SM Portmatrix
SM Portmatrix
SM Portmatrix
Avaya Aura®
Session Manager 8.0
Issue 1.00
May 21, 2018
CID 179213
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 1
ALL INFORMATION IS BELIEVED TO BE CORRECT AT THE TIME OF
PUBLICATION AND IS PROVIDED "AS IS". AVAYA INC. DISCLAIMS ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE AND FURTHERMORE, AVAYA INC. MAKES NO
REPRESENTATIONS OR WARRANTIES THAT THE INFORMATION
PROVIDED HEREIN WILL ELIMINATE SECURITY THREATS TO
CUSTOMERS’ SYSTEMS. AVAYA INC., ITS RELATED COMPANIES,
DIRECTORS, EMPLOYEES, REPRESENTATIVES, SUPPLIERS OR AGENTS
MAY NOT, UNDER ANY CIRCUMSTANCES BE HELD LIABLE FOR ANY
DIRECT, INDIRECT, SPECIAL, PUNITIVE, EXEMPLARY, INCIDENTAL OR
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF THE
INFORMATION PROVIDED HEREIN. THIS INCLUDES, BUT IS NOT
LIMITED TO, THE LOSS OF DATA OR LOSS OF PROFIT, EVEN IF AVAYA
WAS ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF
THIS INFORMATION CONSTITUTES ACCEPTANCE OF THESE TERMS.
© 2018 Avaya Inc. All Rights Reserved. All trademarks identified by the
® or ™ are registered trademarks or trademarks, respectively, of Avaya
Inc. All other trademarks are the property of their respective owners.
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 2
1. Session Manager Components
Data flows and their sockets are owned and directed by an application. Here a server running on RHEL 7.4
has many applications, such as JBoss, PostgreSQL, WAS, ASM, etc. For all applications, sockets are created
on the network interfaces on the server. For the purposes of firewall configuration, these sockets are sourced
from the server, so the firewall (firewalld service) runs on the same server. Application components in the
Session Manager Application Server are listed as follows and may comprise of one or more processes
working together.
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 3
2. Port Usage Tables
Source Port: This is the default layer-4 port number of the connection source. Valid values include: 0 –
65535. A “(C)” next to the port number means that the port number is configurable. A port may be
‘ephemeral’ if it is a short-lived and gets allocation automatically from a predefined range.
Destination Port: This is the default layer-4 port number to which the connection request is sent. Valid
values include: 0 – 65535. A “(C)” next to the port number means that the port number is
configurable.
Network/Application Protocol: This is the name associated with the layer-4 protocol and layers-5-7
application.
Optionally Enabled / Disabled: This field indicates whether customers can enable or disable a layer-4 port
changing its default port setting. Valid values include: Yes or No
“No” means the default port state cannot be changed (e.g. enable or disabled).
“Yes” means the default port state can be changed and that the port can either be enabled or
disabled.
Description: Connection details. Add a reference to refer to the Notes section after each table for specifics
on any of the row data, if necessary.
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 4
2.2 Port Tables
Below are the tables which document the port usage for this product.
