Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
HeikoAnkenbrand
Champion Champion
Champion
Jump to solution

R8x Ports Used for Communication by Various Check Point Modules (new version 2.0)

Introduction

This drawing should give you an overview of the used R80, R81 ports respectively communication flows. It should give you an overview of how different Check Point modules communicate with each other. Furthermore, services that are used for firewall operation are also considered. These firewall services are also partially mapped as implied rules in the set on the firewall.

Overview

Ports_2.0a.jpg

Download PDF

Download R8x version 2.0:
R8x Ports Used for Communication PDF

SmartConsole Extention


New!

Now I have developed a SmartConsole Extension so that you can view the overview directly in the SmartConsole.
In the Access Policy section in the upper area, there is a tab called "Ports for Modules". More infos here.

Extension URL: https://www.ankenbrand24.de/ex/ports.json

picture_ports_1_6546456.jpg

References

Support Center: Ports used by Check Point software 

Versions

 

Version 2.0:
+ v2.0f new! now with SmartConsole Extension                                02/13/2023
+ v2.0e add LOM port 2048                                                                         01/31/2023
+ v2.0d  add LOM ports                                                                               01/23/2023

+
v2.0c  new colors + design                                                                      01/22/2023
+ v2.0b  best mistake 🙂  SmartDashboard versus SmartConsole     01/22/2023
+ v2.0a correct names : SMS, MDS, SmartConsole, ...                          01/21/2023

old Version 1.9:
+ v1.9a  add port 443 cloud CME  19.03.2022
+
v1.9b  fix port issue 442 cloud CME  22.03.2022

old Version 1.8:
+ v1.8a R81.10 EA update 04.05.2021
+ v1.8b add port 18264 30.05.2021
+ v1.8c R81.10 upgrade 28.07.2021

old Version 1.7:
+ v1.7a R81 EA update 17.07.2021
+ v1.7b bug fix 20.08.2021
+ v1.7c bug fix + new download link 25.06.2021

old Version 1.6:
+ v1.6a add Azure ports 05.05.2020
+ v1.6b add all cloud ports 15.06.2020

old Version 1.5:
+ v1.5a typos corrected 18.09.2019
+ v1.5b port update 26.01.2020

old version 1.4:
+ v1.4a bug fix, update port 1701 udp L2TP 09.04.2018
+ v1.4b bug fix 15.04.2018
+ v1.4c CPUSE update 17.04.2018
+ v1.4d legend fixed 17.04.2018
+ v1.4e add SmartLog and SmartView on port 443 20.04.2018
+ v1.4f bug fix 21.05.2018
+ v1.4g bug fix 25.05.2018
+ v1.4h add Backup ports 21, 22, 69 UDP and ClusterXL full sync port 256  30.05.2018
+ v1.4i add port 259 udp VPN link probeing 12.06.2018
+ v1.4j bug fix 17.06.2018
+ v1.4k add  OSPF/BGP route Sync 25.06.2018
+ v1.4l bug fix routed 29.06.2018
+ v1.4m bug fix tcp/udp ports 03.07.2018
+ v1.4n add port 256 13.07.2018
+ v1.4o bug fix / add TE ports 27.11.2018
+ v1.4p bug fix routed port 2010 23.01.2019
+ v1.4q change to new forum format 16.03.2019

old version 1.3:
+ v1.3a new designe (blue, gray), bug fix, add netflow, new names 27.03.2018
+ v1.3b add routing ports, bug fix designe 28.03.2018
+ v1.3c bug fix, rename ports (old) 29.03.2018
+ v1.3d bug fix 30.03.2018
+ v1.3e fix issue L2TP UDP port 1701

old version 1.1:
+ v1.1a - added r80.xx ports 16.03.2018
+ v1.1b - bug in drawing fixed 17.03.2018
+ v1.1c - add RSA, TACACS, Radius 19.03.2018
+ v1.1d - add 900, 259 Client-auth - deleted od 4.0 ports 20.03.2018
+ v1.1e - add OPSEC -delete R55 ports 21.03.2018
+ v1.1f - bug fix 22.03.2018
+ v1.1g - bug fix - add mail smtp -add dhcp - add snmp 25.03.2018

➜ CCSM Elite, CCME, CCTE
(36)
294 Replies
HeikoAnkenbrand
Champion Champion
Champion

Thank you, it's done!

Heiko

➜ CCSM Elite, CCME, CCTE
Hugo_vd_Kooij
Advisor

Heiko, It seems the legend (lower left corner) on v1.4b is partly hidden.

<< We make miracles happen while you wait. The impossible jobs take just a wee bit longer. >>
HeikoAnkenbrand
Champion Champion
Champion

THX, It was a problem with my PDF printer. Therefore, the legend was not displayed correctly. I fixed the issue. Should be okay now.

Regards,

Heiko

➜ CCSM Elite, CCME, CCTE
Vladimir
Champion
Champion

Heiko, the version of the attachment is still Ports_1.4d.pdf.

I think that the diagram in its present form is great as an overall reference map.

If you are interested and can share the Visio source file, I can try to convert it into a web page with layer toggle options.

This way, everyone will be able to enable the components their infrastructure is actually using as well as versions.

I am also not certain how to represent it, but it will be useful to mark user-configurable ports, (WebUI, portal, LEA, etc..) and to give users ability to change corresponding notation on the diagram.

Thank you for your ongoing efforts!

