Firewalls can be used to protect various parts of a network and must be configured to allow the connections required by SGD.
This section includes the following topics:
Client devices must be able to make HTTP and AIP connections to any SGD server in the array. This is because a user's SGD session and a user's application sessions can be hosted on different SGD servers.
The following table lists the ports you might need to open to allow connections between client devices and SGD servers.
Source | Destination | Port | Protocol | Purpose |
---|---|---|---|---|
Client | SGD web server | 80 | TCP | Standard, unencrypted HTTP requests and responses. Used to display webtops and for web services. |
Client | SGD web server | 443 | TCP | Secure, encrypted HTTPS requests and responses. Used to display webtops and for web services. |
Client | SGD server | 3144 | TCP | Standard, unencrypted AIP connections. Used for control and application display updates. |
Client | SGD server | 5307 | TCP | SSL-based secure, encrypted AIP connections. Used for control and application display updates. |
TCP ports 80 and 443 are the Internet-standard ports for HTTP and HTTPS. Port 443 is only used if HTTPS is enabled on the SGD web server. You can configure the SGD web server to use any port.
For a default installation in secure mode, where you enable SGD security services and use HTTPS, only ports 443 and 5307 must be open in the firewall.
For an installation in non-secure mode, where connections are not secured, ports 80, 3144, and 5307 must be open in the firewall. This is because the SGD Client initially makes a secure connection on port 5307. After the connection is established, the connection is then downgraded to a standard connection on port 3144. See Section 1.5.2, “Firewall Traversal” for how to configure SGD when these ports cannot be opened.
Ports 3144 and 5307 are registered with the Internet Assigned Numbers Authority (IANA) and are reserved for use only by SGD.
A network might contain firewalls between the SGD servers in an array, for example if you have multiple offices each containing an SGD server. The SGD servers in an array must be able to connect to any other member of the array.
The following table lists the ports you might need to open to allow connections between SGD Servers.
Source | Destination | Port | Protocol | Purpose |
---|---|---|---|---|
SGD server | Another SGD server | 515 | TCP | Used when moving print jobs from one SGD server to another using the tarantella print move command. |
SGD server | Another SGD server | 1024 and above | TCP | Used to support audio, smart cards and serial ports for Windows applications. |
SGD server | Another SGD server | 5427 | TCP | Used for connections between SGD servers to allow array replication, and sharing of both static and dynamic data across the array. |
Port 5427 is registered with IANA and is reserved for use only by SGD.
If you enable support for audio, smart cards, or serial ports for Windows applications, your firewall must allow connections between SGD servers on TCP port 1024 and above. The protocol engines that manage these features run on the SGD server that hosts the user session and this might be a different server to the one that hosts the application session. If you do not use these features, it is best to disable support for them in SGD. See the following for more information:
An SGD server must be able to connect to an application server in order to run applications.
The ports used for connections between SGD servers and application servers depends on the application type and the connection method used to log in to the application server. Other ports are needed to provide support while using applications.
The following table lists the ports you might need to open to allow connections between SGD Servers and application servers.
Source | Destination | Port | Protocol | Purpose |
---|---|---|---|---|
SGD server | Application server | 22 | TCP | Used to connect to X and character applications using SSH. |
SGD server | Application server | 23 | TCP | Used to connect to Windows, X, and character applications using Telnet. |
Application server | SGD server | 139 | TCP | Used for UNIX and Linux platform client drive mapping services. The server binds to this port at start-up, whether or not client drive mapping services are enabled. |
Application server | SGD server | 515 | TCP | Used to send print jobs from the application server to an SGD server. |
SGD server | Application server | 3389 | TCP | Used to connect to Windows applications that use the Microsoft RDP protocol. |
SGD server | Application server | 3579 | TCP | Used for connections between the primary SGD server and the SGD load balancing service on an application server. |
Application server | SGD server | 3579 | UDP | Used for connections between the SGD load balancing service on an application server and the primary SGD server. |
SGD server | Application server | 5999 | TCP | Used to connect to Windows applications, if the application is configured to use the Wincenter protocol and the connection method is Telnet. The Wincenter protocol is no longer supported but might be used by legacy Windows application objects. |
Application server | SGD server | 6010 and above | TCP | Used to connect X applications to the protocol engines on the SGD server. |
For X applications, ports 6010 and above are only used if the connection method for X applications is Telnet. If the connection method is SSH, the connections use port 22. If you enable audio for X applications, all ports must be open between the application server and SGD. This is because the SGD audio daemon connects to the SGD server on random ports. This applies even if the connection method is SSH. See Section 5.3, “Audio” for details.
Port 3579 is registered with IANA and is reserved for use only by SGD. You only need to open these ports if you are using SGD Advanced Load Management. See Section 7.2.3, “Application Load Balancing” for details.
SGD needs to make connections to any authentication services and directory services you might be using.
The following table lists the ports you might need to open to allow connections between SGD Servers and other services.
Source | Destination | Port | Protocol | Purpose |
---|---|---|---|---|
SGD server | Windows server | 88 | TCP or UDP | Used to authenticate users in an Active Directory forest. |
SGD server | LDAP directory server | 389 | TCP | Used to authenticate users, or to assign applications to users, using a Lightweight Directory Access Protocol (LDAP) directory. |
SGD server | Windows server | 464 | TCP or UDP | Used to enable users to change their password if it has expired. |
SGD server | LDAP directory server | 636 | TCP | Used to authenticate users, or to assign applications to users, using a secure connection (LDAPS) to an LDAP directory. |
SecurID Authentication Manager | SGD server | 1024 to 65535 | UDP | Used to authenticate users using SecurID. |
SGD server | Windows server | 3268 | TCP | Used to authenticate users in an Active Directory forest. |
SGD server | Windows server | 3269 | TCP | Used to authenticate users in an Active Directory forest. |
SGD server | SecurID Authentication Manager | 5500 | UDP | Used to authenticate users using SecurID. |
Ports 88, 464, 3268, 3269 are only required if you are using Active Directory authentication. Ports 88 and 464 can use either the TCP or UDP protocol depending on the packet size and your Kerberos configuration. See Section 2.2.4, “Configuring SGD for Kerberos Authentication” for details. Ports 3268 and 3269 are only used for SSL connections to Active Directory, see Section 2.2.3.5, “SSL Connections to Active Directory” for details.
Ports 389 and 636 are only required if you are using an LDAP directory to establish a user's identity or to assign applications to users. This applies to the following authentication mechanisms:
Active Directory authentication, see Section 2.2, “Active Directory Authentication”
LDAP authentication, see Section 2.4, “LDAP Authentication”
Third-party or web authentication using the LDAP search method, see Section 2.6, “Third-Party Authentication and Web Authentication”
Ports 1024 to 65535 are only required if you are using SecurID Authentication. For the RSA SecurID Authentication Manager to communicate with an SGD server acting as an Agent Host, all ports from 1024 to 65535 must be open from the IP addresses of the Master and Slave Authentication Managers to the IP addresses of all Agent Hosts. See Section 2.5, “SecurID Authentication” for details.
Port 5500 is only required if you are using SecurID authentication. For the RSA SecurID Authentication Manager to communicate with an SGD server acting as an Agent Host, port 5500 must be open from the IP addresses of the Host Agents to the IP addresses of the Master and Slave Authentication Managers.