# Security/Firewall Requirements

This section explains how the Applications Manager can be accessed behind a firewall. Firewalls act as barriers that prevent unauthorized access to a network while allowing authorized users to access permitted resources. You need to configure the firewall so that the host on which Applications Manager runs can access the monitor at the relevant port.

**Note:** Ensure that all required ports are open to enable bi-directional communication.

## Ports to be opened when Monitors are behind the firewall:

| Monitors | Port Details |
|---|---|
| **APPLICATION SERVERS** |  |
| Glassfish | Glassfish JMX port (Default port: 8686) |
| JBoss | Two-way communication between JBoss web server port (Default port: 8080) and Applications Manager web server port (Default port: 9090).<br>Applications Manager hostname must be reachable from JBoss server.<br>JBoss RMI object port (Default port: 4444). |
| Jetty | Enable JMX for monitoring. The JMX Port for default installations of Jetty is 9999. |
| Microsoft .NET | Windows Management Instrumentation (WMI) -- Port: 445<br>Remote Procedure Call (RPC) (Default port: 135)<br>[Learn more about the ports required for WMI Mode of monitoring.](https://www.manageengine.com/products/applications_manager/help/secure-configuration.html#WMIModeofMonitoring) |
| Oracle Application Server | Oracle Application Server port (Default port: 7200) |
| Tomcat | Tomcat web server port (Default port: 8080) |
| VMware vFabric tc Server | JMX port for VMware vFabric tc Server (Default port: 6969) |
| WebLogic | Two-way communication between WebLogic listening port (Default port: 7001) and Applications Manager web server port (Default port: 9090) |
| WebSphere | WebSphere application port (Default port: 9080) |
| **CLOUD APPS** |  |
| Microsoft Azure | - REST API HTTPS port (Default port: 443)<br>- For Azure VM: PowerShell port (Default port: 5985,5986)<br>- For Azure SQL: DB connection via JDBC port (Default port: 1433) |
| Amazon | REST API via SDK HTTPS port (Default port: 443) |
| Microsoft 365 | REST API HTTPS port (Default port: 443) |
| Openstack | REST API HTTPS port (Default port: 443) |
| Google Cloud Platform | REST API HTTPS port (Default port: 443) |
| Oracle Cloud | - REST API HTTPS port (Default port: 443)<br>- For Autonomous Database: DB connection via JDBC port (Default port: 1433) |
| **CUSTOM MONITORS** |  |
| Database Query monitor | The corresponding database server port |
| File/Directory, Script (Telnet/SSH mode) | Telnet port: 23 (if the mode of monitoring is Telnet)<br>SSH port: 22 (if the mode of monitoring is SSH) |
| File/Directory, WMI Performance counter (WMI mode) | Remote Procedure Call (RPC) (Default port: TCP 135)<br>Windows Management Instrumentation (WMI) (Default port: TCP 445)<br>[Learn more about the ports required for WMI Mode of monitoring.](https://www.manageengine.com/products/applications_manager/help/secure-configuration.html#WMIModeofMonitoring) |
| **DATABASE SERVERS** |  |
| DB2 | The port on which DB2 is running (Default port: 50000) |
| Memcached | The port on which the Memcached server is running (Default port: 11211) |
| MySQL | The port on which MySQL is running (Default port: 3306) |
| Oracle | The port on which Oracle is running (Default port: 1521) |
| PostgreSQL | The port on which PostgreSQL is running (Default port: 5432) |
| Microsoft SQL Server | The port on which SQL Server is running (Default port: 1433). UDP port 1434 might be required for the SQL Server Browser Service when you are using named instances. |
| Sybase | The port on which Sybase is running (Default port: 5000) |
| SAP HANA | SAP HANA's IndexServer port (Default port: 30015) |
| Apache HBase | The port on which HBase is running.<br>For default installations of HBase, the JMX port number is 10101 for Master and 10102 for RegionServer. |
| **NoSQL** |  |
| Cassandra | Enable JMX for monitoring. The JMX Port for default installations of Cassandra is 7199. |
| **ERP** |  |
| Oracle EBS | Oracle EBS web server port (Default port: 7200) |
