Cisco 7010 Installation Manual page 23

Chapter 1 Introduction to the Firepower System
Note that the system allows you to change some of its communication ports:
•
•
•
The following table lists the open ports required by each appliance type so that you can take full
advantage of Firepower System features.
Table 1-7 Default Communication Ports for Firepower System Features and Operations
Port Description
22/tcp SSH/SSL
25/tcp SMTP
53/tcp DNS
67/udp DHCP
68/udp
80/tcp HTTP
161/udp SNMP
162/udp SNMP
389/tcp LDAP
636/tcp
389/tcp LDAP
636/tcp
443/tcp HTTPS
You can specify custom ports for LDAP and RADIUS authentication when you configure a
connection between the system and the authentication server; see the Firepower Management
Center Configuration Guide.
You can change the management port (8305/tcp); see the Firepower Management Center
Configuration Guide. However, Cisco strongly recommends that you keep the default setting. If you
change the management port, you must change it for all appliances in your deployment that need to
communicate with each other.
You can use port 32137/tcp to allow upgraded Firepower Management Centers to communicate with
the Collective Security Intelligence Cloud. However, Cisco recommends you switch to port 443,
which is the default for fresh installations of Version 6.0 and later. For more information, see the
Firepower Management Center Configuration Guide.
Direction Is Open on...
Bidirectional Any
Outbound Any
Outbound Any
Outbound Any
Outbound Any except virtual
devices and
ASA FirePOWER
Bidirectional Management Center
Bidirectional Any except virtual
devices and
ASA FirePOWER
Outbound Any
Outbound Any except virtual
devices
Outbound Management Center
Inbound Any except virtual
devices and
ASA FirePOWER
Security, Internet Access, and Communication Ports
To...
allow a secure remote connection to the
appliance.
send email notices and alerts from the
appliance.
use DNS.
use DHCP.
Note These ports are closed by default.
allow the RSS Feed dashboard widget to
connect to a remote web server.
update custom and third-party Security
Intelligence feeds via HTTP.
download URL category and reputation data
(port 443 also required).
allow access to an appliance's MIBs via
SNMP polling.
send SNMP alerts to a remote trap server.
communicate with an LDAP server for
external authentication.
obtain metadata for detected LDAP users.
access an appliance's web interface.
Firepower 7000 and 8000 Series Installation Guide
1-15