IBM Security SiteProtector System Configuring Firewalls for SiteProtector Traffic

IBM Security IBM Security SiteProtector System Configuring Firewalls for SiteProtector Traffic Version 2.9

Note Before using this information and the product it supports, read the information in Notices on page 13. This edition applies to Version 2.9 of the IBM Security SiteProtector System and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright IBM Corporation 1994, 2011. US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

Contents About this publication........ v Technical support............. v Chapter 1. Firewall Port Information... 1 Port information for SiteProtector traffic..... 1 Port information for Active Directory integration.. 7 Port information for Internet access....... 7 Local-only ports............. 8 Chapter 2. Configuring Components for NAT Firewalls............ 9 Configuring the Application Server for communication with NAT firewalls....... 9 Restarting the Sensor Controller and Application Server services............. 10 Configuring the Agent Manager for communication through NAT firewalls........... 10 Notices.............. 13 Trademarks.............. 14 Copyright IBM Corp. 1994, 2011 iii

iv SiteProtector System: Configuring Firewalls for SiteProtector Traffic

About this publication The IBM Security SiteProtector System cannot function properly if firewalls prevent components from communicating. This guide provides procedures for configuring network devices and SiteProtector components so that they can communicate through firewalls. Intended audience This document assumes that you are familiar with the following: v Procedures for configuring firewalls v Routers, or any other devices that you use to block traffic on your network v Procedures for modifying system files such as Windows registries and properties files Topics Chapter 1, Firewall Port Information, on page 1 Chapter 2, Configuring Components for NAT Firewalls, on page 9 Technical support IBM Security provides technical support to customers who are entitled to receive support. The IBM Support Portal Before you contact IBM Security about a problem, see the IBM Support Portal at http://www.ibm.com/ software/support. The IBM Software Support Guide If you need to contact technical support, use the methods described in the IBM Software Support Guide at http://www14.software.ibm.com/webapp/set2/sas/f/handbook/home.html. The guide provides the following information: v Registration and eligibility requirements for receiving support v Customer support telephone numbers for the country in which you are located v Information you must gather before you call Copyright IBM Corp. 1994, 2011 v

vi SiteProtector System: Configuring Firewalls for SiteProtector Traffic

Chapter 1. Firewall Port Information If SiteProtector components or modules are located behind firewalls, you may need to reconfigure the firewalls so that the components or modules can communicate with each other. This section includes background information and procedures for configuring firewall ports for different types of traffic. TCP/IP ports Firewalls commonly filter traffic by IP address and by TCP or UDP ports. Firewalls typically block these addresses and ports unless they are explicitly allowed. Where firewalls are typically located Firewalls can be placed anywhere on a network but are most commonly located between the following: v Console and the Application Server v Application Server and the agents v Agent Manager and Desktop Endpoint Security agents v Event Collector and agents v Application Server and the Internet v X-Press Update Server and the Internet (IBM Download Center) Topics Port information for SiteProtector traffic Port information for Third Party Module traffic Port information for Active Directory integration on page 7 Port information for Internet access on page 7 Port information for SiteProtector traffic This topic provides information that can help you configure firewall rules that allow traffic between all SiteProtector System components. Requirement If a firewall is located between the source and destination component, create a firewall rule that allows incoming traffic to the destination ports that are specified. Reference: Refer to your firewall documentation for specific instructions about creating and configuring a firewall rule. Destination ports that must be open Destination ports use the TCP protocol unless otherwise indicated. The following table lists the destination ports that must be open to allow communication between each pair of SiteProtector components. Copyright IBM Corp. 1994, 2011 1

Source Component Destination Component Wire Protocol Encryption Destination Ports SiteProtector Console SP Server HTTP / HTTPS / RMI / JRMP / JMS Yes 3988, 3989, 3994, 3996, 3997, 3998, 3999, 8093 Event Viewer N/A Yes 3993 ADS Appliance HTTPS Yes 443 IBM Security web site http://www- 03.ibm.com/security/ HTTP None 80 2 SiteProtector System: Configuring Firewalls for SiteProtector Traffic

Source Component Destination Component Wire Protocol Encryption Destination Ports SP Server Databridges L/S 1 Yes 2998 Active Directory Server LDAP None 389, 3268 2 Event Collector HTTPS / L/S Yes 2998, 8996 SecurityFusion L/S Yes 2998 module Agent Manager L/S / HTTPS Yes 2998, 3995 Deployment Manager L/S Yes 2998 X-Press Update HTTPS Yes 3994 Server Event Archiver HTTPS Yes 8998 Site DB JDBC / TDS / RPC / Named Pipe Network Multi-Function Security (MFS) Appliance Network Intrusion Detection System (IDS) prior to firmware release 1.0 Network Intrusion Detection System (IDS) and IBM Security Network Intrusion Prevention System (IPS) with firmware release 1.0 or later Network Enterprise Scanner External Ticketing Server Yes 1433, 445, 135, 1434 (UDP port not encrypted) HTTPS Yes 443, 8001 L/S Yes 2998 HTTPS Yes 443 HTTPS Yes 443 Vendor Proprietary 3 Yes 1058, 1069 4 SNMP Server SNMP None 162 SMTP Server SMTP None 25 IBM Internet L/S Yes 2998 Scanner RealSecure Network L/S Yes 2998 Sensor IBM Security Server L/S Yes 2998 Protection Remote Host Windows RPC None 135 Deployment Manager Site DB JDBC / TDS / RPC / Named Pipe Configurable 1433, 135, 445, 1434 Chapter 1. Firewall Port Information 3

Source Component Destination Component Wire Protocol Encryption Destination Ports Desktop Agents (7.0 Agent Manager HTTPS Yes 8082 and earlier) Agent Manager Desktop Agent N/A None ICMP SP Server HTTPS Yes 3994, 8093, 8443 Site DB OLE DB / RPC / Configurable 1433, 135, 445, 1434 Named Pipe IBM Security Server Protection for Windows N/A None ICMP Proventia Server for Linux Event Archiver IBM Security Network IPS appliances (G, GX, and GV) HTTPS Yes 443 IBM Security Virtual Server Protection Network Enterprise Scanner Network Multi-Function Security (MFS) HTTPS Yes 443, 8001 SNMP Server SNMP None 162 SMTP Server SMTP None 25 X-Press Update Server HTTPS YES 3994 4 SiteProtector System: Configuring Firewalls for SiteProtector Traffic

Source Component Destination Component Wire Protocol Encryption Destination Ports Event Collector Databridge L/S Yes 901-930 Agent Manager L/S Yes 914 Event Archiver HTTPS Yes 8997 Event Collector L/S Yes 912 SP Server HTTPS Yes 3994 IBM Internet Scanner L/S Yes 60155 RealSecure Network L/S Yes 901, 904, 907, 910 Sensor Network Intrusion Detection System (IDS) L/S Yes 901-930 5 SNMP Server SNMP None 162 SMTP Server SMTP None 25 RealSecure Server Sensor (IBM Security Server Protection) L/S Yes 902 SecurityFusion L/S Yes 901 module Site DB ODBC / RPC / Configurable 1433, 135, 445, 1434 Named Pipe Event Archiver SP Server HTTPS Yes 3994 Agent Manager HTTPS Yes 3995 Event Archiver Agent Manager HTTPS Yes 3995 Importer Web Console SP Server HTTPS Yes 3994 Web Browser Deployment Manager HTTPS Yes 3994 Agent Manager HTTP Yes 8085 Network Enterprise Scanner Agent Manager HTTPS Yes 3995 Network Intrusion Detection System (IDS) IBM Security Network Intrusion Prevention System (IPS) Network Multi-Function Security (MFS) IBM Security Server Protection for Windows Agent Manager 6 HTTPS Yes 3995 Chapter 1. Firewall Port Information 5

Source Component IBM Security Network IPS appliances (G, GX, and GV) Destination Component Wire Protocol Encryption Destination Ports X-Press Update HTTPS Yes 3994 Server 7 Network Multi-Function Security (MFS) IBM Security Virtual Server Protection Network Enterprise Scanner IBM Security Server Protection for Windows Proventia Server for Linux Desktop Endpoint Security SecurityFusion module IBM Security Server Protection Desktop Endpoint Security Event Collector L/S Yes 950 Site DB ODBC / RPC / Configurable 1433, 135, 445, 1434 Named Pipe Agent Manager HTTPS Yes 3995 Agent Manager HTTPS Yes 3995 Event Viewer Service SP Server RMI / JRMP Yes 3989, 3988 X-Press Update Server Agent Manager HTTPS Yes 3995 IBM Security web site http://www- 03.ibm.com/security/ HTTP Yes 80, 443 X-Press Update Server www.iss.net xpu.iss.net download.iss.net download-1.sg.iss.net update.iss.net HTTPS Yes 3994 HTTPS Yes 443 1. The Wire Protocol abbreviation L/S refers to Leap/Score. 2. Port 3268 is referenced from the Global Catalog. 3. Vendor Proprietary means this is specific only to the vendor. 6 SiteProtector System: Configuring Firewalls for SiteProtector Traffic

4. Port 1069 is based upon the Remedy web Site. 5. Proventia Network Intrusion Detection System firmware releases earlier than 1.0 use destination ports 901 through 903. 6. All Proventia Agents and Desktop Agent release 7 or earlier communicating with the Agent Manager have the Command & Control option. 7. Use these settings if you want all agents to download updates directly from the X-Press Update Server. Port information for Active Directory integration To integrate Active Directory with SiteProtector, the Sensor Controller must be able to communicate with Active Directory over certain ports. Destination ports that must be open The following table lists the destination ports that must be open to allow communication between SiteProtector components and Active Directory: Protocol TCP Port Kerberos Secure Authentication 88 Lightweight Directory Access Protocol (LDAP) 389 Kerberos Passwords 464 LDAP over SSL 636 Microsoft Global Catalog 3268 Microsoft Global Catalog with LDAP/SSL 3269 Port information for Internet access If you download SiteProtector System updates from the Internet, then you may need to reconfigure your firewall rules to allow this communication. This topic gives a procedure for configuring firewall rules for Internet access. Reference: Refer to your firewall documentation for specific instructions. Requirement If a firewall is located between the source and destination component, create a firewall rule that allows incoming traffic to the specified destination ports. Destination ports that must be open The following table lists the destination ports that must be open to allow communication between SiteProtector components and the IBM Download Center. Protocol Destination Address Destination Port SSL or HTTPS xpu.iss.net 443 SSL or HTTPS www.iss.net 443 SSL or HTTPS download.iss.net 443 SSL or HTTPS update.iss.net 443 Chapter 1. Firewall Port Information 7

Important: IBM Security recommends that you use secure protocols (SSL or HTTPS) to download updates from the Deployment Manager. Local-only ports Certain local-only ports must be open to allow communication between the Application Server and other SiteProtector components on the same machine. Local-only ports are bound to the system's loopback adapter (127.0.0.1) and cannot be accessed remotely. Local-only ports are in a listening state because they only receive internal system communications and are not configured to make use of external calls. Reference: Refer to your firewall documentation for specific instructions. Static ports The following static local-only ports are available for the Application Server: v 1527 v 2001 v 4201 v 6882 v 8009 v 8080 v 9999 v 61050 v 61613 Dynamic ports Local-only ports are also assigned dynamically depending on the port availability for that system. Dynamic local-only ports cannot be documented here because they change dynamically depending on circumstances. 8 SiteProtector System: Configuring Firewalls for SiteProtector Traffic

Chapter 2. Configuring Components for NAT Firewalls If your SiteProtector components are located behind firewalls that use NAT or other types of address translation, you may be required to perform additional configuration tasks so that SiteProtector components can communicate. Problems with using NAT with SiteProtector By default, some SiteProtector components are configured to use private IP addresses to communicate with other components. NAT firewalls typically block components that use private IP addresses. How to enable NAT communication To correct NAT communication problems, you must configure SiteProtector components to use either a public IP address or a fully qualified domain name. Common NAT firewall locations NAT is typically enabled on external firewalls and not on firewalls that are located on the intranet. You may experience communication problems if firewalls are located between the following: v Remote consoles and the Application Server v Remote Desktop Endpoint Security agents and the Agent Manager Topics Configuring the Application Server for communication with NAT firewalls Restarting the Sensor Controller and Application Server services on page 10 Configuring the Agent Manager for communication through NAT firewalls on page 10 Configuring the Application Server for communication with NAT firewalls This topic explains how to configure the Application Server to communicate with NAT firewalls. About this task Important: Perform the procedure in this topic only if a NAT firewall is between the Application Server and the Console. Reference: For more information on stopping and restarting the application services, see Restarting the Sensor Controller and Application Server services on page 10. Procedure 1. Stop the Application Server service. 2. Click Start on the taskbar, and then select Run. 3. In the Open field, type regedit. The Registry Editor appears. 4. Navigate to the following path: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ Copyright IBM Corp. 1994, 2011 9

5. Use the following table to configure the registry keys: Folder Entry Change the... issspappservice\parameters JVM Option Number 6 value data from the IP address to the DNS name issspsenctlservice\parameters IPBind value data from the IP address to the DNS name Example: Djava.rmi.server.hostname=public_IP_or_FQDN 6. Restart the Sensor Controller and Application Server services. Restarting the Sensor Controller and Application Server services This topic explains how to stop or restart the Sensor Controller and the Application Server services. About this task After you have configured the Application Server to communicate with NAT, you must restart the Sensor Controller and Application Server services to put the changes into effect. Procedure 1. Click Start on the taskbar of the computer where the Application Server and Sensor Controller are installed, and then select Settings > Control Panel. 2. Open the Administrative Tools folder, and then double-click Services. The Services window appears. 3. In the right pane, scroll until you find SiteProtector Sensor Controller Service, and then select it. 4. Do one of the following: v To stop the Sensor Controller service, click Stop Service (the Stop option) on the toolbar. v To start the Sensor Controller service, click Start Service (the Play option) on the toolbar. 5. Repeat Steps 1 through 4 for the Application Server. Configuring the Agent Manager for communication through NAT firewalls Perform the procedure in this topic only if a NAT firewall is between the Agent Manager and IBM Proventia Desktop Endpoint Security agents. This procedure configures the Agent Manager so that it can communicate with NAT firewalls. Before you begin You must perform this procedure before you generate agent builds. Otherwise, agents cannot communicate with the Agent Manager, and you will be forced to regenerate agent builds. Procedure 1. On the computer where the Agent Manager is installed, locate the Agent Manager initialization files at the following path: \Program Files\ISS\SiteProtector\AgentManager\rsspdc.ini 2. Open the file in a text editor. 3. Change the dcname to one of the following: v DNS name (the recommended option) v public IP address 10 SiteProtector System: Configuring Firewalls for SiteProtector Traffic

Note: If you select the DNS name option, ensure that it resolves to an IP address. 4. Save the file. 5. On the Console, right-click the Agent Manager icon, and then select Stop. 6. Right-click the Agent Manager icon, and then select Start. Chapter 2. Configuring Components for NAT Firewalls 11

12 SiteProtector System: Configuring Firewalls for SiteProtector Traffic

Notices This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-ibm product, program, or service. IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not grant you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY 10504-1785 U.S.A. For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to: Intellectual Property Licensing Legal and Intellectual Property Law IBM Japan Ltd. 1623-14, Shimotsuruma, Yamato-shi Kanagawa 242-8502 Japan The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-ibm Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk. IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you. Copyright IBM Corp. 1994, 2011 13

Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact: IBM Corporation SiteProtector Project Management C55A/74KB 6303 Barfield Rd., Atlanta, GA 30328 U.S.A Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee. The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or any equivalent agreement between us. All statements regarding IBM's future direction or intent are subject to change or withdrawal without notice, and represent goals and objectives only. Trademarks IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at Copyright and trademark information at Copyright and trademark information at www.ibm.com/ legal/copytrade.shtml. Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both. UNIX is a registered trademark of The Open Group in the United States and other countries. Microsoft and Windows are trademarks of Microsoft Corporation in the United States, other countries, or both. Other company, product, or service names may be trademarks or service marks of others. 14 SiteProtector System: Configuring Firewalls for SiteProtector Traffic

Printed in USA