vRealize Automation Ports

In this post I’ll describe the required firewall ports for vRealize Automation Appliance Ports .

As a security best practice, configure incoming and outgoing ports for the vRealize Automation appliance according to VMware recommendations.

Incoming Ports

Port	Protocol	Comments
22	TCP	Optional. Access for SSH sessions.
80	TCP	Optional. Redirects to 443.
88	TCP (UDP optional)	Cloud KDC Kerberos authentication from external mobile devices.
443	TCP	Access to the vRealize Automation console and API calls.
		Access for machines to download the guest agent and software bootstrap agent.
		Access for load balancer, browser.
4369, 5671, 5672, 25672	TCP	RabbitMQ messaging.
5480	TCP	Access to the virtual appliance management interface.
		Used by the Management Agent.
5488, 5489	TCP	Internally used by the vRealize Automation appliance for updates.
8230, 8280, 8281, 8283	TCP	Internal vRealize Orchestrator instance.
8443	TCP	Access for browser. Identity Manager administrator port over HTTPS.
8444	TCP	Console proxy communication for vSphere VMware Remote Console connections.
8494	TCP	Container service cluster sync
9300–9400	TCP	Access for Identity Manager audits.
54328	UDP
40002, 40003	TCP	vIDM cluster sync

 

Outgoing Ports

Port	Protocol	Comments
25, 587	TCP, UDP	SMTP for sending outbound notification email.
53	TCP, UDP	DNS server.
67, 68, 546, 547	TCP, UDP	DHCP.
80	TCP	Optional. For fetching software updates. Updates can be downloaded separately and applied.
88, 464, 135	TCP, UDP	Domain controller.
110, 995	TCP, UDP	POP for receiving inbound notification email.
143, 993	TCP, UDP	IMAP for receiving inbound notification email.
123	TCP, UDP	Optional. For connecting directly to NTP instead of using host time.
389	TCP	Access to View Connection Server.
389, 636, 3268, 3269	TCP	Active Directory. Default ports shown, but are configurable.
443	TCP	Communication with IaaS Manager Service and infrastructure endpoint hosts over HTTPS.
		Communication with the vRealize Automation software service over HTTPS.
		Access to the Identity Manager upgrade server.
		Access to View Connection Server.
445	TCP	Access to ThinApp repository for Identity Manager.
902	TCP	ESXi network file copy operations and VMware Remote Console connections.
5050	TCP	Optional. For communicating with vRealize Business for Cloud.
5432	TCP, UDP	Optional. For communicating with another appliance PostgreSQL database.
5500	TCP	RSA SecurID system. Default port shown, but is configurable.
8281	TCP	Optional. For communicating with an external vRealize Orchestrator instance.
8494	TCP	Container service cluster sync
9300–9400	TCP	Access for Identity Manager audits.
54328	UDP
40002, 40003	TCP	vIDM cluster sync