Edit

Networking requirements

  • Article

This article lists the interfaces that must be accessible on Microsoft Defender for IoT network sensors, on-premises management consoles, and deployment workstations in order for services to function as expected.

Make sure that your organization's security policy allows access for the interfaces listed in the tables below.

User access to the sensor and management console

Protocol Transport In/Out Port Used Purpose Source Destination
SSH TCP In/Out 22 CLI To access the CLI Client Sensor and on-premises management console
HTTPS TCP In/Out 443 To access the sensor, and on-premises management console web console Access to Web console Client Sensor and on-premises management console

Sensor access to Azure portal

Protocol Transport In/Out Port Purpose Source Destination
HTTPS TCP Out 443 Access to Azure Sensor OT network sensors connect to Azure to provide alert and device data and sensor health messages, access threat intelligence packages, and more. Connected Azure services include IoT Hub, Blob Storage, Event Hubs, and the Microsoft Download Center.

Download the list from the Sites and sensors page in the Azure portal. Select an OT sensor with software versions 22.x or higher, or a site with one or more supported sensor versions. Then, select More options > Download endpoint details. For more information, see Sensor management options from the Azure portal.

Sensor access to the on-premises management console

Protocol Transport In/Out Port Used Purpose Source Destination
NTP UDP In/Out 123 Time Sync Connects the NTP to the on-premises management console Sensor On-premises management console
TLS/SSL TCP In/Out 443 Give the sensor access to the on-premises management console. The connection between the sensor, and the on-premises management console Sensor On-premises management console

Other firewall rules for external services (optional)

Open these ports to allow extra services for Defender for IoT.

Protocol Transport In/Out Port Used Purpose Source Destination
SMTP TCP Out 25 Email Used to open the customer's mail server, in order to send emails for alerts, and events Sensor and On-premises management console Email server
DNS TCP/UDP In/Out 53 DNS The DNS server port On-premises management console and Sensor DNS server
HTTP TCP Out 80 The CRL download for certificate validation when uploading certificates. Access to the CRL server Sensor and on-premises management console CRL server
WMI TCP/UDP Out 135, 1025-65535 Monitoring Windows Endpoint Monitoring Sensor Relevant network element
SNMP UDP Out 161 Monitoring Monitors the sensor's health On-premises management console and Sensor SNMP server
LDAP TCP In/Out 389 Active Directory Allows Active Directory management of users that have access, to sign in to the system On-premises management console and Sensor LDAP server
Proxy TCP/UDP In/Out 443 Proxy To connect the sensor to a proxy server On-premises management console and Sensor Proxy server
Syslog UDP Out 514 LEEF The logs that are sent from the on-premises management console to Syslog server On-premises management console and Sensor Syslog server
LDAPS TCP In/Out 636 Active Directory Allows Active Directory management of users that have access, to sign in to the system On-premises management console and Sensor LDAPS server
Tunneling TCP In 9000

In addition to port 443

Allows access from the sensor, or end user, to the on-premises management console

Port 22 from the sensor to the on-premises management console		 Monitoring Tunneling Endpoint, Sensor On-premises management console

Next steps

For more information, see Plan and prepare for deploying a Defender for IoT site.