Communication ports used by Citrix Technologies

Transcription

1 Communication ports used by Citrix Technologies April, 2014 Overview Introduction This document provides an overview of ports that are used by Citrix components and must be considered as part of Virtual Computing architecture, especially if communication traffic traverses network components such as firewalls or proxy servers, where ports must be opened to ensure communication flow. References The assignments are listed by the Internet Assigned Numbers Authority (IANA), updated regularly, and revised when new information is available and new assignments are made. The specific location of the port numbers list is available at the following Web site: Microsoft Article Network Ports Used by Key Microsoft Products. Microsoft Article ID Service overview and network port requirements for Windows.

2 Source Destination Type Port Details Access Gateway 5.x Access Gateway Appliance Access Gateway Appliance 694 Communication between Access Gateway appliances Advanced Access Control LDAP (e.g. Active Directory Domain Controller) 80/443/9002 Communication between Access Gateway Standard and Advanced Access Control /UDP 389 LDAP connection /UDP 636 LDAP SSL connection 3268 LDAP connection to Global Catalog 3269 LDAP connection to Global Catalog over SSL DNS /UDP 53 DNS name resolution Radius /UDP 1645 / 1812 RADIUS connection User Device Access Gateway Appliance 443 Port used for connecting to an Access Gateway Deployment Admin Workstation Access Gateway Appliance 443 Administration Website Advanced Access Control 9005 AAC Administration Access Gateway Prior to Version 5.0 Access Gateway Appliance Advanced Access Control 80/443 Communication between Access Gateway Standard and Advanced Access Control LDAP /UDP 389 LDAP connection (e.g. Active Directory /UDP 636 LDAP SSL connection Domain Controller) 3268 LDAP connection to Global Catalog 3269 LDAP connection to Global Catalog over SSL DNS /UDP 53 DNS name resolution Radius /UDP 1645 / 1812 RADIUS connection User Device Access Gateway Appliance 443 Port used for connecting to an Access Gateway Deployment Admin Workstation Access Gateway Appliance 9001 Administration Website 9002 Administrative Desktop (until 4.5) Advanced Access Control 9005 AAC Administration AppController 2.x and later AppController AppController 9736 Used for High Availability DNS /UDP 53 DNS name resolution LDAP /UDP 389 LDAP connection (e.g. Active Directory /UDP 636 LDAP SSL connection Domain Controller) 3268 LDAP connection to Global Catalog Page 2

3 3269 LDAP connection to Global Catalog over SSL SMTP 25 Mail server connection SysLog UDP 514 Used for Logging Reporting User Device AppController 443 Port used for connecting to the store or Receiver for Web Site hosted on AppController Admin Workstation AppController 22 Console Administration (Encrypted) 4443 GUI Administration 3820 Used for Log Transfer (SCP) 21 Used for Log Transfer (FTP) Branch Repeater Branch Repeater Appliance Branch Repeater Appliance N/A Pass through of native application ports User Device Branch Repeater Appliance 443 Client to Appliance communication (Branch Repeater Plug-In) Admin Workstation Branch Repeater Appliance 80/443 Citrix Repeater Console 3389 RDP connection to server console (Windows) Citrix License Any Citrix Component Citrix License Handles initial point of contact for license requests (Lmadmin.exe) 7279 Check-in/check-out of Citrix licenses (Citrix.exe) Admin Workstation Citrix License 8082 Web-based administration console (Lmadmin.exe) 8083 Simple License Service port (required for XenDesktop 7.x) 80 Licensing Config PowerShell Snap-in Service used by Citrix.LicensingConfig.SdkWcfEndpo int.exe Citrix Online Products User Workstation GoToMeeting GoToWebinar GoToMyPC GoToAssist 80/443/8200 Contacting GoToMeeting service broker using the Endpoint Gateway (EGW) CloudStack/CloudPlatform CloudStack Management CloudStack Management Citrix Xen Resource Pool Master 9090 / 8250 Inter-server communication 22/80/443 Communication with Xen infrastructure Page 3

4 Secondary Storage Virtual Machine (SSVM) Console Proxy VM KVM 22 Communication with KVM infrastructure VMware vcenter 443 Communication with vsphere infrastructure MySQL 3306 MySQL DNS 53 CloudStack Management to DNS Secondary Storage Virtual Machine (SSVM) 3922 CloudStack Management to SSVM Console Proxy VM 3922 Communication with Console Proxy VM Virtual Router 3922 CloudStack Management to Virtual Router Secondary Storage 111/2049 CloudStack Management to NFS (initial deployment of SSVM and CPVM CloudStack Management 8250 SSVM to CloudStack Management HTTP(s) Share 80/443 SSVM to HTTP(s) File Share to download VM Image Secondary Storage 111/2049 SSVM to NFS DNS 53 SSVM to DNS CloudStack Management 8250 Console Proxy VM to CloudStack Management Virtual Router DNS 53 Console Proxy VM to DNS Admin Workstation CloudStack Management 8250 Virtual Router to CloudStack Management DNS 53 Virtual Router to DNS CloudStack Management 8080 User/Client/API to CloudStack Management - Management Port (authenticated communication) 8096 User/Client to CloudStack Management - Management Port (unauthenticated communication) Common Citrix Communication Ports Citrix Receiver 80/443 Communication with Merchandising ICA / HDX 1494 Access to applications and virtual desktops Session Reliability 2598 Access to applications and virtual desktops IMA 2512 Independent Management Architecture (IMA) Page 4

