Guardium port requirements

Open ports

Ports used in/by the Guardium system.

DB Server – Collector

TCP 8443 - open from DB server to collector

TCP 16016 – Unix STAP, both directions, registration, heartbeat, and data (including IBM i S-TAP running in PASE)

TCP 16017 – Windows/Unix CAS, both directions, templates and data

TCP 16018 – Unix STAP (TLS), both directions, registration, heartbeat, and data

TCP 16019 – Windows/Unix CAS (TLS), both directions, templates and data

TCP 16020 - From STAP agent Clear UNIX STAP connection pooling

TLS 16021 - From STAP agent Encrypted UNIX STAP connection pooling

TCP 8081 – Guardium Installation Manager, both directions, database server to collector/Central Manager

TCP 9500 – Windows STAP, both directions, DB Server to Collector, STAP registration and data

TCP 9501 – Windows STAP (TLS), both directions, DB Server to Collector, STAP registration and data

Collector – Aggregator (Secure Shell – SSL)

TCP 22 – collector to aggregator, SCP data exports, both directions

Central Manager – Managed Devices

TCP 22 – SSH/SCP data transfers, both directions

TCP 8443 – SSL, both directions

TCP 8444 – SSL, STAP to GIM file upload

TCP 3306 – MySQL, opened to specific sources (for instance, the Central Manager is open to all managed units; a managed unit is open to the Central Manager)

TLS 8447 - Used for remote messaging service infrastructure (and profile distribution infrastructure) for communication between Guardium systems in the federated environment / centrally-managed environment. Configuration profiles allow the definition of configuration and scheduling settings from a Central Manager and conveniently distribute those settings to managed unit groups without altering the configuration of the Central Manager itself.

File Activity Monitoring (FAM)

TCP/TLS 16022/16023 - Universal Feed. 16022 (FAM monitoring, unencrypted) and 16023 (FAM monitoring, encrypted) both need to be open bidirectionally. The sniffer needs the block from 16016 to 16023 open bidirectionally.

18087 - Listener port for FAM on IBM Content Classification (ICM) server located on the same machine where FAM is installed.(serverSettings.icmURL=http://localhost:18087) Open bidirectionally.

Guardium Installation Manager (GIM)

8445 - GIM client listener, both directions. The GIM client is doing the listening. Any GIM server on either the Central Manager or the collector can reach out to it (the GIM client).

8446 - GIM authenticated TLS, both directions. Use between the GIM client and the GIM server (on the Central Manager or collector). If GIM_USE_SSL is NOT disabled, then the gim_client will attempt to communicate its certificate via port 8446. IF port 8446 is NOT open, then it defaults to 8444, BUT no certificate is passed (for example, TLS without verification).

8081 - TLS - To use 8081 for the GIM client to connect to the GIM server, there is a need to disable the GIM_USE_SSL parameter - it is ON by default. This parameter is part of the GIM common parameters in the GUI. If GIM_USE_SSL is NOT disabled, then the gim_client will attempt to communicate its certificate via port 8446. IF port 8446 is NOT open, then it defaults to 8444, BUT no certificate is passed (for example, TLS without verification).

Enterprise load balancer

TLS 8443 - S-TAP load balancer - This is needed for UNIX/Linux S-TAPs to communicate instances to the collector. However this port is also used for the Central Manager load balancer. The S-TAP initiates a request to Central Manager (load balancer) on 8443 sending HTTPS message, if installation indicates to use Enterprise load balancer. Between the database server and Central Manager, there will be the capability to use a proxy server, if customer doesn't want an open port directly from database to Central Manager.

Quick Search for Enterprise

TCP 8983 - SOLR - Incoming, SSL

TCP 9983 - SOLR - Incoming, SSL

User Interface – Guardium System (standalone, aggregator, Central Manager)

TCP 22 – user to system, CLI connectivity, both directions

TCP 8443 – user to system, GUI connectivity (configurable), both directions

System – SMTP server

TCP 25 – system to SMTP server, email alerts

System – SNMP server

UDP 161 - SNMP client to system – SNMP Polling

UDP 162 - system to SNMP server, SNMP traps

System – SYSLOG server

UDP/TCP 514 – remote syslog message from/to other systems, typically SIEMNote: The local port is 514, but the remote port must be entered into the configuration. If encryption is used, the protocol must be TCP, not UDP.

