Required Ports. NetIQ 3.2 SP3
Advertentie
Advertentie
4
Setting Up Firewalls
Access Manager is not a firewall; it should be used with firewalls. Figure 4‐1
illustrates a simple firewall setup for a basic Access Manager configuration of an Identity Server, an Access Gateway, and an Administration Console.
Figure 4-1 Access Manager Components between Firewalls
LDAP Server
First
Firewall
Identity Server
Second
Firewall
Browsers
Access Gateway Administration
Console
Web Servers
The first firewall separates the Access Manager components from the Internet, allowing browsers to access the resources through specific ports. The second firewall separates the Access Manager components from the Web servers they are protecting and the Administration Console.This is one of many configurations possible. This section describes the following:
Section 4.1, “Required Ports,” on page 69
Section 4.3, “Sample Configurations,” on page 78
4.1
Required Ports
The following tables list the ports that need to be opened when a firewall separates one component from another. Some combinations appear in more than one table, but this allows you to discover the required ports whether you are thinking that a firewall is separating an Access Gateway from the
Administration Console or that a firewall is separating an Administration Console from the Access
Gateway.
With these tables, you should be able to place the Access Manager components of your system anywhere within your existing firewalls and know which ports need to be opened in the firewall.
Setting Up Firewalls 69
Table 4-1 When a Firewall Separates an Access Manager Component from a Global Service
Component
NTP Server
DNS Servers
Remote Linux Administration
Workstation
Remote Windows Administration
Workstation
Port
UDP 123
UDP 53
TCP 22
Configurable
Description
Access Manager components must have time synchronized or authentication fails. We highly recommend that all components be configured to use an NTP (network time protocol) server.
Depending upon where your NTP server is located in relationship to your firewalls, you might need to open UDP 123 so that the Access Manager component can use the NTP server.
Access Manager components must be able to resolve DNS names. Depending upon where your
DNS servers are located, you might need to open
UDP 53 so that the Access Manager component can resolve DNS names.
If you use SSH for remote administration and want to use it for remote administration of Access
Manager components, you need to open TCP 22 to allow communication from your remote administration workstation to your Access Manager components.
If you use RDP or VNC for remote administration and want to use it for remote administration of
Access Manager components, you need to open the ports required by your application from the remote administration workstation to your Access
Manager components. You need to open ports for console access and for file sharing.
For console access, VNC usually uses TCP 5901 and RDP uses TCP 3389. For file sharing, UDP
135-139 are the default ports.
Table 4-2 When a Firewall Separates the Administration Console from a Component
Component
Access Gateway, Identity Server,
SSL VPN, or J2EE Agent
Port
TCP 1443
TCP 8444
TCP 1289
TCP 524
TCP 636
Description
For communication from the Administration Console to the devices.
For communication from the devices to the
Administration Console.
For communication from the devices to the Audit server on the Administration Console.
For NCP certificate management with NPKI. The port needs to be opened so that both the device and the Administration Console can use the port.
For secure LDAP communication from the devices to the Administration Console.
70 NetIQ Access Manager 3.2 SP3 Setup Guide
Component
Importing an Access Gateway
Appliance
LDAP User Store
Administration Console
Browsers
Port
ICMP
TCP 524
TCP 524
TCP 636
TCP 427
TCP 8080, 8443
TCP 8080
TCP 8443, 2443,
2080.
TCP 8028, 8030
Description
During an import, the Access Gateway Appliance sends two pings through ICMP to the Administration
Console. When the import has finished, you can disable the ICMP echo requests and echo replies.
Required only if the user store is eDirectory. When configuring a new eDirectory user store, NCP is used to enable Novell SecretStore by adding a
SAML authentication method and storing a public key for the Administration Console. It is not used in day-to-day operations.
Required to synchronize the configuration data store.
Required for secure LDAP communication.
Used for SLP (Service Location Protocol) communication.
Used for Tomcat communication.
For HTTP communication from the browsers to the
Administration Console.
For HTTPS communication from the browsers to the Administration Console.
NOTE: 2443 and 2080 are optional ports required when the Administration Console and Identity
Server are collocated.
To use iMonitor or DSTrace from a client to view information about the configuration store on the
Administration Console.
