Firewall rules for DMZ-based Unified Access Gateway appliances

DMZ-based Unified Access Gateway appliances require certain firewall rules on the front-end and back-end firewalls. During installation, Unified Access Gateway services are set up to listen on certain network ports by default.

A DMZ-based Unified Access Gateway appliance deployment usually includes two firewalls:

• An external network-facing, front-end firewall is required to protect both the DMZ and the internal network. You configure this firewall to allow external network traffic to reach the DMZ.
• A back-end firewall between the DMZ and the internal network is required to provide a second tier of security. You configure this firewall to accept only traffic that originates from the services within the DMZ.

Firewall policy strictly controls inbound communications from DMZ service, which greatly reduces the risk of compromising your internal network.

The following tables list the port requirements for the different services within Unified Access Gateway.

Note: All UDP ports require forward datagrams and reply datagrams to be allowed. Unified Access Gateway services use DNS to resolve hostnames. The DNS server IP addresses are configurable. DNS requests are made on UDP port 53 and so it is important that an external firewall does not block these requests or replies.

Port Requirements for the Secure Email Gateway

Note: As the Secure Email Gateway (SEG) service runs as a non-root user in the Unified Access Gateway, the SEG cannot run on the system ports. Therefore, the custom ports must be greater than port 1024.

Port Requirements for Horizon

Note: To allow external client devices to connect to a Unified Access Gateway appliance within the DMZ, the front-end firewall must allow traffic on certain ports. By default, the external client devices and external web clients (HTML Access) connect to a Unified Access Gateway appliance within the DMZ on TCP port 443. If you use the Blast protocol, port 8443 must be open on the firewall. If you use Blast through TCP port 443, there is no need to open TCP 8443 on the firewall.

Port Requirements for Workspace ONE Intelligence Configuration

Port Requirements for Web Reverse Proxy

Port Requirements for Admin UI

Port Requirements for Content Gateway Basic Endpoint Configuration

Port Requirements for Content Gateway Relay Endpoint Configuration

Note: Since Content Gateway service runs as a non-root user in Unified Access Gateway, Content Gateway cannot run on system ports and therefore, custom ports should be > 1024.

Port Requirements for Tunnel

Tunnel Basic Endpoint Configuration

HTTP 200 OK

Tunnel Cascade Configuration

Tunnel Front-end and Back-end Configuration

The following points are valid for the Tunnel requirements.

Note: * - This port can be changed if needed based on your environment's restrictions

1. If port 443 is used, Per-App Tunnel will listen on port 8443.

   Note: When Tunnel and Content Gateway services are enabled on the same appliance, and TLS Port Sharing is enabled, the DNS names must be unique for each service. When TLS is not enabled only one DNS name can be used for both services as the port will differentiate the incoming traffic. (For Content Gateway, if port 443 is used, Content Gateway will listen on port 10443.)

2. For the Tunnel to query the Workspace ONE UEM console for compliance and tracking purposes.

3. For Tunnel Front-end topologies to forward device requests to the internal Tunnel Back-end only.

4. For applications using Tunnel to access internal resources.

5. The Tunnel must communicate with the API for initialization. Ensure that there is connectivity between the REST API and the Tunnel server. Navigate to Groups & Settings > All Settings > System > Advanced > Site URLs to set the REST API server URL. This page is not available to SaaS customers. The REST API URL for SaaS customers is most commonly your Console or Devices Services server URL.