Port numbers, URLs, and IP addresses
This document provides information on Deep Security default port numbers, URLs, IP addresses, and protocols. If a port, URL or IP address is configurable, a link is provided to the relevant configuration page.
If your network uses a proxy or load balancer, you can configure Deep Security to connect to it instead of directly to the components listed on this page. For details, see Configure proxies and Load Balancers.
In addition to the ports on this page, Deep Security uses ephemeral ports when opening a socket (source port). Under rare circumstances these may be blocked, causing connectivity issues. For details, see Blocked port.
Deep Security port numbers
The following diagram shows the default ports in a Deep Security system:
The following table provides details about the default ports. In this table, ports listed as mandatory must be opened to ensure the proper functioning of the Deep Security system; ports listed as optional may be opened depending on the feature or component you want to deploy; port numbers are referred to as ports.
| Port type | Default port number and protocol |
|---|---|
| Deep Security Agent listening (inbound) port |
Mandatory port:
|
| Deep Security Agent outbound ports |
Mandatory ports:
When using the AWS AMI and Azure VM versions of the manager, open port 443 instead of port 4119. Optional ports:
|
| Deep Security Relay listening (inbound) ports |
|
| Deep Security Relay outbound ports |
|
| Deep Security Manager listening (inbound) ports |
Mandatory ports:
|
|
Mandatory ports:
Optional ports:
|
Deep Security URLs
To restrict the URLs that are allowed in your environment, you need to ensure that your firewall allows traffic from the source to the destinations, as described in the following table. For each FQDN, you have to allow access to its associated HTTP and HTTPS URLs. For example, for the FQDN files.trendmicro.com, allow access to http://files.trendmicro.com:80 and https://files.trendmicro.com:443.
| Source | Destination server or service name | Destination fully-qualified domain name (FQDN) |
|---|---|---|
| API clients | Deep Security APIs |
|
| Legacy REST API clients | Deep Security legacy REST API's Status Monitoring API |
|
| Deep Security Manager, Deep Security Agent, Deep Security Relay |
Download Center or web server Hosts software. |
|
| Deep Security Manager |
Smart Protection Network - Used for event tagging with Integrity Monitoring. |
|
| Deep Security Manager |
|
|
| Deep Security Agent |
Smart Protection Network - Used for behavior monitoring, and predictive machine learning. |
20.0 and later agents connect to:
12.0 and later agents connect to:
11.0 and later agents connect to:
10.2 and 10.3 agents connect to:
10.1 and 10.0 agents connect to:
|
| Deep Security Agent |
Smart Protection Network - Used for behavior monitoring, predictive machine learning, and process memory scans. |
20.0 and later agents connect to:
12.0 and later agents connect to:
11.0 and later agents connect to:
10.2 and 10.3 agents connect to:
10.1 and 10.0 agents connect to:
|
| Deep Security Agent | Smart Protection Network - Smart Feedback |
20.0 and later agents connect to:
12.0 and later agent connect to:
11.0 and later agents connect to:
10.0 agents connect to:
|
| Deep Security Agent | Smart Protection Network - Smart Scan Service |
20.0 and later agents connects to:
12.0 and later agents connect to:
11.0 and later agents connect to:
10.2 and 10.3 agents connect to:
10.1 and 10.0 agents connect to:
9.6 and 9.5 agents connect to:
|
| Deep Security Agent |
Smart Protection Network - |
20.0 and later agents connect to:
12.0 and later agents connect to:
11.0 and later agents connect to:
10.2 and 10.3 agents connect to:
|
| Deep Security Agent | Smart Protection Network - Web Reputation Service |
20.0 and later agents connect to:
12.0 and later agents connect to:
The 11.0 and later agents connect to:
10.2 and 10.3 agents connect to:
10.1 and 10.0 agents connect to:
9.6 and 9.5 agents connect to:
|
| Deep Security Manager | Help and support |
|
| Deep Security Manager | Licensing and registration servers |
|
| Deep Security Manager | News feed |
|
| Browser on Deep Security Agent computers, and the computer used to log in to Deep Security Manager | Site Safety |
Optional. There are links to the URLs below within the manager UI and on the agent's 'Your administrator has blocked access to this page for your safety' page.
|
| Deep Security Relay, and Deep Security Agent |
Update Server (also called Active Update) Hosts security updates. |
|
| Deep Security Manager |
AWS and Azure URLs Used for
|
AWS URLs
Azure URLs
The management.core.windows.net URL is only required if you used the v1 Azure connector available in Deep Security Manager 9.6 to add an Azure account to the manager. With Deep Security Manager 10.0 and later, a v2 connector is used, and does not require access to this URL. GCP URLs
|
| Deep Security Manager |
Telemetry service Used for protected Deep Security Product Usage Data Collection. |
|
| Deep Security Manager |
Activation Used for activating Deep Security Manager with an activation code and for integrating with Trend Vision One. |
|