Table 2: Ports on Session Manager network interface for Management & other Application Components (eth0)
Source Destination
Network / Optionally Default
Port Port Application Enabled / Port Description
System (Configurable System (Configurable
Protocol Disabled? State
Range) Range)
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 5
Source Destination
Network / Optionally Default
Port Port Application Enabled / Port Description
System (Configurable System (Configurable
Protocol Disabled? State
Range) Range)
Local TCP
System Manager Ephemeral 9572 No Closed Transfer log files to System Manager
Session Manager /Proprietary
Local
Other Systems Ephemeral 10162 UDP No Open Port for SAL-Agent’s SNMP traffic
Session Manager
Local
System Manager Ephemeral 11099 TCP/RMI No Open RMI registry
Session Manager
Local
System Manager Ephemeral 11100 TCP/JMX No Open JMX traffic
Session Manager
Egress or outgoing connections
Local
Ephemeral SSH Server 22 TCP No Open For external ssh access
Session Manager
Local Domain Name
Ephemeral 53 TCP No Open For FQDN resolution
Session Manager Server (DNS)
Local
Ephemeral Web Server (http) 80 TCP No Open For fetching CRLs over http
Session Manager
Local
Ephemeral NTP Server (ntp) 123 UDP No Open To sync system clock with remote NTP servers
Session Manager
Local SAL Gateway
Ephemeral 162 UDP/SNMP No Open SNMP traps from Session Manager
Session Manager and/or NMS
Local
Ephemeral System Manager 443 HTTPS No Open Serviceability Agent communication to SMGR
Session Manager
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 6
Source Destination
Network / Optionally Default
Port Port Application Enabled / Port Description
System (Configurable System (Configurable
Protocol Disabled? State
Range) Range)
Local Remote Syslog 514
Ephemeral TCP Yes Closed For logging to a Remote Syslog server
Session Manager Server (1-65535)
Local
Ephemeral System Manager 1398 TCP/JNDI No Open JNDI name service
Session Manager
Local
Ephemeral System Manager 1399 TCP/RMI No Open RMI name service
Session Manager
Local
Ephemeral System Manager 2009 TCP/JMX No Open JMX traffic for DRS
Session Manager
Local
Ephemeral System Manager 3873 TCP/RMI No Open EJB RMI
Session Manager
Local Remoting connector
Ephemeral System Manager 4446 TCP/JBoss No Open
Session Manager
Local JMX JRMP remote invoker
Ephemeral System Manager 4744 TCP/JMX No Open
Session Manager
Cassandra on
Local Provides communication channel between Cassandra
Ephemeral other Session 7001 TLS/Gossip Yes Closed nodes on Session Manager instances in a cluster when
Session Manager Managers in a Data Storage Clustering is enabled.
Cluster
Local Local
Ephemeral 7500 UDP/JBoss No Open Intra-Session Manager communication
Session Manager Session Manager
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 7
Table 3: Ports on Session Manager network interface for Security Module (secmod) (eth1)
Source Destination
Network / Optionally Default
Port Port Application Enabled / Port Description
System (Configurable System (Configurable Protocol State
Disabled?
Range) Range)
Local SIP signaling traffic – this is the default value, but other
SIP Servers and SIP 5060
Ephemeral UDP/SIP Yes Closed ports can be configured for SIP signaling using the
endpoints Session Manager (1024-65535) System Manager (See Notes 1, 3, 4, 6)
Local SIP signaling traffic – this is the default value, but other
SIP Servers and SIP 5060
Ephemeral TCP/SIP Yes Closed ports can be configured for SIP signaling using the
endpoints Session Manager (1024-65535)
System Manager (See Notes 1, 3, 4, 6)
Local SIP signaling traffic – this is the default value, but other
SIP Servers and SIP 5061
Ephemeral TCP/SIPS Yes Closed ports can be configured for SIP signaling using the
endpoints Session Manager (1024-65535) System Manager (See Notes 2, 3, 4, 6)
CS1000 Network Local UDP
Ephemeral 16500-16501 Yes Closed Interoperability with CS1000 networks through TPS
Control Server Session Manager /Proprietary
Egress or outgoing connections
Local ICMP
Ephemeral SIP Servers NA Yes Open Used to test status of SIP trunk to SIP Servers
Session Manager /Type 0,8
SIP signaling traffic – this is the default value, but other
Local SIP Servers and 5060
Ephemeral UDP/SIP Yes Closed ports can be configured for SIP signaling using the
Session Manager SIP endpoints (1024-65535)
System Manager (See Notes 1, 3, 4, 6)
SIP signaling traffic – this is the default value, but other
Local SIP Servers and 5060
Ephemeral TCP/SIP Yes Closed ports can be configured for SIP signaling using the
Session Manager SIP endpoints (1024-65535) System Manager (See Notes 1, 3, 4, 6)
SIP signaling traffic – this is the default value, but other
Local SIP Servers and 5061
Ephemeral TCP/SIPS Yes Closed ports can be configured for SIP signaling using the
Session Manager SIP endpoints (1024-65535) System Manager (See Notes 2, 3, 4, 6)
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 8
NOTES:
1. Used when encryption is not required.
2. Used for encrypted communication.
3. The SIP signaling port can be configured to use any valid port number in the range 1024-65535.
4. For SIP communications, the alternative transport options are UDP, TCP, or TLS.
5. For PPM communications, the alternative port options are 80 for unsecure HTTP communication, or 443 for secure communication.