System – NTP server

TCP/UDP 123 – system to Network Time Protocol Server

System – DNS server

TCP/UDP 53 – system to Domain Name Server

System – EMC Centera (backups)

TCP 3218 – system to EMC Centera

System – Tivoli LDAP

UDP 389 – system to/from Tivoli LDAP

System – Mainframe

TCP 16022 – connects S-TAP to DB2 z/OS, S-TAP IMS, S-TAP VSAM (S-TAP Data Set)

TCP 16023 - TLS connections, specifically IBM‘s Application Transparent Transport Layer Security (AT-TLS)

Ports for connections to Windows database servers

Port	Protocol	Purpose
8075	UDP	Windows S-TAP heartbeat signal (two-way traffic). Note: The UNIX S-TAP agent does not use UDP for heartbeat signals, so there is no corresponding UNIX port for this function.
9500	TCP	Clear Windows S-TAP
9501	TLS	Encrypted Windows S-TAP (optional)
16017	TCP	Clear Windows CAS
16019	TLS	Encrypted Windows CAS (optional)

Default Ports Used for Guardium Application Access

Port	Protocol	Purpose
8443	TCP	Web browser access (https) to the Guardium user interface. Note: This port can be changed by the Guardium administrator, and is also used to register a managed unit to the Central Manager.
22	TCP	SSH access from clients to manage the Guardium appliance
3306	TCP	Communication between central manager and managed units

Ports for connections to z/OS database servers

Port	Protocol	Purpose
16022	TCP	Connects to S-TAP for DB2 z/OS, S-TAP for IMS, S-TAP for Data Sets
16023	TCP	TLS connections, specifically IBM's Application Transport Layer Security (AT-TLS)
41500	TCP	Default starting port for internal message logging communications – LOG_PORT_SCAN_START
39987	TCP	Default agent-specific communications port between the agent and the agent secondary address spaces – ADS_LISTENER_PORT

Default ports used for other features

Port	Protocol	Purpose
20, 21	TCP	FTP Server for backups/archiving (optional)
22	TCP	SCP for backups/archiving, patch distributions, and file-transfers
25	TCP	SMTP (email server) for alerts and other notification
53	TCP	DNS Servers
123	TCP, UDP	NTP (Time Server) for time synchronization
161	TCP, UDP	SNMP Polling (optional)
162	TCP, UDP	SNMP Traps (optional)
389	TCP	LDAP, for example, Active Directory or Sun One Directory
514	TCP	Syslog Server (optional)
636	TCP	LDAP, for example, Active Directory or Sun One Directory over SSL (optional)
1500	TCP	Tivoli Storage Manager backup hosts (optional)
3218	TCP, UDP	EMC Centera backup hosts (optional)
user-defined	TCP	Database Server listener ports, for example, 1521 for Oracle or 1433 for MS-SQL, for Guardium datasource access (optional). Use this port for S-TAP verification and Discovery.
16022/16023	TCP/TLS	Universal Feed - File Activity Monitoring (FAM0
18027		FAM using IBM Content Classification locally (serverSettings.icmURL=http://localhost:18087)
8445		GIM client listener, both directions The GIM client is doing the listening. Any GIM server on either the Central Manager or the collector can reach out to it (the GIM client).
8446	TLS	GIM authenticated TLS, both directions Use between the GIM client and the GIM server (on the Central Manager or collector). If GIM_USE_SSL is NOT disabled, then the gim_client will attempt to communicate its certificate via port 8446. IF port 8446 is NOT open, then it defaults to 8444 BUT no certificate is passed (for example, TLS without verification).
8447	TLS	Used for remote messaging service infrastructure (and profile distribution infrastructure) for communication between Guardium systems in the federated environment / centrally-managed environment. Configuration profiles allow the definition of configuration and scheduling settings from a Central Manager and conveniently distribute those settings to managed unit groups without altering the configuration of the Central Manager itself.
8443	TLS	Enterprise load balancer This is needed for UNIX/Linux S-TAPs to communicate instances to the collector. However this port is also used for the Central Manager load balancer. If the installation wants to use Enterprise load balancer, then the S-TAP initiates a request to the Central Manager on port 8443 by sending an HTTPS message. So between database server and Central Manager, there will be the capability to use a proxy server, if customer doesn't want an open port directly from database to Central Manager.
8081	TLS	To use 8081 for the GIM client to connect to the GIM server - need to disable the GIM_USE_SSL parameter - it is ON by default. This parameter is part of the GIM common parameters in the GUI. If GIM_USE_SSL is NOT disabled, then the gim_client will attempt to communicate its certificate via port 8446. IF port 8446 is NOT open, then it defaults to 8444 BUT no certificate is passed (for example, TLS without verification).
8983	TCP	SOLR, incoming, SSL (Quick Search for Enterprise)
9983	TCP	SOLR, incoming, SSL (Quick Search for Enterprise)