Forcepoint DLP ports

Deployment and Installation Center | Forcepoint DLP | v8.4.x

In this topic

Data Security module of the Security Manager (administrator client)

Forcepoint DLP Endpoint client

Forcepoint DLP Endpoint server

Web Security module of the Security Manager

Crawler agent (discovery and fingerprinting)

Forcepoint management server

Supplemental Forcepoint DLP server

Web Content Gateway

Forcepoint Email Security

The most robust and effective implementation of Forcepoint DLP depends on certain ports being open to support the mechanics of the software. The ports for Forcepoint DLP components are 17500-17515 by default. These ports must be left open for all Forcepoint DLP software and hardware configurations.

If you have a security policy in place, exclude these ports from that policy so that Forcepoint DLP can operate properly. If you do not, the policy you have in place may disrupt Forcepoint DLP functionality.

The tables in the rest of this section list the inbound and outbound ports required for each Forcepoint DLP component.

You can lock down or "harden" your security systems once these ports are open.


	Important Forcepoint DLP agents and machines with a policy engine, such as a Forcepoint DLP Server or Content Gateway machine, must have direct connection to the Forcepoint management server. When deployed in a DMZ or behind a firewall, the relevant ports must be allowed.

Data Security module of the Security Manager (administrator client)


Outbound
To	Port	Purpose
Data Security module	19448	User interface browsing
Data Security module	9443	User interface browsing
Data Security module	3389	Remote desktop
Protector	22	SSH

Forcepoint DLP Endpoint client


Outbound
To	Port	Purpose
Forcepoint DLP Server	443	Connect to endpoint server (secure connection, default)
Forcepoint DLP Server	80	Connect to endpoint server (unsecured connection, if enabled)

Forcepoint DLP Endpoint server


Outbound
To	Port	Purpose
Forcepoint management server	443	Retrieve fingerprints and natural language processing scripts
Forcepoint management server	17443	Incidents
Inbound
From	Port	Purpose
Forcepoint management server	443	Retrieve fingerprints and natural language processing scripts
Forcepoint DLP Endpoint Client	80, 443	Incidents
Supplemental Forcepoint DLP Server	17444	Retrieve fingerprints and natural language processing scripts

Web Security module of the Security Manager


Outbound
To	Port	Purpose
Forcepoint management server	56992	Linking Service
Inbound
From	Port	Purpose
Security Manager, Forcepoint DLP Server, Protector, Web Content Gateway	56992	Linking Service

Crawler agent (discovery and fingerprinting)


Outbound
To	Port	Purpose
Forcepoint management server	443	Secure communication
Forcepoint DLP Server	17500-17515	Consecutive ports that allow communication with Forcepoint agents and machines The range is needed for load balancing.
Internet	443	Salesforce fingerprinting
Inbound
From	Port	Purpose
Forcepoint management server	9797	Crawler listening The port is used only for the standalone crawler agent.

Exchange server


Inbound
From	Port	Purpose
Forcepoint DLP Server, Crawler Agent (Discovery and Fingerprinting)	80	Exchange discovery
Forcepoint DLP Server, Crawler Agent (Discovery and Fingerprinting)	443	Exchange discovery

File server


Inbound
From	Port	Purpose
Crawler Agent (Discovery and Fingerprinting)	139	File sharing access
Crawler Agent (Discovery and Fingerprinting)	445	File sharing access

SharePoint server


Inbound
From	Port	Purpose
Crawler Agent (Discovery and Fingerprinting)	80	File sharing access
Crawler Agent (Discovery and Fingerprinting)	443	File sharing access

Database server


Outbound
To	Port	Purpose
Crawler Agent (Discovery and Fingerprinting)	Varies	The port that allows connection to the database (according to database type)
Inbound
From	Port	Purpose
Crawler Agent (Discovery and Fingerprinting)	Varies	The port that allows connection to the database (according to database type)

Forcepoint management server


Outbound
Forcepoint DLP Server, Protector, Web Content Gateway, Forcepoint Email Security	17500-17515 and 17700-17715	Consecutive ports that allow communication with Forcepoint agents and machines. A range is necessary for load balancing. The second range is used when Web Content Gateway and Forcepoint Email Security are both installed.
Inbound
From	Port	Purpose
Forcepoint DLP Endpoint	80	Configuration
Forcepoint DLP Server, Protector, Web Content Gateway	17443	Incidents This port should be left open. It is not configurable.
Security Manager	17447	Processing batch jobs such as scheduled tasks
Security Manager	17446	Translating messages into sender/receiver protocols
Crawler	17514	Enabling emailed reports for discovery tasks
Forcepoint DLP Server, Protector, Web Content Gateway	139	File sharing
Forcepoint DLP Server, Protector, Web Content Gateway	443	Secure communication
Forcepoint DLP Server, Protector, Web Content Gateway	445	File sharing
Forcepoint DLP Server, Protector, Web Content Gateway	8453	User repository
Forcepoint DLP Server, Protector, Web Content Gateway	8005	Tomcat server
Forcepoint DLP Server, Protector, Web Content Gateway, Forcepoint Email Security	17500-17515 and 17700-17715	Consecutive ports that allow communication with Forcepoint agents and machines. A range is necessary for load balancing. The second range is used when Web Content Gateway and Forcepoint Email Security are both installed.
Forcepoint DLP Server, Protector, Web Content Gateway	9443	Access user interface This port should be left open. It is not configurable.
Forcepoint DLP Server, Protector, Web Content Gateway	19448	HTTP access to user interface This port should be left open. It is not configurable.

