Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                

SM Portmatrix

Download as pdf or txt
Download as pdf or txt
You are on page 1of 19

Avaya Port Matrix:

Avaya Aura®
Session Manager 8.0

Issue 1.00
May 21, 2018
CID 179213

Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 1
ALL INFORMATION IS BELIEVED TO BE CORRECT AT THE TIME OF
PUBLICATION AND IS PROVIDED "AS IS". AVAYA INC. DISCLAIMS ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE AND FURTHERMORE, AVAYA INC. MAKES NO
REPRESENTATIONS OR WARRANTIES THAT THE INFORMATION
PROVIDED HEREIN WILL ELIMINATE SECURITY THREATS TO
CUSTOMERS’ SYSTEMS. AVAYA INC., ITS RELATED COMPANIES,
DIRECTORS, EMPLOYEES, REPRESENTATIVES, SUPPLIERS OR AGENTS
MAY NOT, UNDER ANY CIRCUMSTANCES BE HELD LIABLE FOR ANY
DIRECT, INDIRECT, SPECIAL, PUNITIVE, EXEMPLARY, INCIDENTAL OR
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF THE
INFORMATION PROVIDED HEREIN. THIS INCLUDES, BUT IS NOT
LIMITED TO, THE LOSS OF DATA OR LOSS OF PROFIT, EVEN IF AVAYA
WAS ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF
THIS INFORMATION CONSTITUTES ACCEPTANCE OF THESE TERMS.

© 2018 Avaya Inc. All Rights Reserved. All trademarks identified by the
® or ™ are registered trademarks or trademarks, respectively, of Avaya
Inc. All other trademarks are the property of their respective owners.

Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 2
1. Session Manager Components
Data flows and their sockets are owned and directed by an application. Here a server running on RHEL 7.4
has many applications, such as JBoss, PostgreSQL, WAS, ASM, etc. For all applications, sockets are created
on the network interfaces on the server. For the purposes of firewall configuration, these sockets are sourced
from the server, so the firewall (firewalld service) runs on the same server. Application components in the
Session Manager Application Server are listed as follows and may comprise of one or more processes
working together.

Table 1: Session Manager Components

Component Interface Description


Security eth1(public IP) SIP and HTTP traffic to/from the WAS traffic is on this interface. It is
Module the front-end of ASM running Linux RHEL 7.4 with Avaya proprietary
applications providing SIP protection, TLS termination and firewall.
(secmod)
WebSphere eth0 (public IP) The WebSphere Application Server (WAS) is a converged JSR289
Container that processes SIP messages received from SIP entities or
(WAS)
endpoints.
MGMT eth0 (public IP) Listen on port 8643 for HTTPS connection to provide user a web
(Management interface (Management Console) to add, remove, restart, or monitor
Agent) SM
SAL-Agent eth0 (public IP) The SAL Agent is a Java application which receives events and
collects inventory information from the product and converts them to
its own internal format, encapsulates the message into HTTPS, and
sends it to an Enterprise Server, usually at Avaya.
DRS eth0 (public IP) Data Replication Service – Synchronize database changes between
SMGR and SM. DRS use HTTPS for replication messages. JMX is
used from remote management.
Cassandra eth0 (public IP) Provides a scalable, highly available database for call logs, and
optionally contacts when integrating with Avaya Aura Device
Services.

Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 3
2. Port Usage Tables

2.1 Port Usage Table Heading Definitions

Source System: System name or type that initiate connection requests.

Source Port: This is the default layer-4 port number of the connection source. Valid values include: 0 –
65535. A “(C)” next to the port number means that the port number is configurable. A port may be
‘ephemeral’ if it is a short-lived and gets allocation automatically from a predefined range.

Destination System: System name or type that receives connection requests.

Destination Port: This is the default layer-4 port number to which the connection request is sent. Valid
values include: 0 – 65535. A “(C)” next to the port number means that the port number is
configurable.

Network/Application Protocol: This is the name associated with the layer-4 protocol and layers-5-7
application.

