vRealize Automation uses designated ports for communication and data access.

Although vRealize Automation uses only port 443 for communication, there might be other ports open on the system. Because open, unsecure ports can be sources of security vulnerabilities, review all open ports on your system and ensure that only the ports that are required by your business applications are open.

Identity Appliance

The following ports are used by the Identity Appliance.

Table 1. Incoming Ports for the Identity Appliance

Port

Protocol

Comments

22

TCP

Optional. SSH

5480

TCP

Access to virtual appliance Web management interface

7444

TCP

SSO service over HTTPS

Table 2. Outgoing Ports for the Identity Appliance

Port

Protocol

Comments

53

TCP, UDP

DNS

67, 68, 546, 547

TCP, UDP

DHCP

80

TCP

Optional. For fetching software updates. Updates can be downloaded separately and applied.

123

TCP, UDP

Optional. For connecting directly to NTP instead of using host time.

389, 636

TCP, UDP

OpenLDAP and Active Directory

vRealize Appliance

The following ports are used by the vRealize Appliance.

Table 3. Incoming Ports for the vRealize Appliance

Port

Protocol

Comments

22

TCP

Optional. SSH.

80

TCP

Optional. Redirects to 443.

111

TCP, UDP

RPC

443

TCP

Access to the vRealize Automation console and API calls.

5480

TCP

Access to virtual appliance Web management interface

5480

TCP

Used by Management Agent

5488, 5489

TCP

Internal. Used by vRealize Appliance for updates.

5672

TCP

RabbitMQ messaging

8230, 8280, 8281

TCP

Internal vRealize Orchestrator instance

8444

TCP

Console proxy communication for vSphere VMware Remote Console connections

Table 4. Outgoing Ports for the vRealize Appliance

Port

Protocol

Comments

25, 587

TCP, UDP

SMTP for sending outbound notification emails

53

TCP, UDP

DNS

67, 68, 546, 547

TCP, UDP

DHCP

80

TCP

Optional. For fetching software updates. Updates can be downloaded separately and applied.

110, 995

TCP, UDP

POP for receiving inbound notification emails

143, 993

TCP, UDP

IMAP for receiving inbound notification emails

123

TCP, UDP

Optional. For connecting directly to NTP instead of using host time.

443

TCP

IaaS Manager Service over HTTPS

Communication with virtualization hosts over HTTPS

902

TCP

ESXi network file copy operations and for VMware Remote Console (VMRC) connections

5432

TCP, UDP

Optional. For communicating with an Appliance Database.

7444

TCP

Communication with SSO service over HTTPS

8281

TCP

Optional. For communicating with an external vRealize Orchestrator instance .

Other ports may be required by specific vRealize Orchestrator plugins that communicate with external systems. For more information, see the documentation for the vRealize Orchestrator plugin.

Infrastructure as a Service

The ports in the tables Incoming Ports for Infrastructure as a Service Components and Outgoing Ports for Infrastructure as a Service must be available for use by the IaaS Windows Server.

Table 5. Incoming Ports for Infrastructure as a Service Components

Component

Port

Protocol

Comments

SQL Server instance

1433

TCP

MSSQL

Manager Service

443*

TCP

Communication with IaaS components and vRealize Appliance over HTTPS

vRealize Appliance

443

TCP

Communication with IaaS components and vRealize Appliance over HTTPS

* Any virtualization hosts managed by proxy agents must also have TCP port 443 open for incoming traffic.

Table 6. Outgoing Ports for Infrastructure as a Service Components

Component

Port

Protocol

Comments

All

53

TCP, UDP

DNS

All

67, 68, 546, 547

TCP, UDP

DHCP

All

123

TCP, UDP

Optional. NTP.

Manager Service

443

TCP

Communication with vRealize Appliance over HTTPS

Website

443

TCP

Communication with Manager Service over HTTPS

Distributed Execution Managers

443

TCP

Communication with Manager Service over HTTPS

Proxy agents

443

TCP

Communication with Manager Service and virtualization hosts over HTTPS

Guest agent

443

TCP

Communication with Manager Service over HTTPS

Manager Service, Website

1433

TCP

MS SQL

Microsoft Distributed Transaction Coordinator Service

In addition to verifying that the ports listed in the previous tables are free for use, you must enable Microsoft Distributed Transaction Coordinator Service (MS DTC) communication between all servers in the deployment. MS DTC requires the use of port 135 over TCP and a random port between 1024 and 65535.

The Prerequisite Checker validates whether MS DTC is running and that the required ports are open.