Port numbers

If connecting Deep Security Manager, Relay, or Agents through a:

  • firewall or AWS Security Group
  • router
  • proxy
  • other network address translation (NAT) device

you'll need to know the required domain names or IP addresses, ports, and protocols.

Firewall policies, proxies, and port forwarding often require this information. This is especially true for connections to services on the Internet, such as DNS, time servers, the Trend Micro Active Update servers, Trend Micro Smart Protection Network, and Deep Security as a Service. If a computer has other installed software that listens on the same ports, you must resolve the port conflict.

Default port numbers are in these tables. If the default port numbers don't work with your network or installation, you have a proxy, or if you require SSL or TLS secured versions of the traffic, the tables indicate if you can configure it.

Deep Security Manager ports

Incoming (listening ports)

Transport Protocol Destination Port Number Service Source Purpose Configurable? Proxy configurable?
TCP
443 HTTPS
Trend Micro Control Manager, SOAP API client, or other REST API client
  • WSDL access at:
    https://<manager FQDN or IP>:443/webservice/Manager?WSDL
  • Status monitoring at:
    https://<manager FQDN or IP>:443/rest/status/manager/ping
  • Control Manager uploads sandboxing results from Deep Discovery Analyzer with connected threat defense.
No No
Web browser

Administrative connections to the Deep Security GUI or API.

No No
Agent/Appliance

Deep Security Agent/Appliance installer downloads.

No No
4119 HTTPS
Web browser

Administrative connections to the Deep Security GUI or API.

Yes No
Trend Micro Control Manager, SOAP API client, or other REST API client
  • WSDL access at:
    https://<manager FQDN or IP>:4119/webservice/Manager?WSDL
  • Status monitoring at:
    https://<manager FQDN or IP>:4119/rest/status/manager/ping
  • Control Manager uploads sandboxing results from Deep Discovery Analyzer with connected threat defense.
Yes No
Agent/Appliance Deep Security Agent/Appliance installer downloads.

Yes

No
4120 HTTPS Agent/Appliance
  • Discovery and Agent/Appliance activation.
  • Agent/Appliance to Manager heartbeat. Receives events and provides configuration updates to them. See also Agent-Manager communication .
Yes Yes
8080 HTTP Web installer

Software installation via the web installer. Once Deep Security Manager installation is complete, or if you use the Quick Start instead, you can block this port.

No No
8443 HTTPS Web installer

Software installation via the web installer. Once Deep Security Manager installation is complete, or if you use the Quick Start instead, you can block this port.

   

Outgoing

Transport Protocol Destination Port Number Service Destination Purpose Configurable? Proxy configurable?
TCP 25 SMTP E-mail server

Alerts for events.

AWS throttles (rate limits) e-mail on SMTP's IANA standard port number, port 25. If you use AWS Marketplace, you may have faster alerts if you use SMTP over STARTTLS (secure SMTP) instead. For more information, see:
http://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-connect.html
http://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-issues.html
Yes No
UDP 53 DNS DNS server Domain name resolution of Trend Micro services, e-mail server, NTP server, and others.

Yes

(configure in the operating system)

Yes

(configure in the operating system)

  TCP 80 HTTP

Trend Micro Smart Feedback

www.smartprotectionnetwork.com (in English)

cn.trendmicro.com (in Chinese)

www.trendmicro.co.jp (in Japanese)

Smart Protection feedback. No No
Control Manager

 

Get suspicious objects list for connected threat defense.

Source port is 4119.

Yes Yes

Whois server

(could be http://reports.internic.net/cgi/whois?whois_nic=[IP]&type=nameserver)

Reverse name resolution of IP addresses into hostnames for event logs and computer discovery. Yes No
80 or 443 HTTP or HTTPS

Trend Micro licensing and registration server

licenseupdate.trendmicro.com

Licensing and product registration. No Yes
 

HTTP or HTTPS

Trend Micro Active Update

iaus.trendmicro.com/iau_server.dll

Security package updates.