| Microsoft Dynamics CRM/365 (On-Premise) | To monitor a Microsoft Dynamics CRM/365 application, use an Administrator user account that has permission to execute WMI queries on the 'root\CIMV2' namespace of the Dynamics CRM/365 Server.<br><br>**Firewall access for monitoring:**<br>Ports required for monitoring via WMI:<br>- Windows Management Instrumentation (WMI) (Default port: TCP 445)<br>- Remote Procedure Call (RPC) (Default port: TCP 135)<br>- Refer to the ports required for [WMI Mode of monitoring](https://www.manageengine.com/products/applications_manager/help/secure-configuration.html#WMIModeofMonitoring) under Servers<br><br>**PowerShell access for monitoring:**<br>[Click here](https://www.manageengine.com/products/applications_manager/help/enabling-powershell.html) to see PowerShell prerequisites. |
| Microsoft Dynamics AX | Windows Management Instrumentation (WMI) -- Port: 445<br>Remote Procedure Call (RPC) -- Port: 135<br>Refer to the ports required for [WMI Mode of monitoring](https://www.manageengine.com/products/applications_manager/help/secure-configuration.html#WMIModeofMonitoring) under Servers |
| **MAIL SERVERS** |  |
| Exchange Server | Windows Management Instrumentation (WMI) (Default port: 445)<br>Remote Procedure Call (RPC) (Default port: 135)<br>PowerShell remoting - TCP 5985 and 5986<br>Exchange PowerShell session - TCP 80 and 443<br>[Learn more about the ports required for WMI Mode of monitoring](https://www.manageengine.com/products/applications_manager/help/secure-configuration.html#WMIModeofMonitoring) |
| Mail Server | SMTP server port (Default port: 25) to send mails from Applications Manager.<br>POP port (Default port: 10) to fetch mails using the POP server. |
| **MIDDLEWARE/PORTAL** |  |
| IBM WebSphere MQ | The MQ Listener Port (Default port: 1414) |
| Microsoft MSMQ/SharePoint Server/Biztalk Server | Windows Management Instrumentation (WMI) -- Port: 445<br>Remote Procedure Call (RPC) -- Port: 135<br>PowerShell remoting - TCP 5985 and 5986<br>[Learn more about the ports required for WMI Mode of monitoring.](https://www.manageengine.com/products/applications_manager/help/secure-configuration.html#WMIModeofMonitoring) |
| VMware vFabric RabbitMQ Server | The port on which the management plugin is configured (Default port: 55672) |
| WebLogic Integration Server | WebLogic Integration port (Default port: 7001) |
| Oracle Tuxedo | The SNMP port number on which the Tuxedo SNMP agent is running. The Default port number is 161. |
| Apache ActiveMQ | Remote JMX should be enabled. The Default JMX port is 1099.<br>[Learn how to enable JMX for ActiveMQ](https://www.manageengine.com/products/applications_manager/help/prerequisites-for-applications-manager.html#ApacheActiveMQ) |
| Apache Kafka | The Default JMX port is 9999.<br>To enable JMX, you can set the JMX_PORT environment variable in the kafka-run-class.sh/kafka-run-class.bat file or use standard Java system properties. Alternatively, you can set the KAFKA_JMX_OPTS environment variable in the kafka-run-class.sh/kafka-run-class.bat file to enable JMX for monitoring in Applications Manager. For more information on configuring JMX, refer to this [link](https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html). |
| Skype for Business Server | Windows Management Instrumentation (WMI) -- Port: 445<br>Remote Procedure Call (RPC) -- Port: 135<br>Refer to the ports required for [WMI Mode of monitoring](https://www.manageengine.com/products/applications_manager/help/secure-configuration.html#WMIModeofMonitoring) under Servers |
| **SERVERS** |  |
| AS400/iSeries | Uses the JTOpen package. Non-SSL ports: 449, 446, 8470–8476. Ensure that the ports mentioned under the "Port Non-SSL" column in the following link are not blocked in the firewall:<br>https://www-01.ibm.com/support/docview.wss?uid=nas8N1019667 |
| Linux / Solaris / AIX / HPUnix / Tru64 Unix | Telnet Port (Default port: 23), if the mode of monitoring is Telnet.<br>SSH Port (Default port: 22), if the mode of monitoring is SSH<br>SNMP Agent Port (Default port: 161), if the mode of monitoring is SNMP |
| Windows Cluster | Windows Management Instrumentation (WMI) -- Port: 445<br>Remote Procedure Call (RPC) -- Port: 135<br>Refer to the ports required for [WMI Mode of monitoring](https://www.manageengine.com/products/applications_manager/help/secure-configuration.html#WMIModeofMonitoring) under Servers |
