Deep Security 11.2 has reached end of support. Use the version selector (above) to see more recent versions of the Help Center.
Port numbers
If connecting Deep Security Manager, Deep Security Relay, or Deep Security Agents through a:
- firewall or AWS/Azure/NSX Security Group
- router
- proxy
- other network address translation (NAT) device
you'll need to know the required domain names or IP addresses, ports, and protocols.
In addition to the ports on this page, Deep Security uses ephemeral ports when opening a socket (source port). If a firewall rule is restricting the source port of the TCP packet, connectivity issues will occur. This problem is not common when working with firewall rules or cloud security groups, however, it can occur if you place network restrictions on ephemeral ports. For details, see Activation Failed - Blocked port
Firewall policies, proxies, and port forwarding often require this information. This is especially true for connections to services on the Internet, such as DNS, time servers, the Trend Micro Active Update servers, Trend Micro Smart Protection Network, and Deep Security as a Service. If a computer has other installed software that listens on the same ports, you must resolve the port conflict.
Default port numbers are in these tables. If the default port numbers don't work with your network or installation, you have a proxy, or if you require SSL or TLS secured versions of the traffic, the tables indicate if you can configure it.
Deep Security Manager ports
Incoming (listening ports)
| Transport Protocol | Destination Port Number | Service | Source | Purpose | Configurable? | Proxy configurable? |
|---|---|---|---|---|---|---|
| TCP | 443 | HTTPS | Trend Micro Control Manager, SOAP API client, or other REST API client |
|
No | No |
| TCP | 443 | HTTPS | Web browser |
Administrative connections to the Deep Security GUI or API. |
No | No |
| TCP | 443 | HTTPS | Agent/appliance |
Agent/appliance installer downloads. |
No | No |
| TCP | 4120 | HTTPS | Agent/appliance |
|
Yes | Yes |
| TCP | 8080 | HTTP | Web installer |
Software installation via the web installer. Once the manager installation is complete, or if you use the Quick Start instead, you can block this port. |
No | No |
Outgoing
| Transport Protocol | Destination Port Number | Service | Destination | Purpose | Configurable? | Proxy configurable? |
|---|---|---|---|---|---|---|
| TCP | 25 | SMTP | E-mail server |
Alerts for events. AWS throttles (rate limits) e-mail on SMTP's IANA standard port number, port 25. If you use AWS Marketplace, you may have faster alerts if you use SMTP over STARTTLS (secure SMTP) instead. For more information, see:
https://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-connect.html https://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-issues.html |
Yes | No |
| UDP | 53 | DNS | DNS server | Domain name resolution of Trend Micro services, e-mail server, NTP server, and others. |
Yes (configure in the operating system) |
Yes (configure in the operating system) |
| TCP | 80 | HTTP |
Trend Micro Smart Feedback
|
Smart Protection feedback. | No | No |
| TCP | 80 | HTTP |
Whois server (could be http://reports.internic.net/cgi/whois?whois_nic=[IP]&type=nameserver) |
Reverse name resolution of IP addresses into hostnames for event logs and computer discovery. | Yes | No |
| TCP | 443 | HTTPS |
Trend Micro licensing and registration server licenseupdate.trendmicro.com |
Licensing and product registration. | No | Yes |
| TCP | 443 | HTTPS | news.deepsecurity.trendmicro.com | Deep Security news feed | No | Yes |
| TCP | 80 or 443 | HTTP or HTTPS |
|
Security package updates. Alternatively, use a relay. |
Yes | |
| TCP | 80 or 443 | HTTP or HTTPS |
Trend Micro Download Center or web server files.trendmicro.com |
Agent/appliance installer downloads. |
Yes (append port number to URL) |
No |
| TCP | 80 or 443 | HTTP or HTTPS |
Trend Micro Certified Safe Software Service (CSSS)
|
Automatic event tagging for Integrity Monitoring. | No | Yes |
| UDP | 123 | NTP |
