Internal corporate network rules
The following table outlines the firewall rules required for internal corporate network access for:
- Ivanti EPMM Appliance (physical or virtual) - All ports (except UDP) should be bi-directional to allow information / data exchange between systems.
- Ivanti Sentry Appliance (physical or virtual, ActiveSync / Ivanti Tunnel) - Ivanti Sentry must be able to resolve the Ivanti EPMM hostname (via DNS lookup) or a hostfile entry must be added.
- Ivanti recommends to allow HTTPS traffic on port 8443 from the corporate network, limited to Ivanti applications only. This Service is intended for EPMM server management and must have strictly controlled access.
- Ivanti recommends restricting access to port 22 or SSH from the internal corporate network only. This service is intended for Ivanti Standalone Sentry System Manager and must have strictly controlled access.
Ivanti EPMM Appliance and the Ivanti Sentry Appliance items communicate with each other.
Table: Internal corporate network rules
Requirement | Description | Port |
|---|---|---|
Traffic from Internal Corporate Network to .Ivanti EPMM Ivanti EPMM is in the DMZ | ||
Ivanti EPMM administrator access (System Manager) | Open HTTPS 8443 from the corporate network to the Ivanti EPMM appliance | HTTPS 8443 |
Ivanti EPMM administrator access | Open HTTPS 443 and SSH 22 from the corporate network to the Ivanti EPMM appliance | HTTPS 443, SSH 22 |
Ivanti EPMM Enterprise Connector (Optional LDAP Proxy) | Open HTTPS 443 from Enterprise Connector to Ivanti EPMM | HTTPS 443 |
Ivanti EPMM Reporting Database (Optional) | Ensure that HTTPS 7443 from the Reporting Database to Ivanti EPMM is open. It is open by default. | HTTPS 7443 |
Self-service user portal | Open HTTPS 443 from the corporate network to the Ivanti EPMM appliance | HTTPS 443 |
Traffic from Ivanti EPMM to Internal Corporate Network Ivanti EPMM is in the DMZ | ||
LDAP / Active Directory | LDAP User Lookup and Authentication | TCP 636 (secure) -or- TCP 389 |
SMTP Relay for SMS and Email Notifications | Open TCP 25 (if not in DMZ) and define the SMTP relay server | TCP 25 |
DNS Lookup Open | Open UDP 53 (if not in DMZ) and define DNS server(s) TCP is needed in case of large DNS Queries | UDP 53 |
NTP Time Synchronization Service | Open UDP 123 (if not in DMZ) and define NTP server(s) | UDP 123 |
Certificate / SCEP Server | SCEP Proxy Configuration | HTTP 443 |
Ivanti EPMM access to Ivanti Sentry | Open HTTPS 9090 (primary access), HTTPS 443 (view of Ivanti Sentry certificate) to the Ivanti Sentry appliance, and HTTPS 8443 (to remotely enable Ivanti Sentry logging from the Ivanti EPMM System manager). | HTTPS 9090, HTTPS 443, and HTTPS 8443 |
Sentry access to Ivanti EPMM | Open HTTPS 8443 to the Ivanti EPMM appliance (HTTPS 8443 is the default, but HTTPS 443 is also supported.) | HTTPS 8443 |
Traffic from Internal Corporate Network to Standalone Sentry Standalone Sentry is in the DMZ | ||
Ivanti EPMM administrator access | Open HTTPS 8443 from the corporate network to Ivanti Sentry(System Manager access) | HTTPS 8443 |
Ivanti EPMM administrator access | Open SSH 22 from the corporate network to Ivanti Sentry | SSH 22 |
Traffic from Standalone Sentry to Internal Corporate Network Standalone Sentry is in the DMZ | ||
CIFS-based Content Server | Open TCP 445 if using Ivanti Docs@Work with CIFS-based content servers | TCP 445 |
Certificate / SCEP Server | SCEP Server/CA Access (for CRL verification only) | HTTP 80 or HTTPS 443 |
App Server for AppTunnel | Open HTTP 80 or HTTPS 443 to the app/content server if configuring this Ivanti Sentry for AppTunnel | HTTP 80 or HTTPS 443 (typically) |
Exchange ActiveSync | Open HTTP 80 or HTTPS 443 to the ActiveSync server if configuring this Ivanti Sentry for email service | HTTP 80 or HTTPS 443 |
DNS Lookup | Open UDP 53 (if not in DMZ) and define DNS server(s) | UDP 53 |
NTP Time Synchronization | Open UDP 123 (if not in DMZ) and define NTP server(s) | UDP 123 |
LDAP / Active Directory | Open TCP/UDP 389 Kerberos LDAP ping (optional for Kerberos-constrained delegation) | TCP/UDP 389 |
SMTP Relay for Sentry Console Email Notifications | Open TCP 25 (if not in DMZ) and define SMTP relay server | TCP 25 |
Kerberos Server | Open TCP 88 (for Kerberos-constrained delegation) | TCP 88 |
Related topics
- For firewall rules required for Internal rules/outside rules, see External and Internet rules.
- For additional firewall rules, see Additional firewall rules.