| Windows | **For WMI Mode of Monitoring:**<br>Ports required:<br>- Remote Procedure Call (RPC) (Default port: 135)<br>- Dynamic ports (see ranges below)<br><br>WMI uses DCOM for remote communication. Configure the target server to use a port within a specified range. See: https://support.microsoft.com/en-us/help/154596/how-to-configure-rpc-dynamic-port-allocation-to-work-with-firewalls<br><br>Dynamic Port Ranges:<br>- Windows Server 2008 and later / Windows Vista and later:<br>  - Start port: 49152<br>  - End port: 65535<br>- Below Windows Server 2008 / Below Vista:<br>  - Start port: 1025<br>  - End port: 5000<br>- Mixed environments:<br>  - High port range: 49152–65535<br>  - Low port range: 1025–5000<br><br>More information: https://learn.microsoft.com/en-GB/troubleshoot/windows-server/networking/Default-dynamic-port-range-tcpip-chang<br><br>Ports required for SNMP Mode of monitoring:<br>- SNMP Agent (Default port: 161) |
| **SERVICES** |  |
| Active Directory | Windows Management Instrumentation (WMI) -- Port: 445<br>Remote Procedure Call (RPC) -- Port: 135<br>PowerShell remoting -- TCP 5985 and 5986<br>Refer to the ports required for [WMI Mode of monitoring](https://www.manageengine.com/products/applications_manager/help/secure-configuration.html#WMIModeofMonitoring) under Servers |
| FTP/SFTP | Port on which FTP or SFTP is running (Default port: 21 for FTP, 22 for SFTP) |
| JMX [MX4J / JDK 1.5] | Port of JMX agent (Default port: 1099)<br><br>To monitor JMX behind a firewall:<br>- Edit startApplicationsManager.bat/sh file. Add `-Dmonitor.jmx.rmi.port=<port number for RMI socket communication>` to the Java runtime options.<br>- Restart Applications Manager server.<br>- Ensure that the RMI Socket port and JNDI Port are opened in the firewall.<br>- Add the JMX Applications monitor with relevant details.<br>- The monitor should be added successfully. |
| LDAP | LDAP server port |
| Network Policy Server (NPS) | Windows Management Instrumentation (WMI) -- Port: 445<br>Remote Procedure Call (RPC) -- Port: 135<br>Refer to the ports required for [WMI Mode of monitoring](https://www.manageengine.com/products/applications_manager/help/secure-configuration.html#WMIModeofMonitoring) under Servers |
| Service Monitoring | The service port that you need to monitor |
| SNMP | SNMP Agent port (Default port: 161) |
| Telnet | Port that you need to Telnet |
| Oracle Coherence | Enable JMX for monitoring. The JMX Port for default installations of Coherence is 1099. |
| Hadoop | Enable JMX for monitoring. The JMX port for the NameNode. |
| **APPLICATION PERFORMANCE MANAGEMENT** |  |
| APM Insight | One-way communication from the Agent installed application server to the Applications Manager port (Default port: 9090/8443). |
| **VIRTUALIZATION** |  |
| Hyper-V | Windows Management Instrumentation (WMI) -- Port: 445<br>Remote Procedure Call (RPC) -- Port: 135<br>Refer to the ports required for WMI Mode of monitoring under Servers |
| VMWare ESX/ESXi | VMWare Web Service port (Default port: 443) |
| Citrix Xenserver | HTTPS Port where the XenServer web service runs (Default port: 443) |
| Docker | The Docker socket port (Default port: 4243) |
| Kubernetes | SSH Port (Default port: 22) |
| OpenShift | SSH Port (Default port: 22)<br>REST API Port (Default port: 8443) |
| **WEB SERVER/SERVICES** |  |
| SSL Certificate Monitor | SSL port on which the web server is running (Default port: 443) |
| Web Server | HTTP Port of Web Server (Default port: 80; For SSL: 443) |
| Elasticsearch | The port on which Elasticsearch is running (Default port: 9200) |
| Apache Solr | The port on which Apache Solr is running (Default port: 8983) |
| IIS Server | Port on which the IIS Server is running (Default port: 80; For SSL: 443) |
| **Miscellaneous** |  |
| Trap Listeners | Trap Listener port (Default port: 1620) in the Applications Manager server must be reachable from the server where you want to send traps. More on receiving [SNMP Traps](https://www.manageengine.com/products/applications_manager/help/snmp-trap-listener.html). |
| RUM Agent | - Default RUM agent port 7070 (HTTP) and 7443 (HTTPS).<br>- Above RUM Agent ports should be opened in the firewall for all end users accessing the monitored application.<br>- One-way communication from the RUM Agent to the Applications Manager HTTPS port (Default: 8443).<br><br>**Note:**<br>- End users accessing the monitored website should have access to RUM Agent.<br>- RUM Agent should be available on the internet and able to communicate with Applications Manager. |
| EUM Agent | - Default EUM agent port 9999 (HTTP) and 9443 (HTTPS).<br>- One-way communication from the EUM Agent to the Applications Manager HTTPS port (Default: 8443).<br>- Firewall requirements for EUM-based monitor types (DNS, LDAP, Telnet, Mail, Ping, RBM [Default port 9595]) are the same as non-EUM monitors. |