6. These ports are opened dynamically by Asset and closed when Asset is stopped.
Source Destination
Network / Optionally Default
Port Application Enabled / Port Description
Port
System (Configurable System Protocol State
(Interface) Disabled?
Range)
Ports Added
Messaging between other Session Managers in a
Other Session Local cluster
Ephemeral 7900-7904 TCP/JGroup No Open
Managers in Cluster Session Manager
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 9
Table 5: Port changes from SM 7.1.1 to SM 7.1.2
Source Destination
Network / Optionally Default
Port Application Enabled / Port Description
Port
System (Configurable System Protocol State
(Interface) Disabled?
Range)
Ports Removed
Local
Ephemeral System Manager 1390-1391 TCP/JMX No Open JSR 160 JMX Connector
Session Manager
Ports Added
Local
Ephemeral System Manager 1398 TCP/JNDI No Open JNDI name service
Session Manager
Source Destination
Network / Optionally Default
Port Application Enabled / Port Description
Port
System (Configurable System Protocol State
(Interface) Disabled?
Range)
Ports Removed
Avaya Aura Local JMX port to Cassandra when an AADS is paired with
Ephemeral 8085 TCP/JMX Yes Closed
Device Services Session Manager the Session Manager.
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 10
Table 7: Port changes from SM 7.0.1 to SM 7.1
Source Destination
Network / Optionally Default
Port Application Enabled / Port Description
Port
System (Configurable System Protocol State
(Interface) Disabled?
Range)
Ports Added
Local
Ephemeral SSH Server 22 TCP No Open For external ssh access
Session Manager
Local Domain Name
Ephemeral 53 TCP No Open Non-SIP FQDN resolution
Session Manager Server (DNS)
Local
Ephemeral Web Server (http) 80 TCP No Open To allow fetching CRLs over http
Session Manager
Local
Ephemeral NTP Server (ntp) 123 UDP No Open To sync system clock with remote NTP servers
Session Manager
Local Remote Syslog 514
Ephemeral TCP Yes Closed For logging to a Remote Syslog server
Session Manager Server (1-65535)
Other Session Messaging between other Session Managers in a
Local
Ephemeral Managers in 7800-7804 TCP/JGroup No Open cluster (only used during error conditions)
Session Manager Cluster (See Note 2)
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 11
Table 8: Port changes from SM 7.0 to SM 7.0.1
Source Destination
Network / Optionally Default
Port Application Enabled / Port Description
Port
System (Configurable System Protocol State
(Interface) Disabled?
Range)
Ports Added
Cassandra on Provides communication channel between Cassandra
Local
other Session Ephemeral 7001 TLS/Gossip Yes Closed nodes on Session Manager instances in a cluster when
Session Manager Data Storage Clustering is enabled.
Managers in a Cluster
Avaya Aura Local JMX port to Cassandra when an AADS is paired with
Ephemeral 8085 TCP/JMX Yes Closed
Device Services Session Manager the Session Manager.
Avaya Aura Local Port for Cassandra database queries an AADS is
Ephemeral 9042 TLS/CQL Yes Closed
Device Services Session Manager paired with the Session Manager.
Source Destination
Network / Optionally Default
Port Application Enabled / Port Description
Port
System (Configurable System Protocol State
(Interface) Disabled?
Range)
Ports Added
CS1000 Network Local UDP Interoperability with CS1000 networks through TPS
Ephemeral 16501 Yes Closed
Control Server Session Manager /Proprietary (See Note 1)
NOTE:
1. This port has been there since 6.1. It was missed from this port matrix document earlier.
There are no port changes from Session Manager 6.2 FP1 to 6.2 FP2, 6.2 FP3, and 6.2 FP4.
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 12
Table 10: Port changes from Session Manager 6.2 to 6.2 FP1
Source Destination
Network / Optionally Default
Port Application Enabled / Port Description
Port
System (Configurable System Protocol State
(Interface) Disabled?
