Data Security ports

Deployment and Installation Center | Data Security Solutions | Version 7.8.x

In this topic

Human interface device (administrator client)

Crawler agent (discovery and fingerprinting)

Data Security manager

Supplemental Data Security server

Web Content Gateway

Email Security Gateway

The most robust and effective implementation of Data Security depends on certain ports being open to support the mechanics of the software. The ports for Data Security components are 17500-17515 by default. These ports must be left open for all Data Security software and hardware configurations.

If you have a security policy in place, exclude these ports from that policy so that Data Security can operate properly. If you do not, the policy you have in place may disrupt Data Security functionality.

The tables in the rest of this section list the inbound and outbound ports required for each Data Security component. (Note that TRITON - Data Security refers to the user interface service. Data Security Management Server refers to the management service, MGMDT.)

You can lock down or "harden" your security systems once these ports are open.


	Important Data Security agents and machines with a policy engine, such as a Data Security Server or Websense Content Gateway machine, must have direct connection to the Data Security Management Server (on the TRITON management server). When deployed in a DMZ or behind a firewall, the relevant ports must be allowed.

Human interface device (administrator client)


Outbound
To	Port	Purpose
TRITON - Data Security	19448	User interface browsing
TRITON - Data Security	9443	User interface browsing
TRITON - Data Security	3389	Remote desktop
Protector	22	SSH
Inbound
None

Data Endpoint client


Outbound
To	Port	Purpose
Data Security Server	443*	Connect to Endpoint Server
Data Security Server	80**	Connect to Endpoint Server
* You can choose between secured and unsecured connection. The default is secured (HTTPS, port 443). ** Optional
Inbound
None

Data Endpoint server


Outbound
To	Port	Purpose
Data Security Management Server	443	Retrieve fingerprints and natural language processing scripts
Data Security Management Server	17443	Incidents
Inbound
From	Port	Purpose
Data Security Management Server	443	Retrieve fingerprints and natural language processing scripts
Endpoint Client	80	Incidents
Supplemental Data Security Server	17444	Retrieve fingerprints and natural language processing scripts

Printer agent


Outbound
To	Port	Purpose
Data Security Management Server	443	Secure communications
Data Security Management Server	17500-17515*	Consecutive ports that allow communication with Websense agents and machines.
Data Security Management Server	17443	Incidents
Data Security Server	17500-17515*	Consecutive ports that allow communication with Websense agents and machines.
* This range is necessary for load balancing.
Inbound
None

ISA/TMG agent


Outbound
To	Port	Purpose
Data Security Management Server	443	Secure communications
Data Security Management Server	17500-17515*	Consecutive ports that allow communication with Websense agents and machines.
Data Security Server	17500-17515*	Consecutive ports that allow communication with Websense agents and machines.
Internet gateway	80	For HTTP connections
* This range is necessary for load balancing.
Inbound
None

SMTP agent


Outbound
To	Port	Purpose
Data Security Management Server	17500-17515*	Consecutive ports that allow communication with Websense agents and machines.
Data Security Server	17500-17515*	Consecutive ports that allow communication with Websense agents and machines.
Next hop MTA	25**	SMTP for inbound/outbound traffic
* This range is necessary for load balancing. ** This is default. Other port can be configured.
Inbound
From	Port	Purpose
Previous MTA	25*	SMTP for inbound/outbound traffic
* This is default. Other port can be configured.

Web Security manager


Outbound
To	Port	Purpose
Data Security Management Server	56992	Linking Service
Inbound
From	Port	Purpose
TRITON - Data Security, Data Security Server, Protector, Web Content Gateway	56992	Linking Service

Crawler agent (discovery and fingerprinting)


Outbound
To	Port	Purpose
Data Security Management Server	443	Secure communication
Data Security Server	17500-17515*	Consecutive ports that allow communication with Websense agents and machines.
Internet	443	Salesforce fingerprinting
* This range is necessary for load balancing.
Inbound
From	Port	Purpose
Data Security Management Server	9797*	Crawler listening
* This is only for the standalone crawler agent.

Exchange server


Outbound
None
Inbound
From	Port	Purpose
Data Security Server, Crawler Agent (Discovery and Fingerprinting)	80	Exchange discovery
Data Security Server, Crawler Agent (Discovery and Fingerprinting)	443	Exchange discovery

File server


Outbound
None
Inbound
From	Port	Purpose
Crawler Agent (Discovery and Fingerprinting)	139	File sharing access
Crawler Agent (Discovery and Fingerprinting)	445	File sharing access

SharePoint server


Outbound
None
Inbound
From	Port	Purpose
Crawler Agent (Discovery and Fingerprinting)	80	File sharing access
Crawler Agent (Discovery and Fingerprinting)	443	File sharing access

Database server


Outbound
To	Port	Purpose
Crawler Agent (Discovery and Fingerprinting)	Varies	The port that allows connection to the database (according to database type)
Inbound
From	Port	Purpose
Crawler Agent (Discovery and Fingerprinting)	Varies	The port that allows connection to the database (according to database type)

