Guardium port requirements

Open ports

Ports used in or by the Guardium system.

DB Server – Collector

• TCP 8443 - open from DB server to collector
• TCP 16016 – UNIX STAP, both directions, registration, heartbeat, and data (including IBM i S-TAP running in PASE)
• TCP 16017 – Windows/Unix CAS, both directions, templates and data
• TCP 16018 – UNIX S-TAP (TLS) and External S-TAP, both directions, registration, heartbeat, and data
• TCP 16019 – Windows/Unix CAS (TLS), both directions, templates and data
• TCP 16020 - From S-TAP agent Clear UNIX S-TAP connection pooling
• TLS 16021 - From S-TAP agent Encrypted UNIX S-TAP connection pooling
• TCP 8081 – Guardium Installation Manager, both directions, database server to collector/Central Manager
• TCP 9800 – Windows S-TAP using protocol 8, both directions, DB Server to Collector, S-TAP registration and data
• TCP 9801 – Encrypted (TLS) Windows S-TAP using protocol 8, both directions, DB Server to Collector, S-TAP registration and data

Collector – Aggregator (Secure Shell – SSL)

• TCP 22 – collector to aggregator, SCP data exports, both directions

Central Manager – Managed Devices

• TCP 22 – SSH/SCP data transfers, both directions
• TCP 8443 – SSL, both directions
• TCP 8444 – SSL, STAP to GIM file upload
• TCP 3306 – MySQL, opened to specific sources (for instance, the Central Manager is open to all managed units; a managed unit is open to the Central Manager)
• TLS 8447 - Used for remote messaging service infrastructure (and profile distribution infrastructure) for communication between Guardium systems in the federated environment / centrally-managed environment. Configuration profiles allow the definition of configuration and scheduling settings from a Central Manager and conveniently distribute those settings to managed unit groups without altering the configuration of the Central Manager itself.

File Activity Monitoring (FAM), on the unit where it is installed. (Bidirectional means data can be sent or received in both directions once connection is established.)

• TCP/TLS 16022/16023: Universal Feed. 16022 (FAM monitoring, unencrypted) and 16023 (FAM monitoring, encrypted) both need to be open bidirectionally.
• 16016 to 16023: These ports must be open bidirectionally for the sniffer. The connection is made from the S-TAP to the sniffer (sniffer does not initiate the connection); listening ports are on the sniffer side only.
• 18087: Listener port for FAM on IBM Content Classification (ICM) server located on the same machine where FAM is installed.(serverSettings.icmURL=http://localhost:18087) Open bidirectionally.

Guardium Installation Manager (GIM)

• 8445 - GIM client listener, both directions. The GIM client is doing the listening. Any GIM server on either the Central Manager or the collector can reach out to it the GIM client.
• 8446 - GIM authenticated TLS, both directions. Use between the GIM client and the GIM server (on the Central Manager or collector). If GIM_USE_SSL is NOT disabled, then the gim_client will attempt to communicate its certificate via port 8446. IF port 8446 is NOT open, then it defaults to 8444, BUT no certificate is passed (for example, TLS without verification).
• 8081 - TLS - To use 8081 for the GIM client to connect to the GIM server, there is a need to disable the GIM_USE_SSL parameter - it is ON by default. This parameter is part of the GIM common parameters in the GUI. If GIM_USE_SSL is NOT disabled, then the gim_client will attempt to communicate its certificate via port 8446. IF port 8446 is NOT open, then it defaults to 8444, BUT no certificate is passed (for example, TLS without verification).

Enterprise load balancer

• TLS 8443 - S-TAP load balancer - This is needed for UNIX/Linux S-TAPs to communicate instances to the collector. However this port is also used for the Central Manager load balancer. The S-TAP initiates a request to central manager (load balancer) on 8443 sending HTTPS message, if installation indicates to use Enterprise load balancer. Between the database server and central manager, there will be the capability to use a proxy server, if customer doesn't want an open port directly from database to central manager.

Quick Search for Enterprise

• TCP 8983 - SOLR - Incoming, SSL
• TCP 9983 - SOLR - Incoming, SSL

User Interface - Guardium System (standalone, aggregator, central manager)

• TCP 22 - user to system, CLI connectivity, both directions
• TCP 8443 - user to system, GUI connectivity (configurable), both directions, sending discovered instances to the UI
• 8445 - TLS. Bidirectional port to connect to a file server.
• 80 - No TLS. Bidirectional port to connect to a file server.

Outbound ports to monitor Azure streaming

The following ports must be open to support IPv4 connections to Azure services.

Outbound ports to monitor AWS streaming

The following ports must be open to support IPv4 connections to AWS.

Ports for connections to Windows database servers

Default ports used for Guardium Application Access

Ports for connections to z/OS database servers

Default ports used for other features