Cisco ISE Ports Reference

1 CiscoISE PortsReference Cisco ISE All PersonaNodes Ports , on page 1 Cisco ISE Infrastructure, on page 1 Cisco ISE AdministrationNode Ports , on page 2 Cisco ISE MonitoringNode Ports , on page 4 Cisco ISE Policy ServiceNode Ports , on page 6 Cisco ISE pxGridServicePorts, on page 10 OCSP and CRL ServicePorts, on page 11 CiscoISE All PersonaNodesPortsTable1: PortsUsedby All NodesPortson OtherEthernetInterfaces(GigbitEthernet1 through5, orBond1 and 2)Portson GigabitEthernet0 or Bond0 CiscoISE Service HTTPS(SOAP):TCP/443 Data synchronization/Replication(JGroups):TCP /12001(Global) ISE MessagingService:SSL:TCP/8671 Replicationand SynchronizationCiscoISE InfrastructureThis appendixlists the TCP and User DatagramProtocolUDP Ports that Cisco ISE uses for intranetworkcommunicationswith externalapplicationsand Cisco ISE Ports listed in this appendixmust beopen on the in mind the followinginformationwhen configuringserviceson a Cisco ISE network: Cisco ISE managementis restrictedto PortsReference1 RADIUS listens on all networkinterfacecards (NICs).

2 CiscoISE serverinterfacesdo not you areinstallingon a hardwareappliance,ensure that you disableVLAN trunkingon switch Ports that are used to connectto Cisco ISE nodes andconfigurethem as access layer Ports . All NICs can be configuredwith IP AdministrationNodePortsThe followingtable lists the Ports used by the Administrationnodes:CiscoISE PortsReference2 CiscoISE PortsReferenceCiscoISE AdministrationNodePortsTable2: PortsUsedby the AdministrationNodesPortson OtherEthernetInterfaces(GigbitEthernet1 through5, orBond1 and 2)Portson GigabitEthernet0 or Bond0 CiscoISE Service HTTP:TCP/80,HTTPS:TCP/443(TCP/80redirect edtoTCP/443;notconfigurable) SSH Server:TCP/22 ExternalRESTfulServices(ERS) REST API: TCP/9060 To manageguest accountsfrom AdminGUI: TCP/9002 ElasticSearch(ContextVisibility;to replicatedatafrom primaryto secondaryAdminnode): TCP/9300 Ports 80 and 443supportAdminwebapplicationsand areenabledby both PrimaryandSecondaryAdministrationNodesfo r :UDP/161 This port is route table Syslog:UDP/20514,TCP/1468 SecureSyslog:TCP/6514 Defaultports are configurablefor SNMPT raps: UDP/162 Logging(Outbound)CiscoISE PortsReference3 CiscoISE PortsReferenceCiscoISE AdministrationNodePortsPortson OtherEthernetInterfaces(GigbitEthernet1 through5, orBond1 and 2)Portson GigabitEthernet0 or Bond0 CiscoISE Service AdminUser Interfaceand EndpointAuthentications: LDAP:TCP/389,3268, UDP/389 SMB: TCP/445 KDC: TCP/88 KPASS: TCP/464 WMI : TCP/135 ODBC:The ODBC Ports are configurableon the MicrosoftSQL: TCP/1433 Sybase:TCP/2638 PortgreSQL:TCP/5432 Oracle:TCP/1521 NTP: UDP/123 DNS.

