HP -UX B6941-90001 Administrator's Reference Manual page 444

NOTE
Tuning, Troubleshooting, Security, and Maintenance
ITO Security
Packet-filtering firewalls may lock a range of ports to inbound or
outbound traffic. If this is true, then:
ITO's managed nodes and management server must be configured to
restrict all RPC connections to the same range of port numbers as
those specified at the firewall
A connection between an RPC server and an RPC client needs at least
two ports; one on the server machine, one on the client. Each ITO process
that is either an RPC client or RPC server has its own port for
communication: the port remains blocked by the ITO process which owns
it until the process exits, whereupon the port becomes free for dynamic
assignment to the next RPC client-server request. For more general
information on dynamic port assignment in ITO, see "Processes and Port
Numbers" on page 444 and the HP OpenView IT/Operations Concepts
Guide.
An RPC client using DCE or NCS does not automatically know the port
number of the RPC server on the remote system and, consequently, has
to obtain this information before initiating an RPC request. It does this
by contacting the llbd or rpcd on the remote system and looking up the
specific port number of the RPC server it needs to connect to. With this
information, the RPC client sends the "real" request for "real"
information to the RPC server at the port number it obtained.
The llbd/rpcd always runs on UDP 135, a reserved port which must
always be accessible even through a firewall.
Processes and Port Numbers
In addition to using the checks and controls that a DCE environment
supplies for authentication and data integrity both prior to and during
connections between processes, the administrator can combat security
breaches within ITO by restricting to a specific range, defined in the
GUI, the port numbers that ITO-specific processes use. Conversely, the
ability to define this range of ports means that the administrator can
also configure ITO to run in an environment where, for security reasons,
routers or packet-filtering firewalls restrict the use of ports to a specific
and, often, quite limited range.
444 Chapter 10