Luna Network HSM 7 Port Usage
The table below describes the Luna Network HSM 7 appliance's default port settings.
Standard Ports
| Port | Protocol | Feature | Configurable | Session Initiation |
|---|---|---|---|---|
| 22 | TCP | Secure Shell (SSH) | Yes | inbound |
| 123 | UDP | Network Time Protocol (NTP) | No | outbound |
| 161 | UDP | Simple Network Management Protocol (SNMP) daemon | Yes | inbound |
| 162 | UDP | Simple Network Management Protocol (SNMP) trap | Yes (lunash:> sysconf snmp notification add) | outbound |
| 514 | UDP | Remote Syslog Service | Yes | outbound |
| 1501 | TCP | Callback Service (CBS) | No | inbound |
| 9697 | TCP | Callback Service (CBS) | No | inbound (Remote PED enhanced) |
| 1503 | TCP | Remote PED multifactor quorum authentication | Yes | outbound |
| 1792 | TCP | NTLS (Network Trust Link Service)* | No | inbound |
| 5656 | TCP | Secure Trusted Channel (STC)* | No | inbound |
| 8443 | TCP | REST API webserver | Yes | inbound |
* Applications use the client connection to obtain service from the HSM. Service is available only to client systems that are registered with HSM partitions.
Additional Ports
For each remote syslog host that is added (lunash:> syslog remotehost add), three outbound ports are opened for the rsyslogd process to connect to the remote syslog server. These ports are assigned randomly by the Luna Network HSM 7 appliance in the range of 32768-60999.
Cluster Ports
The ports listed below are associated with the cluster service, which is available only if the cluster secure package is installed (see Updating the Cluster). Thales requires minimum Luna Appliance Software 7.8.5 with the lnh_cluster-1.0.4 package, Luna HSM Firmware 7.8.4, and Luna HSM Client 10.7.2 to use clusters in production environments.
NOTE All the ports below must remain open for communication between cluster members.
| Port | Protocol | Feature | Configurable | Session Initiation |
|---|---|---|---|---|
| 50000 | TCP | Cluster service management and inter-member discovery | No | inbound/outbound |
| 50005 | TCP | Cluster service configuration and inter-member communication | No | inbound/outbound |
| 50052 | TCP | Crypto operations on cluster (default) | Yes (50055-50059) | inbound |
| 50053 | TCP | Cluster administration (inter-member) | No | inbound/outbound |
| 50070 | TCP | Cluster administration (REST API and inter-member) (default) | Yes (50075-50079) | inbound/outbound |
| 50085 | TCP | Cluster messaging service (inter-member) | No | inbound/outbound |
| 50088 | TCP | Cluster messaging service management (inter-member) | No | inbound/outbound |