5 Management Console 2513 Citrix Management Consoles and *WCF services Application / Desktop 80/8080/443 XML Service Request STA 80/8080/443 Secure Ticketing Authority (embedded into XML Service) *Note: In XenApp 6.5 port 2513 is used by XenApp.Command.Remoting.Services through WCF EasyCall EasyCall Client 8443 PSync EasyCall Gateway 5060 EasyCall Gateway communicates with the SIP trunk over port 5060 Admin Console 443 Administration of EasyCall LDAP 389 Active Directory/LDAP PBX N/A The PBX port depends on the vendor and varies. EdgeSight EdgeSight Microsoft SQL 1433 Communication with SQL for Agent payload uploads Microsoft SQL Reporting Services Microsoft SQL Reporting Services 80/443 Communication with Reporting Services when creating EdgeSight reports EdgeSight Agent 9035 Communication with RSCorSvc on EdgeSight Agent from within the EdgeSight Console SNMP 161 In case alerts are forwarded by means of SNMP SMTP 25 In case alerts are forwarded by means of s Microsoft SQL 1433 Database access EdgeSight Agent EdgeSight 80/443 Communication with EdgeSight for payloads and alerts EdgeSight Agent (Loopback) 9036 EdgeSight Agent internal communication (client-side database) Admin Workstation EdgeSight 80/443 Console access EdgeSight Agent 9035 Accessing Real-Time data Lab Manager End-Device to Lab Manager User Interface End-Device to Virtual Machines 8443 End device communication with Lab Manager User interface 3389 RDP for Windows Guests 5900 VNC for Linux Guests Page 5

6 End-Device to Virtualization Host VMAgent to Lab Manager Lab Manager to Active Directory NetScaler / Access Gateway 5900 Connections for Xen Connections for Microsoft Hyper-V /UDP Discovery ports for VMAgent 8443 Secure (HTTPS) Discovery ports for VMAgent 389 LDAP Please note that depending on the NetScaler configuration, network traffic can originate from SNIP, MIP or NSIP interfaces. NetScaler Appliance (General) DNS /UDP 53 DNS name resolution NetScaler Appliance (Access Gateway ) NetScaler Appliance (CloudBridge) NetScaler Appliance (for High Availability) UDP 3003 Exchange of Hello packets for communicating UP/DOWN status (heartbeat) 3008 Secure High Availability configuration synchronization 3009 Secure command propagation and MEP 3010 High Availability configuration synchronization plus web-logging and audit server logging 3011 Command propagation and MEP Command Center UDP 162 Traps from NetScaler to Command Center NetScaler LOM 5900/623 Lights Out Management LDAP /UDP 389 LDAP connection (e.g. Active Directory /UDP 636 LDAP SSL connection Domain Controller) 3268 LDAP connection to Global Catalog 3269 LDAP connection to Global Catalog over SSL Radius /UDP 1645 / 1812 RADIUS connection XenDesktop / XenApp Controller 80/8080/443 Application / Desktop Request via XML Service Secure Ticketing Authority 80/8080/443 Secure Ticketing Authority (embedded into XML Service) XenDesktop Virtual Desktop / XenApp Worker NetScaler Appliance (CloudBridge) 1494 Access to applications and virtual desktops by means of standard ICA/HDX 2598 Access to applications and virtual desktops with Session Reliability enabled IP 50 IPSec Encapsulating Security Protocol (ESP) traffic Page 6

7 IP 51 IPSec Authentication Header (AH) traffic UDP 500 Internet Key Exchange (IKE/ISAKMP) negotiation Admin Workstation NetScaler Appliance 22 SSH - CLI Administration (encrypted) 80/443 HTTP(s) - GUI Administration 3008 Java - GUI Administration (encrypted) 3010 Java - GUI (no encryption) Command Center 8443 If an HTML client is used, then only 8443 port needs to be open between client and Command Center server. Citrix recommends using an HTML client as much as possible. 9091/9092/ 9094 For opening communication between client and the server Command Center NetScaler Appliance 9091/9092 Ports are used to refresh, update, and query objects pertaining to Discovery (Maps/Devices, etc.)/fault Management/Administration/ Configuration Management modules 9094 Used specifically by Configuration Management module while executing/scheduling tasks 1099/6010 Used when you execute the Invoke NSCLI option. Under Device, right click under Map Between Command Center and NetScaler. The ping is the SNMP ping. 22 Connect SSH/SFTP to the NetScaler device from Command Center UDP 161 SNMP Polling to NetScalers NetScaler Insight Center NetScaler Appliance 22 For NITRO communication 80/443 For SSH communication ICMP - To detect the network reachability NetScaler Appliance NetScaler Insight Center UDP 4739 For AppFlow communication NetScaler Gateway Plug-in VPN/XenApp/XenDesktop /UDP 3148 For VPN tunnel with secure ICA UDP 3108/3168/3188 connections - Download Password Manager/Single Sign-On Single Sign-On Plugin, Single Sign-On Service and Admin Workstation Credential Store File Share Credential Store Active Directory integrated /UDP 445 CIFS /UDP NetBIOS /UDP 389 LDAP connection /UDP 636 LDAP SSL connection 3268 LDAP connection to Global Catalog Page 7

