Internal Firewall

If you have a firewall on the internal network, you may need to adjust its policy to open ports for back-end applications with which the appliance must communicate. In addition to opening ports for standard network services such as DNS and email, you may need to modify your firewall policy before the appliance can access the services shown in the below table. Opening your firewall to permit SSH or AMC access is optional, but can be useful for performing administrative tasks from a remote system. Access to the Appliance Management Console (AMC) should be restricted to trusted administrative networks whenever possible and should not be exposed to the public Internet.

Traffic types and ports used by SMA on internal network

Traffic type	Port/protocol	Usage
Microsoft networking	138/tcp and 138/udp 137/tcp and 137/udp 139/udp 162/snmp 445/smb	Used by WorkPlace to perform WINS name resolution, browse requests, and access file shares
AMC administrative access	8443/tcp	Administrative access to the Appliance Management Console (AMC)
SSH	22/tcp	Command-line administration
LDAP (unencrypted)	389/tcp and 389/udp	Communicate with an LDAP directory or Microsoft Active Directory
LDAP over SSL (encrypted)	636/tcp	Communicate with an LDAP directory or Microsoft Active Directory over SSL
RADIUS	1645/udp or 1812/udp (authentication) 1813/udp (accounting)	Communicate with a RADIUS authentication and accounting server
NTP	123/udp	Synchronize the appliance clock with an NTP server
Syslog	514/tcp and 514/udp	Send system log information to a syslog server
SNMP	161/udp	Monitor the appliance from an SNMP management tool
SNMP traps	162/udp	Send SNMP trap notifications to an SNMP management station
Kerberos	88/tcp/udp	Authenticates service requests between two or more trusted hosts across an untrusted network
Global catalog LDAP over SSL	3269/tcp	Searches object in an Active Directory domain tree, given one or more attributes of the target object.
Global catalog LDAP	3268/tcp	LDAP service which contains data from Active Directory forests.
SAML identity providers	443/tcp	Communicate with SAML identity providers, such as Microsoft Entra ID (Azure AD) and Okta
CRL / OCSP	80/tcp and 443/tcp	Validate certificates using a certificate revocation list (CRL) or the Online Certificate Status Protocol (OCSP)
SMTP	25/tcp	Send email notifications
DNS	53/tcp and 53/udp	Resolve domain names (required for CMS/GTO deployments)