System Center 2012 Configuration Manager is a distributed client/server system. The distributed nature of Configuration Manager means that connections can be established between site servers, site systems, and clients. Some connections use ports that are not configurable, and some support custom ports you specify. You must verify that the required ports are available if you use any port filtering technology such as firewalls, routers, proxy servers, and IPsec.

If you support Internet-based clients by using SSL bridging, in addition to port requirements, you might have to also allow some HTTP verbs and headers to traverse your firewall. For more information, see Prerequisites for Internet-Based Client Management in the Planning for Communications in Configuration Manager topic.

The port listings that follow are used by Configuration Manager and do not include information for standard Windows services, such as Group Policy settings for Active Directory Domain Services and Kerberos authentication. For information about Windows Server services and ports, see Service overview and network port requirements for the Windows Server system.

Configurable Ports

Non-Configurable Ports

Ports Used by Configuration Manager Clients and Site Systems

The following sections detail the ports used for communication in Configuration Manager. The arrows in the section title, between the computers, represent the direction of the communication:

  • -- > indicates one computer initiates communication and the other computer always responds

  • < -- > indicates that either computer can initiate communication

Asset Intelligence Synchronization Point < -- > Microsoft

Application Catalog Web Service Point -- > SQL Server

Application Catalog Website Point -- > Application Catalog Web Service Point

Endpoint Protection Point -- > Internet

Enrollment Proxy Point -- > Enrollment Point

Enrollment Point -- > SQL Server

Exchange Server Connector -- > Exchange Online

Exchange Server Connector -- > On Premises Exchange Server

Client -- > Application Catalog Website Point

Client -- > Client

Client -- > Cloud-Based Distribution Point

Client -- > Distribution Point

Client -- > Distribution Point Configured for Multicast

Client -- > Distribution Point Configured for PXE

Client -- > Fallback Status Point

Client -- > Global Catalog Domain Controller

Client -- > Management Point

Client -- > Software Update Point

Client -- > State Migration Point

Client -- > System Health Validator

Configuration Manager Console -- > Client

Configuration Manager Console -- > Internet

Configuration Manager Console -- > Reporting Services Point

Configuration Manager Console -- > Site Server

Configuration Manager Console -- > SMS Provider

Mac Computer -- > Enrollment Proxy Point

Management Point -- > Domain Controller

Management Point < -- > Site Server

Management Point -- > SQL Server

Mobile Device -- > Enrollment Proxy Point

Mobile Device -- > Windows Intune

Out of Band Service Point --> Enrollment Point

Out of Band Service Point --> AMT Management Controller

Out of Band Management Console --> AMT Management Controller

Reporting Services Point -- > SQL Server

Site Server < -- > Application Catalog Web Service Point

Site Server < -- > Application Catalog Website Point

Site Server < -- > Asset Intelligence Synchronization Point

Site Server -- > Client

Site Server -- > Cloud-Based Distribution Point

Site Server -- > Distribution Point

Site Server -- > Domain Controller

Site Server < -- > Endpoint Protection Point

Site Server < -- > Enrollment Point

Site Server < -- > Enrollment Proxy Point

Site Server -- > Internet

Site Server < -- > Fallback Status Point

Site Server < -- > Reporting Services Point

Site Server < -- > Site Server

Site Server -- > SQL Server

Site Server -- > SMS Provider

Site Server < -- > Software Update Point

Site Server < -- > State Migration Point

Site Server < -- > System Health Validator

SMS Provider -- > SQL Server

Software Update Point -- > Internet

Software Update Point -- > Upstream WSUS Server

SQL Server --> SQL Server

Windows Intune Connector -- > Windows Intune

Notes for Ports Used by Configuration Manager Clients and Site Systems

  1. Proxy Server port: This port cannot be configured but can be routed through a configured proxy server.

  2. Alternate Port Available: An alternate port can be defined within Configuration Manager for this value. If a custom port has been defined, substitute that custom port when defining the IP filter information for IPsec policies or for configuring firewalls.

  3. Windows Server Update Services: WSUS can be installed either on the default Web site (port 80) or a custom Web site (port 8530).

    After installation, the port can be changed. You do not have to use the same port number throughout the site hierarchy.

    • If the HTTP port is 80, the HTTPS port must be 443.

    • If the HTTP port is anything else, the HTTPS port must be 1 higher—for example, 8530 and 8531.

  4. Trivial FTP (TFTP) Daemon: The Trivial FTP (TFTP) Daemon system service does not require a user name or password and is an integral part of the Windows Deployment Services (WDS). The Trivial FTP Daemon service implements support for the TFTP protocol defined by the following RFCs:

    • RFC 350—TFTP

    • RFC 2347—Option extension

    • RFC 2348—Block size option

    • RFC 2349—Time-out interval, and transfer size options

    Trivial File Transfer Protocol is designed to support diskless boot environments. TFTP Daemons listen on UDP port 69 but respond from a dynamically allocated high port. Therefore, enabling this port will allow the TFTP service to receive incoming TFTP requests but will not allow the selected server to respond to those requests. Allowing the selected server to respond to inbound TFTP requests cannot be accomplished unless the TFTP server is configured to respond from port 69.

  5. Communication between the site server and site systems: By default, communication between the site server and site systems is bi-directional. The site server initiates communication to configure the site system, and then most site systems connect back to the site server to send status information. Reporting service points and distribution points do not send status information. If you select Require the site server to initiate connections to this site system on the site system properties, after the site system is installed, it will not initiate communication to the site server. Instead, the site server initiates the connections and uses the Site System Installation Account for authentication to the site system server.

Additional Lists of Ports

The following sections provide additional information about ports used by Configuration Manager.

AMT Out of Band Management Ports

Client to Server Shares

Connections to Microsoft SQL Server

External Connections made by Configuration Manager

Installation Requirements for Site Systems that Support Internet-Based Clients

Ports Used by Configuration Manager Client Installation

Ports Used by Windows Server

See Also