8 Credential Store Novell File Share 3269 LDAP SSL connection to Global Catalog /UDP 524 ZENworks communication Single Sign-On Plugin Single Sign-On Service 443 Only used in case advanced features such as Account Self-Service or Data Integrity are used Provisioning Services Provisioning Provisioning UDP Inter-server communication, version 6.0 and later (configurable) UDP Inter-server communication, prior to version 6.0 Microsoft SQL 1433 Microsoft SQL Domain Controller 389 Communication with Active Directory services Target Device Broadcast / DHCP UDP 67 DHCP communication (PVS outbound Broadcast / PXE Service UDP 67 / 4011 Optional: Obtaining network boot communication on ports information in case DHCP options , 6902 and 6905 for -TFTP Name (Bootstrap Target Devices starting Protocol ) and 67 - Bootfile with version 6.0) Name (Bootstrap Protocol Client) are not configured or boot from ISO / local disk not used. TFTP UDP 69 Trivial File Transfer (TFTP) for Bootstrap delivery Provisioning UDP 6910 Target Device logon at Provisioning services UDP vdisk Streaming (Streaming Service) (configurable) UDP 6969 Two Stage Boot (BDM). Used in boot from ISO or USB scenarios only. Admin Workstation Provisioning SOAP Service SOAP Service SmartAuditor SmartAuditor Agent SmartAuditor /UDP 80/443 SmartAuditor components connecting to SmartAuditor Broker /UDP 1801 MSMQ (Provides reliable transport of data from SmartAuditor Agent to SmartAuditor using an MSMQ private message queue named CitrixSmAudData) 2101 MSMQ-DCs 2103 MSMQ-RPC 2105 MSMQ-RPC 2107 MSMQ-Mgmt Page 8

9 UDP 3527 MSMQ-Ping SmartAuditor Microsoft SQL 1433 Microsoft SQL Admin Workstation SmartAuditor /UDP 80/443 Console Access StageManager End-Device to StageManager User Interface End-Device to Virtual Machines 9443 End device communication with StageManager User interface 3389 RDP for Windows Guests 5900 VNC for Linux Guests End-Device to Connections for Xen Virtualization Host 2179 Connections for Microsoft Hyper-V VMAgent to StageManager /UDP Discovery ports for VMAgent/GuestAgent 9443 Secure (HTTPS) Discovery ports for VMAgent/GuestAgent StageManager to 389 LDAP Active Directory 636 LDAP over SSL (LDAPS) StorageLink StorageLink Service Communication of StorageLink Manager to StorageLink Service Database 1433 Microsoft SQL StoreFront User Device Storefront 80 / 443 Connecting to the Store or Receiver for Web site hosted on StoreFront server StoreFront Domain Controller /UDP 389 LDAP connection to query userfriendly name and -address /UDP 88 Native Windows authentication protocol to validate domain user credentials /UDP 464 Native Windows authentication protocol to allow users change expired passwords Microsoft SQL 1433 Only StoreFront 1.2 and earlier. port used to connecting StoreFront and SQL server to read/write application information to the subscription database Page 9

10 StoreFront Randomly selected unreserved port per service XenDesktop Controller, XenApp Controller, AppController Only StoreFront 2.0 and later. Used for Peer-to-peer Services (Credential Wallet, Subscriptions Store (1 per Store). This service uses MS.Net NetPeerTcpBinding which negotiates a random port on each server between the peers. Only used for communication within the cluster. 808 Only StoreFront 2.0 and later. Used for Subscription Replication Services. Not installed by default. Used to replicate subscriptions between associated clusters 80 / 443 For application and desktop requests. Workflow Studio Console 8010 Connection to remote runtime Database 1433 Microsoft SQL XenApp XenApp XenApp 2512 Worker to Controller and Controller to Controller communication Microsoft SQL 1433 Microsoft SQL 1434 Microsoft SQL. Note: Named instance connection requires UDP 1434 Power & Capacity Concentrator Application Streaming App Hub on File Share Application Streaming App Hub on Web Share Only if Power & Capacity Management Agent has been installed: Communication with Concentrator SMB 445 Communication with Application Hub (File / Share) HTTP/S 80/443 Communication with Application Hub (Web ) Admin Workstation XenApp 135 Authentication of the admin user account Randomly selected unreserved port AppCenter to XenApp Controller communication (via MFCOM service) XenClient XenClient Synchronizer XenClient Synchronizer 443 Used in scenarios with Remote Synchronizers which are located in branch offices Hyper-V Host RDP 2179 Used by Hyper-V Management Service Console (RDP) Page 10

