Hello, I am seeing a lot of blocks going to an azure public IP over port 5671 from our on-prem modernized appliance. We use azure site recovery. I read it's something to do with Azure Service Bus but would love to get more information. Is it something I can change/uninstall? Many thanks in advance.

Hello Tyler Saville , Thanks for your question It is used for communication between your on-premises infra and Azure Site Recovery services. Port 5671 is used by Azure Service Bus for secure AMQP communication. Given that this is an integral part of Azure Site Recovery, it's not recommended to block this traffic. So in this case, No you cannot uninstall. Check if your on-premises environment has security restrictions in place that might be blocking outbound communication on port 5671. Troubleshoot Azure-to-Azure VM network connectivity issues You can mark it 'Accept Answer' and 'Upvote' if this helped you Regards, Abiola

Port 5671 Azure Site Recovery

Accepted answer

akinbade abiola 18,715 Reputation points

2024-07-10T22:48:17.42+00:00

Hello Tyler Saville,

Thanks for your question

It is used for communication between your on-premises infra and Azure Site Recovery services. Port 5671 is used by Azure Service Bus for secure AMQP communication. Given that this is an integral part of Azure Site Recovery, it's not recommended to block this traffic. So in this case, No you cannot uninstall.

Check if your on-premises environment has security restrictions in place that might be blocking outbound communication on port 5671.

Troubleshoot Azure-to-Azure VM network connectivity issues

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Abiola
Please sign in to rate this answer.
Tyler Saville 431 Reputation points

2024-07-11T00:15:11.0766667+00:00

We are blocking port 5671 outbound but everything is working in site recovery. From my brief reading, it sounds like azure service bus can use port 443 instead. Can we leave as is or would it be recommended to open FW for *.servicebus.windows.net?

akinbade abiola 18,715 Reputation points

2024-07-11T08:00:11.9+00:00

Yes it can use port 443 instead of port 5671. So if you are already using port 443. It is recommended so you can leave as is. See:

You can use the following protocols with Azure Service Bus to send and receive messages:

Advanced Message Queuing Protocol 1.0 (AMQP)

Hypertext Transfer Protocol 1.1 with TLS (HTTPS) It is documented here

https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-faq#what-ports-do-i-need-to-open-on-the-firewall--

You can mark Answer 'Accept Answer' and 'Upvote' if this the thread helped you

Tyler Saville 431 Reputation points

2024-07-11T12:19:30.6266667+00:00

If we did want to allow, would we just allow ports 5671 and 5672 to .servicebus.windows.net? We have many clients using ASR so wasn't sure if the destination (.servicebus.windows.net) would change or if that would cover them all? Or are you recommending to just leave 5671 blocked and use port 443 like we do now? Thanks again

SadiqhAhmed-MSFT 46,466 Reputation points Microsoft Employee

2024-07-15T07:36:18.85+00:00

@Tyler Saville This has been answered here - Can anyone explain this? No namespace configured - Microsoft Q&A let us know if you have any other questions.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Port 5671 Azure Site Recovery

0 additional answers

Your answer