Safeguard Authentication Services must be able to communicate with Active Directory, including domain controllers, global catalogs, and DNS servers using Kerberos, LDAP, and DNS protocols. The following table summarizes the network ports that must be open and their function.
| Port | Function |
|---|---|
|
389 |
Used for LDAP searches against Active Directory Domain Controllers. TCP is normally used, but UDP is used when detecting Active Directory site membership. |
|
3268 |
Used for LDAP searches against Active Directory Global Catalogs. TCP is always used when searching against the Global Catalog. |
|
88 |
Used for Kerberos authentication and Kerberos service ticket requests against Active Directory Domain Controllers. TCP is used by default. |
|
464 |
Used for changing and setting passwords against Active Directory using the Kerberos change password protocol. Safeguard Authentication Services always uses TCP for password operations. |
|
53 |
Used for DNS. Since Safeguard Authentication Services uses DNS to locate domain controllers, DNS servers used by the UNIX hosts must serve Active Directory DNS SRV records. Both UDP and TCP are used. |
|
123 |
UDP only. Used for time-synchronization with Active Directory. |
|
445 |
CIFS port used to enable the client to retrieve configured group policy. |
NOTE: Safeguard Authentication Services, by default, operates as a client, initiating connections. It does not require any firewall exceptions for incoming traffic.