Alternatively, use a relay.

Yes

Yes

SOCKS support

  HTTP or HTTPS

Trend Micro Download Center or web server

files.trendmicro.com

Deep Security Agent/Appliance installer downloads.

Yes

(append port number to URL)

No
  HTTP or HTTPS

Trend Micro Certified Safe Software Service (CSSS)

grid.trendmicro.com (HTTP)

gacl.trendmicro.com (HTTPS)

Automatic event tagging for integrity monitoring No Yes
UDP 123 NTP

NTP server

(can be Trend Micro Control Manager server)

Accurate time for SSL or TLS connections, schedules, and event logs.

Yes

(configure in the operating system)

No

162

SNMP SNMP manager Traps for events. Yes No
TCP 389 LDAP Microsoft Active Directory server
  • Discovery of and (optionally) synchronization of computer groups in the directory.
Yes No
  HTTPS AWS Marketplace, Microsoft Azure Marketplace, and other clouds

Communication with cloud accounts to retrieve a list of computers.

No Yes
UDP 514 Syslog SIEM or log server External logging and reporting. Yes No
TCP 636 LDAPS Microsoft Active Directory server
  • Discovery and (optionally) synchronization of computer groups in the directory.
  • Import and (optionally) synchronization of user groups, including contacts and passwords.
Yes No
1433 SQL Microsoft SQL database

Deep Security Manager application to its storage.

Although it is not visible from the GUI, you can configure an encrypted database connection.

Yes No
1521 SQL Oracle database

Deep Security Manager application to its storage.

Although it is not visible from the GUI, you can configure an encrypted database connection.

Yes No
4118 HTTPS Agent/Appliance

Manager to Agent/Appliance heartbeat. Send events and get configuration updates from the Manager. See also Agent-Manager communication .

Depending on your deployment type, you may be able to close port 4118, and only use agent-initiated heartbeats.

Yes

No
4122 HTTPS Relay

Security package updates such as anti-malware engine and signatures via a Deep Security Relay. Alternatively, the Deep Security Manager can connect directly to the Trend Micro Active Update servers.

See also Agent-Manager communication .

Yes Yes

TCP

UDP

All All Agent/Appliance Port scan to detect open (listening) ports on computers. Yes No

Deep Security Relay ports

Relays require all of the ports for an agent and these port numbers.

Incoming (listening)

Transport Protocol Destination Port Number Service Source Purpose Configurable? Proxy configurable?
TCP 4122 HTTPS Manager, Agent, Appliance, or Relay
  • Relay-to-Relay communication and Agent-to-Relay communication for synchronizing Deep Security Agent software installers and security package updates such as anti-malware engine and signatures.
  • Manager, agent, or appliance downloading security package updates such as anti-malware engine and signatures from Relay.

See also Agent-Manager communication .

Yes Yes*
In Deep Security Agent 10.0 GA and earlier, agents didn't have support for connections through a proxy to relays.You must either:
4123   Localhost Relay

Communication of Agent to its own integrated Relay.

This port should not be listening to connections from other computers, and you don't need to configure it in network firewall policies. But if you have a host firewall on the Deep Security Manager server itself, verify that it does not block this connection to itself. Also verify that other applications do not use the same port (a port conflict).

No No

Outgoing

Transport Protocol Destination Port Number Service Destination Purpose Configurable? Proxy configurable?
  TCP 80 or 443 HTTP or HTTPS

Trend MicroActive Update

iaus.trendmicro.com/iau_server.dll

Security package updates such as anti-malware engine and signatures.

Alternatively, use another relay.

Yes

Yes

SOCKS support

4122 HTTPS Relay

Relay-to-Relay communication for synchronizing Deep Security Agent software installers and security components such as anti-malware engine and signatures.

See also Agent-Manager communication .

