Ports and Protocols for Symantec IT Management Suite 7.1

Products

• Management Platform (Formerly known as Notification Server)

Issue/Introduction

 

Resolution

This article contains information for the Ports and Protocols used by components of IT Management Suite (ITMS) 7.1

 

 

 Symantec Installation Manager

Component	Protocol	Direction	Port	Connections	Is configurable?
Symantec Installation Manager	TCP		80/443	SIM uses ports to download files only. It does not open any ports. SIM accesses the following URLs. Your firewall should allow these URLs in order to use SIM properly.   http://www.solutionsam.com http://www.symantec.com/about/profile/policies/privacy.jsp http://lindon.extranet.altiris.com/eval_license_broker/get_licenses.asmx

 

Notification Server and NS Console

Component	Protocol	Direction	Port	Connections	Is configurable?
NS Console	TCP	Inbound	80/443	When using a remote console, Notification Server uses HTTP (port 80) to connect to the server and download the client application / admin console content	Yes
NS (agent install)	UDP (NETLOGON)	Outbound	138	Initial connection Notification Server to client	No
NS (agent install)	TCP (MS DS/CIFS/SMB)	Outbound	445	Initial connection Notification Server to client	No
Agent (initial connection)	TCP	Outbound	80/443	Initial connection Client to Notification Server (after Service Starts)	Yes
Agent (initial connection)	ICMP Type 8 (PING)	Outbound		ICMP Type 8 (PING) package server speed check	No
Agent (policy update and post event)	TCP	Outbound	80/443	The Agent establishes a connection to server port TCP 80 for HTTP and server port TCP 443 for SSL. This port is configurable by the user, however, and can be set to any free port.	Yes
Hierarchy	TCP	Inbound/Outbound	80/443	Hierarchy uses the ports that individual Notification Servers have been set up and configured to use. To join Notification Servers in a hierarchy, you must correctly enter the port numbers or HTTPS prefix inside the Add Hierarchy Node Wizard. In Step 1 of the wizard, in the URL field, you enter either HTTPS or the IIS port. For example, to add a child node called HN-NSX8605.testdom01.lab using port 30000, enter http://HN-NSX8605.testdom01.lab:30000/Altiris/Console in the URL field. This means that your child Notification is configured to use port 30000, and you are instructing the local Notification Server to connect to it for hierarchy communications using that port. To add a child node called HN-NSX8605.testdom01.lab using HTTPS, enter https://HN-NSX8605.testdom01.lab/Altiris/Console in the URL field. Notification Servers within the hierarchy may not all use the same HTTP port for communication. As long as the hierarchy connection is configured correctly inside the Add Hierarchy Node Wizard, they will all work correctly.	Yes
NS to MS SQL DB	TCP	Outbound	1433	Standard port for connection to remote MS SQL DB using TCP/IP transport. Note that MS SQL can be configured to custom or dynamic port usage.	Yes, in MS SQL configuration
NS to MS SQL DB	UDP	Outbound	1434	Used to determine dynamic or custom port used by MS SQL instance	No
NS	TCP/UDP	Outbound	389	Active Directory data import using AD import rules or Data Connector LDAP data source	No
NS	TCP	Outbound	25	Optional connection to mail server using SMTP, required for sending notifications to configured recipients using automation policies or tasks	Yes, NS console
NS	UDP	Outbound	137	Optional WINS import of computers	No
NS - Data Connector	TCP/UDP	Outbound	1024-65536	in case data sources like ODBC or OLEDB are used outgoing connection may be required to specific services defined by driver used

 

