Cloud APM server ports

Edit online

The prerequisite scanner checks whether internal and external ports are available for communication on the Cloud APM server.

Two types of ports are used by the Cloud APM server:

One type of port must be available and opened on the firewall. Such ports are for external communication, and you must open them on the firewall or disable the firewall. See Table 1.
The other type of port is used for internal communication between components. Such ports must be available but can be blocked by the firewall because they do not require external communication. It is necessary to keep these ports from being used by any applications that are installed on the Cloud APM server. See Table 2.

For each port that is used for external communication, one side sends a request and the other side provides a response. The side that initiates the connection is indicated for each port in Table 1.

For the list of ports that must be available for external communication on a Hybrid Gateway, see Installing the Hybrid Gateway.

The prerequisite scanner checks whether the ports in Table 1 and Table 2 are available and returns FAIL for each port that is not available.

Table 1. Ports for external communication
Port	Description
80	If you use HTTP to communicate with the Cloud APM server, open port 80. The agents and the Hybrid Gateway initiate a unidirectional connection with the Cloud APM server on port 80. HTTP communication is the default option. A firewall can be used to block external access to this port if you want to use HTTPS only for agent to Cloud APM server. The port is labeled `MINHTTP` in the prerequisite scanner output.
443	If you use HTTPS to communicate with the Cloud APM server, open port 443. The agents and the Hybrid Gateway initiate a unidirectional connection with the Cloud APM server on port 443. The port is labeled `MINHTTPS` in the prerequisite scanner output.
9443	If you use HTTPS to communicate with the Cloud APM server, open port 9443. The Cloud APM console browser initiates a unidirectional connection with the Cloud APM server on port 9443. The port is labeled `APMUIHTTPS` in the prerequisite scanner output.
8099	Open port 8099 for Open ID Connect (OIDC) authentication. As part of the Cloud APM console user authentication process, a user's browser might be redirected to port 8099. The Cloud APM console browser initiates a unidirectional connection with the Cloud APM server on port 8099. The port is labeled `OIDCHTTPS` in the prerequisite scanner output.
50000	If you configure the Cloud APM server to connect to a remote Db2® server, open port 50000. Either the Db2 server or the Cloud APM server can initiate a connection on this port. The port is labeled `DB2` in the prerequisite scanner output.
27000	If you configure the Cloud APM server to connect to a remote MongoDB, a firewall must allow access to port 27000. The Cloud APM server initiates a unidirectional connection with MongoDB on port 27000. If you use the local MongoDB, then external access to port 27000 can be blocked. The port is labeled `MONGODB` in the prerequisite scanner output.
8091 and 8099	To use the Threshold Manager API or the Resource Group Management Service API, or both, open ports 8091 and 8099. API users initiate a unidirectional connection with the Cloud APM server. Port 8091 is labeled `SERVER1HTTPS` in the prerequisite scanner output. Port 8099 is labeled `OIDCHTTPS` in the prerequisite scanner output.
9443 and 8099	To use the Role Based Access Control (RBAC) API, open ports 9443 and 8099. For more information about the RBAC API, see Accessing and using the Role-Based Access Control Service API. API users initiate a unidirectional connection with the Cloud APM server. Port 9443 is labeled `APMUIHTTPS` in the prerequisite scanner output. Port 8099 is labeled `OIDCHTTPS` in the prerequisite scanner output.
9998	If you configure the Cloud APM server to send EIF messages to an EIF receiver, such as the Probe for Tivoli EIF, open port 9998. To use a custom port, update the value of the EIF Port setting in the Event Manager category of the Advanced Configuration window (see Event Manager). The Cloud APM server initiates a unidirectional connection with the EIF receiver. The port is labeled `FNEIFRCVR` in the prerequisite scanner output.
389 or 636	If you plan to use LDAP to authenticate users of the Cloud APM console, open the port that is used by your LDAP server. Usually, you open port 389 but if you set up the LDAP server to require SSL/TLS encrypted connections, open port 636. Contact your LDAP server team to confirm which port numbers are used by your LDAP servers. The Cloud APM server initiates this unidirectional connection with the LDAP server. These ports are not included in the prerequisite scanner output.
8093	If you plan to use the Universal View feature for defining dashboard pages in the Custom Views tab of the Application Performance Dashboard, open port 8093 through a firewall. The Cloud APM console browser initiates a unidirectional connection with the Cloud APM server on port 8093. The port is labeled `UVIEWSHTTPS` in the prerequisite scanner output.

