Ports and Protocols
This topic lists the network connections Cygna Forest Recovery uses. Each row names the side that opens the connection; replies on the same connection need no separate rule. Agents only open outbound connections, so they need no inbound firewall rules.
Connections
| From | To | Port and protocol | Purpose |
|---|---|---|---|
Operator browser, cdr |
Manager | TCP 5210, HTTPS | Console and REST API. |
| Operator browser | Manager | TCP 80, HTTP (optional) | Redirects the browser to the console on HTTPS. Serves nothing else. You can turn it off at installation. |
| DC agent, storage agent, Isolated Recovery Host agent, recovery agent | Manager | TCP 5211, HTTPS over HTTP/2 with mutual TLS | Agent enrollment and agent sessions, which carry jobs, recovery steps, configuration, and status. |
| Domain controller, recovery environment, Isolated Recovery Host | Storage machine | TCP 445, SMB | Writing backups to staging, and reading a backup during a restore. A test restore reads its backup through the Isolated Recovery Host, so the connection comes from the host's address. |
| DC agent | Domain controllers | TCP and UDP 389, LDAP; TCP 3268, global catalog | Reading the directory topology. |
Manager or cdr agent deploy |
Target domain controller | TCP 445, SMB (ADMIN$ share and Remote Registry); and TCP 5985, WinRM, or TCP 135 and dynamic RPC ports, DCOM |
Installing or updating the DC agent remotely (optional). |
cdr repository estimate
|
Domain controllers | TCP 5985, WinRM, or TCP 135 and dynamic RPC ports, DCOM | Measuring domain controller volumes to size backup storage (optional). |
| Manager | Mail server | TCP 587, SMTP with STARTTLS (default); TCP 465, SMTP over TLS; or TCP 25, unencrypted relay. The port is the SMTP port setting. | Sending recovery plan notifications and the recovery report by email (optional). |
The Manager ports 5210 and 5211 are defaults. You can change them, and the redirect port, when you install the Manager. For details, see Installing the Manager.
Plain http:// addresses are refused everywhere except the redirect port. Agents and cdr must use https://.
Firewall rules created by the Manager installer
The Manager installer adds these inbound rules to Windows Defender Firewall on the Manager machine. Each rule allows TCP traffic to CygnaDR.Manager.exe on its port, on every network profile.
| Rule name | Port | Profile |
|---|---|---|
| Cygna DR Manager (agent gRPC) | 5211 | All |
| Cygna DR Manager (console) | 5210 | All |
| Cygna DR Manager (console redirect) | 80 | All |
If you install with different ports, the rules use those ports. The redirect rule is not created when the redirect is turned off. Uninstalling the Manager removes all of these rules.
Notes
- Network profiles—The Manager's rules apply on every profile because Windows classifies the network of a machine outside a domain as Public until someone changes it. The rules are not limited by source address. What protects the ports is the Manager itself: the console and API require a signed-in operator, and the agent port admits only agents holding a certificate from the Manager's CA. To narrow the rules further, add a remote address scope to them or replace them with your own.
- SMB on the storage machine—The storage agent installer does not create any firewall rule. Allow inbound TCP 445 on the storage machine from your domain controllers and recovery targets, and from the Isolated Recovery Host if you have one, and limit it to those networks.
- Isolated Recovery Host—The host agent installer creates no firewall rules, and the host needs no inbound connections. A test restore virtual machine reaches the Manager and the storage machine through the host's NAT while it restores. After the restore, the restored system runs on a private switch with no network at all and reports only through Hyper-V, so it opens no connections. See Test Restores.
- Remote installation—For WinRM, when the machine that runs the installation is not in the target's domain, as is always the case for the Manager, the target must be in that machine's WinRM TrustedHosts list. For DCOM, the target must allow the Windows Management Instrumentation (WMI-In) firewall rule group. See Accounts and Permissions.
- Listening address—By default, the Manager listens on all of its network interfaces. On a machine with several interfaces, you can bind it to one at installation.
- During a forest or domain recovery—Restore targets are cut off from production, and only the paths a recovery needs stay open to the Manager and the storage machine. See Isolating Recovery Targets.