Range)
Ports Added
Local 1390/1391
System Manager Ephemeral TCP/JMX No Open JSR 160 JMX Connector
Session Manager (eth0)
Local 3873
Ephemeral System Manager TCP/RMI NA NA EJB RMI (See Note 1)
Session Manager (eth0)
Ports Removed
Local Local 5759
Ephemeral TCP No Open Access SIP AS Management Console
Session Manager Session Manager (eth0)
Local Local 45566-45569 UDP SIP A/S multicast traffic for interprocess
Ephemeral No Open
Session Manager Session Manager (eth0) Multicast communication
NOTES:
1. This port has been there since 5.2. It was missed from this port matrix document earlier.
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 13
Table 11: Port Changes From Session Manager 6.1 to 6.2
Source Destination
Network / Optionally Default
Port Application Enabled / Port Description
Port
System (Configurable System Protocol State
(Interface) Disabled?
Range)
Ports Added
Local Local 45566-45569 UDP SIP A/S multicast traffic for
Ephemeral No Open
Session Manager Session Manager (eth0) Multicast interprocess communication
Ports Removed
Local 7443
System Manager Ephemeral TCP Yes Open HTTPS web based administration
Session Manager (eth0)
Source Destination
Network / Optionally Default
Port Application Enabled / Port Description
Port
System (Configurable System Protocol State
(Interface) Disabled?
Range)
Ports Added
Local Local 56677 Intra-Session Manager communication
Ephemeral UDP/JGroup Yes Open
Session Manager Session Manager (eth0) (See Note 1)
CS1000 Network Local 16500 UDP
Ephemeral Yes Closed Interoperability with CS1000 networks
Control Server Session Manager (eth2) /Proprietary
NOTES:
1. This was a port number change.
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 14
Table 13: Port Changes from Session Manager 5.2 to 6.0
Source Destination
Network / Optionally Default
System Port System Port Application Enabled / Port Description
(Configurable (Interface) Protocol Disabled? State
Range)
Ports Added
Local
System Manager Ephemeral 2009 (eth0) TCP/JMX No Open JMX traffic for DRS
Session Manager
Local PPM configuration data download to SIP
SIP endpoints Ephemeral 80 (eth2) TCP/HTTP Yes Closed
Session Manager endpoints
Local PPM configuration data download to SIP
SIP endpoints Ephemeral 443 (eth2) TCP/HTTPS Yes Open
Session Manager endpoints
Ports Removed
Local
System Manager Ephemeral 11101 (eth0) TCP/JBoss Yes Open RMI Registry
Session Manager
Local
System Manager Ephemeral 11102 (eth0) TCP/JBoss Yes Open RMI Registry
Session Manager
Local
System Manager Ephemeral 11103 (eth0) TCP/JBoss Yes Open JMX specific binding
Session Manager
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 15
3. Port Usage Diagram
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 16
Appendix A: Overview of TCP/IP Ports
Ports are used in TCP and UDP to name the ends of logical connections which carry data flows. TCP
and UDP streams have an IP address and port number for both source and destination IP devices. The
pairing of an IP address and a port number is called a socket (discussed later). Therefore, each data
stream is uniquely identified with two sockets. Source and destination sockets must be known by the
source before a data stream can be sent to the destination. Some destination ports are “open” to receive
data streams and are called “listening” ports. Listening ports actively wait for a source (client) to make
contact to a destination (server) using a specific port that has a known protocol associate with that port
number. HTTPS, as an example, is assigned port number 443. When a destination IP device is
contacted by a source device using port 443, the destination uses the HTTPS protocol for that data
stream conversation.
The Well Known and Registered ports are assigned by IANA (Internet Assigned Numbers Authority) and
are found here: http://www.iana.org/assignments/port-numbers.
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 17
In UNIX and Linux operating systems, only root may open or close a well-known port. Well Known Ports
are also commonly referred to as “privileged ports”.
