Network Port Diagram vSphere
I was troubleshooting an issue with an ESXi host and Update Manager for which I needed the firewall ports. In KB2131180 you can find a PDF document with a beautiful diagram and reference table. But getting all the required ports between a specific source and destination was not easy. So I created this table that is searchable…
Search for “ESXi” to get all the ports for ESXi. Combine this with “vCenter” (“ESXi vCenter”) to narrow your search. I know it’s not perfect but better than a static PDF I think.
| Port | Protocol | Source | Target | Purpose |
|---|---|---|---|---|
| 22 | TCP | Client PC | ESXi | SSH Server |
| 53 | UDP | ESXi | DNS Server | DNS Client |
| 68 | UDP | ESXi | DHCP Server | DHCP Client |
| 80 | TCP | Client PC | ESXi | Redirect Web Browser to HTTPS Service (443) |
| 88 | TCP | ESXi | Active Directory Server | PAM Active Directory Authentication - Kerberos |
| 111 | TCP | ESXi | NFS Server | NFS Client – RPC Portmapper |
| 111 | UDP | ESXi | NFS Server | NFS Client – RPC Portmapper |
| 123 | UDP | ESXi | NTP Time Server | NTP Client |
| 161 | UDP | SNMP Server | ESXi | SNMP Polling. Not used in ESXi 3.x |
| 162 | UDP | ESXi | SNMP Collector | SNMP Trap Send |
| 389 | TCP/UDP | ESXi | LDAP Server | PAM Active Directory Authentication - Kerberos |
| 427 | UDP | vSphere Client | ESXi | CIM Service Location Protocol (SLP) |
| 443 | TCP | vSphere Client | ESXi | vSphere Client to ESXi/ESX Host management connection |
| 443 | TCP | ESXi | ESXi | Host to host VM migration and provisioning |
| 445 | UDP | ESXi | MS Directory Services Server | PAM Active Directory Authentication |
| 445 | TCP | ESXi | MS Directory Services Server | PAM Active Directory Authentication |
| 445 | TCP | ESXi | SMB Server | SMB Server |
| 464 | TCP | ESXi | Active Directory Server | PAM Active Directory Authentication - Kerberos |
| 514 | UDP/TCP | ESXi | Syslog Server | Remote syslog logging |
| 902 | TCP/UDP | ESXi | ESXi | Host access to other hosts for migration and provisioning |
| 902 | TCP | vSphere Client | ESXi | vSphere Client access to virtual machine consoles (MKS) |
| 902 | TCP/UDP | ESXi | vCenter Server | (UDP) Status update (heartbeat) connection from ESXi to vCenter Server |
| 1024 (dynamic) | TCP/UDP | ESXi | Active Directory Server | Bi-directional communication on TCP/UDP ports is required between the ESXi host and the Active Directory Domain Controller (via the netlogond process on the ESXi host). See Active Directory and Active Directory Domain Services Port Requirements and MS article 179442. |
| 2049 | TCP | ESXi | NFS Server | Transactions from NFS storage devices |
| 2049 | UDP | ESXi | NFS Server | Transactions from NFS storage devices |
| 3260 | TCP | ESXi | iSCSI storage server | Transactions to iSCSI storage devices |
| 5900 to 5964 | TCP | ESXi | ESXi | RFB protocol, which is used by management tools such as VNC |
| 5989 | TCP | CIM Server | ESXi | CIM transactions over HTTP |
| 5989 | TCP | vCenter Server | ESXi | CIM XML transactions over HTTPS |
| 5989 | TCP | ESXi | vCenter Server | CIM XML transactions over HTTPS |
| 8000 | TCP | ESXi (VM Target) | ESXi (VM Source) | Requests from vMotion |
| 8000 | TCP | ESXi (VM Source) | ESXi (VM Target) | Requests from vMotion |
| 8100 | TCP/UDP | ESXi | ESXi | Traffic between hosts for vSphere Fault Tolerance (FT) |
| 8182 | TCP/UDP | ESXi | ESXi | Traffic between hosts for vSphere High Availability (vSphere HA) |
| 8200,83 | TCP/UDP | ESXi | ESXi | Traffic between hosts for vSphere Fault Tolerance (FT) |
| 8301 | UDP | ESXi | ESXi | DVS Port Information |
| 8302 | UDP | ESXi | ESXi | DVS Port Information |
| 31100 | TCP | vCenter Server | SPS Server | Internal Communication Port |
| 31000 | TCP | SPS Server | vCenter Server | Internal Communication Port |
| 6500 | UDP | ESXi | vCenter Server | Network coredump server |
| 8000 | TCP | ESXi | vCenter Server | Network coredump web port |
| 8001 | TCP | ESXi | vCenter Server | Network syslog server |
| 25 | TCP | vCenter Server | SMTP Server | Email notifications |
| 53 | UDP | vCenter Server | DNS Server | DNS lookups |
| 80 | TCP | Client PC | vCenter Server | vCenter Server requires port 80 for direct HTTP connections. |
| 80 | TCP | vCenter Server | ESXi | DPM with IPMI (iLO/BMC) ASF Remote Management and Control Protocol |
| 88 | UDP | vCenter Server | Active Directory Server | AD Authentication |
