Port and firewall requirements
ManageEngine SecureAI uses a fixed set of ports for its web console, its MCP Gateway service, and its bundled Elasticsearch and PostgreSQL instances. Ensure that these ports are free on the server before you install the product, and that your firewall allows the traffic described on this page.
Ports used by SecureAI
| Port number | Protocol | Port type | Service | Purpose |
|---|---|---|---|---|
| 8989 | HTTP | Inbound | Web Console | To access the SecureAI web console over HTTP |
| 9352 | HTTPS | Inbound | Web Console | To access the SecureAI web console over HTTPS |
| 9353 | HTTPS | Inbound | MCP Gateway | To allow MCP clients to reach the MCP Gateway service |
| 8991 | HTTPS | Internal | MCP Gateway to SecureAI | For communication between the MCP Gateway and the SecureAI core |
| 9450 | TCP | Internal | Elasticsearch HTTP/REST | For SecureAI to communicate with the bundled Elasticsearch instance |
| 9550 | TCP | Internal | Elasticsearch cluster | For inter-node communication within the Elasticsearch cluster |
| 33388 | TCP | Internal | PostgreSQL | For SecureAI to communicate with its bundled PostgreSQL database |
Firewall requirements
Inbound rules
Open the following ports on the SecureAI server to allow traffic in:
- TCP 8989: For HTTP access to the web console. Redirect this traffic to HTTPS.
- TCP 9352: For HTTPS access to the web console.
- TCP 9353: For the MCP Gateway service. Restrict this port to trusted MCP clients on your internal network.
Internal rules
The following ports carry traffic within the SecureAI server or your internal network alone. Do not expose them externally:
- TCP 8991: For communication between the MCP Gateway and the SecureAI core. Bind this port to the loopback address or an internal interface.
- TCP 9450: For the Elasticsearch HTTP/REST API. Bind this port to 127.0.0.1.
- TCP 9550: For Elasticsearch cluster communication. Bind this port to 127.0.0.1.
- TCP 33388: For communication between SecureAI and its bundled PostgreSQL database. Never open it to a public network.
Recommendations
- Restrict port 8989 to your internal network and enforce an HTTPS redirect to port 9352 for all external access.
- Apply IP allowlisting on port 9353 so that only authorized MCP clients can reach the MCP Gateway.
- Bind the PostgreSQL port to the application server IP alone.
- Apply all firewall rules before you move SecureAI into production, so that no port is accidentally exposed.
Changing the ports after installation
To switch the web console between HTTP and HTTPS, go to Settings > General Settings > Connection and, under Connection Type, select HTTP or HTTPS. Restart SecureAI for the change to take effect, and update your firewall rules to match.