Security/Firewall Requirements

Windows Management Instrumentation (WMI) -- Port: 445

Remote Procedure Call (RPC) (Default port: 135)

Learn more about the  ports required for WMI Mode of monitoring.

• REST API HTTPS port (Default port: 443)
• For Azure VM: PowerShell port (Default port: 5985,5986)
• For Azure SQL: DB connection via JDBC port (Default port: 1433)

• REST API HTTPS port (Default port: 443)
• For Autonomous Database: DB connection via JDBC port (Default port: 1433)

Telnet port: 23 (if the mode of monitoring is Telnet)

SSH port: 22 (if the mode of monitoring is SSH)

Remote Procedure Call (RPC) (Default port: TCP 135)

Windows Management Instrumentation (WMI) (Default port: TCP 445)

Learn more about the  ports required for WMI Mode of monitoring.

To monitor a Microsoft Dynamics CRM/365 application, use an Administrator user account that has permission to execute WMI queries on the 'root\CIMV2' namespace of the Dynamics CRM/365 Server.

Firewall access for monitoring:

Ports required for monitoring via WMI.

• Windows Management Instrumentation (WMI) (Default port: TCP 445)
• Remote Procedure Call (RPC) (Default port: TCP 135)
• Refer to the ports required for WMI Mode of monitoring under Servers

PowerShell access for monitoring:

Click here to see powerShell prerequisites.

Windows Management Instrumentation (WMI) -- Port: 445

Remote Procedure Call (RPC) -- Port: 135

Refer to the ports required for WMI Mode of monitoring under Servers

Windows Management Instrumentation (WMI) (Default port: 445)

Remote Procedure Call (RPC) (Default port: 135)

PowerShell remoting - TCP 5985 and 5986

Exchange PowerShell session - TCP 80 and 443

Learn more about the ports required for WMI Mode of monitoring

Windows Management Instrumentation (WMI) -- Port: 445

Remote Procedure Call (RPC) -- Port: 135

PowerShell remoting - TCP 5985 and 5986

Learn more about the ports required for WMI Mode of monitoring.

Remote JMX should be enabled. The Default JMX port is 1099.

Learn how to enable JMX for ActiveMQ

The Default JMX port is 9999.

Windows Management Instrumentation (WMI) -- Port: 445

Remote Procedure Call (RPC) -- Port: 135

Refer to the ports required for WMI Mode of monitoring under Servers

To connect to an AS400/iSeries server from Applications Manager, it uses the JTOpen package. The JTOpen package uses the following Non-SSL ports: 449, 446, 8470, 8471, 8472, 8473, 8474, 8475, 8476. Ensure that the ports mentioned under the "Port Non-SSL" column in the link are not blocked in the firewall.

https://www-01.ibm.com/support/docview.wss?uid=nas8N1019667

Telnet Port (Default port: 23), if the mode of monitoring is Telnet.

SSH Port (Default port: 22), if the mode of monitoring is SSH

SNMP Agent Port (Default port: 161), if the mode of monitoring is SNMP

Windows Management Instrumentation (WMI) -- Port: 445

Remote Procedure Call (RPC) -- Port: 135

Refer to the ports required for WMI Mode of monitoring under Servers

For WMI Mode of Monitoring:

Applications Manager supports users with both administrator and non-administrator roles for monitoring Windows servers through WMI mode. However, it is recommended to use administrator privileges for Windows server monitoring.

Ports required -

Remote Procedure Call (RPC) (Default port: 135)

WMI uses DCOM for remote communication. The server to be monitored by Applications Manager uses a random port number above 1024 by Default to respond. You have to connect to this target server and configure it to use a port within a specified range of ports. Check out this link to learn more about restricting the ports in the target server:  https://support.microsoft.com/en-us/help/154596/how-to-configure-rpc-dynamic-port-allocation-to-work-with-firewalls. Note that you must specify at least 5 ports in this range for target server ( you are normally recommended to open at least a 100 ports). This same range of ports must also be opened in the firewall.

• For Windows Server 2008 and later versions (Windows Server 2019, Windows Server 2016, Windows Server 2012, Windows Server 2008 R2, Windows Server 2008), and in Windows Vista and later versions (Windows 10, Windows 8, Windows 7, Windows Vista), use the following dynamic port range:

  Start port: 49152

  End port: 65535

• For versions of Windows Server below 2008 (Windows 2000, Windows XP, and Windows Server 2003, and in Windows below Vista (Windows XP), use the following dynamic port range:

  Start port: 1025

  End port: 5000

• If your computer network environment uses Windows Server 2019, Windows Server 2016, Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, Windows Vista together with versions of Windows below Windows Server 2008 and Windows Vista, you must enable connectivity over both the following port ranges:

  High port range: 49152 through 65535

  Low port range: 1025 through 5000

• For more information about the Default dynamic port range, click here.

