1.4. Firewalls

Firewalls can be used to protect various parts of a network and must be configured to allow the connections required by SGD.

This section includes the following topics:

1.4.1. Firewalls Between Client Devices and SGD Servers

Client devices must be able to make HTTP and AIP connections to any SGD server in the array. This is because a user's SGD session and a user's application sessions can be hosted on different SGD servers.

The following table lists the ports you might need to open to allow connections between client devices and SGD servers.

Source

Destination

Port

Protocol

Purpose

Client

SGD web server

80

TCP

Standard, unencrypted HTTP requests and responses.

Used to display webtops and for web services.

Client

SGD web server

443

TCP

Secure, encrypted HTTPS requests and responses.

Used to display webtops and for web services.

Client

SGD server

3144

TCP

Standard, unencrypted AIP connections.

Used for control and application display updates.

Client

SGD server

5307

TCP

SSL-based secure, encrypted AIP connections.

Used for control and application display updates.

TCP ports 80 and 443 are the Internet-standard ports for HTTP and HTTPS. Port 443 is only used if HTTPS is enabled on the SGD web server. You can configure the SGD web server to use any port.

For a default installation in secure mode, where you enable SGD security services and use HTTPS, only ports 443 and 5307 must be open in the firewall.

For an installation in non-secure mode, where connections are not secured, ports 80, 3144, and 5307 must be open in the firewall. This is because the SGD Client initially makes a secure connection on port 5307. After the connection is established, the connection is then downgraded to a standard connection on port 3144. See Section 1.5.2, “Firewall Traversal” for how to configure SGD when these ports cannot be opened.

Ports 3144 and 5307 are registered with the Internet Assigned Numbers Authority (IANA) and are reserved for use only by SGD.

1.4.2. Firewalls Between SGD Servers

A network might contain firewalls between the SGD servers in an array, for example if you have multiple offices each containing an SGD server. The SGD servers in an array must be able to connect to any other member of the array.

The following table lists the ports you might need to open to allow connections between SGD Servers.

Source

Destination

Port

Protocol

Purpose

SGD server

Another SGD server

515

TCP

Used when moving print jobs from one SGD server to another using the tarantella print move command.

SGD server

Another SGD server

1024 and above

TCP

Used to support audio, smart cards and serial ports for Windows applications.

SGD server

Another SGD server

5427

TCP

Used for connections between SGD servers to allow array replication, and sharing of both static and dynamic data across the array.

Port 5427 is registered with IANA and is reserved for use only by SGD.

If you enable support for audio, smart cards, or serial ports for Windows applications, your firewall must allow connections between SGD servers on TCP port 1024 and above. The protocol engines that manage these features run on the SGD server that hosts the user session and this might be a different server to the one that hosts the application session. If you do not use these features, it is best to disable support for them in SGD. See the following for more information:

1.4.3. Firewalls Between SGD Servers and Application Servers

An SGD server must be able to connect to an application server in order to run applications.

The ports used for connections between SGD servers and application servers depends on the application type and the connection method used to log in to the application server. Other ports are needed to provide support while using applications.

The following table lists the ports you might need to open to allow connections between SGD Servers and application servers.

Source

Destination

Port

Protocol

Purpose

SGD server

Application server

22

TCP

Used to connect to X and character applications using SSH.

SGD server

Application server

23

TCP

Used to connect to Windows, X, and character applications using Telnet.

Application server

SGD server

139

TCP

Used for UNIX and Linux platform client drive mapping services. The server binds to this port at start-up, whether or not client drive mapping services are enabled.

Application server

SGD server

515

TCP

Used to send print jobs from the application server to an SGD server.

SGD server

Application server

3389

TCP

Used to connect to Windows applications that use the Microsoft RDP protocol.

SGD server

Application server

3579

TCP

Used for connections between the primary SGD server and the SGD load balancing service on an application server.

Application server

SGD server

3579

UDP

Used for connections between the SGD load balancing service on an application server and the primary SGD server.

SGD server

Application server

5999

TCP

Used to connect to Windows applications, if the application is configured to use the Wincenter protocol and the connection method is Telnet. The Wincenter protocol is no longer supported but might be used by legacy Windows application objects.

Application server

SGD server

6010 and above

TCP

Used to connect X applications to the protocol engines on the SGD server.

For X applications, ports 6010 and above are only used if the connection method for X applications is Telnet. If the connection method is SSH, the connections use port 22. If you enable audio for X applications, all ports must be open between the application server and SGD. This is because the SGD audio daemon connects to the SGD server on random ports. This applies even if the connection method is SSH. See Section 5.3, “Audio” for details.

Port 3579 is registered with IANA and is reserved for use only by SGD. You only need to open these ports if you are using SGD Advanced Load Management. See Section 7.2.3, “Application Load Balancing” for details.

1.4.4. Other Firewalls

SGD needs to make connections to any authentication services and directory services you might be using.

The following table lists the ports you might need to open to allow connections between SGD Servers and other services.

Source

Destination

Port

Protocol

Purpose

SGD server

Windows server

88

TCP or UDP

Used to authenticate users in an Active Directory forest.

SGD server

LDAP directory server

389

TCP

Used to authenticate users, or to assign applications to users, using a Lightweight Directory Access Protocol (LDAP) directory.

SGD server

Windows server

464

TCP or UDP

Used to enable users to change their password if it has expired.

SGD server

LDAP directory server

636

TCP

Used to authenticate users, or to assign applications to users, using a secure connection (LDAPS) to an LDAP directory.

SecurID Authentication Manager

SGD server

1024 to

65535

UDP

Used to authenticate users using SecurID.

SGD server

Windows server

3268

TCP

Used to authenticate users in an Active Directory forest.

SGD server

Windows server

3269

TCP

Used to authenticate users in an Active Directory forest.

SGD server

SecurID Authentication Manager

5500

UDP

Used to authenticate users using SecurID.

Ports 88, 464, 3268, 3269 are only required if you are using Active Directory authentication. Ports 88 and 464 can use either the TCP or UDP protocol depending on the packet size and your Kerberos configuration. See Section 2.2.4, “Configuring SGD for Kerberos Authentication” for details. Ports 3268 and 3269 are only used for SSL connections to Active Directory, see Section 2.2.3.5, “SSL Connections to Active Directory” for details.

Ports 389 and 636 are only required if you are using an LDAP directory to establish a user's identity or to assign applications to users. This applies to the following authentication mechanisms:

Ports 1024 to 65535 are only required if you are using SecurID Authentication. For the RSA SecurID Authentication Manager to communicate with an SGD server acting as an Agent Host, all ports from 1024 to 65535 must be open from the IP addresses of the Master and Slave Authentication Managers to the IP addresses of all Agent Hosts. See Section 2.5, “SecurID Authentication” for details.

Port 5500 is only required if you are using SecurID authentication. For the RSA SecurID Authentication Manager to communicate with an SGD server acting as an Agent Host, port 5500 must be open from the IP addresses of the Host Agents to the IP addresses of the Master and Slave Authentication Managers.