Security/Firewall Requirements

Windows Management Instrumentation (WMI) -- Port: 445

Remote Procedure Call (RPC) (default : 135)

WebSphere

WebSphere application port (default : 9080)

• REST API HTTPS port (Default port: 443)
• For Azure VM: Powershell port (Default port: 5985,5986)
• For Azure SQL: DB connection via JDBC port (Default port: 1433)

• REST API HTTPS port (Default port: 443)
• For Autonomous Database: DB connection via JDBC port (Default port: 1433)

Telnet Port: 23 (if mode of monitoring is Telnet)

SSH Port: 22 (if mode of monitoring is SSH)

Remote Procedure Call (RPC) (Default :TCP 135)

Windows Management Instrumentation (WMI) (Default : TCP 445)

To monitor a Microsoft Dynamics CRM/365 application, use Administrator user account which has the permission to excute WMI queries on 'root\CIMV2' namespace of the Dynamics CRM/365 Server.

Firewall access for monitoring:

Ports required for monitoring via WMI.

• Windows Management Instrumentation (WMI) (default : TCP 445)
• Remote Procedure Call (RPC) (default :TCP 135)
• Also refer to ports required for WMI Mode of monitoring under Servers

Powershell access for monitoring:

Click here to see powershell prerequisites.

Windows Management Instrumentation (WMI) -- Port: 445

Remote Procedure Call (RPC) -- Port: 135

Windows Management Instrumentation (WMI) -- Port: 445

Remote Procedure Call (RPC) -- Port: 135

PowerShell remoting - TCP 5985 and 5986

Learn how to enable JMX for ActiveMQ

The default JMX port is 9999.

Windows Management Instrumentation (WMI) -- Port: 445

Remote Procedure Call (RPC) -- Port: 135

To connect AS400/iSeries server from Applications Manager it uses JTOpen package. The JTOpen package uses the following Non-SSL ports 449, 446, 8470, 8471, 8472, 8473, 8474, 8475, 8476. Ensure that the ports mentioned under "Port Non-SSL" column in the link are not blocked in firewall.

https://www-01.ibm.com/support/docview.wss?uid=nas8N1019667

Telnet Port (default : 23), if mode of monitoring is Telnet.

SSH Port (default : 22), if mode of monitoring is SSH

SNMP Agent Port (default : 161), if mode of monitoring is SNMP

For WMI Mode of Monitoring:

Applications Manager supports users with both administrator and non-administrator roles for monitoring Windows servers through WMI mode. However, it is recommended to use administrator privilege for Windows server monitoring.

Ports required -

Remote Procedure Call (RPC) (default : 135)
WMI uses DCOM for remote communication. The server to be monitored by applications manager uses a random port number above 1024 by default to respond back. You have to connect to this target server and configure it to use a port within a specified range of ports. Check out this link to know more about restricting the ports in the target server:  https://support.microsoft.com/en-us/help/154596/how-to-configure-rpc-dynamic-port-allocation-to-work-with-firewalls. Note that you must specify at least 5 ports in this range for target server ( you are normally recommended to open at least a 100 ports). This same range of ports must also be opened in the firewall.

• For Windows Server 2008 and later versions (Windows Server 2019, Windows Server 2016, Windows Server 2012, Windows Server 2008 R2, Windows Server 2008), and in Windows Vista and later versions (Windows 10, Windows 8, Windows 7, Windows Vista), use the following dynamic port range:

  Start port: 49152

  End port: 65535

• For versions of Windows Server below 2008 (Windows 2000, Windows XP, and Windows Server 2003, and in Windows below Vista (Windows XP), use the following dynamic port range:

  Start port: 1025

  End port: 5000

• If your computer network environment uses Windows Server 2019, Windows Server 2016, Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, Windows Vista together with versions of Windows below Windows Server 2008 and Windows Vista, you must enable connectivity over both the following port ranges:

  High port range: 49152 through 65535

  Low port range: 1025 through 5000

• For more information about the default dynamic port range, click here.

For SNMP Mode of monitoring:

Ports required - SNMP Agent Port: 161

For WMI Mode of Monitoring:

Applications Manager supports users with both administrator and non-administrator roles for monitoring Windows servers through WMI mode. However, it is recommended to use administrator privilege for Windows server monitoring.

Ports required -

Remote Procedure Call (RPC) (default : 135)
WMI uses DCOM for remote communication. The server to be monitored by applications manager uses a random port number above 1024 by default to respond back. You have to connect to this target server and configure it to use a port within a specified range of ports. Check out this link to know more about restricting the ports in the target server:  https://support.microsoft.com/en-us/help/154596/how-to-configure-rpc-dynamic-port-allocation-to-work-with-firewalls. Note that you must specify at least 5 ports in this range for target server ( you are normally recommended to open at least a 100 ports). This same range of ports must also be opened in the firewall.

• For Windows Server 2008 and later versions (Windows Server 2019, Windows Server 2016, Windows Server 2012, Windows Server 2008 R2, Windows Server 2008), and in Windows Vista and later versions (Windows 10, Windows 8, Windows 7, Windows Vista), use the following dynamic port range:

  Start port: 49152

  End port: 65535

• For versions of Windows Server below 2008 (Windows 2000, Windows XP, and Windows Server 2003, and in Windows below Vista (Windows XP), use the following dynamic port range:

  Start port: 1025

  End port: 5000

• If your computer network environment uses Windows Server 2019, Windows Server 2016, Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, Windows Vista together with versions of Windows below Windows Server 2008 and Windows Vista, you must enable connectivity over both the following port ranges:

  High port range: 49152 through 65535

  Low port range: 1025 through 5000

• For more information about the default dynamic port range, click here.