| 88 | TCP | vCenter Server | Active Directory Server | AD Authentication |
| 135 | TCP | vCenter Server | vCenter Server | Linked Mode |
| 9084 | TCP | vSphere Client | Update Manager | Download of VUM client binary from VUM server machine to the VI client machine. |
| 162 | UDP | vCenter Server | SNMP Server | SNMP Trap Send |
| 389 | TCP/UDP | vCenter Server | Linked vCenter Servers | This is the LDAP port number for the Directory Services for the vCenter Server group. The vCenter Server system needs to bind to port 389, even if you are not joining this vCenter Server instance to a Linked Mode group. If another service is running on this port, you can run the LDAP service on any port from 1025 through 65535. |
| 443 | TCP | vSphere Client | vCenter Server | vCenter Server system uses to listen for connections from the vSphere Client. |
| 443 | TCP | vCenter Server | ESXi | vCenter Agent. Host DPM with HP iLO Remote Management and Control Protocol |
| 623 | UDP | vCenter Server | ESXi | DPM with IPMI (iLO/BMC) ASF Remote Management and Control Protocol |
| 636 | TCP | vCenter Server | vCenter Server | vCenter Server Linked Mode, this is the SSL port of the local instance. |
| 902 | TCP | vCenter Server | ESXi | vCenter Server system uses to send data to managed hosts. This port must not be blocked by firewalls between the server and the hosts or between hosts. |
| 902 | UDP | vCenter Server | ESXi | Managed hosts send a regular heartbeat to the vCenter Server system. This port must not be blocked by firewalls between the server and the hosts or between hosts. |
| 902 | TCP/UDP | vSphere Client | ESXi | vSphere Client uses this ports to display virtual machine consoles. |
| 902 | TCP/UDP | ESXi | ESXi | Host access to other hosts for migration and provisioning |
| 5480 | TCP | Client PC | vCenter Server | Only applicable for vCenter Server Virtual Appliance - used for accessing VAMI page of vCenter Server Appliance over HTTPS |
| 1024 (dynamic) | RPC | Linked vCenter Servers | Linked vCenter Servers | Bi-directional RPC communication on dynamic TCP ports is required between all vCenters that need to replicate (via ADAM). A VIC still needs a direct connection to all vCenters that own an object it needs to manage. |
| 1433 | TCP | vCenter Server | Microsoft SQL Server | For vCenter Microsoft SQL Server Database |
| 1521 | TCP | vCenter Server | Oracle Database Server | For vCenter Oracle Database |
| 5988 | TCP | ESXi | vCenter Server | CIM transactions over HTTP |
| 7500 | UDP | vCenter Server | vCenter Server | Linked Mode, Java Discovery Port |
| 8000 | TCP | vCenter Server | ESXi | Requests from vMotion |
| 8005 | TCP | vCenter Server | vCenter Server | Internal Communication Port |
| 8006 | TCP | vCenter Server | vCenter Server | Internal Communication Port |
| 8009 | TCP | vCenter Server | vCenter Server | AJP Port |
| 8080 | TCP | Client PC | vCenter Server | Web Services HTTP. Used for the VMware VirtualCenter Management Web Services. |
| 8083 | TCP | vCenter Server | vCenter Server | Internal Service Diagnostics |
| 8085 | TCP | vCenter Server | vCenter Server | Internal Service Diagnostics/SDK |
| 8086 | TCP | vCenter Server | vCenter Server | Internal Communication Port |
| 8087 | TCP | vCenter Server | vCenter Server | Internal Service Diagnostics |
| 8443 | TCP | Client PC | vCenter Server | Web Services HTTPS. Used for the VMware VirtualCenter Management Web Services. |
| 8443 | TCP | vCenter Server | vCenter Server | Linked Mode |
| 9443 | TCP | Client PC | vCenter Server | vSphere Web Client Access |
| 10109 | TCP | vCenter Server | vCenter Server | vCenter Inventory Service Service Management |
| 10111 | TCP | vCenter Server | vCenter Server | vCenter Inventory Service Linked Mode Communication |
| 10443 | TCP | Client PC | vCenter Server | vCenter Inventory Service HTTPS |
| 7476 (51915) | TCP | ESXi | vSphere Authentication Proxy | This is a web service, which is used to add host to Active Directory domain. |
| 60099 | TCP | vCenter Server | vCenter Server | Web Service change service notification port |
| 7005 | TCP | vCenter Server (Tomcat Server settings) | vCenter Single Sign On | Base shutdown port. For more information, see Configuring VMware Tomcat Server Settings in vCenter Server 5.1. |
| 7080 | TCP | vCenter Server (Tomcat Server settings) | vCenter Single Sign On | HTTP Port |
| 7444 | TCP | vCenter Server (Tomcat Server settings) | vCenter Single Sign On | HTTPS Port |
