Which network ports do the clients use? (4283823)

Which network ports do the Authentication Services Client use?

Which network ports do the Authentication Services Unix/Linux/MacOSX clients use?

What ports need to be opened in a DMZ or when using a firewall?

As Authentication Services uses Active Directory for authentication and identity lookups, the networking infrastructure must allow the client to communicate with Active Directory. When designing firewalls and other network infrastructure, ensure that the following ports between client and Active Directory Domain Controllers are open:

vasd
REQUIRED

• 88 - TCP (Kerberos traffic)
• 389 - TCP (Kerberized LDAP - queries)
• 389 - UDP (Kerberized LDAP - ping)
• 464 - TCP (Kerberos - password changes)
• 3268 - TCP (Global Catalog LDAP)

OPTIONAL

• 53 - TCP/UDP (DNS - used to receive DNS SRV records not required if joining to specific Domain Controllers)
• 123 - UDP (NTP - used to synchronise time between Active Directory and Authentication Services clients)

Unless specific Domain Controllers are specified during the join, Authentication Services will also need to communicate to the Forest root servers using the following ports:-

• 88 / 389 / 3268

LDAP traffic generated via vas_attrs_find (over 389) is encrypted by Kerberos

vgptool

• 445 - TCP (CIFS)

NOTE: All these ports are OUTGOING from Authentication Services Clients -> Active Directory. Authentication services, by default, operates as a client, initiating connections. It does not require any firewall exceptions for incoming traffic.