Task Management

Component	Protocol	Direction	Port	Connections	Is configurable?
Task Server (CTADataLoader.exe)	TCP	Local to TS computer	50120	Used by CTADataloader process. Local for systems that host Task Server. Is not used by remote systems.	Yes. Altiris.ClientTask.Remoting.config
Task Server (atrshost.exe)	TCP	Local to TS computer	50121	Used by ATRSHOST process. Local for systems that host Task Server. Is not used by remote systems.	Yes. Altiris.ClientTask.Remoting.config
Task Server (atrshost.exe)	TCP	Local to NS computer	50122	Used by ATRSHOST process. Local for systems that host Task Server. Is not used by remote systems.	Yes. Altiris.ClientTask.Remoting.config
Task Server (atrshost.exe)	TCP	Inbound/Outbound	80/443	Task Server downloads tasks from NS and sends task-result xml to NS.	Yes. Either through IIS, or with Altiris HTTP; use the Altiris.Http.config file
Task Server (atrshost.exe)	TCP	Inbound/Outbound	50123	Tickle port. Opened by TS on NS during TS registration on NS after install. Used to receive real-time notifications when some new tasks are to be executed. NS sends tickle to TS when a new task is available.	Yes. Altiris.ClientTask.TickleService.config
Client Task Agent	TCP	Inbound/Outbound	80/443	Obtains the list of Task Servers and TS properties from the NS part of TS	Yes. Either through IIS, or with Altiris HTTP; use the Altiris.Http.config file
Client Task Agent	TCP	Inbound/Outbound	80/443	CTA checks for the new task and sends the task-result xml to TS	Yes. Either through IIS, or with Altiris HTTP; use the Altiris.Http.config file
Client Task Agent	TCP	Inbound/Outbound	50124	Tickle port. Opened by CTA on TS during registration. Used to receive real-time notifications when some new tasks are to be executed. TS send tickle to client if new task is available.	Yes. Altiris.ClientTask.Server.config

 Package Server

Component	Protocol	Direction	Port	Connections	Is configurable?
Package Server	TCP	Inbound	80/443	From client computers HTTP/HTTPS	Yes, depends on the port used by the website Package Server is residing on
Package Server	TCP	Inbound	445	From client computers UNC
Package Server	TCP	Outbound	445	To Notification Server UNC
Package Server	TCP	Outbound	52030	Package Multicasting	Yes, in SMP console
Package Server	UDP	Outbound	52030	Package Multicasting	Yes, in SMP console
Package Server	TCP/UDP	Inbound	135	From client computers UNC
Package Server	TCP/UDP	Inbound	139	From client computers UNC
Package Server	UDP	Inbound	137	From client computers UNC

 Agent for Windows

Component	Protocol	Direction	Port	Connections	Is configurable?
Notification Server	TCP	Inbound	80/443	From client computers	Yes, depends on the port used by the website Notification Server is residing on
Symantec Management Agent	TCP	Outbound	80/443	To Notification Server	Yes, depends on the port used by the website Notification Server is residing on
Symantec Management Agent	TCP	Inbound	445	Push install from Notification Server
Symantec Management Agent	TCP	Inbound	52028	Tickle / Power Management	Yes, in SMP console
Symantec Management Agent	UDP	Inbound	52028	Tickle / Power Management	Yes, in SMP console
Symantec Management Agent	TCP	Inbound	52029	Tickle / Power Management multicast	Yes, in SMP console
Symantec Management Agent	UDP	Inbound	52029	Tickle / Power Management multicast	Yes, in SMP console

 Agent for ULM

Component	Protocol	Direction	Port	Connections	Is configurable?
Notification Server	TCP	Inbound	80/443	From client computers	Yes, depends on the port used by the website the Notification Server is residing on
UNIX, Linux or Mac client computer	TCP	Outbound	80/443	To the Notification Server	Yes, depends on the port used by the website the Notification Server is residing on
UNIX, Linux or Mac client computer	TCP	Outbound	80/443	To Package and Task Servers	Yes, depends on the ports used by the website the Package Server Agent is integrated with
UNIX, Linux or Mac client computer	TCP	Outbound	Source ports 1024 and above	To the Notification Server, Package and Task  Servers	No, the ports randomly selected when connection is established
UNIX, Linux or Mac client computer	TCP	Inbound	22 (SSH)	Push install from the Notification Server	Yes, depends on the port used by SSHD
UNIX, Linux or Mac client computer	TCP	Inbound	52028	Tickle / Power Management messages	Yes, in the SM Console
UNIX, Linux or Mac client computer	UDP	Inbound	52028	Tickle / Power Management messages	Yes, in the SM Console
UNIX, Linux or Mac client computer	UDP	Inbound	52029	Multicast (default group is 224.0.255.135)	Yes, in the SM Console

 Activity Center

Component	Protocol	Direction	Port	Connections	Is configurable?
Activity Center UI	TCP	Inbound	80/443	HTTP/HTTPS	Yes

Asset Management Solution

 Asset Management Solution works through the Altiris Agent. There is no difference from that of the Altiris Agent for Windows ports.