Optionally Enabled / Disabled: This field indicates whether customers can enable or disable a layer-4 port
changing its default port setting. Valid values include: Yes or No
“No” means the default port state cannot be changed (e.g. enable or disabled).
“Yes” means the default port state can be changed and that the port can either be enabled or
disabled.

Default Port State: A port is either open, closed or filtered.


Open ports will respond to queries
Closed ports may or may not respond to queries and are only listed when they can be optionally
enabled.
Filtered ports can be open or closed. Filtered UDP ports will not respond to queries. Filtered TCP
ports will respond to queries but will not allow connectivity.

Description: Connection details. Add a reference to refer to the Notes section after each table for specifics
on any of the row data, if necessary.

Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 4
2.2 Port Tables
Below are the tables which document the port usage for this product.

Table 2: Ports on Session Manager network interface for Management & other Application Components (eth0)

Source Destination
Network / Optionally Default
Port Port Application Enabled / Port Description
System (Configurable System (Configurable
Protocol Disabled? State
Range) Range)

Ingress or incoming connections


Admin terminal or Local
Ephemeral 22 TCP/SSH No Open System mgmt requiring shell access
SAL Gateway Session Manager
Admin terminal or Local
Ephemeral 161 UDP/SNMP No Closed SNMP queries to Session Manager
NMS Session Manager
Local
System Manager Ephemeral 1298 TCP/JNDI No Open JNDI name service
Session Manager
Local
System Manager Ephemeral 1299 TCP/RMI No Open RMI name service
Session Manager
Local
System Manager Ephemeral 2009 TCP/JMX No Open JMX traffic for DRS
Session Manager
Local
System Manager Ephemeral 4073 TCP/EJB3 No Open EJB3 remote invoker
Session Manager
Local
System Manager Ephemeral 4644 TCP/JMX No Open JMX JRMP remote invoker
Session Manager
Local
System Manager Ephemeral 4645 TCP/JBoss No Open JBoss remote invoker
Session Manager
Local
System Manager Ephemeral 4657 TCP/JBoss No Open JBoss Messaging bisocket transport
Session Manager
Local
System Manager Ephemeral 6446 TCP/JBoss No Open Remoting connector
Session Manager
Cassandra on Provides communication channel between Cassandra
Local
other Session Ephemeral 7001 TLS/Gossip Yes Closed nodes on Session Manager instances in a cluster when
Session Manager Data Storage Clustering is enabled.
Managers in a Cluster
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 5
Source Destination
Network / Optionally Default
Port Port Application Enabled / Port Description
System (Configurable System (Configurable
Protocol Disabled? State
Range) Range)

Other Session Local Messaging between other Session Managers in a


Ephemeral 7800-7804 TCP/JGroup No Open
Managers in Cluster Session Manager cluster

Other Session Local Messaging between other Session Managers in a


Ephemeral 7900-7904 TCP/JGroup No Open
Managers in Cluster Session Manager cluster
Local
System Manager Ephemeral 8643 TCP/HTTPS No Open File transfer / REST WS over HTTPS
Session Manager
Avaya Aura Local Port for Cassandra database queries an AADS is
Ephemeral 9042 TLS/CQL Yes Closed
Device Services Session Manager paired with the Session Manager.

Local TCP
System Manager Ephemeral 9572 No Closed Transfer log files to System Manager
Session Manager /Proprietary
Local
Other Systems Ephemeral 10162 UDP No Open Port for SAL-Agent’s SNMP traffic
Session Manager
Local
System Manager Ephemeral 11099 TCP/RMI No Open RMI registry
Session Manager
Local
System Manager Ephemeral 11100 TCP/JMX No Open JMX traffic
Session Manager
Egress or outgoing connections
Local
Ephemeral SSH Server 22 TCP No Open For external ssh access
Session Manager
Local Domain Name
Ephemeral 53 TCP No Open For FQDN resolution
Session Manager Server (DNS)
Local
Ephemeral Web Server (http) 80 TCP No Open For fetching CRLs over http
Session Manager
Local
Ephemeral NTP Server (ntp) 123 UDP No Open To sync system clock with remote NTP servers
Session Manager
Local SAL Gateway
Ephemeral 162 UDP/SNMP No Open SNMP traps from Session Manager
Session Manager and/or NMS
Local
Ephemeral System Manager 443 HTTPS No Open Serviceability Agent communication to SMGR
Session Manager

Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 6
Source Destination
Network / Optionally Default
Port Port Application Enabled / Port Description
System (Configurable System (Configurable
Protocol Disabled? State
Range) Range)
Local Remote Syslog 514
Ephemeral TCP Yes Closed For logging to a Remote Syslog server
Session Manager Server (1-65535)
Local
Ephemeral System Manager 1398 TCP/JNDI No Open JNDI name service
Session Manager
Local
Ephemeral System Manager 1399 TCP/RMI No Open RMI name service
Session Manager
Local
Ephemeral System Manager 2009 TCP/JMX No Open JMX traffic for DRS
Session Manager
Local
Ephemeral System Manager 3873 TCP/RMI No Open EJB RMI
Session Manager
Local Remoting connector
Ephemeral System Manager 4446 TCP/JBoss No Open
Session Manager
Local JMX JRMP remote invoker
Ephemeral System Manager 4744 TCP/JMX No Open
Session Manager
Cassandra on
Local Provides communication channel between Cassandra
Ephemeral other Session 7001 TLS/Gossip Yes Closed nodes on Session Manager instances in a cluster when
Session Manager Managers in a Data Storage Clustering is enabled.
Cluster
Local Local
Ephemeral 7500 UDP/JBoss No Open Intra-Session Manager communication
Session Manager Session Manager

Local Other Session


Messaging between other Session Managers in a
Ephemeral Managers in 7800-7804 TCP/JGroup No Open
Session Manager cluster (only used during error conditions)
Cluster
Local
Ephemeral System Manager 10162 UDP/SNMP No Open SNMP Traps
Session Manager
Local Local
Ephemeral 45688 UDP/JGroup No Open Intra-Session Manager communication
Session Manager Session Manager
Local Local
Ephemeral 56677 UDP/JGroup No Open Intra-Session Manager communication
Session Manager Session Manager

Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 7
Table 3: Ports on Session Manager network interface for Security Module (secmod) (eth1)

Source Destination
Network / Optionally Default
Port Port Application Enabled / Port Description
System (Configurable System (Configurable Protocol State
Disabled?
Range) Range)

Ingress or incoming connections


Local ICMP Used by SIP entities to verify connectivity to Session
SIP Servers Ephemeral NA Yes Open
Session Manager /Type 0,8 Manager
Local PPM configuration data downloaded to SIP endpoints
SIP endpoints Ephemeral 80 TCP/HTTP No Open
Session Manager (See Notes 1, 5)
Local PPM configuration data downloaded to SIP endpoints
SIP endpoints Ephemeral 443 TCP/HTTPS No Open
Session Manager (See Notes 2, 5)