3 UDP/53,TCP/53 For externalidentitysourcesand servicesreachableonlythroughaninterfaceo therthanGigabitEthernet0,configurestatic routes (Outbound)Guestaccountanduserpasswordexp irationsemailnotification:SMTP:TCP/25 EmailConnectionto Cisco cloud over TCP/443 Smart LicensingCiscoISE MonitoringNodePortsThe followingtable lists the Ports used by the Monitoringnodes:CiscoISE PortsReference4 CiscoISE PortsReferenceCiscoISE MonitoringNodePortsTable3: PortsUsedby the MonitoringNodesPortson OtherEthernetInterfaces(GigabitEthernet1 through5, orBond1 and Bond2)Portson GigabitEthernet0 or Bond0 CiscoISE Service HTTP:TCP/80,HTTPS:TCP/443 SSH Server:TCP/22 AdministrationSimpleNetworkManagementPro tocol[SNMP]:UDP/161 This port is route table Syslog:UDP/20514,TCP/1468 SecureSyslog:TCP/6514 Defaultports are configurablefor SMTP:TCP/25for email of alarms SNMPT raps: UDP/162 LoggingCiscoISE PortsReference5 CiscoISE PortsReferenceCiscoISE MonitoringNodePortsPortson OtherEthernetInterfaces(GigabitEthernet1 through5, orBond1 and Bond2)Portson GigabitEthernet0 or Bond0 CiscoISE Service AdminUser Interfaceand EndpointAuthentications: LDAP:TCP/389,3268, UDP/389 SMB: TCP/445 KDC: TCP/88,UDP/88 KPASS: TCP/464 WMI : TCP/135 ODBC:The ODBC Ports are configurableon the MicrosoftSQL: TCP/1433 Sybase:TCP/2638 PortgreSQL:TCP/5432 Oracle:TCP/1521 NTP: UDP/123 DNS: UDP/53,TCP/53 For externalidentitysourcesand servicesreachableonlythroughaninterfaceo therthanGigabitEthernet0,configurestatic routes (Outbound)SSL: TCP/8910 Bulk Downloadfor pxGridCiscoISE PolicyServiceNodePortsThe followingtable lists the Ports used by the Policy Servicenodes:Table4.

4 PortsUsedby the PolicyServiceNodesPortson OtherEthernetInterfaces,or Bond1 and Bond2 Portson GigabitEthernet0 or Bond0 CiscoISE ServiceCiscoISEmanagementisrestrictedto GigabitEthernet0. HTTP:TCP/80,HTTPS:TCP/443 SSH Server:TCP/22 OCSP:TCP/2560 AdministrationCiscoISE PortsReference6 CiscoISE PortsReferenceCiscoISE PolicyServiceNodePortsPortson OtherEthernetInterfaces,or Bond1 and Bond2 Portson GigabitEthernet0 or Bond0 CiscoISE Service Node Groups/JGroups:TCP/7800 Clustering(Node Group) TCP/9090 SCEP UDP/500 IPSec/ISAKMPTACACS+:TCP/49 This port is configurablein and later PSN (SXP node) to NADs:TCP/64999 PSN to SXP (inter-nodecommunication):TCP/443 SXPTCP/443TC-NACS impleNetworkManagementProtocol[SNMP]:UDP /161 This port is route table Syslog:UDP/20514,TCP/1468 SecureSyslog:TCP/6514 Defaultports are configurablefor SNMPT raps: UDP/162 Logging(Outbound) RADIUSA uthentication:UDP/1645,1812 RADIUSA ccounting:UDP/1646,1813 RADIUSDTLS Authentication/Accounting:UDP/2083.

5 RADIUSC hangeof Authorization(CoA) Send: UDP/1700 RADIUSC hangeof Authorization(CoA) Listen/Relay:UDP/1700,3799 UDP port 3799 is not PortsReference7 CiscoISE PortsReferenceCiscoISE PolicyServiceNodePortsPortson OtherEthernetInterfaces,or Bond1 and Bond2 Portson GigabitEthernet0 or Bond0 CiscoISE Service AdminUser Interfaceand EndpointAuthentications: LDAP:TCP/389,3268 SMB: TCP/445 KDC: TCP/88 KPASS: TCP/464 WMI : TCP/135 ODBC:The ODBC Ports are configurableon the MicrosoftSQL: TCP/1433 Sybase:TCP/2638 PortgreSQL:TCP/5432 Oracle:TCP/1521 NTP: UDP/123 DNS: UDP/53,TCP/53 Forexternalidentitysourcesandservicesrea chableonlythroughaninterfaceotherthanGig abitEthernet0, (Outbound) TS Agent:tcp/9094 AD Agent:tcp/9095 Syslog:UDP/40514,TCP/11468 PassiveID (Inbound)HTTPS(Interfacemust be enabledfor servicein Cisco ISE): BlacklistPortal:TCP/8000-8999(Defaultpor t is TCP/8444.)

6 Guest Portal and Client Provisioning:TCP/8000-8999(Defaultportis TCP/8443.) CertificateProvisioningPortal:TCP/8000-8 999(Defaultport isTCP/8443.) My DevicesPortal:TCP/8000-8999(Defaultport is TCP/8443.) SponsorPortal:TCP/8000-8999(Defaultport is TCP/8443.) SMTP guest notificationsfrom guest and sponsorportals:TCP/25 Web Portal Services:- Guest/Web Authentication- Guest SponsorPortal- My DevicesPortal- Client Provisioning- CertificateProvisioning- BlackListingPortalCiscoISE PortsReference8 CiscoISE PortsReferenceCiscoISE PolicyServiceNodePortsPortson OtherEthernetInterfaces,or Bond1 and Bond2 Portson GigabitEthernet0 or Bond0 CiscoISE Service Discovery(Clientside): TCP/80(HTTP),TCP/8905(HTTPS)By default,TCP/80is redirectedto WebPortal Services:Guest Portal and Client ISE presentsthe Admincertificatefor PostureandClient Provisioningon TCP port ISE presentsthe Portal certificateon TCP port 8443(or the port that you have configuredfor portal use).