Ports required for SNMP Mode of monitoring -

SNMP Agent (Default port: 161)

Windows Management Instrumentation (WMI) -- Port: 445

Remote Procedure Call (RPC) -- Port: 135

PowerShell remoting -- TCP 5985 and 5986

Refer to the ports required for WMI Mode of monitoring under Servers

Port of JMX agent (Default port:1099)
 

To monitor JMX behind a firewall, the following changes have to be made.

• Edit startApplicationsManager.bat/sh file. Add
  -Dmonitor.jmx.rmi.port=<port number for RMI socket communication> to the Java runtime options.
• Restart Applications Manager server
• Ensure that you have the RMI Socket port (step1) and JNDI Port (step4) opened up in the firewall
• Add the JMX Applications monitor after providing the relevant details.
• The monitor should be added successfully

Windows Management Instrumentation (WMI) -- Port: 445

Remote Procedure Call (RPC) -- Port: 135

Refer to the ports required for WMI Mode of monitoring under Servers

The Default port of the JMX agent is 1099

Windows Management Instrumentation (WMI) -- Port: 445

Remote Procedure Call (RPC) -- Port: 135

Refer to the ports required for WMI Mode of monitoring under Servers

• Default RUM agent port 7070 (HTTP) and 7443 (HTTPS).
• Above RUM Agent ports should be opened in the firewall for all the end users accessing the application, which is monitored in Real User Monitor in Applications Manager.
• RUM Agent should be able to communicate with the Applications Manager server. i.e., one-way communication from the RUM Agent to the Applications Manager HTTPS port (Default HTTPS port: 8443).

• Default EUM agent port 9999 (HTTP) and 9443 (HTTPS).
• EUM Agent should be able to communicate with the Applications Manager server. i.e., one-way communication from the EUM Agent to the Applications Manager HTTPS port (Default port: 8443).
• Firewall requirements for the following EUM-based monitor types should be the same as those of the non-EUM-based monitors supported in Applications Manager:
  • DNS
  • LDAP
  • Telnet
  • Mail
  • Ping
  • RBM (Default port 9595)

• The AWS Access Key ID for accessing AWS through the API. The access key has 20 alpha-numeric characters.
• The Secret Access Key of the AWS. The secret key should be 40 alpha-numeric characters long.

• To retrieve data for all modules in AS400/iSeries monitor except 'Disk', a user with *USER user profile is required.
• To retrieve data for 'Disk' and to perform Admin actions from Applications Manager, a user with the *SECOFR user profile is required.
• If using the *SECOFR user profile is not possible, then for retrieving disk data and performing admin actions such as viewing spooled files, job logs, and performing actions in JOBS, SPOOL, SUBSYSTEM, a user profile with special authorities such as *ALLOBJ, *SAVSYS, *JOBCTL, *SPLCTL is required.
• The user should have permission to access the QMPGDATA/QPFRDATA library because Applications Manager uses the performance collection service for retrieving disk details from the AS400/iSeries server. Note: If the performance data collection is not enabled in AS400/iSeries, you need to start it by using the command STRPFRCOL or GO PERFORM--> COLLECT PERFORMANCE DATA--> START PERFORMANCE COLLECTION. You will also be able to execute the STRPFRCOL command from the AS400/iSeries server monitor page in Admin--> Non-Interactive command option.

If Authentication is enabled, enter the Username and password for connecting to the JMX agent.

You need an SAP user profile with the following authorization objects: S_RFC, S_XMI_LOG and S_XMI_PROD, which are the minimum prerequisites for adding an SAP monitor.

We use the SAP Java Connector to connect to the SAP ABAP server. The SAP JCo will communicate from APM to SAP using the SAP Dispatcher. The SAP Dispatcher port to be used is 3200 with the SAP System number.

For SNMP Version V1/V2c:

• SNMP Community string with read-only privileges.

For SNMP Version V3:

Select one of the three Security Levels in the drop-down list:

• NoAuthNoPriv - Messages can be sent unauthenticated and unencrypted. Enter a UserName and Context Name.
• AuthNoPriv - Messages can be sent authenticated but unencrypted. Enter a UserName, Context Name, and an Authentication Password. You can select an Authentication Protocol like MD5 or SHA from the drop-down list.
• AuthPriv - Messages can be sent authenticated and encrypted. Enter a UserName, Context Name, an Authentication Password, and a Privacy Password. You can select an Authentication Protocol like MD5 or SHA from the drop-down list. By Default, the 'DES' encryption technique will be used.

• For 5.x and above, a username and password are required to connect to the Tomcat Manager Application. If not, no username/password is required.
• For 5.x, the user specified should have a 'manager' role.
• For 6.x and above, the user specified should have "manager-gui", "manager-script", "manager-jmx" and "manager-status" roles.

When adding VMware ESX/ESXi servers for monitoring, we recommend using the root account. However, if you are unable to use the root account, you can use a 'view-only' profile to add the servers. This profile has all the privileges required for monitoring. The user you create must be:

• A member of the group user.
• Based on the profile 'read only'.