NETWORK OpenText Secure MFT Network and Firewall Requirements Secure MFT is a client-server solution that provides accelerated transfer of large files over any network connection. The solution architecture includes a multitude of components all communicating over the network using different protocols and ports. This document reviews Secure MFT network architecture and offers firewall considerations when deploying it in the corporate network. Network Components and Architecture Secure MFT is built on many components to provide authentication, record storage, data storage, and transfer logic and acceleration. The diagram below denotes the relationship of these components: / WEB TRANSFER SMTP: 25 SQL: 1433 SMB: 445 MAIL RELAY SQL FILE SYSTEM
NETWORK The inter-communication between all those components requires different network protocols operating on different ports. The following table describes the primary function of each component and its network requirements. All ports shown in the table are based on the standard or default configuration. In some cases, customers can modify the port assignment. NAME DESCRIPTION PROTOCOL PORT WEB Provides page rendering services, auditing, reporting, HTTP/S transfer fallback capability for clients that cannot establish OpenText Fuel connection with the server. HTTP/HTTPS 80/443 TRANSFER Provides the support for OpenText Fuel protocol. OpenText Fuel DIRECTORY S MICROSOFT SQL SMTP MAIL RELAY FILE SYSTEM Provides user authentication services including LDAP/AD integration and SSO support. RDBMS back-end that stores server and user settings, transaction audit trail, and user database. Sends emails with links to assets in Secure MFT server to recipients, and email notifications to senders and administrators. A network accessible file storage for Secure MFT to store the file assets. HTTP/HTTPS 80/443 SQL 1443 SMTP 25 SMB 445 The counterpart of Secure MFT Enterprise Server, allows users to authenticate and initiate file transfer. HTTP/HTTPS 80/443
NETWORK Deployment Scenarios Depending on the placement of the Secure MFT Client and Server, there may be any number of firewalls separating those two parties. Scenario 1: Secure MFT is inside the corporate network If the whole stack of the Secure MFT Server components is deployed within the corporate network, in order for external users to access Secure MFT, the corporate network firewall will need to be configured to allow inbound and outbound Secure MFT network connections. INTERNET EXTERNAL DMZ CORP NET SMTP: 25 SQL: 1433 SMB: 445 MAIL RELAY SQL FILE SYSTEM
NETWORK Scenario 2: Secure MFT is in the DMZ If the whole stack of the Secure MFT Server components is deployed in the DMZ but outside of the corporate network, both the corporate network firewall and the DMZ firewall will need to be configured to allow inbound and outbound Secure MFT network connections. Depending on what components the organization wants to keep inside the corporate network, additional ports may need to be opened on the corporate network firewall to allow that network traffic. INTERNET EXTERNAL DMZ SQL SQL: 1433 SMTP: 25 SMB: 445 MAIL RELAY FILE SYSTEM CORP NET INTERNAL
NETWORK Scenario 3: Secure MFT is outside of the corporate network If Secure MFT is hosted by OpenText in the OpenText Cloud, or hosted by the customer in other cloud services, in order for users inside the corporate network to interact with the remote Secure MFT in the Cloud, the customer s corporate network and DMZ firewalls need to be configured to allow outbound network connections to the Secure MFT Server. This also applies to external users who wish to access the Secure MFT Server, which is inside your corporate network. Those external users will need to make sure their firewall settings are set to allow outbound connections to your Secure MFT Server. CLOUD SQL SQL: 1433 SMTP: 25 SMB: 445 MAIL RELAY FILE SYSTEM DMZ CORP NET INTERNAL
NETWORK Transfer Workflow The following diagram outlines the step-by-step process of the Secure MFT Transfer workflow, and ports that it uses in different stages of the communication. It focuses solely on the communication between Secure MFT Client and the Server services. NETWORK 1a Client connects to Secure MFT Web Service via HTTPS to authenticate and negotiate transfer settings ANY 443 USER 1b Web service replies with the security token, permissions/settings, the Transfer Service IP, and its and receive ports WEB 2 Client uses a random port to connect to Transfer Service port, and tells the Transfer Service its receive port (uses same port number as the random port) ANY 3000 3 Client connects to Transfer Service port 4 Client connects to Client port (SAME PORT NUMBER AS THE OUTBOUND PORT IN STEP 2) 3000 ANY TRANSFER Secure MFT -Transfer Workflow Firewall Configurations As mentioned previously, ports need to be opened on the firewalls to allow Secure MFT network traffic to pass through. The discussion continues to focus on the Secure MFT client/server communication, and default ports are used. But depending on the actual deployment scenarios, other ports (SQL, SMTP, SMB, etc) may also need to be opened. HTTP or HTTPS (80 or 443 over ) OpenText Fuel (3000 over and ) Server-side firewall configuration On the server side, the server computer is actively awaiting and accepting incoming requests from client computers over specific and ports, and reply to the client s requests with outbound and traffic. On the server-side firewall, the following configurations have to be made: Allow inbound connections to the server on ports (HTTP/HTTPS and OpenText Fuel) Allow inbound connections to the server on a port (OpenText Fuel) Allow outbound connections from the server on ports (HTTP/HTTPS and OpenText Fuel) Allow outbound connections from the server on a port (OpenText Fuel)
NETWORK Client-side firewall configuration On the client side, the client computer needs to make and outbound requests to the Secure MFT server (web service and the transfer service), and the server services will respond to the client requests through the corresponding ports, which the client machine chooses. On the client-side firewall, the following configurations have to be made: Allow outbound connections from within the firewall to the Secure MFT Server on ports (HTTPS and OpenText Fuel) Allow outbound connections from within the firewall to the Secure MFT Server on a port (OpenText Fuel) Final Words Secure MFT is a complex network application, but with good understanding of its network architecture, requirements, and careful planning, it is easy to modify the firewall and proxy settings to allow Secure MFT traffic to traverse the corporate network and DMZ without sacrificing network security. For more information on how Secure MFT ensures data security, please read the Secure MFT Security Overview whitepaper. www.opentext.com/securemft NORTH AMERICA +1 800 304 2727 EUROPE +31 (0)23 565 2333 AFRICA, MIDDLE EAST +971 4 390 0281 JAPAN +81-3-5472-5273 CHINA +86 21 28909063 HONG KONG +852 2824 8223 AUSTRALIA +61 2 9026 3480 Copyright 2016 Open Text Corporation OpenText is a trademark or registered trademark of Open Text SA and/or Open Text ULC. The list of trademarks is not exhaustive of other trademarks, registered trademarks, product names, company names, brands and service names mentioned herein are property of Open Text SA or other respective owners. All rights reserved. For more information, visit:http://www.opentext.com/2/global/site-copyright.html (01/2016)04146EN