Altiris CMDB Solution

Altiris CMDB Solution works through the Altiris Agent. There is no difference from that of the Altiris Agent for Windows ports.

Altiris Deployment Solution

 

For storing images on PS and communication from preOS with SMP infrastructure, DS use SMP port and protocol.

 

Component	Protocol	Direction	Port	Connections	Is configurable?
HTTP/HTTPS imaging	HTTP/HTTPS	OutBound	80/443	Creating and Deploying images	Yes
Multicasting
PXE Server	PXE over UDP	Inbound/Outbound	67/4011	Network boot using PXE, Port 67 is used when PXE Server is not on DHCP Server machine	No
TFTP Server	TFTP over UDP	Inbound	69	TFTP requests for file download.	No
TFTP Server	TFTP over UDP	Inbound/Outbound	1024-65535	TFTP file download port. TFTP Server uses the first available free port for TFTP file download.	No
BSDP Server	NFS	Inbound/Outbound	111, 1048, 2049	NFS file access is used by the BSDP client to access the Mac disk image. DS uses the windows NFS feature here.	No

 

  Power Scheme

Power Scheme solution works through the Altiris Agent. There is no difference from that of the Altiris Agent for Windows ports.

 Real-Time System Management (RTSM\RTCI)

Real-Time System Management works through the PPA. There is no difference from that of the Pluggable Protocols Architecture component ports.

 Altiris Client Management Suite Portal Page

Portal page contains web parts of other solutions - i.e. covered with specifications for other solutions, no special ports used.

Altiris Server Management Suite Portal Page

Portal page contains web parts of other solutions or with tasks from other solutions - i.e. covered with specifications for other solutions (Monitor, Discovery, PPA, Event Console, RTCI, Task Management, NS Server etc.).

Altiris Network Topology Viewer

Viewer just uses the visualization webpart containing data gathered by other solutions (Network Discovery, PPA), no special ports used.

First Time Setup Portal

Component	Protocol	Direction	Port	Connections	Is configurable?
FTSP UI	TCP	Inbound	80/443	HTTP/HTTPS	Yes

 ITMS Admin App (iPad)

Component	Protocol	Direction	Port	Connections	Is configurable?
Tablet Service	TCP/IP	Inbound/Outbound	80/443	HTTP/HTTPS for ITMS management and status	Yes

  Symantec Barcode Solution

Component	Protocol	Direction	Port	Connections	Is configurable?
Web Console	TCP	Inbound	80/443	When using the NS console the Barcode web pages use HTTP (port 80) to connect to the server and download the  admin console content	Yes
ActiveX (Sync)	TCP	Inbound	80/443	When syncing data to and from the NS, Barcode uses HTTP (port 80) or HTTPS (port 443) to connect to the server and transfer data	Yes
Handheld Device (Sync)	TCP	Inbound	80/443	When syncing data to and from the NS, Barcode uses HTTP (port 80) or HTTPS (port 443) to connect to the server and transfer data	Yes
Handheld Device (Network Diagnostic Wizard)	TCP	Inbound	80/443	When syncing data to and from the NS, Barcode uses HTTP (port 80) or HTTPS (port 443) to connect to the server and transfer data	Yes