Local SIP signaling traffic – this is the default value, but other
SIP Servers and SIP 5060
Ephemeral UDP/SIP Yes Closed ports can be configured for SIP signaling using the
endpoints Session Manager (1024-65535) System Manager (See Notes 1, 3, 4, 6)
Local SIP signaling traffic – this is the default value, but other
SIP Servers and SIP 5060
Ephemeral TCP/SIP Yes Closed ports can be configured for SIP signaling using the
endpoints Session Manager (1024-65535)
System Manager (See Notes 1, 3, 4, 6)
Local SIP signaling traffic – this is the default value, but other
SIP Servers and SIP 5061
Ephemeral TCP/SIPS Yes Closed ports can be configured for SIP signaling using the
endpoints Session Manager (1024-65535) System Manager (See Notes 2, 3, 4, 6)
CS1000 Network Local UDP
Ephemeral 16500-16501 Yes Closed Interoperability with CS1000 networks through TPS
Control Server Session Manager /Proprietary
Egress or outgoing connections
Local ICMP
Ephemeral SIP Servers NA Yes Open Used to test status of SIP trunk to SIP Servers
Session Manager /Type 0,8
SIP signaling traffic – this is the default value, but other
Local SIP Servers and 5060
Ephemeral UDP/SIP Yes Closed ports can be configured for SIP signaling using the
Session Manager SIP endpoints (1024-65535)
System Manager (See Notes 1, 3, 4, 6)
SIP signaling traffic – this is the default value, but other
Local SIP Servers and 5060
Ephemeral TCP/SIP Yes Closed ports can be configured for SIP signaling using the
Session Manager SIP endpoints (1024-65535) System Manager (See Notes 1, 3, 4, 6)
SIP signaling traffic – this is the default value, but other
Local SIP Servers and 5061
Ephemeral TCP/SIPS Yes Closed ports can be configured for SIP signaling using the
Session Manager SIP endpoints (1024-65535) System Manager (See Notes 2, 3, 4, 6)
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 8
NOTES:
1. Used when encryption is not required.
2. Used for encrypted communication.
3. The SIP signaling port can be configured to use any valid port number in the range 1024-65535.
4. For SIP communications, the alternative transport options are UDP, TCP, or TLS.
5. For PPM communications, the alternative port options are 80 for unsecure HTTP communication, or 443 for secure communication.
6. These ports are opened dynamically by Asset and closed when Asset is stopped.

2.3 Port Table Changes

Table 4: Port changes from SM 7.1.3 to SM 8.0

Source Destination
Network / Optionally Default
Port Application Enabled / Port Description
Port
System (Configurable System Protocol State
(Interface) Disabled?
Range)

Ports Added
Messaging between other Session Managers in a
Other Session Local cluster
Ephemeral 7900-7904 TCP/JGroup No Open
Managers in Cluster Session Manager

No changes from SM 7.1.2 to 7.1.3.

Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 9
Table 5: Port changes from SM 7.1.1 to SM 7.1.2

Source Destination
Network / Optionally Default
Port Application Enabled / Port Description
Port
System (Configurable System Protocol State
(Interface) Disabled?
Range)

Ports Removed
Local
Ephemeral System Manager 1390-1391 TCP/JMX No Open JSR 160 JMX Connector
Session Manager
Ports Added
Local
Ephemeral System Manager 1398 TCP/JNDI No Open JNDI name service
Session Manager

Table 6: Port changes from SM 7.1 to SM 7.1.1

Source Destination
Network / Optionally Default
Port Application Enabled / Port Description
Port
System (Configurable System Protocol State
(Interface) Disabled?
Range)

Ports Removed
Avaya Aura Local JMX port to Cassandra when an AADS is paired with
Ephemeral 8085 TCP/JMX Yes Closed
Device Services Session Manager the Session Manager.

Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 10
Table 7: Port changes from SM 7.0.1 to SM 7.1

Source Destination
Network / Optionally Default
Port Application Enabled / Port Description
Port
System (Configurable System Protocol State
(Interface) Disabled?
Range)

Ports Added
Local
Ephemeral SSH Server 22 TCP No Open For external ssh access
Session Manager
Local Domain Name
Ephemeral 53 TCP No Open Non-SIP FQDN resolution
Session Manager Server (DNS)
Local
Ephemeral Web Server (http) 80 TCP No Open To allow fetching CRLs over http
Session Manager
Local
Ephemeral NTP Server (ntp) 123 UDP No Open To sync system clock with remote NTP servers
Session Manager
Local Remote Syslog 514
Ephemeral TCP Yes Closed For logging to a Remote Syslog server
Session Manager Server (1-65535)
Other Session Messaging between other Session Managers in a
Local
Ephemeral Managers in 7800-7804 TCP/JGroup No Open cluster (only used during error conditions)
Session Manager Cluster (See Note 2)

Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 11
Table 8: Port changes from SM 7.0 to SM 7.0.1