Note:

Other ports may be used for external communication if you integrate the Cloud APM server with other products such as Tivoli Common Reporting. See the documentation for these products that you plan to integrate with the Cloud APM server to determine what ports they use. For links to the related documentation, see Table 7 in the Part numbers topic.
If a firewall is blocking the ports, you can either configure the firewall to allow traffic on certain ports or disable the firewall. For more information, see Configuring the firewall for incoming requests to the server.

Table 2. Ports for internal communication between server components
Port	Component
80	Port used by APM services to send requests to the min service. The port is labeled `MINHTTP` in the prerequisite scanner output.
1527	Port for Service Component Registry database. The port is labeled `SCRDERBYDB` in the prerequisite scanner output.
2181	Port for the Zookeeper process of Kafka Message Broker. The port is labeled `ZOOKEEPER` in the prerequisite scanner output.
50000	Port for the Db2 server. If you connect to a local Db2 server, this port must be unblocked for internal communication. The port is labeled `DB2` in the prerequisite scanner output.
6066	Port for Spark applications 2. The port is labeled `SPARKAAPPS2` in the prerequisite scanner output.
6414	Port for Gaian database. The port is labeled `FNGAIANDB` in the prerequisite scanner output.
7077	Port for the Spark applications 1. The port is labeled `SPARKAAPPS1` in the prerequisite scanner output.
8080	This is the HTTP port for the Cloud APM console. However, if you attempt to connect to the console using HTTP and port 8080, you are redirected to use HTTPS and port 9443. The port is labeled `APMUIHTTP` in the prerequisite scanner output.
18080	Port for the Spark master. The port is labeled `SPARKMASTER` in the prerequisite scanner output.
18085	Port for the Spark worker. The port is labeled `SPARKWORKER` in the prerequisite scanner output.
8090	Port for Cloud APM console back end connection. The port is labeled `SERVER1HTTP` in the prerequisite scanner output.
8091	Port for secure Cloud APM console back end connection. The port is labeled `SERVER1HTTPS` in the prerequisite scanner output.
8092	This is the HTTP port for the uviews service, which is used for the Custom Views tab of the Application Performance Dashboard. The ports is labeled `UVIEWSHTTP` in the prerequisite scanner output.
9090	Port for Cloud APM data collector back end
9453	Port for secure Cloud APM data collector back end
9092	Port for Kafka Message Broker The port is labeled `KAFKA1` in the prerequisite scanner output.
9989	Port for Kafka Message Broker The port is labeled `KAFKA2` in the prerequisite scanner output.
10001	Port for Open Services for Lifecycle Collaboration service provider. The port is labeled `OSLCPM` in the prerequisite scanner output.
12315	Port for Service Component Registry Java™ back end. The port is labeled `SCRJAVABKEND` in the prerequisite scanner output.
27000	Port for the MongoDB database. If you connect to a local MongoDB, this port must be unblocked for internal communication. The port is labeled `MONGODB` in the prerequisite scanner output.
13245	Port 1 for role-based access control. The port is labeled `RBACSERVER1` in the prerequisite scanner output.
13246	Port 2 for role-based access control. The port is labeled `RBACSERVER2` in the prerequisite scanner output.
13247	Port 3 for role-based access control. The port is labeled `RBACSERVER3` in the prerequisite scanner output.
13248	Port 4 for role-based access control. The port is labeled `RBACSERVER4` in the prerequisite scanner output.
32105	Port for internal messaging. The port is labeled `FNINTMSG` in the prerequisite scanner output.