 PPA

Component	Protocol	Direction	Port	Connections	Is configurable?
AMT Protocol Plugin	TCP/UDP	Outbound/Inbound	16992	Predefined IANA network port for Intel AMT to send and receive data (SOAP/HTTP)	No
AMT Protocol Plugin	TCP/UDP	Outbound/Inbound	16993	Predefined IANA network port for  Intel AMT to send and receive data (SOAP/HTTPS)	No
AMT Protocol Plugin	TCP/UDP	Outbound/Inbound	16994	Predefined IANA network port for Intel AMT to send and receive data (Redirection/TCP)	No
AMT Protocol Plugin	TCP/UDP	Outbound/Inbound	16995	Predefined IANA network port for Intel AMT to send and receive data (Redirection/TLS)	No
ASF Protocol Plugin	UDP	Outbound/Inbound	623	Predefined IANA network port for ASF protocol to send and receive data. (RMCP - Remote Management and Control Protocol)	No
ASF Protocol Plugin	UDP	Outbound/Inbound	664	Predefined IANA network port for ASF protocol to send and receive data. (RSP - RMCP Security Extensions Protocol)	No
EMC Protocol Plugin	TCP	Outbound	443		Yes
HTTP Protocol Plugin	TCP	Outbound/Inbound	80	Predefined IANA network port for HTTP protocol to send and receive data.	No
IPMI Protocol Plugin	TCP	Outbound/Inbound	623		Yes
SNMP Protocol Plugin	UDP	Outbound/Inbound	161	Predefined IANA network port for SNMP protocol for agents to listen to SNMP requests.	No
SNMP TrapListener Protocol Plugin	UDP	Inbound	162	Predefined IANA network port for SNMP protocol for listening to SNMP traps.	No
SNMP TrapListener Protocol	UDP	1024-65536		Four additional UDP ports is opened by net-snmp open source library used by our code.
SSH Protocol Plugin	TCP/UDP	Inbound/Outbound	22	Predefined network port for SSH protocol.	Yes
VMware Protocol Plugin	TCP	Inbound/Outbound	80/443	Default port for communication.	Yes
WMI Protocol Plugin	TCP	Inbound/Outbound	135	Default port for communication	No
WS-MAN Protocol Plugin	TCP	Inbound/Outbound	623	Predefined IANA network port for WS-MAN protocol	Yes
WS-MAN Protocol Plugin	TCP	Inbound/Outbound	664	Predefined IANA network port for WS-MAN protocol	Yes

Real-Time System Management (RTSM\RTCI)

Real-Time System Management works through the PPA. There is no difference from that of the Pluggable Protocols Architecture component ports.

Patch Management

Patch Management solution (for Windows) works through the Altiris Agent (and Client Task Agent for vulnerability assessment task). There is no difference from that of the Altiris Agent for Windows ports.

Software Management Framework

Software Management Framework works through the Altiris Agent. There is no difference from that of the Altiris Agent for Windows ports.

Altiris Inventory Solution

 Altiris Inventory Solution works through the Altiris Agent. There is no difference from that of the Altiris Agent for Windows ports.

Altiris Inventory Solution - ULM

 Altiris Inventory Solution - ULM works through the Altiris Agent. There is no difference from that of the Altiris Agent for ULM ports.

Inventory Rule Management

Inventory Rule Management works through the Altiris Agent. There is no difference from that of the Altiris Agent for Windows ports.

Altiris Inventory for Network Devices

Component	Protocol	Direction	Port	Connections	Is configurable?
SNMP Protocol Plug-in	UDP	Outbound/Inbound	161	Predefined IANA network port for SNMP protocol for agents to listen to SNMP requests. In addition to above we need to run Network discovery first (as a pre-requisite) and which uses the ports as configured through the Pluggable Protocols Architecture.	No
SNMP TrapListener Protocol Plug-in	UDP	Inbound	162	Predefined IANA network port for SNMP protocol for listening to SNMP traps.	No

 Network Discovery

Network Discovery uses the ports as configured through the Pluggable Protocols Architecture (PPA)

Altiris Patch Management Solution for Linux

Altiris Patch Management Solution for Linux works through the Altiris Agent. There is no difference from that of the Altiris Agent for ULM ports.

Altiris Patch Management Solution for MAC

Altiris Patch Management Solution for MAC works through the Altiris Agent. There is no difference from that of the Altiris Agent for ULM ports.

Altiris Software Management Solution - ULM

Altiris Software Management Solution - ULM works through the Altiris Agent. There is no difference from that of the Altiris Agent for ULM ports

 Altiris Software Management Solution - Windows

 Altiris Software Management Solution for Windows - works through the Altiris Agent. Software Portal works through the HTTP(s) port, configured for the Notification Server (80/443 by default).

