Port numbers, URLs, and IP addresses
You can watch Deep Security 12 - Scoping Environment Pt2 - Network Communication on YouTube to review the network communication related to the different Deep Security components.
Deep Security default port numbers, URLs, IP addresses, and protocols are listed in the sections below. If a port, URL or IP address is configurable, a link is provided to the relevant configuration page.
If your network uses a proxy or load balancer, you can configure Deep Security to use it instead of the default ports and URLs listed on this page. For details, see Proxy settings and Load Balancers.
In addition to the ports on this page, Deep Security uses ephemeral ports when opening a socket (source port). Under rare circumstances these may be blocked, causing connectivity issues. For details, see Blocked port.
Deep Security port numbers
The following diagram shows the default ports in a Deep Security system. For details, see the table below the diagram.
| Port type | Default port number |
|---|---|
| Manager listen ports |
|
| Manager destination ports |
* Notes:
|
| Deep Security Agent listen port |
4118 can be closed if you are using agent-initiated communication. By default, bidirectional communication is used, so 4118 must be opened. See Agent-manager communication for details. |
| Deep Security Agent destination ports |
When using the AWS AMI and Azure VM versions of the manager, open port 443 instead of port 4119. * Notes:
|
| Deep Security Relay listen ports |
Port 4123 should not be listening to connections from other computers, and you don't need to configure it in network firewall policies. But if you have firewall software (such as Windows Firewall or iptables) on the manager's server itself, verify that it does not block this connection to itself. Also verify that other applications do not use the same port (a port conflict). |
| Deep Security Relay destination ports |
When using the AWS AMI and Azure VM versions of the manager, open port 443 instead of port 4119. |
Deep Security URLs
If you need to restrict the URLs that are allowed in your environment, read this section.
You'll need to make sure your firewall allows traffic to the following: Trend Micro, Deep Security, AWS, and Azure server URLs on port 443 (HTTPS).
| Source | Destination server or service name | Destination URL |
|---|---|---|
| API clients | Deep Security APIs |
|
| Legacy REST API clients | Deep Security legacy REST API's Status Monitoring API |
|
| The manager, agent, and relay |
Download Center or web server Hosts software. |
|
| The manager |
Smart Protection Network - Used for event tagging with Integrity Monitoring. |
|
| The agent |
Smart Protection Network - Used for behavior monitoring, and predictive machine learning. |
12.0 and later agents connect to:
11.0 and later agents connect to:
10.2 and 10.3 agents connects to:
10.1 and 10.0 agents connect to:
|
| The agent |
Smart Protection Network - Used for behavior monitoring, predictive machine learning, and process memory scans. |
12.0 and later agents connect to:
11.0 and later agents connect to:
10.2 and 10.3 agents connect to:
10.1 and 10.0 agents connect to:
|
|
The agent |
Smart Protection Network - Smart Feedback |
12.0 and later agents connect to:
11.0 and later agents connect to:
10.0 agents connect to:
|
| The agent | Smart Protection Network - Smart Scan Service |
12.0 and later agents connect to:
11.0 and later agents connect to:
10.2 and 10.3 agents connect to:
10.1 and 10.0 agents connect to:
9.6 and 9.5 agents connect to:
|
| The agent |
Smart Protection Network - |
12.0 and later agents connect to:
11.0 and later agents connect to:
10.2 and 10.3 agents connect to:
|
| The agent | Smart Protection Network - Web Reputation Service |
12.0 and later agents connect to:
11.0 and later agents connect to:
10.2 and 10.3 agents connect to:
10.1 and 10.0 agents connect to:
9.6 and 9.5 agents connect to:
|
| The manager | Help and support |
|
| The manager | Licensing and registration servers |
|
| The manager | News feed |
|
| Browser on agent computers and the computer used to log in to the manager | Site Safety |
Optional. There are links to the URLs below within the manager UI and on the agent's 'Your administrator has blocked access to this page for your safety' page.
|
| The relay, and agent |
Update Server (also called Active Update) Hosts security updates. |
|
| The manager |
AWS and Azure URLs Used for
|
AWS URLs
Azure URLs
The management.core.windows.net URL is only required if you used the v1 Azure connector available in Deep Security Manager 9.6 to add an Azure account to the manager. With Deep Security Manager 10.0 and later, a v2 connector is used, and does not require access to this URL. |
| The manager |
Telemetry service Used for anonymous Deep Security Product Usage Data Collection. |
|