Internal Firewall

If you have a firewall on the internal network, you may need to adjust its policy to open ports for back-end applications with which the appliance must communicate. In addition to opening ports for standard network services such as DNS and email, you may need to modify your firewall policy before the appliance can access the services shown in the below table. Opening your firewall to permit SSH access is optional,but can be useful for performing administrative tasks from a remote system.

Traffic types and ports used by SMA on internal network

Traffic type	Port/protocol	Usage
Microsoft networking	138/tcp and 138/udp 137/tcp and 137/udp 139/udp 162/snmp 445/smb	Used by WorkPlace to perform WINS name resolution, browse requests, and access file shares
LDAP (unencrypted)	389/tcp	Communicate with an LDAP directory or Microsoft Active Directory
LDAP over SSL (encrypted)	636/tcp	Communicate with an LDAP directory or Microsoft Active Directory over SSL
RADIUS	1645/udp or 1812/udp	Communicate with a RADIUS authentication server
NTP	123/udp	Synchronize the appliance clock with an NTP server
Syslog	514/tcp	Send system log information to a syslog server
SNMP	161/udp	Monitor the appliance from an SNMP management tool
Kerberos	88/tcp/udp	Authenticates service requests between two or more trusted hosts across an untrusted network
Global catalog LDAP over SSL	3269/tcp	Searches object in an Active Directory domain tree, given one or more attributes of the target object.
Global catalog LDAP	3268/tcp	LDAP service which contains data from Active Directory forests.