 Event Console

Component	Protocol	Direction	Port	Connections	Is configurable?
Event Receiver	TCP	Inbound	8500	Alert Port	Yes, in the Global Settings Item configuration XML
Event Engine	TCP	Inbound (local to NS only)	8501	Alert Port	Yes, in the Global Settings Item configuration XML
Event Receiver	TCP	Inbound (local to NS only)	8502	Receiver Refresh Port	Yes, in the Global Settings Item configuration XML
Event Engine	TCP	Inbound (local to NS only)	8503	Engine Refresh Port	Yes, in the Global Settings Item configuration XML
Event Engine	UDP	Local to NS only	64522		No
Event Engine	UDP	Local to NS only	64523		No
Event Engine	UDP	Local to NS only	64527		No
Event Engine	UDP	Local to NS only	64528		No
Event Receiver	UDP	Inbound	162	SNMP trap	No
Event Receiver	UDP	Local to NS only	64524		No
Event Receiver	UDP	Local to NS only	64525		No
Event Receiver	UDP	Local to NS only	64526		No
Event Receiver	UDP	Local to NS only	64529		No

Monitor Solution (Monitor Solution for Servers)

Monitor solution also uses the ports as configured through the Pluggable Protocols Architecture (PPA)

Component	Protocol	Direction	Port	Connections	Is configurable?
Metric Provider	TCP	Inbound/Outbound	1011	Real Time Performance Viewer, Metric Provider	Yes (UI in console)
Metric Provider	UDP	Inbound/Outbound	random XXXXX	PPA opened dynamic ports for SNMP metrics, agentless monitoring	No
Metric Provider	TCP	Inbound/Outbound	random	PPA opened dynamic ports for agentless monitoring connections	No

Symantec Workflow

Component	Protocol	Direction	Port	Connections	Is configurable?
Workflow Server	TCP/IP	Inbound/Outbound	80/443	HTTP/HTTPS for ProcessManager Portal, etc	Yes
Server Extensions	TCP/IP	Inbound/Outbound	11434	Publishing from Workflow Designer	Yes, but not recommended
Enterprise Management/Deployment	TCP/IP	Inbound/Outbound	11436	Deployment and registration from Workflow Enterprise Manager	No
Workflow Components	Various	Inbound/Outbound	Various	Workflow Designer is a development tool that allows use of components to integrate with myriad systems and protocols. Ports will vary based on customer's designs and requirements.	Yes

Out of Band Management Solution

Component	Protocol	Direction	Port	Connections	Is configurable?
OOB Site Server	TCP	Inbound	9971	Hello messages from AMT clients.	Yes (OOB General configuration page).
OOB Site Server	TCP	Outbound	16994	Remote configuration of AMT clients.	No
OOB Site Server	TCP	Inbound/Outbound	80/443	Communication between NS and Intel SCS service	Yes, depends on the port used by the website Intel SCS service is residing on.

Symantec pcAnyware

Component	Protocol	Direction	Port	Connections	Is configurable?
Data	TCP	Inbound	5631	pcAnywhere host is configured to listen on for all TCP communication from the remote to the host; also SSL packets are sent to the same TCP port	Yes
Status	UDP	Outbound	5632	UDP broadcast to search for listening hosts and for communication of status information	Yes

Symantec Wise Connector

Component	Protocol	Direction	Port	Connections	Is configurable?
Wise Connector	SMB	Outbound	TCP/UDP 135-139, 445	Connection to UNC share on machine with Wise Package Studio installed where installation packages are located.	No

 Altiris Virtual Machine Management

Component	Protocol	Direction	Port	Connections	Is configurable?
VMware Protocol Plugin	TCP	Inbound/Outbound	443	Default port for communication.	Yes.
MSHyperV Protocol Plugin	TCP	Inbound/Outbound	135	Default port for communication.	No.

 Symantec Endpoint Protection Integration Component

 Symantec Endpoint Protection Integration Component (SEPIC) relies to the ports configured for Notification Server.