All IP addresses must use IPv4. Cryptographic Security Platform Compliance Manager does not support IPv6 addresses.
Inbound and outbound are described from the perspective of the Compliance Manager nodes. Internal traffic is between Compliance Manager nodes.
Port reference
Port | Protocol | Application | Direction | Transport security | Requirement and notes |
|---|---|---|---|---|---|
22 | TCP | SSH | Inbound: administrator systems to any cluster server | SSH encryption | Required for troubleshooting and support access. |
25 | TCP | SMTP | Outbound: Compliance Manager to mail server | If you disable SMTPS and the server supports StartTLS, it will use StartTLS when the connection is made. SMTPS is not compatible with StartTLS, and only one can be used. | Typical outbound mail port. |
53 | UDP | DNS | Outbound: Compliance Manager to DNS server | N/A | Required for name resolution. |
123 | UDP or TCP | NTP | Outbound: Compliance Manager to NTP server | N/A | Typical NTP port The network ports indicated for SMTP, syslog, and NTP are the typical ports for these services. If you need to change those ports, consult with the administrators of these services. |
161 | UDP | SNMP polling | Inbound: SNMP manager to Compliance Manager | TLS is available | Required only when the SNMP Polling feature is enabled. |
162 | UDP | SNMP traps | Outbound: Compliance Manager to SNMP manager | TLS is available | Required only when the SNMP Traps feature is enabled. |
443 | TCP | CSP Compliance Manager webGUI, API, and incoming data source connections | Bidirectional: between Compliance Manager nodes | TLS is always enabled for all use cases | N/A |
514 | TCP | Syslog | Outbound: Compliance Manager to remote syslog server | mTLS is available | TCP/514 is required only when the SYSLOG feature is enabled. For remote syslog, configure an outbound TCP or UDP port in the range between 25 and 65535. Cryptographic Security Platform Compliance Manager supports syslog over both TCP and UDP. |
587 | TCP | SMTP-TLS | Outbound: Compliance Manager to mail server | TLS enabled | Required only when the SMTP-TLS feature is enabled. |
8443 | TCP | Internal clustering | Bidirectional: between Compliance Manager nodes | mTLS enabled | N/A |
2281 | TCP | Zookeeper | Bidirectional: between Compliance Manager nodes | mTLS enabled | N/A |
2888 | TCP | Zookeeper | Bidirectional: between Compliance Manager nodes | mTLS enabled | N/A |
3888 | TCP | Zookeeper | Bidirectional: between Compliance Manager nodes | mTLS enabled | N/A |
5432 | TCP | Postgres DB | Bidirectional: between Compliance Manager nodes | mTLS enabled | N/A |
9093 | TCP | Kafka | Bidirectional: between Compliance Manager nodes | mTLS enabled | N/A |
27017 | TCP | Mongo DB | Bidirectional: between Compliance Manager nodes | mTLS enabled | N/A |
Additional port reference
Backup and Restore via NFS
To access Compliance Manager-generated backup files over NFS, open the following ports:
Port | Service |
|---|---|
2046 | lockd |
2047 | rpc.statd |
2048 | rpc.mountd |
2049 | NFS port |
Run the following command to check the port status.
rcpinfo <cm>Where <cm> is the Compliance Manager IP address or the domain name.