11 XenClient Engine (User Device) Microsoft SQL 1433 SQL database port; this port needs to be open from remote and central XenClient Enterprise Synchronizer servers. Domain Controller 389 Non-SSL port for LDAP to AD 636 SSL port for LDAP to AD XenClient Synchronizer 443 Used by XenClient Enterprise Engines to communicate with XenClient Enterprise Synchronizer. If not open, clients cannot register or otherwise communicate with XenClient Enterprise Synchronizer. Admin Workstation XenClient Synchronizer 8443 Used by the Administrator to communicate with XenClient Enterprise Synchronizer UI. XenDesktop Controller Citrix Xen Resource Pool Master 80/443 Communication with Xen infrastructure Microsoft SCVMM 8100 Communication with Hyper-V infrastructure VMware vcenter 443 Communication with vsphere infrastructure Microsoft SQL 1433 Microsoft SQL 1434 Microsoft SQL. Note: Named instance connection requires UDP 1434 Virtual Desktop 80 XenDesktop 7 and later only. Controller initiates the connection when discovering local applications or for gathering information about local processes, performance data, etc. UDP 9 Unicast magic packet (optional for Microsoft Configuration Manager Wake on LAN) UDP Subnet-directed broadcast magic packet (optional for Microsoft Configuration Manager Wake on LAN) 135 Wake-up proxy (optional for Microsoft Configuration Manager Wake on LAN) Microsoft System Center Configuration Manager 135 WMI connection to ConfigMgr for Dynamically allocated high-port ( ) Wake on LAN Page 11

12 Director Virtual Desktop 80 Only XenDesktop 5.6 and earlier: Communication between Director and Virtual Desktop Agent for WinRM Only XenDesktop 5.6 and earlier: Communication between Director and Virtual Desktop Agent for WinRM 2.0 Director and Admin Workstation Endpoint (Receiver) Virtual Desktop Agent (5.x and later) Virtual Desktop Agent (previous versions) Virtual Desktop Communication between Desktop Director and Virtual Desktop Agent for Remote Assistance Virtual Desktop 1494 ICA/HDX communication 2598 ICA/HDX communication with Session Reliability enabled UDP Used port range for HDX Audio Controller 80 Used by process WorkstationAgent.exe for communicating with Controller Controller 8080 Communication between Desktop Delivery Controller and Virtual Desktop Agent Virtual Desktop Agent Domain Controller 3268 Communication between Virtual Desktop Agent and Microsoft Global Catalog used during the registration process in order to validate its list of configured Controllers (DDCs). Admin Workstation Director 80/443 Access to XenDesktop Director website Page 12

13 Admin Workstation Controller 80/443 When using a locally installed Studio Console or the SDK to directly access the Controller. The following services listen on the Controller: General brokering functionality (BrokerService.exe) Active Directory Identity Service (Citrix.ADIdentity.SdkWcfE ndpoint.exe) Configuration Logging Service Configuration Service (Citrix.Configuration.SdkWc fendpoint.exe) Delegated Admin Service Host Service (Citrix.Host.SdkWcfEndpoi nt.exe) Machine Creation Service (Citrix.MachineCreation.Sdk WcfEndpoint.exe) Machine Identity Service (Citrix.MachineIdentity.Sdk WcfEndpoint.exe) License Configuration Service (Citrix.LicensingConfig.Sdk WcfEndpoint.exe) Virtual Desktop /UDP Dynamically allocated high-port ( ) When initiating a Remote Assistance session from a Windows 7 machine to a Windows Vista / 7 virtual desktop 3389 When initiating a Remote Assistance session from a Windows 7 machine to a Windows XP virtual desktop XenMobile See the following link for XenMobile Ports CTX Xen Xen Xen 443 Intra-host communication between members of a Resource Pool using XenAPI NTP Service /UDP 123 Time Synchronization DNS Service /UDP 53 DNS Domain Controller 389 User authentication when using Active Directory integration (LDAP) 636 LDAP over SSL (LDAPS) Page 13

14 Admin Workstation (XenCenter) File /UDP 139 ISO Store: NetBIOS Session Service /UDP 445 ISO Store: Microsoft-DS SAN Controller 3260 iscsi Storage NAS Head / File 2049 NFS Storage StorageLink Gateway Only Xen 5.6 and earlier: SOAP over HTTP integrated StorageLink traffic Xen 22 SSH 443 Management using XenAPI Virtual Machine 5900 VNC for Linux Guests 3389 RDP for Windows Guests Page 14