Table 4-3 When a Firewall Separates the Identity Server from a Component
Component
Access Gateway
Port Description
TCP 8080 or 8443 For authentication communication from the Access
Gateway to the Identity Server. The default ports for the Identity Server are TCP 8080 and 8443. They are configurable. You need to open the port that you configured for the Base URL of the Identity Server.
TCP 80 or 443 For communication from the Identity Server to the
Embedded Service Provider of the Access
Gateway. This is the reverse proxy port that is assigned to be Embedded Service Provider (see the Reverse Proxy /Authentication page). This is usually either port 80 or 443.
Setting Up Firewalls 71
Component
ESP Enabled SSL VPN
Traditional SSL VPN
J2EE Agent
Administration Console
Identity Server
LDAP User Stores
Port Description
TCP 8080 or 8443 For authentication communication from the SSL
VPN server to the Identity Server. TCP 8080 and
8443 are the default ports for the Identity Server.
They are configurable. You need to open the port of the Base URL of the Identity Server.
Also for communication from the Identity Server to the Embedded Service Provider of the SSL VPN server. This is the Embedded Service Provider
Base URL on the Configuration page. The default values are TCP 8080 and 8443.
N/A. The traditional SSL VPN server never communicates directly with the Identity Server.
TCP 8080 or 8443 For authentication communication from the J2EE
Agent to the Identity Server. TCP 8080 and 8443 are the default ports. They are configurable. You need to open the port of the Base URL of the
Identity Server. See “ Translating the Identity Server
Configuration Port ” in the NetIQ Access Manager
3.2 SP3 Identity Server Guide .
TCP 1443 For communication from the Administration Console to the devices. This is configurable.
TCP 8444
TCP 1289
TCP 524
TCP 636
TCP 8443 or 443
TCP 7801, 7802
TCP 636
For communication from the Identity Server to the
Administration Console.
For communication from the Identity Server to the
Novell Audit server on the Administration Console.
For NCP certificate management with NPKI from the Identity Server to the Administration Console.
For secure LDAP communication from the Identity
Server to the Administration Console.
For HTTPS communication. You can use iptables to configure this for TCP 443. See “ Translating the
Identity Server Configuration Port ” in the NetIQ
Access Manager 3.2 SP3 Identity Server Guide .
For back-channel communication with cluster members. You need to open two consecutive ports for the cluster, for example 7801 and 7802.
The initial port (7801) is configurable.
See“ Configuring a Cluster with Multiple Identity
Servers ” in the NetIQ Access Manager 3.2 SP3
Identity Server Guide .
For secure LDAP communication from the Identity
Server to the LDAP user store.
72 NetIQ Access Manager 3.2 SP3 Setup Guide
Component
Service Providers
Browsers
CRL and OCSP Servers
Active Directory Server with
Kerberos
Port
TCP 8445
TCP 8446
TCP 8080, 3080,
3443
TCP 8443
Configurable
TCP 88, UDP 88
Description
If you have enabled Identity Provider introductions, you need to open a port to allow HTTPS communication from the user’s browser to the service provider.
If you have enabled Identity Provider introductions, you need to open a port to allow HTTPS communication from the user’s browser to the service consumer.
For HTTP communication from the browser to the
Identity Server. You can use iptables to configure this for TCP 80. See “ Translating the Identity Server
Configuration Port ” in the NetIQ Access Manager
3.2 SP3 Identity Server Guide .
NOTE: 3080 and 3443 are optional ports. These are required when the SSL VPN and Identity Server are collocated.
For HTTPS communication from the browser to the
Identity Server. You can use iptables to configure this for TCP 443. See “ Translating the Identity
Server Configuration Port ” in the NetIQ Access
Manager 3.2 SP3 Identity Server Guide .
If you are using x.509 certificates that include an
AIA or CRL Distribution Point attribute, you need to open the port required to talk to that server. Ports
80/443 are the most common ports, but the LDAP ports 389/636 can also be used.
For communication with the KDC on the Active
Directory Server for Kerberos authentication.
Table 4-4 When a Firewall Separates the Access Gateway from a Component
Component
Identity Server
Administration Console
Port Description
TCP 8080 or 8443 For authentication communication from the Access
Gateway to the Identity Server. The default ports are TCP 8080 and 8443, which are configurable.
You need to open the port of the Base URL of the
Identity Server.