NTP server (can be Trend Micro Control Manager server) |
Accurate time for SSL or TLS connections, schedules, and event logs. |
Yes (configure in the operating system) |
No |
| UDP |
162 |
SNMP | SNMP manager | Traps for events. | Yes | No |
| TCP | 389 | LDAP | Microsoft Active Directory server |
Discovery of and (optionally) synchronization of computer groups in the directory. LDAPS can also be used. See below for details. |
Yes | No |
| TCP | 389 | HTTPS | AWS Marketplace, Microsoft Azure Marketplace, and other clouds |
Communication with cloud accounts to retrieve a list of computers. |
No | Yes |
| TCP | 443 | HTTPS | NSX Manager | Communication to VMware NSX Manager. | Yes | No |
| TCP | 443 | HTTPS | vCenter server | Communication to VMware vCenter server. |
Yes |
No |
| TCP | 443 | HTTPS | ESXi server | Communication to VMware ESXi server. |
No |
|
| UDP | 514 | Syslog | SIEM or log server | External logging and reporting. | Yes | No |
| TCP | 636 | LDAPS | Microsoft Active Directory server |
LDAP can also be used. See above for details. |
Yes | No |
| TCP | 1433 | SQL | Microsoft SQL database |
The manager application to its storage. Although it is not visible from the GUI, you can configure an encrypted database connection. |
Yes | No
|
| TCP | 1521 | SQL | Oracle database |
The manager application to its storage. Although it is not visible from the GUI, you can configure an encrypted database connection. |
Yes | No |
| TCP | 5432 | SQL | PostgreSQL database | The manager application to its storage.
Although it is not visible from the GUI, you can configure an encrypted database connection. |
Yes | No |
| TCP | 11000-11999,
14000-14999 |
SQL | Azure SQL Database |
If the manager runs inside the Azure cloud boundary, it uses a direct route to interact with the Azure SQL Database server. For more information, see https://docs.microsoft.com/en-us/azure/sql-database/sql-database-develop-direct-route-ports-adonet-v12. This is only required when using Azure SQL Database with the manager deployed on Azure, for example, the Deep Security Manager VM for Azure Marketplace. |
No | No |
| TCP | 4118 | HTTPS | Agent/appliance |
Manager to agent/appliance
heartbeat. Send events and get configuration updates from the manager.
Depending on your deployment type, you may be able to close port 4118, and only use agent-initiated heartbeats. |
No | |
| TCP | 4122 | HTTPS | Relay |
Security package updates such as Anti-Malware engine and signatures via the relay. Alternatively, the manager can connect directly to the Trend Micro Active Update servers. See also Agent-manager communication. |
Yes | Yes |
|
TCP UDP |
All | All | Agent/appliance | Port scan to detect open (listening) ports on computers. | Yes | No |
Deep Security Relay ports
Relays require all of the ports for an agent and these port numbers.
Incoming (listening)
| Transport Protocol | Destination Port Number | Service | Source | Purpose | Configurable? | Proxy configurable? |
|---|---|---|---|---|---|---|
| TCP | 4122 | HTTPS | Manager, agent, appliance, or relay |
|
Yes | Yes*
See Note. |
| TCP | 4123 | Localhost relay |
Communication of agent to its own integrated relay. This port should not be listening to connections from other computers, and you don't need to configure it in network firewall policies. But if you have firewall software (such as Windows Firewall or iptables) on the manager's server itself, verify that it does not block this connection to itself. Also verify that other applications do not use the same port (a port conflict). |
No | No |
Outgoing
| Transport Protocol | Destination Port Number | Service | Destination | Purpose | Configurable? | Proxy configurable? |
|---|---|---|---|---|---|---|
| TCP | 80 or 443 | HTTP or HTTPS |
Trend Micro Active Update
|
Security package updates such as Anti-Malware engine and signatures. Alternatively, use another relay. |
Yes | |
| TCP | 4122 | HTTPS | Relay |
Relay-to-relay communication for synchronizing agent software installers and security components such as Anti-Malware engine and signatures.
