to the Microsoft SQL Server Database.

1.3.6 Port Settings and Firewalls

Table 1-4 lists the default ports used by PlateSpin Protect. If you configure custom ports, you must open those ports instead. For communications between the PlateSpin Server and the source and target machines it manages, ensure that you also open the appropriate ports on any firewalls between them. Traffic for communications is bidirectional (incoming and outgoing). See also Access and Communication Requirements across Your Protection Network.

Table 1-4 Default Ports Used by PlateSpin Protect

Port Number

Protocol

Function

Details
  • 80
  • TCP
  • HTTP

(Not secure) Used for HTTP communications between the PlateSpin Server host and the source and target machines it manages.

Open this port on your PlateSpin Server host, the source and target workloads, and the VMware ESXi hosts.
  • 443
  • TCP
  • HTTPS

(Secure) Used for HTTPS communications, if SSL is enabled, between the PlateSpin Server host and the source and target machines.

Open this port on your PlateSpin Server host, the source and target workloads, the VMware ESXi hosts, and the vCenter host server.
  • 3725
  • TCP
  • Data transfer

Used for data transfer between the source and target machines, including file-based transfer and block-based transfer.

Open this port on the source and target machines for all workloads. Any firewall between a source and its target must also allow TCP port 3725. See Supported Configurations.
  • 135
  • 445
  • TCP
  • RPC/DCOM

Used for RPC/DCOM communications on Windows machines during the discovery process, and when taking control and rebooting the source machine.

Open these ports for communications between the source and target machines for all Windows workloads. See Supported Windows Workloads.
  • 137
  • 138
  • 139
  • TCP
  • NetBIOS

Used for NetBIOS communications (name service, datagram service, and session service).

Open these ports for communications between the source and target machines for all Windows workloads. See Supported Windows Workloads.
  • 137
  • 138
  • UDP
  • SMB

Used for SMB communications for the file transfer of the Take Control folder and files from the PlateSpin Server to the source machine.

Open these ports on your PlateSpin Server host and the source workloads.
  • 139
  • 445
  • TCP
  • SMB
  • 22
  • TCP

 

Used for SSH and SCP communications on Linux machines during the discovery process.

Open this port on the source and target machines for all Linux workloads. See Supported Linux Workloads.

  • 25
  • TCP
  • SMTP

Used for SMTP traffic if email notification is enabled.

Open this port on the PlateSpin Server host and the mail relay host.
  • 25
  • UDP
  • SMTP
  • 1433
  • TCP
  • SQL

Used for Microsoft SQL Server communications for authentication and data exchange to a remote SQL Server.

Open the SQL ports on your PlateSpin Server host and the remote SQL Server host, as well as on any firewalls between them.

For more information the SQL Server port requirements, see Configure the Firewall to Allow Server Access in the Microsoft Developers Network.
  • 1434
  • TCP
  • SQL

Used for the Microsoft SQL Server dedicated administrator connection.

  • 1434

UDP
  • SQL

Used for the Microsoft SQL Server named instances.

This port might be required when you use named instances on a remote SQL Server.
  • 49152 to 65535
  • TCP
  • SQL

Used for the Microsoft SQL Server or RPC for LSA, SAM, and Netlogon.

If you have configured Microsoft SQL Server to use a specific TCP port, you must open that port on the firewall.

See Requirements for Windows Authentication to the Microsoft SQL Server Database.