>
    Ports Used for User-ID
    Focus
    Download PDF
    Focus
    1. Home
    2. PAN-OS
    3. Firewall Administration
    4. Reference: Port Number Usage
    5. Ports Used for User-ID
    Download PDF

    Ports Used for User-ID

    Table of Contents
    End-of-Life (EoL)

    Ports Used for User-ID

    User-ID is a feature that enables mapping of user IP addresses to usernames and group memberships, enabling user- or group-based policy and visibility into user activity on your network (for example, to be able to quickly track down a user who may be the victim of a threat). To perform this mapping, the firewall, the User-ID agent (either installed on a Windows-based system or the PAN-OS integrated agent running on the firewall), and/or the Terminal Server agent must be able to connect to directory services on your network to perform Group Mapping and User Mapping. Additionally, if the agents are running on systems external to the firewall, they must be able to connect to the firewall to communicate the IP address to username mappings to the firewall. The following table lists the communication requirements for User-ID along with the port numbers required to establish connections.
    Destination Port
    Protocol
    Description
    389
    TCP
    Port the firewall uses to connect to an LDAP server (plaintext or Start Transport Layer Security (Start TLS) to Map Users to Groups.
    3268
    TCP
    Port the firewall uses to connect to an Active Directory global catalog server (plaintext or Start TLS) to Map Users to Groups.
    636
    TCP
    Port the firewall uses for LDAP over SSL connections with an LDAP server to Map Users to Groups.
    3269
    TCP
    Port the firewall uses for LDAP over SSL connections with an Active Directory global catalog server to Map Users to Groups.
    514
    6514
    TCP
    UDP
    SSL
    Port the User-ID agent listens on for authentication syslog messages if you Configure User-ID to Monitor Syslog Senders for User Mapping. The port depends on the type of agent and protocol:
    • PAN-OS integrated User-ID agent—Port 6514 for SSL and port 514 for UDP.
    • Windows-based User-ID agent—Port 514 for both TCP and UDP.
    5007
    TCP
    Port the firewall listens on for user mapping information from the User-ID or Terminal Server agent. The agent sends the IP address and username mapping along with a timestamp whenever it learns of a new or updated mapping. In addition, it connects to the firewall at regular intervals to refresh known mappings.
    5006
    TCP
    Port the User-ID agent listens on for XML API requests. The source for this communication is typically the system running a script that invokes the API.
    88
    UDP/TCP
    Port the User-ID agent uses to authenticate to a Kerberos server. The firewall tries UDP first and falls back to TCP.
    1812
    UDP
    Port the User-ID agent uses to authenticate to a RADIUS server.
    49
    TCP
    Port the User-ID agent uses to authenticate to a TACACS+ server.
    135
    TCP
    Port the User-ID agent uses to establish TCP-based WMI connections with the Microsoft Remote Procedure Call (RPC) Endpoint Mapper. The Endpoint Mapper then assigns the agent a randomly assigned port in the 49152-65535 port range. The agent uses this connection to make RPC queries for Exchange Server or AD server security logs, session tables. This is also the port used to access Terminal Servers.
    The User-ID agent also uses this port to connect to client systems to perform Windows Management Instrumentation (WMI) probing.
    139
    TCP
    Port the User-ID agent uses to establish TCP-based NetBIOS connections to the AD server so that it can send RPC queries for security logs and session information.
    The User-ID agent also uses this port to connect to client systems for NetBIOS probing (supported on the Windows-based User-ID agent only).
    445
    TCP
    Port the User-ID agent uses to connect to the Active Directory (AD) using TCP-based SMB connections to the AD server for access to user logon information (print spooler and Net Logon).
    5985
    HTTP
    Port the User-ID agent uses to monitor security logs and session information with the WinRM protocol over HTTP.
    5986
    HTTPS
    Port the User-ID agent uses to monitor security logs and session information with the WinRM protocol over HTTPS.

    © 2024 Palo Alto Networks, Inc. All rights reserved.