15 By Port Port Product Component Type Details 9 XenDesktop Microsoft Configuration Manager Wake on LAN UDP Unicast magic packet (optional for Microsoft Configuration Manager Wake on LAN) 22 CloudStack/CloudPlatform KVM CloudStack Management to KVM 22 NetScaler / Access Gateway Xen CloudStack Management to Xen Command Center Connect SSH/SFTP to the NetScaler device from Command Center SSH administration CLI Administration (encrypted) 22 Xen Resource Pool SSH XenCenter SSH 22 AppController 2.x Administration SSH- Console administration 25 AppController SMTP Mail server connection 43 SmartAuditor MSMQ Service HTTP/S Secured connections 50 NetScaler / Access Gateway Cloud Bridge IPSec Encapsulating Security Protocol (ESP) traffic 51 NetScaler / Access Gateway Cloud Bridge IPSec Authentication Header (AH) traffic 53 Access Gateway 5.0 DNS /UDP DNS name resolution 53 AppController DNS /UDP DNS name resolution 53 CloudStack/CloudPlatform Console Proxy VM Console Proxy VM to DNS DNS CloudStack Management to DNS SSVM SSVM to DNS Virtual Router Virtual Router to DNS 53 NetScaler / Access Gateway DNS /UDP DNS name resolution 53 Previous versions of Access Gateway Standard / Advanced DNS /UDP DNS name resolution Edition 53 Xen Infrastructure /UDP DNS 67 Provisioning services DHCP UDP DHCP Option for TFTP Name (Bootstrap Protocol ) 68 Provisioning services DHCP UDP DHCP Option for Bootfile Name (Bootstrap Protocol Client) 69 Provisioning services TFTP UDP Trivial File Transfer 80 Access Gateway 5.0 Citrix Access Controller Communication between Access Gateway and Access Control 80 Branch Repeater Administration Citrix Repeater Console

16 By Port Port Product Component Type Details 80 Citrix Online Products GoToMeeting GoToWebinar GoToMyPC Contacting GoToMeeting service broker using the Endpoint Gateway (EGW) GoToAssist 80 CloudStack SSVM SSVM to HTTP(s) File Share to download VM Image Xen CloudStack Management to Xen 80 Common Citrix Communication Ports Application / Desktop XML Service Request Citrix Receiver Communication with Merchandising STA Secure Ticketing Authority (embedded into XML Service) 80 EdgeSight Agent Communication with EdgeSight for payloads and alerts 80 NetScaler / Access Gateway HTTP/S administration GUI Administration 80 Previous versions of Access Gateway Standard / Advanced Edition Advanced Access Control (AAC) 80 SmartAuditor Components (Agent / Player) Components (Agent / Player) /UDP /UDP Communication between Access Gateway Standard and Advanced Access Control SmartAuditor components connecting to SmartAuditor Broker SmartAuditor components connecting to SmartAuditor Broker MSMQ Service HTTP/S Secured connections 80 StoreFront Application/Desktop Req. HTTP XML Service 80 XenApp Offline Plug-in HTTP/S Communication with Application Hub (Web / File / Share) 80 XenDesktop Active Directory Identity Service Used by Citrix.ADIdentity.SdkWcfEndpoint.e xe Broker Used by process BrokerService.exe for WCF communications to VDA, SDK, XML Service Citrix Desktop Service Used by process WorkstationAgent.exe for communicating with Broker Citrix Xen Virtualization Infrastructure Communication with Xen infrastructure Configuration Service Used by Citrix.Configuration.SdkWcfEndpoin t.exe Page 16

17 By Port Port Product Component Type Details Desktop Director Host Service Used by Citrix.Host.SdkWcfEndpoint.exe License Configuration Service Used by Citrix.LicensingConfig.SdkWcfEndp oint.exe Machine Creation Service Used by Citrix.MachineCreation.SdkWcfEndp oint.exe Machine Identity Service Used by Citrix.MachineIdentity.SdkWcfEndp oint.exe Virtual Desktop Agent 5 Communication between Desktop Delivery Controller and Virtual Desktop Agent Virtual Desktop Agent 5 Communication between Desktop Director and Virtual Desktop Agent for WinRM StoreFront Kerberos /UDP Native windows authentication protocol 111 CloudStack/CloudPlatform NFS CloudStack Management to NFS (initial deployment of SSVM and CPVM SSVM SSVM to NFS 123 Xen Infrastructure /UDP NTP 135 SmartAuditor MSMQ Service (default) RPC 135 XenDesktop Virtual Desktop/Delivery Agent(VDA) Microsoft Configuration Manager Wake on LAN Password Manager Credential Store on Network File Share /UDP Communication between Desktop Director and VDA for Remote Assistance Wake-up proxy (optional for Microsoft Configuration Manager Wake on LAN) WMI connection to ConfigMgr for Wake on LAN NetBIOS 139 Xen Infrastructure /UDP ISO Store: NetBIOS Session Service 161 NetScaler / Access Gateway Command Center UDP SNMP Polling to NetScalers and TRAPs from NetScaler to Command 162 NetScaler / Access Gateway Center Command Center UDP SNMP Polling to NetScalers and TRAPs from NetScaler to Command Center 389 AppController Authentication LDAP connection Page 17

