Communication Ports Requirements - Cisco 7010 Installation Manual

Security, Internet Access, and Communication Ports
Table 1-6 Firepower System Feature Internet Access Requirements (continued)
Feature
FireAMP integration
intrusion rule, VDB, and GeoDB
updates
network-based AMP
RSS feed dashboard widget
Security Intelligence filtering
system software updates
URL Filtering
whois

Communication Ports Requirements

Firepower System appliances communicate using a two-way, SSL-encrypted communication channel,
which by default uses port 8305/tcp. The system requires this port remain open for basic intra-appliance
communication. Other open ports allow:
•
•
•
In general, feature-related ports remain closed until you enable or configure the associated feature. For
example, until you connect the Firepower Management Center to a User Agent, the agent
communications port (3306/tcp) remains closed. As another example, port 623/udp remains closed on
7000 and 8000 Series appliances until you enable LOM.
Do not close an open port until you understand how this action will affect your deployment.
Caution
For example, closing port 25/tcp (SMTP) outbound on a managed device blocks the device from sending
email notifications for individual intrusion events (see the Firepower Management Center Configuration
Guide). As another example, you can disable access to a physical managed device's web interface by
closing port 443/tcp (HTTPS), but this also prevents the device from submitting suspected malware files
to the cloud for dynamic analysis.
Firepower 7000 and 8000 Series Installation Guide
1-14
Internet access is required to...
receive endpoint-based (FireAMP) malware
events from the Collective Security Intelligence
Cloud cloud.
download or schedule the download of a
intrusion rule, GeoDB, or VDB update directly
to an appliance.
perform malware cloud lookups.
download RSS feed data from an external
source, including Cisco.
download Security Intelligence feed data from
an external source, including the Firepower
System Intelligence Feed.
download or schedule the download of a system
update directly to an appliance.
download cloud-based URL category and
reputation data for access control, and perform
lookups for uncategorized URLs.
request whois information for an external host. Any except virtual devices and
access to an appliance's web interface
secure remote connections to an appliance
certain features of the system to access the local or Internet resources they need to function correctly
Chapter 1 Introduction to the Firepower System
Appliances
Management Center
Management Center
Management Center
Any except virtual devices and
ASA FirePOWER
Management Center
Any except virtual devices and
ASA FirePOWER
Management Center
ASA FirePOWER