Ports needed by ePO 4.x and ePO 5.0 for communication through a firewall

Environment:

McAfee Agent 4.x
McAfee ePolicy Orchestrator 5.0
McAfee ePolicy Orchestrator 4.x

Summary:

The following tables display the ports needed by ePolicy Orchestrator (ePO) for communication through a firewall:

For the purpose of this article:

• Bi-directional means that a connection can be initiated from either direction
• Inbound means the connection is initiated by a remote system
• Outbound means the connection can be initiated by the local system

ePO 4.5:

Port	Default	Description	Traffic direction
Agent to server communication port	80	TCP port opened by the ePO Server service to receive requests from agents. The repository is also hosted on this port.	Bi-directional between the Agent Handler and the ePO server and inbound to the Agent Handler from the McAfee Agent.
Agent communicating over SSL (4.5 and later agents only)	443	By default, 4.5 agents should communicate over SSL (443 by default).	Inbound connection to the Agent Handler from the McAfee Agent.
Agent wake-up communication port SuperAgent repository port	8081	TCP port opened by agents to receive agent wakeup requests from the ePO server. TCP port opened to replicate repository content to a SuperAgent repository.	Outbound connection from the ePO server/Agent Handler to the McAfee Agent.
Agent broadcast communication port	8082	UDP port opened by SuperAgents to forward messages from the ePO server/Agent Handler.	Outbound connection from the SuperAgents to other McAfee Agents.
Console-to-application server communication port	8443	HTTPS port opened by the ePO Application Server service to allow web browser UI access.	Inbound connection to the ePO server from ePO Console.
Client-to-server authenticated communication port	8444	HTTPS port opened by the ePO Application Server service to receive RSD connections. Also, used by the Agent Handler to talk to the ePO server to get required information (like LDAP servers).	Inbound connection to the ePO server from the Rogue System Sensor. Outbound connection from remote Agent Handlers to the ePO server.
Security threats communication port	8801	HTTP port hosted by McAfee Labs for retrieving security threat feed. Note that this port cannot be changed.	Outbound connection from the ePO server the external McAfee Labs server.
SQL server TCP port	1433	TCP port used to communicate with the SQL server. This port is specified or determined automatically during the setup process.	Outbound connection from the ePO server/Agent Handler to the SQL server.
SQL server UDP port	1434	UDP port used to request the TCP port that the SQL instance hosting the ePO database is using.	Outbound connection from the ePO server/Agent Handler to the SQL server.
Default LDAP server port	389	LDAP connection to look up computers, users, groups, and Organizational Units for User Based Policies.	Outbound connection from the ePO server/Agent Handler to an LDAP server.
Default SSL LDAP server port	636	User Based Policies use the LDAP connection to look up users, groups, and Organizational Units.	Outbound connection from the ePO server/Agent Handler to an LDAP server.

ePO 4.6 and 5.0:

Port	Default	Description	Traffic direction
Agent to server communication port	80	TCP port opened by the ePO Server service to receive requests from agents.	Bi-directional between the Agent Handler and the ePO server and inbound to the Agent Handler from the McAfee Agent.
Agent communicating over SSL (4.5 and later agents only) Software Manager	443	By default, 4.5 agents should communicate over SSL (443 by default). This port is also used for the remote Agent Handler to communicate with the ePO Master Repository.	Inbound connection to the Agent Handler from the McAfee Agent.
Agent wake-up communication port SuperAgent repository port	8081	TCP port opened by agents to receive agent wakeup requests from the ePO server. TCP port opened to replicate repository content to a SuperAgent repository.	Outbound connection from the ePO server/Agent Handler to the McAfee Agent.
Agent broadcast communication port	8082	UDP port opened by SuperAgents to forward messages from the ePO server/Agent Handler.	Outbound connection from the SuperAgents to other McAfee Agents.
Console-to-application server communication port	8443	HTTPS port opened by the ePO Application Server service to allow web browser UI access.	Inbound connection to the ePO server from ePO Console.
Client-to-server authenticated communication port	8444	HTTPS port opened by the ePO Application Server service to receive RSD connections. Also, used by the Agent Handler to talk to the ePO server to get required information (like LDAP servers).	Inbound connection to the ePO server from the Rogue System Sensor. Outbound connection from remote Agent Handlers to the ePO server.
Security threats communication port	8801	HTTP port hosted by McAfee Labs for retrieving security threat feed. Note that this port cannot be changed.	Outbound connection from the ePO server the external McAfee Labs server.
SQL server TCP port	1433	TCP port used to communicate with the SQL server. This port is specified or determined automatically during the setup process.	Outbound connection from the ePO server/Agent Handler to the SQL server.
SQL server UDP port	1434	UDP port used to request the TCP port that the SQL instance hosting the ePO database is using.	Outbound connection from the ePO server/Agent Handler to the SQL server.
Default LDAP server port	389	LDAP connection to look up computers, users, groups, and Organizational Units for User Based Policies.	Outbound connection from the ePO server/Agent Handler to an LDAP server.
Default SSL LDAP server port	636	User Based Policies use the LDAP connection to look up users, groups, and Organizational Units.	Outbound connection from the ePO server/Agent Handler to an LDAP server.

ePO (Ports/Traffic Quick Reference): 

           Agent Handler:

Default Port	Protocol	Traffic direction
80	TCP	Bi-directional connection to/from the Agent Handler
389	TCP	Outbound connection from the Agent Handler
443	TCP	Inbound connection to the Agent Handler
636	TCP	Outbound connection from the Agent Handler
1433	TCP	Outbound connection from the Agent Handler
1434	UDP	Outbound connection from the Agent Handler
8081	TCP	Outbound connection from the Agent Handler
8444	TCP	Outbound connection from the Agent Handler

ePO Server:

Default Port	Protocol	Traffic direction
80	TCP	Bi-directional connection to/from the ePO server
389	TCP	Outbound connection from the ePO server
443	TCP	Inbound/Outbound connection to/from the ePO server
636	TCP	Outbound connection from the ePO server
1433	TCP	Outbound connection from the ePO server
1434	UDP	Outbound connection from the ePO server
8081	TCP	Outbound connection from the ePO server
8443	TCP	Inbound connection to the ePO server
8444	TCP	Inbound connection to the ePO server
8801	TCP	Outbound connection from the ePO server

McAfee Agent:

Default Port	Protocol	Traffic direction
80	TCP	Outbound connection to the ePO server/Agent Handler
443	TCP	Outbound connection to the ePO server/Agent Handler
8081	TCP	Inbound connection from the ePO server/Agent Handler. If the agent is a SuperAgent repository then inbound connection from other McAfee Agents.
8082	UDP	Inbound connection to Agents. Inbound/Outbound connection from/to SuperAgents

SQL Server:

Default Port	Protocol	Traffic direction
1433	TCP	Inbound connection from the ePO server/Agent Handler
1434	UDP	Inbound connection from the ePO server/Agent Handler