Source Destination
Network / Optionally Default
Port Application Enabled / Port Description
Port
System (Configurable System Protocol State
(Interface) Disabled?
Range)

Ports Added
Cassandra on Provides communication channel between Cassandra
Local
other Session Ephemeral 7001 TLS/Gossip Yes Closed nodes on Session Manager instances in a cluster when
Session Manager Data Storage Clustering is enabled.
Managers in a Cluster
Avaya Aura Local JMX port to Cassandra when an AADS is paired with
Ephemeral 8085 TCP/JMX Yes Closed
Device Services Session Manager the Session Manager.
Avaya Aura Local Port for Cassandra database queries an AADS is
Ephemeral 9042 TLS/CQL Yes Closed
Device Services Session Manager paired with the Session Manager.

Table 9: Port changes from SM 6.2 FP1 to SM 7.0

Source Destination
Network / Optionally Default
Port Application Enabled / Port Description
Port
System (Configurable System Protocol State
(Interface) Disabled?
Range)

Ports Added

CS1000 Network Local UDP Interoperability with CS1000 networks through TPS
Ephemeral 16501 Yes Closed
Control Server Session Manager /Proprietary (See Note 1)

NOTE:
1. This port has been there since 6.1. It was missed from this port matrix document earlier.

There are no port changes from Session Manager 6.2 FP1 to 6.2 FP2, 6.2 FP3, and 6.2 FP4.

Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 12
Table 10: Port changes from Session Manager 6.2 to 6.2 FP1

Source Destination
Network / Optionally Default
Port Application Enabled / Port Description
Port
System (Configurable System Protocol State
(Interface) Disabled?
Range)

Ports Added
Local 1390/1391
System Manager Ephemeral TCP/JMX No Open JSR 160 JMX Connector
Session Manager (eth0)
Local 3873
Ephemeral System Manager TCP/RMI NA NA EJB RMI (See Note 1)
Session Manager (eth0)
Ports Removed
Local Local 5759
Ephemeral TCP No Open Access SIP AS Management Console
Session Manager Session Manager (eth0)

Local Local 45566-45569 UDP SIP A/S multicast traffic for interprocess
Ephemeral No Open
Session Manager Session Manager (eth0) Multicast communication

NOTES:
1. This port has been there since 5.2. It was missed from this port matrix document earlier.

Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 13
Table 11: Port Changes From Session Manager 6.1 to 6.2

Source Destination
Network / Optionally Default
Port Application Enabled / Port Description
Port
System (Configurable System Protocol State
(Interface) Disabled?
Range)

Ports Added
Local Local 45566-45569 UDP SIP A/S multicast traffic for
Ephemeral No Open
Session Manager Session Manager (eth0) Multicast interprocess communication
Ports Removed
Local 7443
System Manager Ephemeral TCP Yes Open HTTPS web based administration
Session Manager (eth0)

Local Local 45588


Ephemeral UDP/JGroup Yes Open Intra-Session Manager communication
Session Manager Session Manager (eth0)

Table 12: Port Changes from Session Manager 6.0 to 6.1

Source Destination
Network / Optionally Default
Port Application Enabled / Port Description
Port
System (Configurable System Protocol State
(Interface) Disabled?
Range)

Ports Added
Local Local 56677 Intra-Session Manager communication
Ephemeral UDP/JGroup Yes Open
Session Manager Session Manager (eth0) (See Note 1)
CS1000 Network Local 16500 UDP
Ephemeral Yes Closed Interoperability with CS1000 networks
Control Server Session Manager (eth2) /Proprietary

NOTES:
1. This was a port number change.

Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 14
Table 13: Port Changes from Session Manager 5.2 to 6.0

Source Destination
Network / Optionally Default
System Port System Port Application Enabled / Port Description
(Configurable (Interface) Protocol Disabled? State
Range)

Ports Added
Local
System Manager Ephemeral 2009 (eth0) TCP/JMX No Open JMX traffic for DRS
Session Manager
Local PPM configuration data download to SIP
SIP endpoints Ephemeral 80 (eth2) TCP/HTTP Yes Closed
Session Manager endpoints
Local PPM configuration data download to SIP
SIP endpoints Ephemeral 443 (eth2) TCP/HTTPS Yes Open
Session Manager endpoints

Ports Removed
Local
System Manager Ephemeral 11101 (eth0) TCP/JBoss Yes Open RMI Registry
Session Manager
Local
System Manager Ephemeral 11102 (eth0) TCP/JBoss Yes Open RMI Registry
Session Manager
Local
System Manager Ephemeral 11103 (eth0) TCP/JBoss Yes Open JMX specific binding
Session Manager

Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 15
3. Port Usage Diagram

Figure 1: Session Manager Port Usage

Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 16
Appendix A: Overview of TCP/IP Ports

What are ports and how are they used?


TCP and UDP use ports (defined at http://www.iana.org/assignments/port-numbers) to route traffic
arriving at a particular IP device to the correct upper layer application. These ports are logical descriptors
(numbers) that help devices multiplex and de-multiplex information streams. Consider your desktop PC.
Multiple applications may be simultaneously receiving information. In this example, email may use
destination TCP port 25, a browser may use destination TCP port 80 and a telnet session may use
destination TCP port 23. These logical ports allow the PC to de-multiplex a single incoming serial data
packet stream into three mini-streams inside the PC. Furthermore, each of the mini-streams is directed to
the correct high-level application because the port numbers identify which application each data mini-
stream belongs. Every IP device has incoming (Ingress) and outgoing (Egress) data streams.

Ports are used in TCP and UDP to name the ends of logical connections which carry data flows. TCP
and UDP streams have an IP address and port number for both source and destination IP devices. The
pairing of an IP address and a port number is called a socket (discussed later). Therefore, each data
stream is uniquely identified with two sockets. Source and destination sockets must be known by the
source before a data stream can be sent to the destination. Some destination ports are “open” to receive
data streams and are called “listening” ports. Listening ports actively wait for a source (client) to make
contact to a destination (server) using a specific port that has a known protocol associate with that port
number. HTTPS, as an example, is assigned port number 443. When a destination IP device is
contacted by a source device using port 443, the destination uses the HTTPS protocol for that data
stream conversation.

Port Type Ranges


Port numbers are divided into three ranges: Well Known Ports, Registered Ports, and Dynamic Ports
(sometimes called Private Ports).

Well Known Ports are those numbered from 0 through 1023.

Registered Ports are those numbered from 1024 through 49151

Dynamic Ports are those numbered from 49152 through 65535

The Well Known and Registered ports are assigned by IANA (Internet Assigned Numbers Authority) and
are found here: http://www.iana.org/assignments/port-numbers.

Well Known Ports


For the purpose of providing services to unknown clients, a service listen port is defined. This port is
used by the server process as its listen port. Common services often use listen ports in the well known
port range. A well known port is normally active meaning that it is “listening” for any traffic destined for a
specific application. For example, well known port 23 on a server is actively waiting for a data source to
contact the server IP address using this port number to establish a Telnet session. Well known port 25 is
waiting for an email session, etc. These ports are tied to a well understood application and range from 0
to 1023.

Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 17
In UNIX and Linux operating systems, only root may open or close a well-known port. Well Known Ports
are also commonly referred to as “privileged ports”.