Vladimir

HeikoAnkenbrand
Champion Champion
Champion

Hi Vladimir,

You're right about the ports. GUI, LEA,... are ports that the user can change. But I have always used the default ports. For example, if the user changes the GUI port from 443 to xyz, he must use his setting.

Can you please accept me as follower, then I can write you a message on the topic share the Visio source file.

THX

Heiko

➜ CCSM Elite, CCME, CCTE
Vladimir
Champion
Champion

Done

Alexander_Wilke
Advisor

Hello,

this map is useful but I am missing some communication:

How is the Connection flow from the SmartConsole (SmartLog, SmartView Tracker, SmartDashboard, SmartUpdate) when I connect to a MDM and a MLM.

What is the communication flow if I connect from my PC's SmartDomain Manager "SmartLog" on the MDM and the I select different Domains on a MLM. Is the Connection then directly from my PC to the MLM or still to the MDM?

Thanks for updating the sheet!

Regards

Alex

HeikoAnkenbrand
Champion Champion
Champion

Hi Alex,

the simplest things are usually forgotten. I integrated SmartLog and SmartView into the next version 1.4e.

What I don't want to include in the drawing are loopback ports to the 127.0.0.1 interface.

I haven't found any other ports for MDM and I don't know any ( Ports used by Check Point software):

regards
Heiko

➜ CCSM Elite, CCME, CCTE
HeikoAnkenbrand
Champion Champion
Champion

Is added.

regards
Heiko

➜ CCSM Elite, CCME, CCTE
Alexander_Wilke
Advisor

Hi Heiko,

thanks for updating the PDF.

I don't want to have loopback communication in this Picture but perhaps communication of additional appliance types like MLM and NGSE.

Further what about "SyncXL" on 64K appliances and other Chassi (internal) communication?

HeikoAnkenbrand
Champion Champion
Champion

Hi Alexander,

I also often work on 61k/64k systems! Are you sure we should take this on board?

I think it's so special we can skip it.

Should have to include chassis <> chassis communication here. I don't have enough space on the A3 paper:-)

I'd like to leave it out. But if you want to have it, please enter a comment. Then I'll draw it in.

thx and regards

Heiko

➜ CCSM Elite, CCME, CCTE
HeikoAnkenbrand
Champion Champion
Champion

Now with R81 EA port update.

➜ CCSM Elite, CCME, CCTE
Will_Wells
Explorer

blue is better

Will_Lai
Explorer

Thanks for your diagram, you do gave me a big favor   

Hugo_vd_Kooij
Advisor

Just thinking. Shouldn't GAIA fall back to TCP/53 if the queries results in a large response? (large being over 512 bytes.) 

<< We make miracles happen while you wait. The impossible jobs take just a wee bit longer. >>
Norbert_Bohusch
Advisor

I found something missing:

For authentication to the management server (SmartConsole/Dashboard or Gaia WebUI) the connection from SMS to the services is needed (eg. Radius, TACACS, RSA)

And I have another set of ports for this documentation, if you want to include it: Required open TCP ports for LOM card functionality 

HeikoAnkenbrand
Champion Champion
Champion

Hi, Norbert,

thank you. I'll add the ports. The problem at the moment is that I have no place on the drawing. I will change it from A3 to A2. Then I'll add the ports.

Regards,

Heiko

➜ CCSM Elite, CCME, CCTE
Norbert_Bohusch
Advisor

Maybe another idea would be to split the one drawing in a small number which includes parts of it.

E.g. it would be possible to make one for OS parts like ssh, webui, snmp, dns, updates, auth (radius, tacacs), routing (ospf, rip, ...) and so on and one for GW/Management ports. Or even split this part up in Management stuff and one for gateway...

HeikoAnkenbrand
Champion Champion
Champion

It's a good idea. I must see how I do it! A2 format or two drawings.

Regards,

Heiko

➜ CCSM Elite, CCME, CCTE
Christian_Haber
Explorer

Use A2 and add all ports in one picture.

Judd_Miller
Explorer

Nice Job!

Sopie_Kalback
Participant

Hi,

Could you add LOM ports.

HeikoAnkenbrand
Champion Champion
Champion

Hi Christian,

I will do this in the next version.

Regards

Heiko

➜ CCSM Elite, CCME, CCTE
HeikoAnkenbrand
Champion Champion
Champion

I add LOM ports in the next version.

THX

Heiko

➜ CCSM Elite, CCME, CCTE
Jelle_Hazenberg
Collaborator
Collaborator

Hi Heiko,

First off all great stuff sharing this kind of information with the public! I would like to add another request to the new version.

When using ClusterXL, upon a full sync TCP port 256 is used to synchronize the state tables between cluster members. This is handled by the kernel / fwd daemon.

Kind regards,

Jelle Hazenberg

JozkoMrkvicka
Mentor
Mentor

backups on GWs and MGMTs can be done via FTP, SCP or TFTP.

Kind regards,
Jozko Mrkvicka
HeikoAnkenbrand
Champion Champion
Champion

I add this in the next version.

THX

Heiko

➜ CCSM Elite, CCME, CCTE
HeikoAnkenbrand
Champion Champion
Champion

Hi Jalle,

I add port 256 TCP for ClusterXL full sync. in the next version.

THX

Heiko

➜ CCSM Elite, CCME, CCTE
HeikoAnkenbrand
Champion Champion
Champion

Is added.

 

Regards,

Heiko

➜ CCSM Elite, CCME, CCTE
HeikoAnkenbrand
Champion Champion
Champion

Is added.

 

Regards,

Heiko

➜ CCSM Elite, CCME, CCTE

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events