Yes Yes*
In Deep Security Agent 10.0 GA and earlier, agents didn't have support for connections through a proxy to relays.You must either:

Deep Security Agent ports

Incoming (listening ports)

Transport Protocol Destination Port Number Service Source Purpose Configurable? Proxy configurable?
TCP
22 SSH Manager

Remote installation of the agent (Linux only).

No No
4118 HTTPS Manager

Manager to agent or appliance heartbeat. Send events and get configuration updates from the Manager. See also Agent-Manager communication .

Yes

No
3389 RDP Manager

Remote installation of the agent (Windows only).

No No

Outgoing

Transport Protocol Destination Port Number Service Destination Purpose Configurable? Proxy configurable?
UDP 53 DNS DNS server Domain name resolution of the Deep Security Manager, Trend Micro Smart Protection servers, and others.

Yes

(configure in the operating system)

Yes

(configure in the operating system)

  TCP 80 HTTP

Trend MicroSmart Protection Network

  • ds100-en.url.trendmicro.com (in English)
  • ds100-sc.url.trendmicro.com (in Chinese)
  • ds100-jp.url.trendmicro.com (in Japanese)

Web reputation service.

Alternatively, connect to a Smart Protection server on your local network, or a Smart Protection server on AWS.

Yes Yes

Good File Reputation Service

deepsec10-en.grid-gfr.trendmicro.com

deepsec10-jp.grid-gfr.trendmicro.com

deepsec10-cn.grid-gfr.trendmicro.com

Communicates with the Good File Reputation Service during file scans started by Behavior Monitoring. No

Yes

SOCKS support

File Census

ds1000-en.census.trendmicro.com

ds1000-jp.census.trendmicro.com

ds1000-sc.census.trendmicro.com

ds1000-tc.census.trendmicro.com

Communicates with the Global Census Server during file scans started by Behavior Monitoring. No

Yes

SOCKS support

  80 or 443 HTTP or HTTPS

Trend Micro Download Center or web server

files.trendmicro.com

Deep Security Agent/Appliance installer downloads.

Yes

(append port number to URL)

No

Trend Micro Active Update

iaus.trendmicro.com/iau_server.dll

Security package updates such as anti-malware engine and ignatures.

Alternatively, use a relay.

Yes

Yes

SOCKS support

Web server Connectivity test to determine context (whether the computer is on the private network or not) for policies Yes No
UDP 123 NTP

NTP server

(can be Trend Micro Control Manager server)

Accurate time for SSL or TLS connections, schedules, and event logs.

Yes

(configure in the operating system)

No
TCP
HTTPS
443
Manager
  • Discovery and Agent/Appliance activation.
  • Agent or appliance to manager Manager heartbeat. Receives events and provides configuration updates to them. See also Agent-Manager communication .
  • Agent-to-relay communication for Deep Security Agent software installers and security package updates such as anti-malware engine and signatures.
Yes

Yes*

In Deep Security Agent 10.0 GA and earlier, agents didn't have support for connections through a proxy to relays.You must either:
Deep Discovery Analyzer File submission for sandboxing with connected threat defense. Yes Yes
 

Trend Micro Smart Protection Network

  • https://ds10.icrc.trendmicro.com/tmcss/? (in English)
  • https://ds10-sc.icrc.trendmicro.com.cn (in Chinese)
  • https://ds10-jp.icrc.trendmicro.com/tmcss/? (in Japanese)

File reputation service and Smart Protection feedback.

Alternatively, connect to a Smart Protection server on your local network, or a Smart Protection server on AWS.

Yes Yes
Smart Protection server

File reputation service.

You can connect to a Smart Protection server on your local network, or a Smart Protection server on AWS.

Yes Yes
UDP 514 Syslog SIEM or log server

External logging and reporting.

This is only used if you want the agents to send directly to an external SIEM, instead of uploading event logs to the Deep Security Manager.

Yes No
TCP
4119 HTTPS Manager

Deep Security Agent installer downloads.

