<html><body>Thank you Simo, Is there a better source for the IPA ports required you can direct me to other than this <a href="https://access.redhat.com/solutions/357673">https://access.redhat.com/solutions/357673</a> which shows the below: Resolution IdM Server <-> Clients<table border="0" cellspacing="0" cellpadding="0"><tr valign="top"><td width="97" valign="middle"><div align="center">Name</div></td><td width="160" valign="middle"><div align="center">Destination-port / Type</div></td><td width="689" valign="middle"><div align="center">Purpose</div></td></tr> <tr valign="top"><td width="97" valign="middle">HTTP/HTTPS </td><td width="160" valign="middle">80 / 443 TCP </td><td width="689" valign="middle">WebUI and IPA CLI admin tools communication.</td></tr> <tr valign="top"><td width="97" valign="middle">LDAP/LDAPS</td><td width="160" valign="middle">389 / 636 TCP </td><td width="689" valign="middle">directory service communication.</td></tr> <tr valign="top"><td width="97" valign="middle">Kerberos </td><td width="160" valign="middle">88 / 464 TCP and UDP</td><td width="689" valign="middle">communication for authentication</td></tr> <tr valign="top"><td width="97" valign="middle">DNS </td><td width="160" valign="middle">53 TCP and UDP </td><td width="689" valign="middle">nameservice, used also for autodiscovery, autoregistration and High Availability Authentication(sssd), optional</td></tr> <tr valign="top"><td width="97" valign="middle">NTP </td><td width="160" valign="middle">123 UDP </td><td width="689" valign="middle">network time protocol, optional</td></tr> <tr valign="top"><td width="97" valign="middle">kadmind </td><td width="160" valign="middle">464 / 749 TCP </td><td width="689" valign="middle">used for principal generation, password changes etc.</td></tr></table> IdM Server <-> IdM Server (i.e. Replica)<table border="0" cellspacing="0" cellpadding="0"><tr valign="top"><td width="97" valign="middle"><div align="center">Name</div></td><td width="160" valign="middle"><div align="center">Destination-port/Type</div></td><td width="804" valign="middle"><div align="center">Purpose</div></td></tr> <tr valign="top"><td width="97" valign="middle">HTTP/HTTPS </td><td width="160" valign="middle">80 / 443 TCP </td><td width="804" valign="middle">WebUI and IPA CLI admin tools communication.</td></tr> <tr valign="top"><td width="97" valign="middle">LDAP/LDAPS</td><td width="160" valign="middle">389 / 636 TCP </td><td width="804" valign="middle">directory service communication.</td></tr> <tr valign="top"><td width="97" valign="middle">Kerberos </td><td width="160" valign="middle">88 / 464 TCP and UDP</td><td width="804" valign="middle">communication for authentication</td></tr> <tr valign="top"><td width="97" valign="middle">DNS </td><td width="160" valign="middle">53 / TCP and UDP </td><td width="804" valign="middle">nameservice, used also for autodiscovery, autoregistration and High Availability Authentication(sssd), optional</td></tr> <tr valign="top"><td width="97" valign="middle">NTP </td><td width="160" valign="middle">123 UDP </td><td width="804" valign="middle">network time protocol, optional</td></tr> <tr valign="top"><td width="97" valign="middle">kadmind </td><td width="160" valign="middle">464 / 749 TCP </td><td width="804" valign="middle">used only via localhost</td></tr> <tr valign="top"><td width="97" valign="middle">dogtag </td><td width="160" valign="middle">7389 TCP </td><td width="804" valign="middle">Server and replica communication</td></tr> <tr valign="top"><td width="97" valign="middle">replica conf</td><td width="160" valign="middle">9443 / 9444 / 9445 TCP</td><td width="804" valign="middle">Recplica configuration, only needed during initial replica installation -- IPAv3/RHEL6 only (not required at all in IPAv4/RHEL7)</td></tr></table> Note: In RHEL 7, 389 port is used for replication instead of 7389 port.I have a hard time thinking ntp is required bidirectional as well which I assume is the indication with the <-> but I was also wrong thinking tcp port 53 would not be required which it is(found out hard way) so I was leaning on the docs a lot.What would be your take on bidirectional vs uni from the above list?We are running DNS and NTP from IPA. Sean Hogan <img width="16" height="16" src="cid:1__=88BB0AB3DFEEFEF18f9e8a93df938690918c88B@" border="0" alt="Inactive hide details for Simo Sorce ---08/31/2016 03:36:00 PM---On Wed, 2016-08-31 at 14:22 -0700, Sean Hogan wrote: >">Simo Sorce ---08/31/2016 03:36:00 PM---On Wed, 2016-08-31 at 14:22 -0700, Sean Hogan wrote: > From: Simo Sorce <simo@redhat.com> To: Sean Hogan/Durham/IBM@IBMUS Cc: freeipa-users <freeipa-users@redhat.com> Date: 08/31/2016 03:36 PM Subject: Re: [Freeipa-users] IPA port 80 <hr width="100%" size="2" align="left" noshade style="color:#8091A5; "> <tt>On Wed, 2016-08-31 at 14:22 -0700, Sean Hogan wrote: > > > Hi all, > > Been reading a lot about Port 80 for IPA and firewalls but have not found > a concrete answer. I know the redhat docs indicate port 80 is required > bidirectional however I need to investigate if it is truly needed. > > GUI only responds to 443 so not sure what else would be utilizing port 80. > I have seen some references that dogtag proxies its ports to 80 and 443 but > if the gui is running on 443 does that mean dogtag is proxying via 443 > only? Or is there a way to tell? Has anyone attempted not opening port > 80 from IPA Server to IPA Server and clients to IPA server? > ipa-server-3.0.0-50.el6.1.x86_64 Port 80 is not required, the only thing you'll find there is a redirect to the HTTPS port. Simo. -- Simo Sorce * Red Hat, Inc * New York </tt> </body></html>