Port numbers, URLs, and IP addresses

Optional port:

• 4118/HTTPS — Deep Security Agent port. Leave 4118/HTTPS closed if you plan on using agent-initiated communication. Only open it if you plan on using bidirectional or manager-initiated communication. By default, agent-initiated communication is used, which is why 4118/HTTPS is listed here as 'optional'. See Agent-manager communication for details.

Mandatory ports:

• 53/DNS over TCP or UDP — DNS server port
• 80/HTTP, 443/HTTPS — Smart Protection Network port, Smart Protection Server for File Reputation, Workload Security port
• 123/NTP over UDP — NTP server port

Optional ports:

• 514/Syslog over UDP — SIEM or syslog server port. Allow port 514 if you want the agent to send its security events directly to your SIEM or syslog server. The port number is configurable in Workload Security.
• 5274/HTTP, 5275/HTTPS — Smart Protection Server ports for Web Reputation. Ports 5274 and 5275 are only required for Web Reputation, not Firewall. Allow ports 5274 and 5275 if you are hosting a Smart Protection Server in your local network or Virtual Private Network (VPC), instead of having your agents connect to the cloud-based Smart Protection Network over 80/HTTP and 443/HTTPS. For details, see the Smart Protection Server documentation, or Deploy a Smart Protection Server in AWS.
• 4122/HTTPS — Deep Security Relay port. Allow 4122/HTTPS if you want to host relays in your local network. Local relays are typically not required. See Deploy Deep Security Relay for details.

Relays are typically not required. For details, see Deploy Deep Security Relay. If you do decide to deploy relays, then make sure they can listen on the following ports.

• Allow the agent listening port, since it applies to the relay too
• 4122/HTTPS — Deep Security Relay port
• 4123 — This port is for communication between the agent and its own internal relay

Port 4123 should not be listening to connections from other computers, and you don't need to configure it in network firewall policies. But if you have firewall software (such as Windows Firewall or iptables) on the relay itself, verify that it does not block this connection to itself. Also verify that other applications do not use the same port (a port conflict).

Relays are typically not required. For details, see Deploy Deep Security Relay. If you do decide to deploy relays, then make sure they can connect outbound to the following ports.

• 80/HTTP, 443/HTTPS — Trend Micro Update Server/Active Update and Download Center ports
• 4122 — port of other Deep Security Relays

Ports of components receiving traffic from Workload Security

Optional ports:

• 514/Syslog over UDP — SIEM or syslog server port. Allow port 514 if you want to forward events to an external SIEM or syslog server. 514 is configurable in Workload Security.
• 4118/HTTPS — Deep Security Agent port. Leave 4118/HTTPS closed if you plan on using agent-initiated communication. Only open it if you plan on using bidirectional or manager-initiated communication. By default, agent-initiated communication is used, which is why 4118/HTTPS is listed here as 'optional'. See Agent-manager communication for details.
• 4122/HTTPS — Deep Security Relay port. Allow 4122/HTTPS if you want to host relays in your local network. Local relays are typically not required. See Deploy Deep Security Relay for details.

Data center gateway outbound ports (towards the internet)

These ports are only required if you've set up a data center gateway.

• 53/DNS - DNS server port, can be forwarded by an internal DNS server.
• 443/TLS - Port that data center gateway uses to communicate with Workload Security.

Data center gateway outbound ports (towards an intranet)

These ports are only required if you've set up a data center gateway.

• 443/TLS - Port that data center gateway uses to communicate with vCenter servers. The port number may change depending on the vCenter configuration.

• app.deepsecurity.trendmicro.com
• agents.deepsecurity.trendmicro.com
• dsmim.deepsecurity.trendmicro.com
• relay.deepsecurity.trendmicro.com

And the FQDN for your Trend Micro Cloud One region:

• US: *.workload.us-1.cloudone.trendmicro.com
• India: *.workload.in-1.cloudone.trendmicro.com
• UK: *.workload.gb-1.cloudone.trendmicro.com
• Japan: *.workload.jp-1.cloudone.trendmicro.com
• Germany: *.workload.de-1.cloudone.trendmicro.com
• Australia: *.workload.au-1.cloudone.trendmicro.com

If you restrict outbound communication and you are using up to Deep Security Agent 20.0.0-1540 or your firewall does not allow FQDNs beginning with *.workload, allow access to the list of FQDNs directly below this table.