18 By Port Port Product Component Type Details 389 StoreFront Authentication /UDP LDAP connection 389 Access Gateway 5.x LDAP authentication LDAP connection 389 EasyCall LDAP Active Directory/LDAP 389 Lab Manager Lab Manager to LDAP Active Directory 389 NetScaler / Access Gateway LDAP authentication /UDP LDAP connection 389 NetScaler / Access Gateway LDAP authentication /UDP LDAP connection 389 AppController LDAP authentication /UDP LDAP connection 389 Previous versions of Access Gateway Standard / Advanced LDAP authentication LDAP connection Edition 389 Provisioning services Active Directory Communication with Active Directory services 389 StageManager StageManager to LDAP Active Directory 389 Xen Infrastructure Active Directory 443 Access Gateway 5.0 Appliance administration Administration Website Citrix Access Controller Communication between Access Gateway and Access Control Client Connections Port used for connecting to an Access Gateway Deployment 443 AppController Client Connections Connect to AppController 443 StoreFront Application/Desktop Req. SSL Relay for secure XML traffic 443 Branch Repeater Administration Citrix Repeater Console Client to Appliance Client to Appliance communication 443 Citrix Online Products GoToMeeting GoToWebinar GoToMyPC Contacting GoToMeeting service broker using the Endpoint Gateway (EGW) GoToAssist 443 CloudStack SSVM SSVM to HTTP(s) File Share to download VM Image vcenter CloudStack Management to vcenter Xen CloudStack Management to Xen 443 Common Citrix Communication Ports Application / Desktop XML Service Request Citrix Receiver Communication with Merchandising STA Secure Ticketing Authority (embedded into XML Service) Page 18

19 By Port Port Product Component Type Details 443 EasyCall Admin Console Administration of EasyCall 443 EdgeSight Agent Communication with EdgeSight for payloads and alerts 443 NetScaler / Access Gateway HTTP/S administration GUI Administration 443 Password Manager Password Manager Service Communication with Management Console and Password Manager Agent (non-ima) 443 Previous versions of Access Advanced Access Control Communication between Access Gateway Standard / Advanced (AAC) Gateway Standard and Advanced Edition Access Control Client Connections Port used for connecting to an Access Gateway Deployment 443 XenApp Offline Plug-in HTTP/S Communication with Application Hub (Web / File / Share) 443 XenDesktop Broker Used by process BrokerService.exe for WCF communications to VDA, SDK, XML Service Citrix Xen Virtualization Infrastructure Desktop Director VMware vsphere Virtualization Infrastructure Communication with Xen infrastructure VMware Web Services communication 443 Xen Resource Pool Management using XenAPI XenCenter Management using XenAPI 443 XenClient Enterprise Engine Enterprise Engine communication 445 Password Manager Credential Store on /UDP CIFS Network File Share 445 XenApp Offline Plug-in SMB Communication with Application Hub (File / Share) 445 Xen Infrastructure /UDP ISO Store: Microsoft-DS 464 StoreFront Kpasswd /UDP Native Windows Authentication for expired passwords 500 NetScaler / Access Gateway Cloud Bridge UDP Internet Key Exchange (IKE/ISAKMP) negotiation 524 Password Manager Credential Store on Novell /UDP ZENworks communication File Share 623 NetScaler LOM Administration Lights Out Management 636 Lab Manager Lab Manager to Active Directory LDAP over SSL (LDAPS) Page 19

20 By Port Port Product Component Type Details 636 NetScaler / Access Gateway LDAP authentication /UDP LDAP SSL connection 636 Password Manager Credential Store on Active Directory /UDP LDAP SSL connection 636 StageManager StageManager to LDAP over SSL (LDAPS) Active Directory 636 AppController Authentication LDAP SSL connection 694 Access Gateway 5.0 Appliance Failover Communication between Access Gateway appliances 1099 NetScaler / Access Gateway Command Center Used when you execute the Invoke NSCLI option. Under Device, right click under Map Between Command Center and NetScaler. The ping is the SNMP ping EdgeSight Database Microsoft SQL 1433 Provisioning services Database Microsoft SQL 1433 SmartAuditor Database Microsoft SQL 1433 StorageLink Database Microsoft SQL 1433 StoreFront SQL Connection Connect StoreFront and SQL server 1433 Workflow Studio Database Microsoft SQL 1433 XenApp Database Microsoft SQL 1433 XenDesktop Database Microsoft SQL 1434 XenApp Database Microsoft SQL. Note: Named instance connection requires UDP XenDesktop Database Microsoft SQL. Note: Named instance connection requires UDP Common Citrix Communication Ports ICA / HDX Access to applications and virtual desktops 1801 SmartAuditor MSMQ Service (default) /UDP MSMQ 1812 Access Gateway 5.x RADIUS authentication /UDP RADIUS connection 1812 NetScaler / Access Gateway RADIUS authentication /UDP RADIUS connection 1812 Previous versions of Access Gateway Standard / Advanced RADIUS authentication /UDP RADIUS connection Edition 2049 CloudStack/CloudPlatform NFS CloudStack Management to NFS (initial deployment of SSVM and CPVM 2049 CloudStack/CloudPlatform SSVM SSVM to NFS 2049 Xen Storage NFS Storage 2101 SmartAuditor MSMQ Service (default) MSMQ-DCs Page 20