For SNMP Mode of monitoring:

Ports required - SNMP Agent Port: 161

Windows Management Instrumentation (WMI) -- Port: 445

Remote Procedure Call (RPC) -- Port: 135

PowerShell remoting -- TCP 5985 and 5986

Port in which FTP or SFTP is running (default:21 for FTP, 22 for SFTP)

To monitor JMX behind firewall, the following changes have to be done.

• Edit startApplicationsManager.bat/sh file. Add
  -Dmonitor.jmx.rmi.port=<port number for RMI socket communication> to the Java runtime options.
• Restart Applications Manager server
• Ensure that you have the RMI Socket port (step1) and JNDI Port (step4) are opened up in the firewall
• Add the JMX Applications monitor after providing the relevant details.
• The monitor should be added successfully

Windows Management Instrumentation (WMI) -- Port: 445

Remote Procedure Call (RPC) -- Port: 135

The default port of JMX agent is 1099

Windows Management Instrumentation (WMI) -- Port: 445

Remote Procedure Call (RPC) -- Port: 135

• Default RUM agent port 7070 (HTTP) and 7443 (HTTPS).
• Above RUM Agent ports should be opened in firewall for all the end users accessing the application which is monitored in Real User Monitor in Applications Manager.
• RUM Agent should be able to communicate with Applications Manager server. i.e. One way communication from the RUM Agent to the Applications Manager HTTPS port (default HTTPS port: 8443).

• Default EUM agent port 9999 (HTTP) and 9443 (HTTPS).
• EUM Agent should be able to communicate with Applications Manager server. i.e. One way communication from the EUM Agent to the Applications Manager HTTPS port (default HTTPS port: 8443).
• Firewall requirements for the following EUM-based monitor types should be the same as that of the non-EUM-based monitors supported in Applications Manager:
  • DNS
  • LDAP
  • Telnet
  • Mail
  • Ping
  • RBM (default port 9595)

• The AWS Access Key Id for accessing the AWS through the API. The access key has 20 alpha-numeric characters.
• The Secret Access Key of the AWS. The secret key should be 40 alpha-numeric characters long.

• To retrieve data for all modules in AS400/iSeries monitor except 'Disk', an user with *USER user profile is required.
• To retrieve data for 'Disk' and to perform Admin actions from Applications Manager, an user with *SECOFR user profile is required.

• If using the *SECOFR user profile is not possible, then for retrieving disk data and to perform the admin actions such as viewing spooled file, job log and performing actions in JOBS, SPOOL, SUBSYSTEM a user profile with special authorities such as *ALLOBJ, *SAVSYS, *JOBCTL, *SPLCTL is required.

• The user should have permission to access QMPGDATA/QPFRDATA library because Applications Manager uses performance collection service for retrieving disk details from AS400/iSeries server. Note: If the performance data collection is not enabled in AS400/iSeries, you need to start it by using the command STRPFRCOL or GO PERFORM-->COLLECT PERFORMANCE DATA-->START PERFORMANCE COLLECTION. You will also be able to execute the STRPFRCOL command from AS400/iSeries server monitor page in Admin-->Non-Interactive command option.

If Authentication is enabled, enter the Username and password for connecting to the JMX agent.

You need a SAP user profile with the following authorization objects: S_RFC, S_XMI_LOG and S_XMI_PROD which are the minimum prerequisities for adding a SAP monitor.

We use the SAP Java Connector to connect to the SAP ABAP server. The SAP JCo will communicate from APM to SAP using the SAP Dispatcher. The SAP Dispatcher port to be used is 3200 with the SAP System number.

For SNMP Version V1/V2c:

• SNMP Community string with read only privileges.

For SNMP Version V3:

Select one of the three Security Levels in the drop-down list:

• NoAuthNoPriv - Messages can be sent unauthenticated and unencrypted. Enter a UserName and Context Name.
• AuthNoPriv - Messages can be sent authenticated but unencrypted. Enter a UserName, Context Name and an Authentication Password. You can select an Authentication Protocol like MD5 or SHA from the drop-down list.
• AuthPriv - Messages can be sent authenticated and encrypted. Enter a UserName, Context Name,an Authentication Password and a Privacy Password. You can select an Authentication Protocol like MD5 or SHA from the drop-down list. By default 'DES' encryption technique will be used.

• For 5.x and above, a username and password is required to connect to Tomcat Manager Application. If not, no username/password is required.
• For 5.x the user specified should have a 'manager' role.
• For 6.x and above, the user specified should have "manager-gui", "manager-script", "manager-jmx" and "manager-status" roles.

When adding VMWare ESX/ESXi servers for monitoring, we recommend that you use the root account. However, if you are unable to use the root account, you can use a 'view-only' profile to add the servers. This profile has all the privileges required for monitoring. The user you create must be:

• a member of the group user.
• based on the profile 'read only'.