HTTPS

• app.deepsecurity.trendmicro.com/webservice/Manager?WSDL
• app.deepsecurity.trendmicro.com/api
• app.deepsecurity.trendmicro.com/rest

And the FQDN for your Trend Micro Cloud One region:

• US: *.workload.us-1.cloudone.trendmicro.com
• India: *.workload.in-1.cloudone.trendmicro.com
• UK: *.workload.gb-1.cloudone.trendmicro.com
• Japan: *.workload.jp-1.cloudone.trendmicro.com
• Germany: *.workload.de-1.cloudone.trendmicro.com
• Australia: *.workload.au-1.cloudone.trendmicro.com

HTTPS

Download Center or web server

Hosts software.

• files.trendmicro.com

HTTPS

HTTP

Smart Protection Network -
Global Census Service

Used for behavior monitoring, and predictive machine learning.

• dsaas1100-en-census.trendmicro.com

HTTPS

HTTP

Smart Protection Network -
Good File Reputation Service

Used for behavior monitoring, predictive machine learning, and process memory scans.

• deepsecaas11-en.gfrbridge.trendmicro.com

HTTPS

HTTP

20.0 and later agents connect to:

• ds200-en.fbs25.trendmicro.com
• ds200-jp.fbs25.trendmicro.com

12.0 and later agents connect to:

• ds120-en.fbs25.trendmicro.com
• ds120-jp.fbs25.trendmicro.com

11.0 and later agents connect to:

• deepsecurity1100-en.fbs25.trendmicro.com
• deepsecurity1100-jp.fbs25.trendmicro.com

10.0 agents connect to:

• deepsecurity1000-en.fbs20.trendmicro.com 
• deepsecurity1000-jp.fbs20.trendmicro.com
• deepsecurity1000-sc.fbs20.trendmicro.com

HTTPS

HTTP

• dsaas.icrc.trendmicro.com

HTTPS

HTTP

Smart Protection Network -
predictive machine learning

• dsaas-en-f.trx.trendmicro.com
• dsaas-en-b.trx.trendmicro.com

HTTPS

HTTP

• dsaas.url.trendmicro.com

HTTPS

HTTP

• ak5ih4ev105f2-ats.iot.us-east-1.amazonaws.com
• azrb5zzyvrkw6-ats.iot.us-east-1.amazonaws.com

HTTPS

• iaus.activeupdate.trendmicro.com
• iaus.trendmicro.com
• ipv6-iaus.trendmicro.com
• ipv6-iaus.activeupdate.trendmicro.com

HTTPS

HTTP

The FQDN for your Trend Micro Cloud One region:

• US: gateway-control.workload.us-1.cloudone.trendmicro.com
• India: gateway-control.workload.in-1.cloudone.trendmicro.com
• UK: gateway-control.workload.gb-1.cloudone.trendmicro.com
• Japan: gateway-control.workload.jp-1.cloudone.trendmicro.com
• Germany: gateway-control.workload.de-1.cloudone.trendmicro.com
• Australia: gateway-control.workload.au-1.cloudone.trendmicro.com

HTTPS

The FQDN for your Trend Micro Cloud One region:

• US: gateway.workload.us-1.cloudone.trendmicro.com
• India: gateway.workload.in-1.cloudone.trendmicro.com
• UK: gateway.workload.gb-1.cloudone.trendmicro.com
• Japan: gateway.workload.jp-1.cloudone.trendmicro.com
• Germany: gateway.workload.de-1.cloudone.trendmicro.com
• Australia: gateway.workload.au-1.cloudone.trendmicro.com

HTTPS

Workload Security

Subnet information:

• us-1:
  34.205.5.0/27
• in-1:
  3.108.13.32/27
• gb-1:
  18.169.230.160/27
• jp-1:
  35.75.131.96/27
• de-1:
  3.69.198.64/27
• au-1:
  3.26.127.96/27

SIEM or syslog server

Default port: 514

Protocol: syslog over UDP

Only allow this traffic if you configured a SIEM or syslog server.

Deep Security Agent

Default port: 4118

Protocol: HTTPS over TCP

Deep Security Relay

Default port: 4122

Protocol: HTTPS over TCP