21 By Port Port Product Component Type Details 2103 SmartAuditor MSMQ Service (default) MSMQ-RPC 2105 SmartAuditor MSMQ Service (default) MSMQ-RPC 2107 SmartAuditor MSMQ Service (default) MSMQ-Mgmt 2179 Lab Manager End-Device to Connections for Microsoft Hyper-V Virtualization Host 2179 StageManager End-Device to Connections for Microsoft Hyper-V Virtualization Host 2179 XenClient Hyper-V Hyper-V Management Console 2512 Common Citrix IMA Independent Management Communication Ports Architecture (IMA) 2513 Access Gateway 5.x Controller administration IMA-based communication 2513 Common Citrix Communication Ports Management Console Citrix Management Consoles 2513 Previous versions of Access Gateway Standard / Advanced Edition AAC administration IMA-based communication 2598 Common Citrix Communication Ports 3003 NetScaler / Access Gateway 3008 NetScaler / Access Gateway Session Reliability Access to applications and virtual desktops High Availability UDP Exchange of Hello packets for communicating UP/DOWN status (heartbeat) High Availability Secure High Availability configuration synchronization 3008 Java administration GUI Administration (encrypted ) 3009 NetScaler / Access Gateway High Availability Secure command propagation and MEP 3010 NetScaler / Access Gateway 3011 NetScaler / Access Gateway 3108, 3148, 3168, 3188 High Availability High Availability configuration synchronization plus web-logging and audit server logging Java administration GUI (no encryption) High Availability Command propagation and MEP NetScaler Gateway Plug-in VPN Tunnel Client UDP For VPN tunnel with secure ICA connections - Download Xen Storage iscsi Storage 3268 NetScaler / Access Gateway LDAP authentication LDAP connection to Global Catalog 3268 AppController Authentication LDAP connection to Global Catalog 3268 Password Manager Credential Store on Active Directory LDAP connection to Global Catalog 3268 AppController LDAP Authentication LDAP connection to Global Catalog Page 21

22 By Port Port Product Component Type Details 3268 XenDesktop VDA Agent Communication between VDA and Microsoft Global Catalog AppController LDAP Authentication LDAPS connection to Global Catalog 3269 AppControler Authentication LDAPs connection to Global Catalog 3269 Password Manager Credential Store on Active LDAP SSL connection to Global Directory Catalog 3306 CloudStack/CloudPlatform MySQL CloudStack Management to MySQL 3389 Branch Repeater Administration RDP connection to server console (Windows) 3389 Lab Manager End-Device to Virtual RDP for Windows Guests Machines 3389 StageManager End-Device to Virtual RDP for Windows Guests Machines 3389 XenDesktop Virtual Desktop Agent 5 Communication between Desktop Director and Virtual Desktop Agent for Remote Assistance 3389 Xen XenCenter RDP for Windows Guests 3527 SmartAuditor MSMQ Service (default) UDP MSMQ-Ping 3922 CloudStack/CloudPlatform Console Proxy VM CloudStack Management to Console Proxy VM SSVM CloudStack Management to SSVM Virtual Router CloudStack Management to Virtual Router 4443 AppController Administration GUI Administration 5060 EasyCall EasyCall Gateway EasyCall Gateway communicates with the SIP trunk over port Lab Manager End-Device to Virtual VNC for Linux Guests Machines 5900 NetScaler LOM Administration Lights Out Management 5900 StageManager End-Device to Virtual VNC for Linux Guests Machines 5900 Xen XenCenter VNC for Linux Guests Lab Manager End-Device to Connections for Xen Virtualization Host StageManager End-Device to Connections for Xen Virtualization Host 5985 XenDesktop Virtual Desktop Agent 5 Communication between Desktop Director and Virtual Desktop Agent for WinRM 2.0 Page 22

23 By Port Port Product Component Type Details 6010 NetScaler / Access Gateway Command Center Used when you execute the Invoke NSCLI option. Under Device, right click under Map Between Command Center and NetScaler. The ping is the SNMP ping Provisioning Services Communication UDP Inter-server communication (version 6.0 and later) 6901 Provisioning Services Target Devices UDP Default port for Target Devices prior to version , Provisioning Services Target Devices UDP Default ports for Target Devices starting with version 6.0 and later (hard-coded and not configurable) Provisioning Services Communication UDP Inter-server communication (prior to version 6.0) 6910 Provisioning Services Boot Login UDP Target Device logon at Provisioning services Provisioning Services Streaming Services UDP Provisioning services Streaming Service 7279 Citrix License Citrix Vendor Daemon Check-in/check-out of Citrix licenses (Citrix.exe) 8010 Workflow Studio Console Connection to remote runtime 8080 CloudStack/CloudPlatform User/Client/API User/Client/API to CloudStack Management - Management Port (authenticated communication) 8080 Common Citrix Communication Ports 8080 XenDesktop Virtual Desktop Agent (previous versions) 8082 Citrix License License Management Console Application / Desktop XML Service Request STA Secure Ticketing Authority (embedded into XML Service) Communication between Desktop Delivery Controller and Virtual Desktop Agent Web-based administration console (Lmadmin.exe) 8083 Citrix License License Management Simple License Service port (required for XenDesktop 7.x) 8096 CloudStack/CloudPlatfrom User/Client User/Client to CloudStack Management - Management Port (unauthenticated communication) 8100 XenDesktop Microsoft Hyper-V Virtualization Infrastructure SCVMM Administrator Console Page 23

