Exchange Agent Firewall Port Requirements - CAM TCP Configuration

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal

Issue/Introduction

The Exchange Remote Agent utilizes the CA Message (CAM) and CA File Transfer (CAFT) services for communication.

When a firewall exists between the Provisioning Server and the Exchange Server, specific port configurations are required to ensure reliable delivery. By default, CAM utilizes UDP, which is often blocked or unreliable across enterprise firewalls.

Environment

Identity Manager 14.x

Cause

CAM defaults to UDP for message transfer. If one node is configured for TCP while the destination node is still using UDP, or if the path is not "fixed," CAM may silently revert to UDP, causing firewall drops and connection failures.

• Exchange remote agent fails to communicate with the Provisioning Server.
• Logs report protocol mismatch errors.
• Policy Server logs show LDAP error 91-Can't connect to the LDAP server.
• Intermittent connectivity where services appear to start but fail under load.

Resolution

To ensure stable communication through a firewall, CAM must be forced to use TCP on port 4105 with fixed paths on both the Provisioning Server and the Exchange Server.

Procedure: Configure Fixed TCP Paths

On Machine 1 (Provisioning Server):

1. Open a command prompt with administrative privileges.
2. Set the protocol to TCP for the destination: camconfig paths "Machine2_Hostname protocol=tcp"
3. Lock the configuration to prevent reversion to UDP: camconfig config "fixed_paths=yes"

On Machine 2 (Exchange Server):

1. Open a command prompt with administrative privileges.
2. Set the protocol to TCP for the destination: camconfig paths "Machine1_Hostname protocol=tcp"
3. Lock the configuration: camconfig config "fixed_paths=yes"

Firewall Requirements

• Port 4105 (TCP) must be open.
• Traffic must be allowed in the direction of the connection initiation.
  • Example: If Machine 1 initiates the connection to Machine 2, the firewall must allow port 4105 Outbound from Machine 1 and Inbound to Machine 2.