Data Security manager


Outbound
Data Security Server, Protector, Web Content Gateway, Email Security Gateway	17500-17515 and 17700-17715*	Consecutive ports that allow communication with Websense agents and machines.
Inbound
From	Port	Purpose
Data Security Server, Protector, Web Content Gateway	17443*	Incidents
Data Security Server, Protector, Web Content Gateway	139	File sharing
Data Security Server, Protector, Web Content Gateway	443	Secure communication
Data Security Server, Protector, Web Content Gateway	445	File sharing
Data Security Server, Protector, Web Content Gateway	8453	User repository
Data Security Server, Protector, Web Content Gateway	8005	Tomcat server
Data Security Server, Protector, Web Content Gateway, Email Security Gateway	17500-17515 and 17700-17715*	Consecutive ports that allow communication with Websense agents and machines.
Data Security Server, Protector, Web Content Gateway	9443*	Access user interface
Data Security Server, Protector, Web Content Gateway	19448*	HTTP access to user interface
* This port should be left open. It is not configurable. This range is necessary for load balancing. *Used when Web Content Gateway and Email Security Gateway are both installed.

Supplemental Data Security server


Outbound
To	Port	Purpose
Data Security Management Server	17443	Incidents
Data Security Management Server	17500-17515*	Consecutive ports that allow communication with Websense agents and machines.
* This range is necessary for load balancing.
Inbound
From	Port	Purpose
Data Security Management Server	8892	Syslog
Data Security Management Server	139	File sharing
Data Security Management Server	445	File sharing
Data Security Management Server	17500-17515*	Consecutive ports that allow communication with Websense agents and machines.
* This range is necessary for load balancing.

Web Content Gateway


Outbound
To	Port	Purpose
Data Security Management Server	80	Fingerprint sync
Data Security Management Server	17443	Syslog, forensics, incidents, mobile status
Websense Web Security	56992	Linking Service
Data Security Server	17500-17515*	Consecutive ports that allow communication with Websense agents and machines.
* This range is necessary for load balancing.
Inbound
None

Email Security Gateway

The following ports are used on the appliance for outbound connections to TRITON - Data Security.


Outbound
To	Port	Purpose
Data Security Management Server	17500-17515* and 17700-17715**	Settings deployment, fingerprint repository
Data Security Management Server	17443	Syslog, forensics, incidents
Data Security Management Server	17444	Used to pull configuration settings
Data Security Management Server	80	Fingerprint repository sync
Data Security Server	17500-17515* and 17700-17715**	MGMTD
* This range is necessary for load balancing. **Used when Web Content Gateway and Email Security Gateway are both installed.

Protector


Outbound
To	Port	Purpose
Data Security Server	17500-17515*	Consecutive ports that allow communication with Websense agents and machines.
Data Security Management Server	80	Fingerprint sync
Data Security Management Server	17443	Syslog, forensics, incidents, mobile status
Next hop MTA	25**	SMTP
Websense Web Security	56992	Linking Service
Other	UDP 123	Inbound/ outbound NTPD (available on the appliance yet disabled by default)
* This range is necessary for load balancing. ** Explicit MTA
Inbound
From	Port	Purpose
Data Security Management Server	17500-17515*	Consecutive ports that allow communication with Websense agents and machines.
Anywhere (including TRITON - Data Security)	22	SSH access
Data Security Server	17500-17515*	Consecutive ports that allow communication with Websense agents and machines.
Explicit MTA	25**	SMTP
Explicit MTA	10025**	SMTP, mail analysis
* This range is necessary for load balancing. ** Explicit MTA

ICAP client


Outbound
To	Port	Purpose
Protector	1344	Receiving ICAP traffic
Inbound
None

Mobile agent


Outbound
To	Port	Purpose
Data Security Management Server	17443	Syslog, forensics, incidents, mobile status
Data Security Management Server	80	Fingerprint sync
Data Security Server	17500-17515*	Consecutive ports that allow communication with Websense agents and machines.
Microsoft Exchange Server	80/443	ActiveSync (user defined using TRITON - Data Security)
Websense Web Security	56992	Linking Service
Other	UDP 123	Inbound/ outbound NTPD (available on the appliance yet disabled by default)
* This range is necessary for load balancing.
Inbound
From	Port	Purpose
Data Security Management Server	5820	Settings deployment
Mobile Devices	80/443	ActiveSync (user defined using TRITON - Data Security)
Data Security Management Server	8892	Management
Data Security Management Server	17500-17515*	Consecutive ports that allow communication with Websense agents and machines.
Anywhere (including the Mobile agent)	22	SSH access
Data Security Server	5443	Release quarantined messages
* This range is necessary for load balancing.

FCI agent


Outbound
To	Port	Purpose
Data Security Management Server	443	Secure communications
Data Security Management Server	17500-17515*	Consecutive ports that allow communication with Websense agents and machines.
Data Security Server	17500-17515*	Consecutive ports that allow communication with Websense agents and machines.
* This range is necessary for load balancing.
Inbound
Microsoft FSRM	5985	Microsoft File Server Resource Manager (FSRM)