Security/Firewall Requirements

Windows Management Instrumentation (WMI) -- Port: 445

Remote Procedure Call (RPC) (default : 135)

WebSphere

WebSphere application port (default : 9080)

Telnet Port: 23 (if mode of monitoring is Telnet)

SSH Port: 22 (if mode of monitoring is SSH)

The port in which Exchange Server is running (default : 25)

Windows Management Instrumentation (WMI) (default : 445)
Remote Procedure Call (RPC) (default : 135)
Also refer to the ports required for WMI Mode of monitoring under Servers

To connect AS400/iSeries server from Applications Manager it uses JTOpen package. The JTOpen package uses the following Non-SSL ports 449, 446, 8470, 8471, 8472, 8473, 8474, 8475, 8476. Ensure that the ports mentioned under "Port Non-SSL" column in the link are not blocked in firewall.

http://www-01.ibm.com/support/docview.wss?uid=nas1acc12fda96496e4b8625668f007ab75f

Telnet Port (default : 23), if mode of monitoring is Telnet.

SSH Port (default : 22), if mode of monitoring is SSH

SNMP Agent Port (default : 161), if mode of monitoring is SNMP

Ports required for WMI Mode of monitoring:

Windows Management Instrumentation (WMI) (default : 445)
Remote Procedure Call (RPC) (default : 135)
WMI uses DCOM for remote communication.The server to be monitored by applications manager uses a random port number above 1024 by default to respond back. You have to connect to this target server and configure it to use a port within a specified range of ports. You can follow the steps mentioned in this link : http://support.microsoft.com/kb/300083 for restricting the ports in the target server. Note that you must specify at least 5 ports in this range for target server ( you are normally recommended to open at least a 100 ports - http://support.microsoft.com/kb/217351/EN-US/ ). This same range of ports must also be opened in the firewall.

Ports required for SNMP Mode of monitoring:

SNMP Agent Port: 161

Windows Management Instrumentation (WMI) -- Port: 445

Remote Procedure Call (RPC) -- Port: 135

Port in which FTP or SFTP is running (default:21 for FTP, 22 for SFTP)

To monitor JMX behind firewall the following changes have to be done.

• Edit startApplicationsManager.bat/sh file. Add
  -Dmonitor.jmx.rmi.port=<port number for RMI socket communication> to the Java runtime options.
• Restart Applications Manager server
• Ensure that you have the RMI Socket port (step1) and JNDI Port (step4) are opened up in the firewall
• Add the JMX Applications monitor after providing the relevant details.
• The monitor should be added successfully

Windows Management Instrumentation (WMI) -- Port: 445

Remote Procedure Call (RPC) -- Port: 135

• The AWS Access Key Id for accessing the AWS through the API. The access key has 20 alpha-numeric characters.
• The Secret Access Key of the AWS. The secret key should be 40 alpha-numeric characters long.

• To retrieve data for all modules in AS400/iSeries monitor except 'Disk', an user with *USER user profile is required.
• To retrieve data for 'Disk' and to perform Admin actions from Applications Manager, an user with *SECOFR user profile is required.

• If using the *SECOFR user profile is not possible, then for retrieving disk data and to perform the admin actions such as viewing spooled file, job log and performing actions in JOBS, SPOOL, SUBSYSTEM a user profile with special authorities such as *ALLOBJ, *SAVSYS, *JOBCTL, *SPLCTL is required.

• The user should have permission to access QMPGDATA/QPFRDATA library because Applications Manager uses performance collection service for retrieving disk details from AS400/iSeries server. Note: If the performance data collection is not enabled in AS400/iSeries, you need to start it by using the command STRPFRCOL or GO PERFORM-->COLLECT PERFORMANCE DATA-->START PERFORMANCE COLLECTION. You will also be able to execute the STRPFRCOL command from AS400/iSeries server monitor page in Admin-->Non-Interactive command option.

If Authentication is enabled, enter the Username and password for connecting to the JMX agent. To know more about monitoring a JMX Application if your application is behind a firewall, check out this blog post.

For SNMP Version V1/V2c:

• SNMP Community string with read only privileges.

For SNMP Version V3:

Select one of the three Security Levels in the drop-down list:

• NoAuthNoPriv - Messages can be sent unauthenticated and unencrypted. Enter a UserName and Context Name.
• AuthNoPriv - Messages can be sent authenticated but unencrypted. Enter a UserName, Context Name and an Authentication Password. You can select an Authentication Protocol like MD5 or SHA from the drop-down list.
• AuthPriv - Messages can be sent authenticated and encrypted. Enter a UserName, Context Name,an Authentication Password and a Privacy Password. You can select an Authentication Protocol like MD5 or SHA from the drop-down list. By default 'DES' encryption technique will be used.

• For 5.x and above, a username and password is required to connect to Tomcat Manager Application. If not, no username/password is required.
• For 5.x the user specified should have a 'manager' role.
• For 6.x and above, the user specified should have "manager-gui", "manager-script", "manager-jmx" and "manager-status" roles.

When adding VMWare ESX/ESXi servers for monitoring, we recommend that you use the root account. However, if you are unable to use the root account, you can use a 'view-only' profile to add the servers. This profile has all the privileges required for monitoring. The user you create must be:

• a member of the group user.
• based on the profile 'read only'.