https://community.splunk.com/t5/Security/What-should-I-enable-in-the-firewall-to-allow-communication/m-p/421728#M13271 <P>Hi team!</P> <P>What ports do I need to open and in what direction, I do not know if I leave any.</P> <P>Is there any communications table?</P> <P>Thank you a lot.</P> Tue, 05 Mar 2019 10:53:48 GMT christianubeda 2019-03-05T10:53:48Z https://community.splunk.com/t5/Security/What-should-I-enable-in-the-firewall-to-allow-communication/m-p/421728#M13271 <P>Hi team!</P> <P>What ports do I need to open and in what direction, I do not know if I leave any.</P> <P>Is there any communications table?</P> <P>Thank you a lot.</P> Tue, 05 Mar 2019 10:53:48 GMT https://community.splunk.com/t5/Security/What-should-I-enable-in-the-firewall-to-allow-communication/m-p/421728#M13271 christianubeda 2019-03-05T10:53:48Z https://community.splunk.com/t5/Security/What-should-I-enable-in-the-firewall-to-allow-communication/m-p/421729#M13272 <P>Splunk does not dictate which ports event forwarding uses, however there is a 'convention'.<BR /> Splunk management port defaults to 8089, but this also is configurable.</P> <P>As a basic start (and using defaults) the following should allow your Universal Forwarders to communicate with a deployment server and forward events to indexers/intermediate tiers.</P> <P>UF -&gt; Splunk TCP:9997 (unencrypted event forwarding)<BR /> UF -&gt; Splunk TCP:9998 (TLS encrypted event forwarding)<BR /> UF -&gt; Deployment Server TCP:8089 (TLS)</P> <P>There is a great post with diagrams here which does an awesome job of illustrating all the communications ports<BR /> <A href="https://answers.splunk.com/answers/58888/what-are-the-ports-that-i-need-to-open.html">https://answers.splunk.com/answers/58888/what-are-the-ports-that-i-need-to-open.html</A></P> Tue, 05 Mar 2019 11:00:05 GMT https://community.splunk.com/t5/Security/What-should-I-enable-in-the-firewall-to-allow-communication/m-p/421729#M13272 nickhills 2019-03-05T11:00:05Z