Yes

No
4120 HTTPS Manager
  • Discovery and Agent/Appliance activation.
  • Agent or Appliance to Manager heartbeat. Receives events and provides configuration updates to them. See also Agent-Manager communication .
Yes

Yes*

In Deep Security Agent 10.0 GA and earlier, agents didn't have support for connections through a proxy to relays.You must either:
4122 HTTPS Relay

Agent-to-relay communication for Deep Security Agent software installers and security package updates such as anti-malware engine and signatures.

See also Agent-Manager communication .

Yes Yes*
In Deep Security Agent 10.0 GA and earlier, agents didn't have support for connections through a proxy to relays.You must either:
5274   Smart Protection server

Web reputation service.

You can connect to a Smart Protection server on your local network, or a Smart Protection server on AWS.

Yes No

Deep Security Agent ports (with Deep Security as a Service)

If you use an external SIEM or syslog server to indirectly receive agents' logs via Deep Security as a Service, your SIEM or syslog server must be able to receive UDP 514 from 54.221.196.0/24.

Incoming (listening ports)

Transport Protocol Destination Port Number Service Source Purpose Configurable? Proxy configurable?
TCP 22 SSH deployment tools such as RightScale, Chef, Puppet, and SSH

Remote installation of the agent (Linux only)

Yes

(configure in the operating system)

Yes

(configure in the operating system)

4118 HTTPS Deep Security as a Service

54.221.196.0/24

Manager to Agent/Applianceheartbeat. Send events and get configuration updates from the Manager. See also Agent-Manager communication .

Not required unless you use bi-directional heartbeats. See Agent-Manager communication .

No

Contact your support provider if this port assignment is problematic.

Yes*
3389 RDP deployment tools

Remote installation of the agent (Windows only)

Yes

(configure in the operating system)

Yes

(configure in the operating system)

Outgoing

Transport Protocol Destination Port Number Service Destination Purpose Configurable? Proxy configurable?
UDP 53 DNS DNS server Domain name resolution of Deep Security as a Service, NTP servers, and others.

Yes

(configure in the operating system)

Yes

(configure in the operating system)

123 NTP

NTP server

Accurate time for SSL or TLS connections, schedules, and event logs.

Yes

(configure in the operating system)

No

TCP 80 or 443 HTTP or HTTPS Web server Connectivity test to determine context (whether the computer is on the private network or not) for policies Yes No
Trend MicroDownload Center or web server

Deep Security Agent installer downloads.

Yes

(append port number to URL)

No
443 HTTPS Deep Security as a Service

For IP addresses associated with each feature, see Deep Security as a Service IP addresses.

  • Administrative connections to the Deep Security as a Service GUI.
  • Discovery and Agent/Appliance activation.
  • Agent/Appliance communications with its manager (Deep Security as a Service), including the discovery, heartbeat, and configuration updates.
  • Deep Security Agent software installer downloads.
  • Security package updates such as anti-malware engine and signatures. Alternatively, use a relay.
  • Web reputation service, file reputation service and Smart Protection feedback.
If you use bi-directional connections, your firewalls or routers must allow both incoming and outgoing traffic between your agents and Deep Security as a Service .

No

Contact your support provider if this port assignment is problematic.

Yes*

In Deep Security Agent 10.0 GA and earlier, agents didn't have support for connections through a proxy to relays.You must either:
UDP 514 Syslog SIEM or log server

External logging and reporting.

This is only used if you want the agents to send directly to an external SIEM, instead of uploading event logs through Deep Security as a Service.

Yes No
TCP 4122 HTTPS Relay

Agent-to-relay communication for Deep Security Agent software installers and security package updates such as anti-malware engine and signatures.

This is not used by default, and not necessary unless you want to use your own relay group. See also Agent-Manager communication and Deploy application control rulesets via relays.
Yes Yes*
In Deep Security Agent 10.0 GA and earlier, agents didn't have support for connections through a proxy to relays.You must either: