SUMMARY
Detail about which ports are used for Client to Appliance communications, Source to Target replication, and internal management of the Unitrends Appliance/UEB.
ISSUE
-
What firewall ports are used by Unitrends Support to support your Recovery Series Appliance or UEB, Client to Appliance communications, Source to Target replication, and internal management of your Appliance/UEB?
-
What servers does Unitrends Support use for supporting and communicating with a Unitrends Recovery Series Appliance?
RESOLUTION
Validate Open Ports
To test what ports are open on the target, run the following command:
nmap -P0 [targetIPaddress]
Additionally, a downloadable tool exists to run on a windows machine to validate target connectivity on specific provided OpenVPN ports. See your Unitrends community site, under the training link, select the "catalogs" link and locate the Quick Demo's and Top Resources catalog. Review the Unitrends install Onboarding training package for more information about connecting to Unitrends Cloud and prerequisite requirements.
Internet - Between your Recovery Series Appliance\UB and Unitrends
For details on which Internet-facing (public) ports Unitrends requires for product functionality such as support tunnel, upgrade downloads, and SNMP notifications, please see:
What ports does Unitrends need open in my firewall?
Intranet - Between Your Clients and the Recovery Series Appliance\UB
The following ports are used to communicate between the Unitrends Appliance or UEB and Client Agents as well as to other Unitrends appliances. The ports may need to be opened depending on your company's security policies. Also consider local and group policy settings which may affect connectivity and communications between a Client and the Appliance or UEB. Port connectivity to cloud providers including Amazon AWS/EC2, Azure, Rackspace, or others are not included in this list. See 3rd party documentation for their requirements as they may vary by cloud provider.
Port Protocol - Reason NA ICMP - required for many services including support tunnels, hot copy replication, openvpn, daily client inventory sync, and numerous cloud functions. 1* TCP - Only needed during setup of legacy vaulting (v6.4 and older) 21 (and 20) TCP - FTP for updates from repo.unitrends.com (both ports required!). It does us PASV FTP which opens an ephemeral port and informs the FTP client to connect to that port before requesting data transfer 22 TCP - used for SSH access to the Unitrends appliance. Also used by legacy vaulting 80 TCP - Redirect to https port (also used for some updates via http protocol) 111♦ TCP – Port mapping protocol used by the NFS service. 137 TCP – NetBIOS name service used this port to start sessions. 139 UDP - legacy client SMB access (Win 2000 and older) 161 TCP – SNMP 443♦ TCP – SSL Unitrends UI / Unitrends Image Level Agent. VMware backups. Used for updates to Docker engines (required after release 10.3) 445 TCP - SMB/CIFS - required for Hyper-V IR, Agent Push, NAS (CIFS), Oracle and Sharepoint backups. 873 TCP – RSYNC 888 TCP – Agent Pairing 902♦ TCP and UDP - VMWare vSphere ESXi hosts and vCenter Server agent. Custom vSphere ports are not supported. 1194* UDP - OpenVPN (Default Hot Copy Replication only) NOTE: This will be different is you are Replicating to the Unitrends Cloud** 1743 TCP - Unitrends control port (between Client and Unitrends Appliance) 1744** TCP - Unitrends Data Port using dynamically assigned high number port. 1745-1749** TCP - Unitrends Data Ports using the port assigned in the C:\PCBP\MASTER.ini on Windows based computers
1745-1844** TCP - Unitrends Data Ports using the port assigned in the /usr/bp/bpinit/master.ini file on *NIX based computers
2049♦ TCP - For protecting a NAS or Cold Backup Copy using NFS. Oracle backups from some clients. Recovery to VMware. 3260 TCP – iSCSI 4970 TCP – PostgreSQL 5432 TCP – PostgreSQL 5721 TCP – Kaseya VSA Agent 5900-5910 TCP - VNC 9443 TCP - vSphere web API connectivity for VMWare backup 10000 TCP - NDMP 22024 TCP - VMware Data Recovery Management 55404 TCP - ELK Stack Telemetry 59200 TCP - ELK Stack Telemetry 49152-65535 TCP - Dynamic port range may be used by agent backups if default Data ports are not available
CAUSE
* Hot Backup Copy Replication
OpenVPN use is a requirement of all hot copy replication. (in effect since 9.0.0-6 for security and compliance). This encrypts the communication channel between the Source and Target and makes future changes easy to adjust. OpenVPN allows for packet transmission retry and enforced packet ordering HTTPS alone does not supply, and though it has a small overhead of less than 0.5% it overall improves replication reliability and throughput greatly in excess of this overhead. OpenVPN requires ICMP to establish connectivity. Unitrends recommends having the Target/Manager configured to be the OpenVPN Server and the Source be the OpenVPN Client before remote management is configured.
Source: Receives the backups from the computers it protects (Protected Assets).
Target: Received backup copy data from the Source appliance(s).
Manager: An appliance given permission to manage a Source appliance.
Unitrends Cloud Target Partner
(Hot Backup Copy Replication to Unitrends Cloud)
When first setting up your connection with the Unitrends Cloud Partner, the Firewall/IDS/IPS/Web Filter/Application Control of your network security device must be relaxed to allow traffic bidirectional between your appliance and the FQDN of the Unitrends Cloud only for the setup portion. Once it has been completed, you will only need to allow the UDP Port specifically assigned to your Appliance for Hot Backup Copy Replication.
Unitrends Backup Portal
(MSP Portal via _____.backup.net or login.backup.net)
Please review the article titled "What firewall ports need to be accessible for the Unitrends Backup Portal (backup.net)"
** Unitrends Client Agent to Appliance Ports
These are the minimum ports required for command, control, and data transfer between your Clients (Protected Asset) and your Unitrends Appliance. Please review the Unitrends Administrators Guide, Chapter 10 for additional port requirements based on your protection needs.
Command and Control Channel
The TCP Port 1743 is used for Command and Control messages between the Unitrends appliance and the BP Agent on the computer you want to protect. This is adjusted on the Unitrends appliance and is never changed.
Data Transport Channel
The data itself is transferred over a different TCP Port. In some cases, you may need to alter the TCP Port used (IE. Microsoft ISA and Forefront Firewall uses 1745). The default TCP Port 1744 allows for a random available high port number if the expected port is in use (unless the Unitrends Port Security is set to the value of Medium or High).
-
- 1745 - 1749 on Windows based computers. (1744 uses ephemeral ports if 1745-1749 are in use)
- 1745 - 1844 on Linux/UNIX based computers. (1744 uses ephemeral ports if 1745-1844 are in use)
- 443 used for Image-level backups on Windows systems
This change can be made on the Client station by editing the file (windows C:\PCBP\MASTER.ini and for *NIX /usr/bp/bpinit/master.ini) and changing the value of data=.
♦ VMware Protection
Unitrends uses VMware's VDDK to communicate via the vStorage API for Data Protection (VADP) when backing up VMware. If SAN-direct is not being used, the data will be send via Network Block Device (NBDSSL) using the Network File Copy (NFC) protocol. The VADP backup traffic is not done through vCenter server. vCenter is used only during: VM discovery, Snapshots requests or VM creations during recovery. The rest is done between the ESXi and Unitrends (which is why you should add the ESXi hosts as a Protected Asset). In absence of vCenter, all request are processed by the ESXi host. There are two ports used during the backup or restore:
443 - between backup host and vCenter
902 - between backup host and ESXi host
111 - NFS mounts for Unitrends during recovery
2049 - NFS mounts for Unitrends during recovery
(New release of VMware may require additional ports.)
♦ Windows Image Backup
Windows Image based backup utilizes port 443 over HTTPS. For more information on Image-level backups, please review the Unitrends Administrators Guide, Chapter 8.