LevelBlue Completes Acquisition of Cybereason. Learn more

LevelBlue Completes Acquisition of Cybereason. Learn more

Services
Cyber Advisory
Managed Cloud Security
Data Security
Managed Detection & Response
Email Security
Managed Network Infrastructure Security
Exposure Management
Security Operations Platforms
Incident Readiness & Response
SpiderLabs Threat Intelligence
View All Services
Solutions
BY INDUSTRY
BY REGULATION
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Operational Technology
End-to-end OT security
Microsoft
Unlock the full power of Microsoft Security
Securing the IoT Landscape
Test, monitor and secure network objects
Why LevelBlue
About Us
We reduce cyber risk and fortify organizations
Awards and Accolades
Recognition by analysts and media outlets
LevelBlue SpiderLabs
Global researchers, ethical hackers, and responders
LevelBlue Security Operations Platforms
Unprecedented security visibility and control
Security Colony
Access to cybersecurity threat protection resources
Partners
Microsoft
Unlock the full power of Microsoft Security
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Register
Login
Resources
BLOGS
UPCOMING
MEDIA & ASSETS
NOTICES
HELP
Loading...
Loading...

LevelBlue Knowledge Base

Home » Knowledgebase » MailMarshal (SEG) » INFO: What ports need to be open in my firewall for MailMarshal...

INFO: What ports need to be open in my firewall for MailMarshal SMTP?

Expand / Collapse
Show/Hide Article Tools


This article applies to:

  • MailMarshal (SEG)

Question:

What ports need to be open in my firewall for MailMarshal SMTP?

Information:

For latest information, always review the Release Notes and User Guide for your installed version of the product.

The table below details the various ports used by MailMarshal (SEG):

Port Direction Source Destination Required for Versions Explanation
tcp/25 Both Mail Processing Nodes All All MailMarshal SMTP must be able to send and receive data on port 25 for SMTP communications to the outside world.
udp/53
tcp/53		 Outbound All MailMarshal SMTP Components DNS servers specified in MailMarshal SMTP configuration All MailMarshal SMTP uses port 53 to query DNS servers during PTR checking, blocklist lookups, authentication, and when sending email to an external recipient.
tcp/80
tcp/443		 Outbound Array Manager www.marshal.com All The automatic updates feature connects to www.marshal.com periodically to download new SpamCensor updates (and occasionally updates to other functionality, depending on version) using HTTP and HTTPS.
tcp/80
tcp/443		 Outbound Node Controller 

Receiver 

Engine 		 Any 6.5 and above Various functions of the MailMarshal processing node require HTTP and HTTPS access. IP addresses and URLS are not limited to a known set.

Notably for use of TLS (version 7.1 and above) the Controller must be able to access Certificate Revocation Lists that could be published at any valid URL.
tcp/443 Incoming Workstations/Browsers used to configure and manage SEG Management Console website (Array Manager server) 10.0 and above MailMarshal (SEG) 10 introduces a web management interface in place of the Configurator and Console. Carefully consider access to this interface (intranet only, extranet, or potentially Internet).
tcp/110 Incoming All Mail Processing Nodes (POP3 only) All If the MailMarshal POP3 server is being used, incoming access to port 110 is required for clients to retrieve their mail.
tcp/389 Outgoing Array Manager Active Directory Domain Controllers/LDAP Servers All Outbound access to port 389 is required if MailMarshal retrieves groups from Active Directory or another LDAP server, if Active Directory is used for SMTP AUTH, or if email addresses are retrieved automatically from AD for the Spam Quarantine Management website.
tcp/1433 Outgoing Array Manager SQL Server All Outbound access to port 1433 on the SQL server is mandatory.
tcp/19001 Incoming Controller

MailMarshal Configurator (8.X and below)

MailMarshal Console (8.X and below)

MailMarshal Web Components 		Array Manager All The Controller must be able to contact the Array Manager to receive configuration updates, service commands, etc.

The Configurator, Console, and Web Components must talk to the Controller or Array Manager (depending on version) in order to function.

Note: The Array Manager should be installed in the trusted network. Connection from the Configurator to the Array Manager requires NetBIOS ports (135-139) and LevelBlue recommends you DO NOT open these ports through your firewall. See LevelBlue Knowledgebase article Q10026.
tcp/19001 Incoming Array Manager Controller All The Array Manager must be able to contact the Controller server to check node status, and various other administrative tasks.
tcp/19006
(https)		 Incoming Array Manager REST API clients 8.X and above If you use the SEG REST API to manage SEG, this is the required port for client connections.
tcp/19020 (https) Internal only Array Manager Entra RPC client 11.1 and above If you use the Entra Connector to retrieve user group information from Entra, this port is in use internally to the Array Manager server.

 

This article was previously published as:
NETIQKB36130

 

 

 

To contact LevelBlue about this article or to request support:

Rate this Article:
     
Tags:

Related Articles


Q11360 INFO: What ports need to be open in my firewall for the McAfee for Marshal Virus Scanner?
Q11906 INFO: What ports need to be open in my firewall for Sophos for Marshal?

Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster.


Execution: 0.031. 11 queries. Compression Disabled.
Powered by InstantKB.NET