24 By Port Port Product Component Type Details 8200 Citrix Online Products GoToMeeting GoToWebinar GoToMyPC Contacting GoToMeeting service broker using the Endpoint Gateway (EGW) GoToAssist 8250 CloudStack/CloudPlatform CloudStack Management To/from CloudStack Management Console Proxy VM Console Proxy VM to CloudStack Management SSVM SSVM to CloudStack Management Virtual Router Virtual Router to CloudStack Management 8443 EasyCall EasyCall Client PSync 8443 XenClient Administrator Administrator communicate with Synchronizer 8443 Lab Manager End-Device to Lab Manager User Interface VMAgent to Lab Manager 9001 Previous versions of Access Gateway Standard / Advanced Edition End device communication with Lab Manager User interface Secure (HTTPS) Discovery ports for VMAgent Appliance administration Administration Website 9002 Access Gateway 5.0 Citrix Access Controller Communication between Access Gateway and Access Control 9002 Previous versions of Access Gateway Standard / Advanced Appliance administration Administrative Desktop (until 4.5) Edition 9005 Previous versions of Access Gateway Standard / Advanced Appliance administration AAC Edition 9035 EdgeSight Web Console Communication with RSCorSvc on EdgeSight Agent 9036 EdgeSight Agent EdgeSight Agent internal communication (client-side database) 9090 CloudStack/CloudPlatform CloudStack Management CloudStack Management 9091 NetScaler / Access Gateway 9092 NetScaler / Access Gateway Command Center For opening communication between client and the server Command Center Ports are used to refresh, update, and query objects pertaining to Discovery (Maps/Devices, etc.)/fault Management/Administration/ Configuration Management modules Command Center For opening communication between client and the server Page 24

25 By Port Port Product Component Type Details Command Center Ports are used to refresh, update, and query objects pertaining to Discovery (Maps/Devices, etc.)/fault Management/Administration/ Configuration Management modules 9094 NetScaler / Access Gateway Command Center For opening communication 9094 NetScaler / Access Gateway 9443 StageManager End-Device to StageManager User Interface VMAgent to StageManager between client and the server Command Center Used specifically by Configuration Management module while executing/scheduling tasks End device communication with StageManager User interface Secure (HTTPS) Discovery ports for VMAgent/GuestAgent Provisioning services Write Cache UDP Target Device communication with its Write Cache Provisioning services Write Cache UDP Target Device communication with its Write Cache XenApp Power & Capacity Management Agent Communication with Concentrator XenDesktop Microsoft Configuration Manager Wake on LAN UDP Subnet-directed broadcast magic packet (optional for Microsoft Configuration Manager Wake on LAN) XenDesktop Virtual Desktop Agent 5 UDP Used port range for HDX Audio XenDesktop Virtual Desktop Agent 5 UDP Used port range for HDX Audio StorageLink StorageLink Service Communication of StorageLink Manager to StorageLink Service Xen Storage SOAP over HTTP StorageLink Gateway traffic Citrix License License Manager Daemon Handles initial point of contact for license requests (Lmadmin.exe) Lab Manager VMAgent to Lab Manager /UDP Discovery ports for VMAgent StageManager VMAgent to StageManager /UDP Discovery ports for VMAgent/GuestAgent Provisioning services Console SOAP Service Provisioning services Console SOAP Service Page 25

26 Revision Change Description Updated By Date 2.4 NSG plugin ports, NetScaler LOM, Simple Service License, XenDesktop Wake on LAN 2.3 Added new destination sections, new ports for NetScaler Insight Center and XenMobile Ports link 2.2 Added AppController, Director, StoreFront, XenClient and, XenDesktop ports and updated ports by listing section for all categories. Steve Weizman April 2014 Thomas Berger, Steve Weizman Steve Weizman Stehanie Roper, September 2013 June Revised Provisioning Services Target Device ports Fred Donovan December, Added ports for Provisioning Services version 6.x Fred Donovan, February, 2012 Added ports listing by port John Scoles 1.9 Corrected DHCP descriptions for Provisioning Fred Donovan January, 2012 Services 1.8 Added CloudStack John Scoles November, Changed Power Capacity Management port, added Steve Weizman October, 2011 Command Center 1.6 Changed VDA 5 HDX port type to UDP John Scoles September, Updates to URLs, XenDesktop, and NetScaler Tarkan Koçoğlu July, 2011 sections 1.4 Added 1434 to XenApp and XenDesktop John Scoles November, Update Tarkan Koçoğlu November, Update John Scoles November, Update John Scoles June, Initial document Michael Palesch Thomas Berger Tarkan Koçoğlu August 28, 2009 Page 26