Ports to Open

The specific ports needed to open on a firewall vary somewhat depending on what services are placed into the DMZ and which services need to be accessible from the Internet. This section summarizes commonly deployed DMZ roles and the ports necessary to support them. The description calls out the port, traffic type, type of firewall it applies to (internal or external), and the purpose for the opening.

Audio/Video Edge Service Port Ranges

TCP 50,000 through 59,999—Incoming, these ports are needed for connections with Federated partners running Lync Server. Federated partners still running OCS 2007 also need UDP 50,000 through 59,999. This is to support RTP (Real-Time Transport Protocol). Federated A/V to a partner running an OCS 2007 R2 edge environment works over 3478/UDP or 443/TCP. This applies to the external firewall.

TCP 443 (STUN/TCP)—Outbound, for media transfer between internal users and external users. This applies to both the internal and external firewalls.

UDP 3478 (STUN/UDP)—Inbound and outbound for media exchange between internal users and external users. This applies to both the internal and external firewalls.

TCP 5062 (SIP/MTLS)—Outbound, for authentication of A/V users. This applies to the internal firewall.

Access Edge Service Port Ranges

TCP 5061 (TCP/MTLS)—Incoming and outgoing, usually to a director or the virtual IP of a load balancer. This applies to the internal firewall.

UDP 53 (DNS)—Outgoing, to enable the Access Edge to find other systems. The Access Edge should be configured to use an external DNS, to avoid unnecessary openings in the internal firewall. This might require using the host file to find systems also in the DMZ. This applies to the external firewall.

TCP 80 (HTTP)—Outgoing, to enable the system to download Certificate Revocation Lists. This applies to the external firewall.

TCP 443 (HTTPS)—Outgoing, to enable the system to download Certificate Revocation Lists that are published with SSL. This applies to the external firewall.

TCP 5061 (SIP/MTLS)—Incoming and outgoing. This applies to the external firewall.

Web Conferencing Edge Service

TCP 8057 (PSOM/MTLS)—Outbound, for communications between Web Conferencing Servers and the Web Conferencing Edge Service. This applies to the internal firewall.

TCP 443 (PSOM/TLS)—Inbound for access of remote, anonymous, and federated users into internal Web Conferences. This applies to the external firewall.

All Edge Servers

TCP 4443 (HTTPS)—Inbound, to enable for replication of configuration data to Edge Servers from the Central Management Server. This applies to the internal firewall.