Registered Ports
Unlike well known ports, these ports are not restricted to the root user. Less common services register ports in this range. Avaya uses ports
in this range for call control. Some, but not all, ports used by Avaya in this range include: 1719/1720 for H.323, 5060/5061 for SIP, 2944 for
H.248 and others. The registered port range is 1024 – 49151. Even though a port is registered with an application name, industry often uses
these ports for different applications. Conflicts can occur in an enterprise when a port with one meaning is used by two servers with different
meanings.
Dynamic Ports
Dynamic ports, sometimes called “private ports”, are available to use for any general purpose. This means there are no meanings associated
with these ports (similar to RFC 1918 IP Address Usage). These are the safest ports to use because no application types are linked to these
ports. The dynamic port range is 49152 – 65535.
Sockets
A socket is the pairing of an IP address with a port number. An example would be 192.168.5.17:3009, where 3009 is the socket number
associated with the IP address. A data flow, or conversation, requires two sockets – one at the source device and one at the destination
device. The data flow then has two sockets with a total of four logical elements. Each data flow must be unique. If one of the four elements is
unique, the data flow is unique. The following three data flows are uniquely identified by socket number and/or IP address.
Data Flow 1: 172.16.16.14:1234 - 10.1.2.3:2345
Data Flow 2: 172.16.16.14.1235 - 10.1.2.3:2345
Data Flow 3: 172.16.16.14:1234 - 10.1.2.4:2345
Data flow 1 has two different port numbers and two different IP addresses and is a valid and typical socket pair.
Data flow 2 has the same IP addresses and the same port number on the second IP address as data flow 1, but since the port nu mber on the
first socket differs, the data flow is unique.
Therefore, if one IP address octet changes, or one port number changes, the data flow is unique.
Figure 2: A socket example showing ingress and egress data flow from a PC to a web server
Notice the client egress stream includes the client’s source IP and socket (1369) and the destination IP and
socket (80). The ingress stream has the source and destination information reversed because the ingress is
coming from the server.
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 18
Understanding Firewall Types and Policy Creation
Firewall Types
There are three basic firewall types:
• Packet Filtering
• Application Level Gateways (Proxy Servers)
• Hybrid (Stateful Inspection)
Packet Filtering is the most basic form of the firewalls. Each packet that arrives or leaves the network has
its header fields examined against criterion to either drop the packet or let it through. Routers configured
with Access Control Lists (ACL) use packet filtering. An example of packet filtering is preventing any
source device on the Engineering subnet to telnet into any device in the Accounting subnet.
Application level gateways (ALG) act as a proxy, preventing a direct connection between the foreign
device and the internal destination device. ALGs filter each individual packet rather than blindly copying
bytes. ALGs can also send alerts via email, alarms or other methods and keep log files to track
significant events.
Hybrid firewalls are dynamic systems, tracking each connection traversing all interfaces of the firewall and
making sure they are valid. In addition to looking at headers, the content of the packet, up through the
application layer, is examined. A stateful inspection firewall also monitors the state of the connection and
compiles the information in a state table. Stateful inspection firewalls close off ports until the connection
to the specific port is requested. This is an enhancement to security against port scanning 1.
Firewall Policies
The goals of firewall policies are to monitor, authorize and log data flows and events. They also restrict
access using IP addresses, port numbers and application types and sub-types.
This paper is focused with identifying the port numbers used by Avaya products so effective firewall
policies can be created without disrupting business communications or opening unnecessary access into
the network.
Knowing that the source column in the following matrices is the socket initiator is key in building some
types of firewall policies. Some firewalls can be configured to automatically create a return path through
the firewall if the initiating source is allowed through. This option removes the need to enter two firewall
rules, one for each stream direction, but can also raise security concerns.
Another feature of some firewalls is to create an umbrella policy that allows access for many independent
data flows using a common higher layer attribute. Finally, many firewall policies can be avoided by
placing endpoints and the servers that serve those endpoints in the same firewall zone.
1
The act of systematically scanning a computer's ports. Since a port is a place where information goes into and out of a
computer, port scanning identifies open doors to a computer. Port scanning has legitimate uses in managing networks, but
port scanning also can be malicious in nature if someone is looking for a weakened access point to break into your computer.
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.
May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 19