7 Note Discovery(PolicyServiceNode side): TCP/8443,8905 (HTTPS)From Cisco ISE, or later with AnyConnect, later, this port is configurable. Provisioning-URLR edirection:SeeWebPortalServices:GuestPor taland Client Provisioning Provisioning- Active-Xand Java AppletInstall includingIP refresh,Web Agent Install,and launchNAC Agent Install:See Web PortalServices:Guest Portal and Client Provisioning. Provisioning- NAC Agent Install:TCP/8443 Provisioning- NAC Agent UpdateNotification:UDP/8905 Provisioning- NAC Agent and Other Package/ModuleUpdates:TCP/8905(HTTPS) Assessment- PostureNegotiationand Agent Reports:TCP/8905(HTTPS) Assessment- PRA/Keep-alive:UDP/8905 Posture- Discovery- Provisioning- Assessment/Heartbeat Provisioning-URLR edirection:SeeWebPortalServices:GuestPor taland Client Provisioning. For Androiddeviceswith EST authentication: 8084must be added to the RedirectACL for Androiddevices.

8 Provisioning- Active-Xand Java AppletInstall (includesthe launchof Wizard Install):See Web Portal Services:Guest Portal and ClientProvisioning Provisioning-WizardInstallfromCiscoISE(W indowsandMacOS):TCP/8443 Provisioning- Wizard Install from GooglePlay (Android):TCP/443 Provisioning- SupplicantProvisioningProcess:TCP/8905 SCEP Proxy to CA: TCP/80or TCP/443(Basedon SCEP RA URLconfiguration)Bring Your Own Device(BYOD)/ NetworkServiceProtocol(NSP)- Redirection- Provisioning- SCEPC iscoISE PortsReference9 CiscoISE PortsReferenceCiscoISE PolicyServiceNodePortsPortson OtherEthernetInterfaces,or Bond1 and Bond2 Portson GigabitEthernet0 or Bond0 CiscoISE Service URL Redirection:See Web Portal Services:Guest Portal and ClientProvisioning API: Vendor specific Agent Install and DeviceRegistration:Vendor specificMobileDeviceManagement(MDM)API Integration NetFlow:UDP/9996 This port is DHCP:UDP/67 This port is DHCPSPAN Probe: UDP/68 HTTP:TCP/80,8080 DNS: UDP/53(lookup)This port is route table SNMPQ uery:UDP/161 This port is route table SNMPTRAP:UDP/162 This port is pxGridServicePortsThe followingtable lists the Ports used by the pxGridServicenodes:Table5: PortsUsedby the pxGridServiceNodePortson OtherEthernetInterfaces(GigabitEthernet1 through5, orBond1 and Bond2)Portson GigabitEthernet0 or Bond0 CiscoISE Service SSL: TCP/5222(Inter-NodeCommunication) SSL.

9 TCP/7400(NodeGroupCommunication)Administ rationTCP/8910pxGridSubscribersCiscoISE PortsReference10 CiscoISE PortsReferenceCiscoISE pxGridServicePortsOCSPand CRLS ervicePortsFor the OnlineCertificateStatus Protocolservices(OCSP)and the CertificateRevocationList (CRL),theports are dependenton the CA Server or on servicehostingOCSP/CRLalthoughreferences to the Cisco ISEservicesand Ports list basic Ports that are used in Cisco ISE AdministrationNode, Policy ServiceNode,MonitoringNode the OCSP, the defaultports that can be used are TCP 80/ TCP 443. Cisco ISE Adminportal expectshttp-basedURL for OCSP services,and so, TCP 80 is the can also use the CRL, the defaultprotocolsincludeHTTP, HTTPS,and LDAP and the defaultports are 80, 443, and389 respectively. The actual port is contingenton the CRL PortsReference11 CiscoISE PortsReferenceOCSPand CRLS ervicePortsCiscoISE PortsReference12 CiscoISE PortsReferenceOCSPand CRLS ervicePorts