Summary
This article enumerates the different ports and protocols used in OfficeScan/Apex One, which should be allowed to communicate via firewall or router. This is typically the scenario in case the customer deployed either an OfficeScan/Apex One server or a client/agent in a DMZ or they have segmented their network into multiple subnets.
Details
- Agent/Server communication port - It is a random 5-digit port number set during installation. To determine this port number, check the "Client_LocalServer_Port" parameter in the \PCCSRV\ofcscan.ini file.
- NetBIOS ports - This uses TCP/UDP port 137, TCP port 139, and TCP port 445. These ports are used when installing clients/agents via Remote Install and when clients/agents send quarantined files to the server using the UNC path.
- Communication with Control Manager/Apex Central - MCP agent uses TCP port 80 on HTTP or TCP port 443 on HTTPS to communicate with Control Manager/Apex Central.
- License ports - These allow access to the Trend Micro License Server via TCP port 443.
- Standalone Smart Protection Server - If Standalone Smart Protection Server is used in the environment, File Reputation Service for smart scan uses port 80 for HTTP and port 443 for HTTPS. Web Reputation Service uses port 5274. The web console uses port 4343 for HTTPS.
- Unmanaged endpoints checking - This port (TCP 135 by default) is used by the OfficeScan/Apex One server to check with those unreachable and determine whether it’s managed by another OfficeScan/Apex One server. This port can be configured through the following menu path: OfficeScan/Apex One web console > Assessment > Unmanaged Endpoints > Define scope.
- SQL - SQL will by default use TCP port 1433 to communicate with the SQL Server hosting the OfficeScan/Apex One database.
- SNMP - If SNMP is enabled, it will use UDP ports 161 and 162 by default.
- SMTP - Email notifications will use the standard SMTP port TCP 25.
Some using ports vary depanding on the OfficeScan/Apex One version:
- Apex One web console port - To determine this port number, check the "Master_DomainPort" and "Master_SSLPort" parameter in the \PCCSRV\ofcscan.ini file.
Web Server and Settings Ports HTTP HTTPS (SSL) IIS default website with SSL enabled 80 (not configurable) 443 (not configurable) IIS virtual website with SSL enabled 8080 (configurable) 4343 (configurable) - Integrated Smart Protection Server - Smart Protection Server provides File Reputation Service (FRS) and Web Reputation Service (WRS). The port numbers used for FRS and WRS depend on the web server the OfficeScan server uses. Refer to the following tables:
Web Server and Settings Ports For File Reputation Service HTTP HTTPS (SSL) IIS default website 80 443 IIS virtual website 8080 4343 Web Server and Settings HTTP Port For Web Reputation Service IIS default website with SSL enabled 80 IIS virtual website with SSL enabled 8080 Apache server is no longer in use for OfficeScan XG and Apex One.To change the ports of your Web Reputation Services and File Reputation Services, refer to the KB article: Manually changing the ISPS ports of OfficeScan.
- Edge Relay Server Off-Premise management- The Off-Premise endpoint report backs up logs, submits samples, and updates the Suspicious Object (SO) List to the Edge server. The port information is shown below:
Web Server and Settings HTTPS Listen Port External (Agent to Edge) 443 (not configurable) Internal (Edge server to Apex One server) 4343 (default)
- OfficeScan web console port - To determine this port number, check the "Master_DomainPort" and "Master_SSLPort" parameter in the \PCCSRV\ofcscan.ini file.
Web Server and Settings Ports HTTP HTTPS (SSL) IIS default website with SSL enabled 80 (not configurable) 443 (not configurable) IIS virtual website with SSL enabled 8080 (configurable) 4343 (configurable) - Integrated Smart Protection Server - Smart Protection Server provides File Reputation Service (FRS) and Web Reputation Service (WRS). The port numbers used for FRS and WRS depend on the web server the OfficeScan server uses. Refer to the following tables:
Web Server and Settings Ports For File Reputation Service HTTP HTTPS (SSL) IIS default website 80 443 IIS virtual website 8080 4343 Web Server and Settings HTTP Port For Web Reputation Service IIS default website with SSL enabled 80 IIS virtual website with SSL enabled 8080 Apache server is no longer in use for OfficeScan XG.To change the ports of your Web Reputation Services and File Reputation Services, refer to the KB article: Manually changing the ISPS ports of OfficeScan.
- Edge Relay Server Off-Premise management- The Off-Premise endpoint report backs up logs, submits samples, and updates the Suspicious Object (SO) List to the Edge server. The port information is shown below:
Web Server and Settings HTTPS Listen Port External (Agent to Edge) 443 (not configurable) Internal (OfficeScan server to Edge) 10669 (configurable)
- OfficeScan web console port - To determine this port number, check the "Master_DomainPort" and "Master_SSLPort" parameter in the \PCCSRV\ofcscan.ini file.
Web Server and Settings Ports HTTP HTTPS (SSL) Apache web server with SSL enabled 8080 (configurable) 4343 (configurable) IIS default website with SSL enabled 80 (not configurable) 443 (not configurable) IIS virtual website with SSL enabled 8080 (configurable) 4343 (configurable) - Integrated Smart Protection Server - Smart Protection Server provides File Reputation Service (FRS) and Web Reputation Service (WRS). The port numbers used for FRS and WRS depend on the web server the OfficeScan server uses. Refer to the following tables:
Web Server and Settings Ports For File Reputation Service HTTP HTTPS (SSL) Apache web server 8082 4345 IIS default website 80 443 IIS virtual website 8080 4343 Web Server and Settings Ports For Web Reputation Service Apache web server with SSL enabled 5274 IIS default website with SSL enabled 80 (not configurable) IIS virtual website with SSL enabled 8080 (not configurable)
- OfficeScan web console port - To determine this port number, check the "Master_DomainPort" and "Master_SSLPort" parameter in the \PCCSRV\ofcscan.ini file.
Web Server and Settings Ports HTTP HTTPS (SSL) Apache web server with SSL enabled 8080 (configurable) 4343 (configurable) Apache web server with SSL disabled 8080 (configurable) N/A IIS default website with SSL enabled 80 (not configurable) 443 (not configurable) IIS default website with SSL disabled 80 (not configurable) N/A IIS virtual website with SSL enabled 8080 (configurable) 4343 (configurable) IIS virtual website with SSL disabled 8080 (configurable) N/A Apache and IIS use 8080 and 4343. 8081 and 4344 only happen when the above ports have been used. It is not a default setting. - Integrated Smart Protection Server - Smart Protection Server provides File Reputation Service (FRS) and Web Reputation Service (WRS). The port numbers used for FRS and WRS depend on the web server the OfficeScan server uses. Refer to the following tables:
Web Server and Settings Ports For File Reputation Service HTTP HTTPS (SSL) Apache web server with SSL enabled 8080 4343 Apache web server with SSL disabled 8080 4345 IIS default website with SSL enabled 8082 443 (not configurable) IIS default website with SSL disabled 8082 443 (not configurable) IIS virtual website with SSL enabled 8082 4345 IIS virtual website with SSL disabled 8082 4345 Web Server and Settings Ports For Web Reputation Service Apache web server with SSL enabled 8080 (not configurable) Apache web server with SSL disabled 8080 (not configurable) IIS default website with SSL enabled 80 (not configurable) IIS default website with SSL disabled 80 (not configurable) IIS virtual website with SSL enabled 5274 IIS virtual website with SSL disabled 5274
