Port availability

Access to the XClarity Administrator server

If the XClarity Administrator server and all managed devices are behind a firewall, and you intend to access those devices from a browser that is outside of the firewall, you must ensure that the XClarity Administrator ports are open. If you are using SNMP and SMTP for event management, you might also need to ensure that the ports that are used by the XClarity Administrator server for event forwarding are open.

The XClarity Administrator server listens on and responds through the ports that are listed in the following table.

1. This is the default port. You can configure this port from the user interface.

2. This port is used when SNMP event forwarding with user authentication is configured.

3. Open this port when Wi-Fi is behind a firewall or private Access Point Name (APN) for cellular data. A direct, unproxied connection is required to the APN servers on this port. This port is used as a failback on Wi-Fi only, when devices cannot reach the Apple Push Notifications service on port 5223. The IP address range is 17.0.0.0/8.

4. For the IP address range, see Google ASN 15169. The domain is android.googleapis.com.

5. Though not required outside of China, XClarity Administrator might attempt to connect to this service in other countries.

Access between XClarity Administrator and managed devices

If managed devices (such as compute nodes or rack servers) are behind a firewall and if you intend to manage those devices from a XClarity Administrator server that is outside of that firewall, you must ensure that all ports involved with communications between XClarity Administrator and the baseboard management controller in each managed device are open.

If you intend to install operating systems on managed devices using XClarity Administrator, ensure that you review the list of ports in Access between XClarity Administrator and data network for OS deployment and device-driver updates.

• Flex chassis CMM

  Communication	Flex Chassis CMMs
  Outbound (ports open on external systems)	SLP – UDP/TCP on port 427 CIM HTTP – TCP on port 59882 CIM HTTPS – TCP on port 5989 TCP command – TCP on port 60902 Secure TCP command – TCP on port 6091
  Inbound (ports open on XClarity Administrator appliance)	SFTP – TCP on port 221 CIM indications HTTPS – TCP 9090 LDAPS – TCP on ports 50637

  1. This port is used to transfer firmware-updates using SFTP.

  2. By default, management is performed over secure ports. The non-secure ports are optional.

• Servers and compute nodes

  Communication	ThinkSystem and ThinkAgile	System x	Flex System	ThinkServer
  Outbound (ports open on external systems)	SFTP – UDP on port 115 SLP – UDP/TCP on port 427 HTTPS – TCP on port 443 Remote control – TCP on port 38884 Remote KVM – TCP on port 38894 CIM HTTPS – TCP on port 5989 Firmware updates -- TCP on port 69905	SLP – UDP/TCP on port 427 HTTPS – TCP on port 443 IPMI – TPC on port 623 Remote control – TCP on port 38884 Remote KVM – TCP on port 38894 CIM HTTP – TCP on port 59883 CIM HTTPS – TCP on port 59893 Firmware updates -- TCP on port 69905	SLP – UDP/TCP on port 427 Remote control – TCP on port 38884 Remote KVM – TCP on port 38891, 4 CIM HTTP – TCP on port 59883 CIM HTTPS – TCP on port 59893 Firmware updates -- TCP on port 69905	SNMP traps – UDP on port 162 IPMI – UDP on port 623
  Inbound (ports open on XClarity Administrator appliance)	SFTP – TCP on port 222 HTTPS – TCP on port 443 Firmware updates -- TCP on port 69905 CIM indications HTTPS – TCP 9090 LDAPS – TCP on ports 50636, 50637	SFTP – TCP on port 222 HTTPS – TCP on port 443 Firmware updates -- TCP on port 69905 CIM indications HTTPS – TCP 9090 LDAPS – TCP on ports 50636, 50637	SFTP – TCP on port 222 HTTPS – TCP on port 443 Firmware updates -- TCP on port 69905 CIM indications HTTPS – TCP 9090 LDAPS – TCP on ports 50636, 50637	SNMP traps – UDP on port 162

  1. This port is required to be open for only servers with IMM2.

  2. This port is used to transfer firmware-updates using SFTP.

  3. By default, management is performed over secure ports. The non-secure ports are optional.

  4. Remote control and remote KVM is launched from the web browser, not the XClarity Administrator server.

  5. This port is used to connect to the BMU OS to transfer files and run the update commands.

• Rack and Flex switches

  Communication	Rack switches	Flex switches
  Outbound (ports open on external systems)	SSH – TCP on port 221,3 SNMP - UDP on port 1612 SLP – UDP/TCP on port 4276 HTTPS – TCP on port 4437	SSH – TCP on port 223 SNMP - UDP on port 1615
  Inbound (ports open on XClarity Administrator appliance)	SFTP – TCP on port 224 SNMP traps – TPC on ports 1622	SFTP – TCP on port 224 SNMP traps- TPC on port 1622

  1. For ENOS rack switches, this port is used to configure Head of Stack (HoS) credentials used between CMM and Flex switches, activate the firmware slot, and clear SSH host keys before SFTP file transfer operations.

  2. This port must be open on the XClarity Administrator appliance (inbound) when switches are on a different network than XClarity Administrator, so that XClarity Administrator can receive events for those devices.

  3. This port is used for management (SSH).

  4. This port is used to transfer firmware-updates using SFTP.

  5. For ENOS rack switches, this port is used to transfer inventory data.

  6. This port is used for discovery.

  7. This port is used to apply firmware updates.

• Storage devices

  Communication	Storage devices
  Outbound (ports open on external systems)	FTP – TCP on port 21 SFTP- TCP on port 222 SNMP traps – UDP on port 115 SLP – UDP/TCP on port 427 HTTPS – TCP on port 4431
  Inbound (ports open on XClarity Administrator appliance)	HTTPS – TCP on port 4432 SNMP traps- UDP on port 115

  1. This port is used to transfer firmware-updates.

  2. This port is used to transfer and apply firmware-updates.

Access between XClarity Administrator and data network for OS deployment and device-driver updates

1. If you configured XClarity Administrator to use an operating-system deployment network, ports must be open on that network.

2. For a list of ports that must be available for the deploying operating systems, see Port availability for deployed operating systems.

   For example, if operating-system deployment is configured to use the data network (eth1), then these ports must be open on that network.

3. Each XClarity Administrator instance has a unique Certificate Authority (CA) that is used for only OS deployment. That CA signs a certificate that is used for the target server on ports 3001 and 8443. When OS deployment is initiated, the CA certificate is included in the OS image that is pushed to the target server. As part of the deployment process, that server connects back to ports 3001 and 8443, and verifies the certificate that ports 3001 and 8443 provide during the handshake because they have the CA certificate.

4. This port is used to transfer Windows driver files.

5. This port is used to connect to the target server WinRM.

6. This port is used to transfer OS images and status.