|
Yes | Yes*
See Note. |
Deep Security Agent ports
Incoming (listening ports)
| Transport Protocol | Destination Port Number | Service | Source | Purpose | Configurable? | Proxy configurable? |
|---|---|---|---|---|---|---|
| TCP | 22 | SSH | Manager, deployment tools such as RightScale, Chef, Puppet, Ansible and SSH |
Remote installation of the agent (Linux only). |
No | No |
| TCP | 4118 | HTTPS | Manager |
Manager to agent/appliance
heartbeat. Send events and get configuration updates from the manager.
|
No | |
| TCP | 3389 | RDP | Manager |
Remote installation of the agent (Windows only). |
No | No |
| TCP | 5985 | WinRM HTTP | deployment tools such as RightScale, Chef, Puppet, and Ansible | Remote installation of the agent (Windows only). |
Yes (configure in the operating system) |
Yes (configure in the operating system) |
Outgoing
| Transport Protocol | Destination Port Number | Service | Destination | Purpose | Configurable? | Proxy configurable? |
|---|---|---|---|---|---|---|
| UDP | 53 | DNS | DNS server | Domain name resolution of the manager, Trend Micro Smart Protection Servers, and others. |
Yes (configure in the operating system) |
Yes (configure in the operating system) |
| TCP | 80 | HTTP |
Good File Reputation Service 11.0 and higher
10.2 and 10.3
10.1 and 10.0
|
Communicates with the Good File Reputation Service during file scans started by Behavior Monitoring. |
No | |
| TCP | 80 | HTTP |
File Census 11.0 and higher
10.2 and 10.3
10.1 and 10.0
|
Communicates with the Global Census Server during file scans started by Behavior Monitoring. | No | |
| TCP | 80 or 443 | HTTP or HTTPS |
Trend Micro Download Center or web server files.trendmicro.com |
Agent/appliance installer downloads. |
Yes (append port number to URL) |
No |
| TCP | 80 or 443 | HTTP or HTTPS |
Trend Micro Active Update
|
Security package updates such as Anti-Malware engine and signatures. Alternatively, use a relay. |
Yes | |
| TCP | 80 or 443 | HTTP or HTTPS | Web server | Connectivity test to determine context (whether the computer is on the private network or not) for policies | Yes | No |
| TCP | 80 or 443 | HTTP or HTTPS |
Predictive machine learning 11.0 and higher
10.2 and 10.3
|
Communicates with the Global Machine Learning Server during real-time file scans | No | |
| TCP | 80 or 443 | HTTP or HTTPS |
Trend Micro Smart Protection Network 11.0 and higher
10.2 and 10.3
10.1 and 10.0
|
File reputation service and Smart Protection feedback. Alternatively, you can connect to a Smart Protection Server on your local network |
Yes | Yes |
| TCP | 80 or 443 | HTTP or HTTPS | Smart Protection Server |
You can connect to a Smart Protection Server on your local network |
Yes | Yes |
| UDP | 123 | NTP |
NTP server (can be Trend Micro Control Manager server) |
Accurate time for SSL or TLS connections, schedules, and event logs. |
Yes (configure in the operating system) |
No |
| TCP | 443 | HTTPS | Manager |
|
Yes |
Yes* See Note. |
| UDP | 514 | Syslog | SIEM or log server |
External logging and reporting. This is only used if you want the agents to send directly to an external SIEM, instead of uploading event logs to the manager. |
Yes | No |
| TCP | 5274 | HTTPS |
Trend Micro Smart Protection Network 11.0 and higher
10.2 and 10.3
10.1 and 10.0
|
Web Reputation service. Alternatively, you can connect to a Smart Protection Server on your local network |
Yes | Yes |
| TCP | 5274 | HTTPS | Smart Protection Server |
Web Reputation service. You can connect to a Smart Protection Server on your local network |
Yes | No |
Note: In Deep Security Agent 10.0 GM and earlier, agents didn't have support for connections through a proxy to relays. You must either:
- update agents' software (see Get Deep Security Agent software), then configure the proxy (see Connect agents behind a proxy.)
- bypass the proxy
- change the application control rulesets relay setting as a workaround
