Firewalls

Firewalls can be used to protect various parts of a network and must be configured to allow the connections required by SGD.

This section includes the following topics:

• Firewalls Between Client Devices and SGD Servers

• Firewalls Between SGD Servers

• Firewalls Between SGD Servers and Application Servers

• Other Firewalls

Firewalls Between Client Devices and SGD Servers

Client devices must be able to make HTTP and AIP connections to any SGD server in the array. This is because a user’s SGD session and a user’s application sessions can be hosted on different SGD servers.

The following table lists the ports you might need to open to allow connections between client devices and SGD servers.

Transmission Control Ports (TCP) 80 and 443 are the Internet-standard ports for HTTP and HTTPS. Port 443 is only used if HTTPS is enabled on the SGD web server. You can configure the SGD web server to use any port.

In a default installation, ports 3144 and 5307 must both be open in the firewall. The SGD Client initially makes a secure connection on port 5307, but once the user has authenticated, the connection is downgraded to a standard connection on port 3144. See Firewall Traversal for how to configure SGD when these ports cannot be opened.

If you enable SGD security services and use only HTTPS, only ports 443 and 5307 must be open in the firewall.

Ports 3144 and 5307 are registered with the Internet Assigned Numbers Authority (IANA) and are reserved for use only by SGD.

Firewalls Between SGD Servers

A network might contain firewalls between the SGD servers in an array, for example if you have multiple offices each containing an SGD server. The SGD servers in an array must be able to connect to any other member of the array.

The following table lists the ports you might need to open to allow connections between SGD Servers.

Port 5427 is registered with IANA and is reserved for use only by SGD.

If you enable support for audio, smart cards, or serial ports for Windows applications, your firewall must allow connections between SGD servers on TCP port 1024 and above. The protocol engines that manage these features run on the SGD server that hosts the user session and this might be a different server to the one that hosts the application session. If you do not use these features, it is best to disable support for them in SGD. See the following for more information:

• How to Enable the SGD Windows Audio Service

• How to Enable Smart Cards in SGD

• How to Enable Access to Serial Ports

Firewalls Between SGD Servers and Application Servers

An SGD server must be able to connect to an application server in order to run applications.

The ports used for connections between SGD servers and application servers depends on the application type and the connection method used to log in to the application server. Other ports are needed to provide support while using applications.

The following table lists the ports you might need to open to allow connections between SGD Servers and application servers.

For X applications, ports 6010 and above are only used if the connection method for X applications is Telnet or rexec. If the connection method is SSH, the connections use port 22. If you enable audio for X applications, all ports must be open between the application server and SGD. This is because the SGD audio daemon connects to the SGD server on random ports. This applies even if the connection method is SSH. See Audio for details.

Port 3579 is registered with IANA and is reserved for use only by SGD. You only need to open these ports if you are using SGD Advanced Load Management. See Application Load Balancing for details.

Other Firewalls

SGD needs to make connections to any authentication services and directory services you might be using.

The following table lists the ports you might need to open to allow connections between SGD Servers and other services.

Ports 88, 464, 3268, 3269 are only required if you are using Active Directory authentication. Ports 88 and 464 can use either the TCP or UDP protocol depending on the packet size and your Kerberos configuration. See Configuring SGD for Kerberos Authentication for details. Ports 3268 and 3269 are only used for SSL connections to Active Directory, see SSL Connections to Active Directory for details.

Ports 137 and 139 are only required if you are using a domain controller for authentication. See Windows Domain Authentication for details.

Ports 389 and 636 are only required if you are using an LDAP directory to establish a user’s identity or to assign applications to users. This applies to the following authentication mechanisms:

• Active Directory authentication, see Active Directory Authentication

• LDAP authentication, see LDAP Authentication

• Third-party using the LDAP search method, see Third-Party Authentication

Ports 1024 to 65535 are only required if you are using SecurID Authentication. For the RSA SecurID Authentication Manager to communicate with an SGD server acting as an Agent Host, all ports from 1024 to 65535 must be open from the IP addresses of the Master and Slave Authentication Managers to the IP addresses of all Agent Hosts. See SecurID Authentication for details.

Port 5500 is only required if you are using SecurID authentication. For the RSA SecurID Authentication Manager to communicate with an SGD server acting as an Agent Host, port 5500 must be open from the IP addresses of the Host Agents to the IP addresses of the Master and Slave Authentication Managers.