Protocols, Ports, and Firewall Rules
TechReady4 (internal technical readiness field event in Seattle) went really well. Some good times. Wanted to share some data from a couple slides in the advanced deployment deck. Refer to the TechNet Planning Security for additional details: Plan for secure communication within a server farm, Plan security hardening for server roles within a server farm (Office SharePoint Server). You can also look forward to an extranet document and logical architectures document that will both help planning out your extranet/internet site better.
All protocols are HTTP-based
|
Inbound/Outbound |
From |
Port |
To |
|
Inbound |
Client IPs (as applicable) |
TCP 80 or 443 |
ISA Web Pub or
WFE |
|
Inbound |
TS Jump point |
RDP (TCP 3389)
For Remote Admin |
APP (Central Admin /SSP Admin) |
|
Inbound |
All SharePoint Server (Depends on Central Admin config) |
Office Server Web Services, TCP 56737, SSL 56738 |
App (Central Admin /SSP Admin) |
|
Inbound |
Index
*** |
TCP 80 or 443 |
WFE |
|
Outbound |
ALL SharePoint Svrs
(Based on Auth) |
DS (TCP 445)
RPC (TCP 135)
DNS (UDP 53)
Kerberos (UDP 88)
LDAP/S (UDP 389/636) |
DC/DNS (LDAP) |
|
Outbound/(Inbound if applicable) |
WFE (alerts or mail enabled list)
* |
SMTP (TCP 25) |
SMTP/Exchange |
|
Outbound |
ALL SharePoint Svrs |
SQL (TCP 1433) or SSL custom port |
SQL |
|
Outbound |
WFE (Search Request) |
Search Query, either NBT (TCP/UDP 137, 138,139) or Direct-hosted SMB (TCP/UDP 445) |
Query |
|
Outbound |
Index (Propagation) |
Search Query, either NBT (TCP/UDP 137, 138,139) or Direct-hosted SMB (TCP/UDP 445) |
Query |
|
Outbound |
WFE (SSO) |
RPC for SSO – (TCP 135), plus random high ports (Dynamic RPC) or restricted high ports (Static RPC) |
APP Servers |
* Don't forget outbound RSS/XML displays, and any online web parts
** Don't forget outbound to BDC connections and datasources as applicable
*** Don't Forget outbound ports (80/25, etc...) to crawl seeds, content sources
Warning: As with anything be sure to consider what is necessary, don't just do it to make it work.
