Understanding Firewall Requirements for System Center Operations Manager 2007 R2

We’re frequently asked what firewall ports need to be opened and what protocols are communicated between servers in a System Center Operations Manager envrionment.  This gets a little more detailed than many people might care to know about, however it’s amazing how often we have to dig this up and forward to people when designing or rolling out OpsMgr, so here you go…

OpsMgr servers that are deployed across a firewall have special considerations that must be taken into account. Port 5723, the default port for OpsMgr communications, must specifically be opened on a firewall to allow OpsMgr to communicate across it.

The following Table describes communication ports for this and other OpsMgr components.  The first reference is FROM, the second reference is TO, and the third reference is PORT:

Agent    Root Management Server  5723

Agent    Management server  5723

Agent    Gateway server   5723

Agent (ACS forwarder)  Management server ACS collector 51909

Gateway server   Root Management Server  5723

Gateway server   Management server  5723

Management or Gateway server UNIX or Linux computer  1270

Management or Gateway server UNIX or Linux computer  22

Management server  Operations Manager database 1433

Management server  Root Management Server  5723, 5724

Management server  Reporting data warehouse 1433

Management server ACS collector ACS database   1433

Operations Console  Root Management Server  5724

Operations Console (reports) SQL Server Reporting Services 80

Reporting Server  Root Management Server  5723, 5724

Reporting Server  Reporting data warehouse 1433

Root Management Server  Operations Manager database 1433

Root Management Server  Reporting data warehouse 1433

Web console browser  Web console server  51908

Web console server  Root Management Server  5724

The firewall port for the agents is the port that needs to be opened most often, which is only port 5723 from the agent to the management servers for monitoring. Other ports, such as 51909 for ACS, are more rarely needed.

This posting is 1 of a monthlong series of postings on the Microsoft System Center family of products. This is an excerpt from my book “System Center Enterprise Unleashed” with more postings on the System Center family of products up at http://www.networkworld.com/community/morimoto