---
title: Firewall Rules
slug: discovery-app-req-guide/firewall-rules
createdAt: 2026-11-05T06:02:50.442Z
---

Discovery is performed when the Discovery App retrieves commands from the Ivanti Neurons for Service Mapping cloud and launches selective probes per the defined schedule to the target systems. The data returned by the probes is then securely transmitted from the DA to the Ivanti Neurons for Service Mapping cloud for processing into the CMDB. Table 4 shows the necessary communications to allow the scans to run and have the data sent to the Ivanti Neurons for Service Mapping cloud. These firewall requirements are in addition to authentication and port requirements shown in the following section.

Table 4: Discovery App Firewall Rules

| **Outbound (Discovery App to Ivanti cloud)**                                                                                                                                                                                                                                                                                    |                                                                                                                                                                                                                                     |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **SSL Port 443 to the following URL’s (Geo dependent)**                                                                                                                                                                                                                                                                         |                                                                                                                                                                                                                                     |
| **U.S. Hosting**<br />- [https://discoveryselector-usw2.ivanticloud.com](https://discoveryselector-usw2.ivanticloud.com)<br />- [https://discoveryserver1-usw2.ivanticloud.com](https://discoveryserver1-usw2.ivanticloud.com)<br />- https\://servicemapping-usw2.ivanticloud.com                                              | **EU (Frankfurt) Hosting**<br />- [https://discoveryserver1-euc1.ivanticloud.com](https://discoveryserver1-euc1.ivanticloud.com)<br />- [https://discoveryselector-euc1.ivanticloud.com](https://discoveryselector-euc1.virima.com) |
| **Australia Hosting**<br />- [https://discoveryserver1-apse2.ivanticloud.com/](https://discoveryserver1-apse2.ivanticloud.com/)<br />- https\://discoveryselector-apse2.ivanticloud.com/                                                                                                                                        |                                                                                                                                                                                                                                     |
| **Proxy Server**                                                                                                                                                                                                                                                                                                                |                                                                                                                                                                                                                                     |
| Proxy server is supported\* for outbound communication from Discovery App to INSM cloud with the following properties in Discovery Application common.properties file:<br />#ProxyHost= #ProxyPort= #ProxyUserName= #ProxyPassWord=<br />\*Currently a proxy server cannot be used in conjunction with CyberArk PAM integration |                                                                                                                                                                                                                                     |
| **Allow Persistent Connection**                                                                                                                                                                                                                                                                                                 |                                                                                                                                                                                                                                     |
| Firewall rules must allow for a persistent connection between the Discovery Application and Ivanti Neurons for Service Mapping cloud. Same is true for connections between Discovery Agents and the Discovery Application.                                                                                                      |                                                                                                                                                                                                                                     |
| **ICMP Ping or NMAP**                                                                                                                                                                                                                                                                                                           |                                                                                                                                                                                                                                     |
| As of version 6.1 both ICMP Ping and NMAP to check for hosts have been deprecated. Host checks are now done via port checks (ports 22, 135, 161)                                                                                                                                                                                |                                                                                                                                                                                                                                     |