Applications Manager makes sure that data is secure. The internal PostgreSQL database allows only localhost to access the database through authenticated users. User names and passwords are stored in the bundled PostgreSQL database. The passwords are encrypted to maintain security.

## Privileges required for different monitor types:

| Monitors | Privileges |
|---|---|
| Active Directory | Administrator username/password [WMI mode] |
| Amazon | - AWS Access Key ID (20 alpha-numeric characters)<br>- Secret Access Key (40 alpha-numeric characters) |
| Apache Server | Credentials for accessing the server status URL for Apache |
| AS400/iSeries | - *USER profile for all modules except Disk<br>- *SECOFR profile for Disk and admin actions<br>- Alternatively, special authorities: *ALLOBJ, *SAVSYS, *JOBCTL, *SPLCTL<br>- Access to QMPGDATA/QPFRDATA library<br>- Enable performance data collection using STRPFRCOL if required |
| Database Query Monitor | User with privileges for accessing the database and executing the query |
| DB2 | User with at least SYSMON instance-level authority |
| Exchange Server | Administrator username/password [WMI mode] |
| File/Directory | User with privileges for accessing the file or directory |
| FTP/SFTP | Username and Password if authentication is enabled |
| Glassfish | Username and password for connecting to Glassfish Admin console |
| HP-UX | Guest user privilege |
| HTTP URL | Enter credentials if basic authentication is required |
| Hyper-V | Administrator privileges to the root OS |
| IBM AIX | Guest user privilege; root required for memory details |
| IBM WebSphere MQ | A Channel name with type "Server Connection Channel" |
| JBoss | JBoss username/password if authenticated; access to JMX console |
| JMX/Java Runtime | Username/password if authentication is enabled.<br>Add runtime options:<br>`-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=<PORT NO>`<br>`-Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.local.only=false -Dcom.sun.management.jmxremote.authenticate=false` |
| LDAP | Username and Password if authentication is enabled; otherwise anonymous login |
| Linux | Guest user privilege |
| Mail Server | Username and password if authentication is enabled |
| Microsoft .Net | Administrator username/password [WMI mode] |
| Microsoft Office SharePoint Server | Administrator username/password [WMI mode] |
| MS SQL | System Administrator/Owner for the "master" database |
| MSMQ | Administrator username/password [WMI mode] |
| MySQL | User with access to databases to be monitored; MySQL configured to allow host access |
| Oracle EBS | Users with CONNECT, SELECT_CATALOG_ROLE, and SELECT ANY TABLE roles |
| RabbitMQ | User must have administrator tag |
| SAP/SAP CCMS | SAP user profile with authorization objects: S_RFC, S_XMI_LOG, S_XMI_PROD.<br>SAP Dispatcher port: 3200 (with SAP System number) |
| Script monitor | User with privileges to execute the script and access output |
| Server with SNMP mode | SNMP Community string with read privileges |
| SNMP/Network device | **SNMP v1/v2c:** Community string with read-only privileges.<br>**SNMP v3:**<br>- NoAuthNoPriv: Username, Context Name<br>- AuthNoPriv: Username, Context Name, Authentication Password (MD5/SHA)<br>- AuthPriv: Username, Context Name, Authentication Password, Privacy Password (Default DES encryption) |
| Solaris | Guest user privilege |
| Sybase | Admin privileges or DB owner for master database |
| Tomcat | - 5.x and above: username/password for Manager Application<br>- 5.x: 'manager' role<br>- 6.x and above: "manager-gui", "manager-script", "manager-jmx", "manager-status" roles |
| VMWare ESX/ESXi | Prefer root account; alternatively view-only profile:<br>- Member of group user<br>- Based on 'read only' profile |
| VMware vFabric RabbitMQ Server | Username and Password |
| WebLogic | WebLogic administrator credentials if authenticated |
| WebLogic Integration Server | WebLogic administrator credentials if authenticated |
| Webservices | Username and Password if required |
| WebSphere | Username/password if Global Security is enabled |
| Windows | Administrator username/password [WMI mode] |
| Windows Cluster | Administrator username/password [WMI mode] |

## Enterprise Edition

| Path | Ports |
|---|---|
| Central Server to Probe Server | SSL Port (Default port: 8443) for [data syncing](https://www.manageengine.com/products/applications_manager/help/enterprise-edition-data-sync.html).<br>Web server (Default port: 9090). |
| Probe Server to Central Server | SSL Port (Default port: 8443) for [data syncing](https://www.manageengine.com/products/applications_manager/help/enterprise-edition-data-sync.html). |

**Note:** [Production Environment](https://www.manageengine.com/products/applications_manager/help/production-environment.html) gives you the configuration details that you need to take care of when moving Applications Manager into Production.