# Forcepoint Security Management Center ports

The most important default ports used in communications to and from SMC components are presented in the following illustrations.

Figure: Destination ports for basic communications within the SMC

Figure: Default destination ports for optional SMC components and features

This table lists the default ports SMC uses internally and with external components. Many of these ports can be changed. The names of corresponding default Service elements are also included for your reference.

Table 1. SMC default ports
Listening host | Port/protocol | Contacting hosts | Service description | Service element name
--- | --- | --- | --- | ---
Additional Management Servers | 8902- 8913/TCP | Management Server | Database replication (push) to the additional Management Server. | SG Control
DNS server | 53/UDP, 53/TCP | SMC Client, Management Server, Log Server | DNS queries. | DNS (UDP)
LDAP server | 389/TCP | Management Server | External LDAP queries for display/editing in the SMC Client. | LDAP (TCP)
Log Server | 162/UDP, 5162/UDP | Monitored third-party components | SNMPv1 trap reception from third-party components. Port 162 is used if installed on Windows, port 5162 if installed on Linux. | SNMP (UDP)
Log Server | 514/TCP, 514/UDP, 5514/TCP, 5514/UDP | Monitored third-party components | Syslog reception from third-party components. Port 514 is used if installed on Windows, port 5514 if installed on Linux. | Syslog (UDP) [Partial match]
Log Server | 2055/UDP | Monitored third-party components | NetFlow or IPFIX reception from third-party components. Port 2055 is used in both Windows and Linux. | NetFlow (UDP)
Log Server | 3020/TCP | Log Server, Web Access Server, Security Engines | Alert sending from the Log Server and Web Access Server. Log and alert messages; monitoring of block lists, connections, status, and statistics from Security Engines. | SG Log
Log Server | 8914-8918/TCP | SMC Client | Log browsing. | SG Data Browsing
Log Server | 8916-8917/TCP | Log Server, Web Access Server | Database replication (push) to the Log Server; Log browsing on the Web Access Server. | SG Data Browsing (Web Access Server)
Management Server | 3021/TCP | Log Server, Web Access Server | System communications certificate request/renewal. | SG Log Initial Contact
Management Server | 8902-8913/TCP | SMC Client, Log Server, Web Access Server | Monitoring and control connections. | SG Control
Management Server | 3023/TCP | Additional Management Servers, Log Server, Web Access Server | Log Server and Web Access Server status monitoring. Status information from an additional Management Server to the active Management Server. | SG Status Monitoring
Management Server | 8903, 8907/TCP | Additional Management Servers | Database replication (pull) to the additional Management Server. | SG Control
Active Management Server | 8922/TCP | Backup SMC server | PostgreSQL database replication used in SMC HA configurations. | SG HA Replication
Management Server | 8082/TCP | Client API | Connection from the Client API to Management Server. | -
Management Server | 8085/TCP | Web Access clients | Communication for using Web Access. | HTTPS
Monitored third-party components | 161/UDP | Log Server | SNMP status probing to external IP addresses. | SNMP (UDP)
NTP server | 123/TCP or UDP | SMC Appliance | Receiving NTP information. | NTP
RADIUS server | 1812/UDP | Management Server | RADIUS authentication requests for administrator logon. The default ports can be edited in the properties of the RADIUS Server element. | RADIUS (Authentication)
Security Engine update service | 443/TCP | SMC servers | Update packages, engine upgrades, and licenses. | HTTPS
SMC Appliance | 161/UDP | Third-party components | Requesting health and other information about the SMC Appliance. | SNMP
Update servers | 443/TCP | SMC Appliance | Receiving appliance patches and updates. | HTTPS
SMC Appliance | 22/TCP | Terminal clients | SSH connections to the command line of the SMC Appliance. Note: SSH is not available in FIPS mode. | SSH
Syslog server | 514/UDP, 5514/UDP | Log Server | Log data forwarding to syslog servers. The default ports can be edited in the LogServerConfiguration.txt file. | Syslog (UDP) [Partial match]
Engine, Layer 2 Engine, IPS, Master Engine | 22/TCP | SMC Appliance | Contacting engines and moving SMC Appliance backups off the appliance. | SSH
Third-party components | 2055/UDP | Log Server | NetFlow or IPFIX forwarding to third-party components. Port 2055 is used in both Windows and Linux. | NetFlow (UDP)
Third-party components | 162/UDP | SMC Appliance | Sending SNMP status probing to external devices. | SNMP
Third-party components | 445/TCP | SMC Appliance | Moving SMC Appliance backups off the appliance. Note: You cannot use CIFS in FIPS mode. | CIFS
Web Access Server | 8083/TCP | Web Access clients | Communication for using Web Access. | HTTPS