Central Cluster Ports

  • All nodes refer to a central cluster only.

  • The port refers to the destination node.

  • All node-to-node traffic within the cluster and all central-remote collector connectivity is encrypted.

  • See also Kubernetes networking reference

For more information, see TOS Architecture.

Source Destination Service / Port Description

User PC browser

  • Cluster Primary VIP

  • External Load Balancer VIP (cloud deployments)

HTTPS <TCP 443>

Mandatory

User access to web UI

After setting the external Load Balancer VIP, connect the External Load Balancer to the cluster using HTTPS <TCP 31443>

Administrator's PC

Physical IPs of all nodes

SSH <TCP 22>

Mandatory

Used for system maintenance

Physical IPs of all nodes

Physical IPs of all nodes

TCP <TCP 8443, 9090, 9091, 9092, 9093, 9095>

All ports mandatory, except for 9095, which is required only if you have a remote collector connected to the central cluster. These ports are used for event streaming between cluster nodes.

Physical IPs of all nodes

Physical IPs of all nodes

TCP <TCP 7472>

Required for all deployments except Azure/AWS/GCP

Used by MetalLB speaker

Physical IPs of all nodes

Check Point audited devices, Cisco Routers, and ASA Firewalls

SSH <TCP 22>

Required to run the device audit log in STRE. These ports are required even if the audited device is monitored on a remote collector; communication comes from the TOS central cluster.

Physical IPs of all nodes

FortiManager and Panorama audited devices

HTTPS <TCP 443>

Required to run the device audit log in STRE. These ports are required even if the audited device is monitored on a remote collector; communication comes from the TOS central cluster.

Physical IPs of all nodes

SMTP server

SMTP <TCP 25> (default) or alternative port as configured

Required if you configure notifications via email.

Physical IPs of all nodes

SMTP server (StartTLS)

SMTP <TCP 587> (default) or alternative port as configured

Required if you configure SecureChange notifications via email using StartTLS encryption.

Physical IPs of all nodes

SMTP server (implicit TLS)

SMTP <TCP 465> (default) or alternative port as configured

Required if you configure SecureChange notifications via email using implicit TLS.

Physical IPs of all nodes

DNS server

DNS <UDP 53>

Mandatory

Used for domain lookups

Physical IPs of all nodes

NTP server

NTP <UDP 123>

Required if NTP is used for network time synchronization

Physical IPs of all nodes

External syslog server

Syslog <UDP 514> (default)

Or alternative port as configured

Required if you want to send TOS syslogs outside the cluster - see notifications via syslog.

Physical IPs of all nodes

LDAP server

LDAP <TCP 389>

LDAP over SSL <TCP 636>

LDAP global catalog <TCP 3268>

LDAP global catalog over SSL <TCP 3269>

Required if you authenticate users using an LDAP server

Physical IPs of all nodes

TACACS Server

TACACS
<TCP 49>

Required if you authenticate users via a TACACS server

Physical IPs of all nodes

RADIUS server

RADIUS
<UDP 1812>

Required if you authenticate users via a RADIUS server

SNMP Management Server

  • Cluster Primary VIP

  • External Load Balancer VIP (cloud deployments)

SNMP <UDP 161> (default) or alternative port as configured

Used for SNMP queries

After setting the external Load Balancer VIP, connect the External Load Balancer to the cluster using HTTPS <TCP 30161>

Physical IPs of all nodes

SNMP Management Server

SNMP-Trap <UDP 162> (default) or alternative port as configured

Used for SNMP traps

Administrator's PC

SIM/iDRAC interfaces on all Tufin Appliances

Web GUI <TCP 80> or <TCP 443> (SSL certificate upload available)

Unencrypted: KVM <TCP 7578>

CDROM <TCP 5120>

USB <TCP 5123>

Encrypted (AES/RC4/Stunnel):

KVM <TCP 7582>

CDROM <TCP 5124>

USB <TCP 5127>

Required for Tufin appliances only

Used for Supermicro Intelligent Management (SIM) port address

See also: Configuring SIM for Gen 4

 

Physical IPs of all nodes

Physical IPs of all nodes

UDP 51820

Mandatory

K3s server and agent nodes required by WireGuard

Physical IPs of all nodes

Physical IPs of all nodes

UDP and TCP 7946

Required for all deployments except Azure, AWS, and GCP.

Used by MetalLB speaker.

Physical IPs of all nodes

Physical IPs of all nodes

HTTPS <TCP 2379-2381>

Mandatory

etcd server communication

Physical IPs of all nodes

Physical IPs of all nodes

HTTPS <TCP 6443-6444>

Mandatory

Kubernetes API Server

Physical IPs of all nodes

Physical IPs of all nodes

Application Specific <TCP/UDP 30000-32767>

Mandatory

Kubernetes internal service range

Physical IPs of all nodes

Physical IPs of all nodes

HTTPS <TCP 10248-10252,10255, 10256>

Mandatory

Kubernetes components

Physical IPs of all nodes

Physical IPs of all nodes

TCP/UDP 2382

Mandatory

Kubernetes components

Physical IPs of all nodes

Physical IPs of all nodes

TCP 10010

Mandatory

Kubernetes components

Physical IPs of all nodes

Physical IPs of all nodes

HTTPS <TCP 32500>

Mandatory

Docker registry

Physical IPs of all nodes

Physical IPs of all nodes

HTTPS <TCP 9100>

Mandatory

Kubernetes node-exporter

Physical IPs of all nodes

Physical IPs of all nodes

HTTPS <TCP 8080>

Required for adding and removing nodes from the cluster

Physical IPs of all nodes

External cloud repository

HTTPS <TCP 443>

The URL is used to connect the SecureChange server to an external cloud repository, in an environment where this integration is enabled

Physical IPs of all nodes

Physical IPs of all nodes

HTTPS <TCP 32444>

Required for disaster recovery on both active and backup clusters (bi-directional)

Physical IPs of all nodes

NFS server (external storage)

NFS <TCP/UDP 2049>

rpcbind <TCP/UDP 111>

rpc.statd (listening) <TCP/UDP Dynamic, 32768–60999> (net.ipv4.ip_local_port_range)

rpc.statd (outgoing notify) <UDP Dynamic 600-1023> (privileged range)

  • Required only when NFSv3 is used, including fallback from NFSv4.

  • Both rpcbind and rpc.statd must be enabled on all nodes.

  • rpcbind is disabled by default.

  • rpc.statd ports are assigned dynamically at service start and may differ per node.

  • The listening ports (TCP/UDP) are taken from the kernel ephemeral range defined by net.ipv4.ip_local_port_range (default 32768–60999).

  • The outgoing notify port (UDP) is taken from the privileged range 600–1023. Verify the assigned ports with rpcinfo -p, or set fixed ports in /etc/nfs.conf under [statd] using port= and outgoing-port=.