TCP 80 or 443 For communication from the Identity Server to the
Embedded Service Provider of the Access
Gateway. This is the reverse proxy port that is assigned to be Embedded Service Provider (see the Reverse Proxy /Authentication page). This is usually either port 80 or 443.
TCP 1443 For communication from the Administration Console to the Access Gateway. This is configurable.
TCP 8444 For communication from the Access Gateway to the
Administration Console.
Setting Up Firewalls 73
Component
ESP Enabled SSL VPN
Traditional SSL VPN
J2EE Agent
Access Gateway
Browsers/Clients
Web Servers
Port Description
TCP 1289
TCP 524
For communication from the Access Gateway to the
Novell Audit server on the Administration Console.
For NCP certificate management with NPKI from the Access Gateway to the Administration Console.
TCP 636
N/A. The ESP enabled SSL VPN server never communicates directly with the Access Gateway.
TCP 8080
For secure LDAP communication from the Access
Gateway to the Administration Console.
(Access Gateway Appliance) For HTTP communication from the Access Gateway to the
SSL VPN.
TCP 8443 (Access Gateway Appliance) If SSL has been enabled between the Access Gateway and the SSL
VPN, TCP 8443 needs to be opened for HTTPS communication from the Access Gateway to the
SSL VPN.
Only required if the Access Gateway is configured to protect the J2EE server as a Web server.
TCP 8080, 8443 For communication from the Access Gateway to the
JBoss server. These are the default ports. They are configurable.
TCP 9080, 9443
TCP 7001, 7002
TCP 7801, 7802
For communication from the Access Gateway to the
WebSphere server. These are the default ports.
They are configurable.
For communication from the Access Gateway to the
WebLogic server. These are the default ports. They are configurable.
For back-channel communication with cluster members. You need the first port plus 1.
TCP 80
TCP 443
TCP 80
TCP 443
The initial port (7801) is configurable. It is set by the
Identity Server cluster configuration that the Access
Gateway trusts. See“ Configuring a Cluster with
Multiple Identity Servers ” in the NetIQ Access
Manager 3.2 SP3 Identity Server Guide .
For HTTP communication from the client to the
Access Gateway. This is configurable.
For HTTPS communication from the client to the
Access Gateway. This is configurable.
For HTTP communication from the Access Gateway to the Web servers. This is configurable.
For HTTPS communication from the Access
Gateway to the Web servers. This is configurable.
74 NetIQ Access Manager 3.2 SP3 Setup Guide
Table 4-5 When a Firewall Separates the Traditional SSL VPN from a Component
Component
Access Gateway
Identity Server
Administration Console
Port Description
TCP 8080
TCP 8443
For HTTP communication from the Access Gateway to the SSL VPN.
If SSL has been enabled between the Access
Gateway and the SSL VPN, TCP 8443 needs to be opened for HTTPS communication from the Access
Gateway to the SSL VPN.
N/A. The SSL VPN never communicates directly with the Identity Server.
TCP 1443 For communication from the Administration Console to the SSL VPN. This is configurable.
TCP 8444
TCP 1289
TCP 524
TCP 636
For communication from the SSL VPN to the
Administration Console.
For communication from the SSL VPN to the Novell
Audit server on the Administration Console.
For NCP certificate management with NPKI from the SSL VPN to the Administration Console.
For secure LDAP communication from the SSL
VPN to the Administration Console.
J2EE Agent
SSL VPN Server
Browsers
SOCKS server
OpenVPN
Application Servers (E-mail, Telnet,
Thin Client, etc.)
Firewall on same machine as the
SSL VPN
N/A. The SSL VPN never communicates with the J2EE Agent.
TCP 8900 For communication between the cluster members.
This is a default port. You can use any other free port.
TCP 8080
TCP 8443
TCP 7777
For HTTP communication.
For HTTPS communication.
For SOCKS communication from the SSL VPN to the SOCKS server. This is the default port for access to the SSL VPN, but it can be configured to use TCP 443.
UDP 7777
TCP 22
TCP 23
Application ports tun0
For OpenVPN server communication. This is the default port for access to the SSL VPN, but it can be configured to use UDP 443.
For SSH communication from the SSL VPN to the application server.
For Telnet communication from the SSL VPN to the application server.
