Deep Security 12 FR has reached end of support. Use the version selector (above) to see more recent versions of the Help Center.
Port numbers, URLs, and IP addresses
Deep Security default port numbers, URLs, IP addresses, and protocols are listed in the sections below. If a port, URL or IP address is configurable, a link is provided to the relevant configuration page.
If your network uses a proxy
In addition to the ports on this page, Deep Security uses ephemeral ports when opening a socket (source port). Under rare circumstances these may be blocked, causing connectivity issues. For details, see Activation Failed - Blocked port.
Deep Security port numbers
The following diagram shows the default ports in a Deep Security system. For details, see the table below the diagram.
In the table below:
- 'Mandatory ports' refer to ports that must be opened to ensure the proper functioning of the Deep Security system.
- 'Optional ports' refer to ports that may be opened depending on the feature or component you want to deploy.
- 'Port' is used in place of 'port number' for brevity.
| Port type | Default port number and protocol |
|---|---|
| Deep Security Agent |
|
| Deep Security Agent |
Mandatory ports:
Optional ports:
|
| Deep Security Relay listening (inbound) ports |
Port 4123 should not be listening to connections from other computers, and you don't need to configure it in network firewall policies. But if you have firewall software (such as Windows Firewall or iptables) on the relay itself, verify that it does not block this connection to itself. Also verify that other applications do not use the same port (a port conflict). |
| Deep Security Relay outbound ports |
|
|
|
Mandatory ports:
|
|
Mandatory ports:
Optional ports:
|
Deep Security URLs
If you need to restrict the URLs that are allowed in your environment, read this section.
You'll need to make sure your firewall allows traffic from the 'Source' to the 'Destinations' listed in the table below. For each FQDN, make sure you allow access to its associated HTTP and HTTPS URLs. For example, for the FQDN files.trendmicro.com, allow access to http://files.trendmicro.com:80 and https://files.trendmicro.com:443.
| Source | Destination server or service name | Destination fully-qualified domain name (FQDN) |
|---|---|---|
| API clients | Deep Security APIs |
|
| Legacy REST API clients | Deep Security legacy REST API's Status Monitoring API |
|
|
|
Download Center or web server Hosts software. |
|
| Deep Security Manager |
Smart Protection Network - Used for event tagging with Integrity Monitoring. |
|
| Deep Security Agent |
Smart Protection Network - Used for behavior monitoring, and predictive machine learning. |
12.0 and higher
11.0 and higher
10.2 and 10.3
10.1 and 10.0
|
| Deep Security Agent |
Smart Protection Network - Used for behavior monitoring, predictive machine learning, and process memory scans. |
12.0 and higher
11.0 and higher
10.2 and 10.3
10.1 and 10.0
|
| Deep Security Manager | Smart Protection Network - Smart Feedback |
12.0 and higher
11.0 and higher
10.0
|
| Deep Security Agent |
Smart Protection Network - Smart Scan Service |
12.0 and higher
11.0 and higher
10.2 and 10.3
10.1 and 10.0
9.6 and 9.5
|
| Deep Security Agent |
Smart Protection Network - |
12.0 and higher
11.0 and higher
10.2 and 10.3
|
| Deep Security Agent |
Smart Protection Network - Web Reputation Service |
12.0 and higher
11.0 and higher
10.2 and 10.3
10.1 and 10.0
9.6 and 9.5
|
| Deep Security Manager | Help and support |
|
| Deep Security Manager | Licensing and registration servers |
|
| Deep Security Manager | News feed |
|
| Browser on Deep Security Agent computers, and the computer used to log in to Deep Security Manager | Site Safety |
Optional. There are links to the URLs below within the manager UI and on the agent's 'Your administrator has blocked access to this page for your safety' page.
|
| Deep Security Relay, and Deep Security Agent |
Update Server (also called Active Update) Hosts security updates. |
|
| Deep Security Manager |
AWS and Azure URLs Used for
|
AWS URLs
Azure URLs
The management.core.windows.net URL is only required if you used the v1 Azure connector available in Deep Security Manager 9.6 to add an Azure account to the manager. With Deep Security Manager 10.0 and later, a v2 connector is used, and does not require access to this URL. GCP URLs
|
| Deep Security Manager |
Telemetry service Used for anonymous Deep Security Product Usage Data Collection. |
|