Endpoint Protection

 View Only

  • 1.  Port Usage for SEP12.1 RU1

    Posted Mar 19, 2012 11:47 PM

    Any one know what is the port usage for SEP12.1 RU1?

    today i push the client upgrade package to all my client, my firewall alert me that there are a lot of traffic try to use port 445.

    which previously recommended by symantec to block the port 445 somewhere around last year to avoid the virus outbreak.

     

    So now, my network administrator would like to know what are the port use by SEPM / SEP12.1 RU1.

    Any one know this?



  • 2.  RE: Port Usage for SEP12.1 RU1

    Posted Mar 19, 2012 11:56 PM

    Check this  

     http://www.symantec.com/business/support/index?page=content&id=TECH163787

    Port Number Port Type Initiated by Listening Process Description
    80, 8014 TCP SEP Clients svchost.exe (IIS) Communication between the SEPM manager and SEP clients and Enforcers. (8014 in MR3 and later builds, 80 in older).
    443 TCP SEP Clients svchost.exe (IIS) Optional secured HTTPS communication between a SEPM manager and SEP clients and Enforcers.
    1433 TCP SEPM manager sqlservr.exe Communication between a SEPM manager and a Microsoft SQL Database Server if they reside on separate computers.
    1812 UDP Enforcer w3wp.exe RADIUS communication between a SEPM manager and Enforcers for authenticating unique ID information with the Enforcer.
    2638 TCP SEPM manager dbsrv9.exe Communication between the Embedded Database and the SEPM manager.
    8014, 8443 TCP Remote Java or web console SemSvc.exe HTTPS communication between a remote management console and the SEPM manager. All login information and administrative communication takes place using this secure port.
    9090 TCP Remote web console SemSvc.exe Initial HTTP communication between a remote management console and the SEPM manager (to display the login screen only).
    8005 TCP SEPM manager SemSvc.exe The SEPM manager listens on the Tomcat default port.
    39999 UDP Enforcer Communication between the SEP Clients and the Enforcer. This is used to authenticate Clients by the Enforcer.
    2967 TCP SEP Clients Smc.exe The Group Update Provider (GUP) proxy functionality of SEP client listens on this port.

    The Symantec Endpoint Protection Manager (SEPM) use two web servers: Internet Information Services (IIS) and Tomcat. IIS uses port 80 (or 8014) and 443. Tomcat uses port(s) 9090 and 8443. The communication between IIS and Tomcat uses the HTTP protocol. IIS uses port 9090 to talk to Tomcat, Tomcat uses port 80 to talk to IIS.

    Client-Server Communication:
    For IIS SEP uses HTTP or HTTPS between the clients or Enforcers and the server. For the client server communication it uses port 80 (or 8014) and 443 by default. In addition, the Enforcers use RADIUS to communicate in real-time with the manager console for clients authentication. This is done on UDP port 1812.

    Remote Console:
    9090 is used by the remote console to download .jar files and display the help pages.
    8443 is used by the remote console to communicate with SEPM and the Replication Partners to replicate data.

    Web Console:
    8443 is used by the web console to communicate with the SEPM.
    8014 is used by the web console to communicate with SEPM Reporting component.

    Client-Enforcer Authentication:
    The clients communicate with the Enforcer using a proprietary communication protocol. This communication uses a challenge-response to authenticate the clients. The default port for this is UDP 39,999.

     

    References
    This document is available in the following languages:

     

    http://www.symantec.com/business/support/index?page=content&id=TECH102416

    https://www-secure.symantec.com/connect/forums/communication-ports-using-symantec-endpoint-protection-11x



  • 3.  RE: Port Usage for SEP12.1 RU1

    Posted Mar 20, 2012 12:18 AM

    Which Communications Ports does Symantec Endpoint Protection use?

    http://www.symantec.com/business/support/index?page=content&id=TECH163787

     



  • 4.  RE: Port Usage for SEP12.1 RU1
    Best Answer

    Posted Mar 20, 2012 07:57 AM

    For SEP 12 https://www-secure.symantec.com/connect/articles/symantec-endpoint-protection-manager-requires-tcp-port-information

    Symantec Endpoint Protection Manager requires TCP port information.

     

    Symantec Endpoint Protection Manager uses TCP 9090 to display the Symantec Endpoint Protection Manager console. If other software is listening on this port, you cannot log on to the Symantec Endpoint Protection Manager console. Note that Symantec IM Manager uses TCP port 9090. If you are required to run Symantec Endpoint Protection Manager console on a computer that also requires other software that uses TCP port 9090, you can change the port for Symantec Endpoint Protection Manager console.

     

    To change TCP port 9090, edit the following file with WordPad

    \Symantec\Symantec Endpoint Protection Manager\tomcat\conf\server.xml

    Search for port=9090 and change 9090 to a different TCP port number. Save the file, and then restart Symantec Endpoint Protection Manager service.

     

    We can then log on to the Symantec Endpoint Protection Manager console. Be aware, however, that changing port 9090 partially disables the online Help system. Every time you use Help, you will have to change 9090 in the URL to the changed port number to display the Help text.

     

    The default port for Enforcer communication with Symantec Endpoint Protection Manager is 8014

    The default port for non-encrypted communication (HTTP) with the Symantec Endpoint Protection Manager has been changed from 80 to 8014. Encrypted communications (HTTPS) continue to use port 443. This port setting applies to all types of Enforcers.