Specific to the application that SSL VPN is providing access to.
SSL VPN creates a tunnel that needs to be open on the internal networks list of the machine. For configuration information, see the following Note.
Setting Up Firewalls 75
NOTE: On SLES 11 SP1 and SP2, you can edit this file or use YaST to configure UDP ports and internal networks.
Table 4-6 When a Firewall Separates the ESP‐Enabled SSL VPN from a Component
Component
Identity Server
Administration Console
Port Description
TCP 8080 or 8443 For authentication communication from the SSL
VPN server to the Identity Server. TCP 8080 and
8443 are the default ports. They are configurable.
You need to open the port of the Base URL of the
Identity Server.
TCP 1443
For communication from the Identity Server to the
Embedded Service Provider of the SSL VPN server.
This is the Embedded Service Provider Base
URL on the Configuration page. The default values are TCP 8080 and 8443.
For communication from the Administration Console to the SSL VPN. This is configurable.
ESP-Enabled SSL VPN
J2EE Agent
Browsers
SOCKS server
OpenVPN
TCP 8444
TCP 1289
TCP 524
TCP 636
TCP 7801 and
8900
Application Servers (E-mail, Telnet,
Thin Client, etc.)
TCP 22
TCP 23
Application ports
For communication from the SSL VPN to the
Administration Console.
For communication from the SSL VPN to the Novell
Audit server on the Administration Console.
For NCP certificate management with NPKI from the SSL VPN to the Administration Console.
For secure LDAP communication from the SSL
VPN to the Administration Console.
For communication between the cluster members.
8900 is a default port. You can use any other free port instead of 8900.
N/A. The SSL VPN never communicates with the J2EE Agent.
TCP 8080 For HTTP communication.
TCP 8443
TCP 7777
TCP 7777
For HTTPS communication.
For SOCKS communication from the SSL VPN to the SOCKS server. This is the default port for access to the SSL VPN, but it can be configured to use TCP 443.
For OpenVPN server communication. This is the default port for access to the SSL VPN, but it can be configured to use UDP 443.
For SSH communication from the SSL VPN to the application server.
For Telnet communication from the SSL VPN to the application server.
Specific to the application that SSL VPN is providing access to.
76 NetIQ Access Manager 3.2 SP3 Setup Guide
Component
Firewall on same machine as the
SSL VPN
Port tun0
Description
SSL VPN creates a tunnel that needs to be open on the internal networks list of the machine. For configuration information, see the following Note.
NOTE: On SLES 11 SP1 and SP2, you can edit this file or use YaST to configure UDP ports and internal networks.
Table 4-7 When a Firewall Separates the J2EE Agent from a Component
Component
Administration Console
Identity Server
Access Gateway
SSL VPN
Port
TCP 1443
Description
For communication from the Administration Console to the J2EE Agent. This is configurable.
TCP 8444
TCP 1289
TCP 524
TCP 636
For communication from the J2EE Agent to the
Administration Console.
For communication from the J2EE Agent to the
Novell Audit server on the Administration Console.
For NCP certificate management with NPKI from the J2EE Agent to the Administration Console.
For secure LDAP communication from the J2EE
Agent to the Administration Console.
TCP 8080 or 8443 For authentication communication from the J2EE
Agent to the Identity Server and from the Identity
Server to the J2EE Agent. TCP 8080 and 8443 are the default ports. They are configurable. You need to open the port of the Base URL of the Identity
Server. See “ Translating the Identity Server
Configuration Port ” in the NetIQ Access Manager
3.2 SP3 Identity Server Guide .
Only required if the Access Gateway is configured to protect the J2EE server as a Web server.
TCP 8080, 8443 For communication from the Access Gateway to the
JBoss server. These are the default ports. They are configurable.
TCP 9080, 9443
TCP 7001, 7002
For communication from the Access Gateway to the
WebSphere server. These are the default ports.
They are configurable.
For communication from the Access Gateway to the
WebLogic server. These are the default ports. They are configurable.
N/A. The J2EE Agent never communicates with the SSL VPN.
Setting Up Firewalls 77
Downloaden
Openbare link bijgewerkt
De openbare link naar uw chat is bijgewerkt. You may view and manage your chat links after registration here.
Openbare link document
Advertentie