Supplemental Forcepoint DLP server


Outbound
To	Port	Purpose
Forcepoint management server	17443	Incidents
Forcepoint management server	17500-17515	Consecutive ports that allow communication with Forcepoint agents and machines. The range is needed for load balancing.
Inbound
From	Port	Purpose
Forcepoint management server	8892	Syslog
Forcepoint management server	139	File sharing
Forcepoint management server	445	File sharing
Forcepoint management server	17500-17515	Consecutive ports that allow communication with Forcepoint agents and machines. The range is needed for load balancing.

Web Content Gateway


Outbound
To	Port	Purpose
Forcepoint management server	80	Fingerprint sync
Forcepoint management server	17443	Syslog, forensics, incidents, mobile status
Web protection components	56992	Linking Service
Forcepoint DLP Server	17500-17515	Consecutive ports that allow communication with Forcepoint agents and machines. The range is needed for load balancing.

Forcepoint Email Security

The following ports are used on the appliance for outbound connections to Forcepoint DLP.


Outbound
To	Port	Purpose
Forcepoint management server	17500-17515 and 17700-17715	Settings deployment, fingerprint repository A range is needed for load balancing. The second range is used when Web Content Gateway and Forcepoint Email Security are both installed.
Forcepoint management server	17443	Syslog, forensics, incidents
Forcepoint management server	17444	Used to pull configuration settings
Forcepoint management server	80	Fingerprint repository sync
Forcepoint DLP Server	17500-17515 and 17700-17715	MGMTD A range is needed for load balancing. The second range is used when Web Content Gateway and Forcepoint Email Security are both installed.

Protector


Outbound
To	Port	Purpose
Forcepoint DLP Server	17500-17515	Consecutive ports that allow communication with Forcepoint agents and machines. The range is needed for load balancing.
Forcepoint management server	80	Fingerprint sync
Forcepoint management server	17443	Syslog, forensics, incidents, mobile status
Next hop MTA	25	SMTP (explicit MTA)
Forcepoint Web Security	56992	Linking Service
Other	UDP 123	Inbound/ outbound NTPD (available on the appliance yet disabled by default)
Inbound
From	Port	Purpose
Forcepoint management server	17500-17515	Consecutive ports that allow communication with Forcepoint agents and machines. The range is needed for load balancing.
Anywhere (including Security Manager)	22	SSH access
Forcepoint DLP Server	17500-17515	Consecutive ports that allow communication with Forcepoint agents and machines. The range is needed for load balancing.
Explicit MTA	25	SMTP
Explicit MTA	10025	SMTP, mail analysis

Cloud agent


Outbound
To	Port	Purpose
Cloud apps	443	Secure communication with cloud applications (OneDrive)
Forcepoint management server	17500-17515	Communication with all Forcepoint DLP components
Inbound
Cloud apps	8080, 443	Notifications from cloud applications (no sensitive data is passed on non-secure channels)
Forcepoint management server	17500-17515	Communication with all Forcepoint DLP components
Any service (including the cloud agent) that is not using logging on	22	Manage VM by SSH

ICAP client


Outbound
To	Port	Purpose
Protector	1344	Receiving ICAP traffic

Mobile agent


Outbound
To	Port	Purpose
Forcepoint management server	17443	Syslog, forensics, incidents, mobile status
Forcepoint management server	80	Fingerprint sync
Forcepoint DLP Server	17500-17515	Consecutive ports that allow communication with Forcepoint agents and machines. The range is needed for load balancing.
Microsoft Exchange Server	80/443	ActiveSync
Forcepoint Web Security	56992	Linking Service
Other	UDP 123	Inbound/ outbound NTPD (available on the appliance yet disabled by default)
Inbound
From	Port	Purpose
Forcepoint management server	5820	Settings deployment
Mobile Devices	80/443	ActiveSync
Forcepoint management server	8892	Management
Forcepoint management server	17500-17515	Consecutive ports that allow communication with Forcepoint agents and machines. The range is needed for load balancing.
Anywhere (including the Mobile agent)	22	SSH access
Forcepoint DLP Server	5443	Release quarantined messages

FCI agent


Outbound
To	Port	Purpose
Forcepoint management server	443	Secure communications
Forcepoint management server	17500-17515	Consecutive ports that allow communication with Forcepoint agents and machines. The range is needed for load balancing.
Forcepoint DLP Server	17500-17515	Consecutive ports that allow communication with Forcepoint agents and machines. The range is needed for load balancing.
Inbound
Microsoft FSRM	5985	Microsoft File Server Resource Manager (FSRM)

Analytics engine

The following ports must be kept open on the server running the analytics engine:


Outbound
To	Port	Purpose
Forcepoint management server	17443	Syslog, forensics, incidents, analytics engine status
Forcepoint management server	17500-17515	Consecutive ports that allow communication with Forcepoint agents and machines. The range is needed for load balancing.
Forcepoint management server (local database) or remote SQL Server	1433	Database connection
Inbound
From	Port	Purpose
Forcepoint management server	17500-17515	Consecutive ports that allow communication with Forcepoint agents and machines. The range is needed for load balancing.