Registered Ports
Unlike well known ports, these ports are not restricted to the root user. Less common services register ports in this range. Avaya uses ports
in this range for call control. Some, but not all, ports used by Avaya in this range include: 1719/1720 for H.323, 5060/5061 for SIP, 2944 for
H.248 and others. The registered port range is 1024 – 49151. Even though a port is registered with an application name, industry often uses
these ports for different applications. Conflicts can occur in an enterprise when a port with one meaning is used by two servers with different
meanings.
Dynamic Ports
Dynamic ports, sometimes called “private ports”, are available to use for any general purpose. This means there are no meanings associated
with these ports (similar to RFC 1918 IP Address Usage). These are the safest ports to use because no application types are linked to these
ports. The dynamic port range is 49152 – 65535.
Sockets
A socket is the pairing of an IP address with a port number. An example would be 192.168.5.17:3009, where 3009 is the socket number
associated with the IP address. A data flow, or conversation, requires two sockets – one at the source device and one at the destination
device. The data flow then has two sockets with a total of four logical elements. Each data flow must be unique. If one of the four elements is
unique, the data flow is unique. The following three data flows are uniquely identified by socket number and/or IP address.
Data Flow 1: 172.16.16.14:1234 - 10.1.2.3:2345
Data Flow 2: 172.16.16.14.1235 - 10.1.2.3:2345
Data Flow 3: 172.16.16.14:1234 - 10.1.2.4:2345

Data flow 1 has two different port numbers and two different IP addresses and is a valid and typical socket pair.
Data flow 2 has the same IP addresses and the same port number on the second IP address as data flow 1, but since the port nu mber on the
first socket differs, the data flow is unique.
Therefore, if one IP address octet changes, or one port number changes, the data flow is unique.

Socket Example Diagram

Client HTTP-Get Source 192.168.1.10:1369 Destination 10.10.10.47:80 Web Server

TCP-info Destination 192.168.1.10:1369 Source 10.10.10.47:80

Figure 2: A socket example showing ingress and egress data flow from a PC to a web server

Notice the client egress stream includes the client’s source IP and socket (1369) and the destination IP and
socket (80). The ingress stream has the source and destination information reversed because the ingress is
coming from the server.

Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 18
Understanding Firewall Types and Policy Creation
Firewall Types
There are three basic firewall types:

• Packet Filtering
• Application Level Gateways (Proxy Servers)
• Hybrid (Stateful Inspection)

Packet Filtering is the most basic form of the firewalls. Each packet that arrives or leaves the network has
its header fields examined against criterion to either drop the packet or let it through. Routers configured
with Access Control Lists (ACL) use packet filtering. An example of packet filtering is preventing any
source device on the Engineering subnet to telnet into any device in the Accounting subnet.

Application level gateways (ALG) act as a proxy, preventing a direct connection between the foreign
device and the internal destination device. ALGs filter each individual packet rather than blindly copying
bytes. ALGs can also send alerts via email, alarms or other methods and keep log files to track
significant events.

Hybrid firewalls are dynamic systems, tracking each connection traversing all interfaces of the firewall and
making sure they are valid. In addition to looking at headers, the content of the packet, up through the
application layer, is examined. A stateful inspection firewall also monitors the state of the connection and
compiles the information in a state table. Stateful inspection firewalls close off ports until the connection
to the specific port is requested. This is an enhancement to security against port scanning 1.

Firewall Policies
The goals of firewall policies are to monitor, authorize and log data flows and events. They also restrict
access using IP addresses, port numbers and application types and sub-types.

This paper is focused with identifying the port numbers used by Avaya products so effective firewall
policies can be created without disrupting business communications or opening unnecessary access into
the network.

Knowing that the source column in the following matrices is the socket initiator is key in building some
types of firewall policies. Some firewalls can be configured to automatically create a return path through
the firewall if the initiating source is allowed through. This option removes the need to enter two firewall
rules, one for each stream direction, but can also raise security concerns.

Another feature of some firewalls is to create an umbrella policy that allows access for many independent
data flows using a common higher layer attribute. Finally, many firewall policies can be avoided by
placing endpoints and the servers that serve those endpoints in the same firewall zone.

1
The act of systematically scanning a computer's ports. Since a port is a place where information goes into and out of a
computer, port scanning identifies open doors to a computer. Port scanning has legitimate uses in managing networks, but
port scanning also can be malicious in nature if someone is looking for a weakened access point to break into your computer.
Avaya – Proprietary
Use pursuant to the terms of your signed agreement or Avaya policy.

May 2018 Avaya Port Matrix: Avaya Aura® Session Manager 8.0 19

You might also like