| 7009 | TCP | vCenter Server (Tomcat Server settings) | vCenter Single Sign On | AJP Port |
| 10111 | TCP | vCenter Inventory Service | vCenter Server | vCenter Inventory Service Linked Mode Communication |
| 25 | TCP | VCO Server | SMTP Server | Email notifications |
| 389 | TCP/UDP | VCO Server | LDAP Server | LDAP Authentication |
| 443 | TCP | VCO Server | vCenter Server | Used to obtain virtual infrastructure and virtual machine information from orchestrated vCenter Server(s) through the vCenter API |
| 636 | TCP | VCO Server | LDAP Server | VCO uses LDAP authentication and group membership to determine role authorization in LCM and access to VMs/requests. This is the SSL secured LDAP protocol LDAPS (the SSL pendent of 389). This is used for secured LDAP authentication |
| 1433 | TCP | VCO Server | Microsoft SQL Server | vCenter Orchestrator Server to Microsoft SQL Server for VCO Database |
| 1521 | TCP | VCO Server | Oracle Database Server | vCenter Orchestrator Server to Oracle for VCO Database |
| 3306 | TCP | VCO Server | MySQL Server | vCenter Orchestrator Server to MySQL Server for VCO Database |
| 5432 | TCP | VCO Server | PostgresSQL Server | vCenter Orchestrator Server to PostgresSQL Server for VCO Database |
| 8230 | TCP | VCO Client | VCO Server | Lookup port – The main port to communicate with Orchestrator Configurator server (JNDI port). All other ports communicate with the Orchestrator Configurator smart client through this one. It is part of the JBoss Application server infrastructure |
| 8240 | TCP | VCO Client | VCO Server | Command port – The application communication port (RMI container port), it is used for remote invocations. It is part of the JBoss Application server infrastructure. |
| 8244 | TCP | VCO Client | VCO Server | Data port used to access all Orchestrator data models, such as workflows and policies. It is part of the JBoss application server infrastructure. |
| 8250 | TCP | VCO Client | VCO Server | Messaging port – The Java messaging port used to dispatch events. It is part of the JBoss Application server infrastructure |
| 8280 | TCP | VCO Server | VCO Server | Port used by VCO Server to connect to the Web front-end via HTTP |
| 8281 | TCP | VCO Server | VCO Server | Port used by VCO Server to connect to the Web front-end via HTTPS |
| 8281 | TCP | vCenter Server | VCO Server | Port used by VCO Server to connect to vCenter Server to communicate with the vCenter API |
| 8282 | TCP | VCO Client PC | VCO Server | HTTP server port – Port used by the HTTP connector to connect to the Web frontend. |
| 8283 | TCP | VCO Client PC | VCO Server | HTTPS server port – Port used by HTTP connector to connect to the Web frontend. Requires Jetty to be configured for SSL. |
| 80 | TCP | Update Manager Server | www.vmware.com and xml.shavlik.com | To obtain metadata for the updates, Update Manager must be able to connect to http://www.vmware.com and http://xml.shavlik.com |
| 80 | TCP | ESXi | Update Manager | ESXi/ESX Host to Update Manager Server. The reverse proxy forwards the request to port 9084 |
| 80 | TCP | Update Manager | vCenter Server | Update Manager to vCenter Server communication |
| 443 | TCP | Update Manager Server | www.vmware.com and xml.shavlik.com | To obtain metadata for the updates, Update Manager must be able to connect to http://www.vmware.com and http://xml.shavlik.com |
| 443 | TCP | ESXi | Update Manager | ESXi/ESX Host to Update Manager Server . The reverse proxy forwards the request to port 9084 |
| 443 | TCP | vCenter Server | Update Manager | vCenter Server to Update Manager Server. The reverse proxy forwards the request to port 8084 |
| 735 | TCP | Update Manager Server | Virtual Machines | Update Manager listenerport (rdevServer.exe) part of theRemote Device Server used for virtual machine patching. |
| 902 | TCP | Update Manager | ESXi | To push patches and updates from Update Manager to the ESXi/ESX Hosts to be updated |
| 1433 | TCP | Update Manager Server | Microsoft SQL Server | Update Manager to Microsoft SQL Server connectivity (for UM Database) |
| 1521 | TCP | Update Manager Server | Oracle Database Server | Update Manager to Oracle connectivity (for UM Database) |
| 8084 | TCP | Update Manager | vCenter Server | SOAP between components of Update Manager Server and the vCenter Update Man ager client plug-in. Configurable at install. |
| 9084 | TCP | ESXi | Update Manager | ESXi/ESX hosts connect to the VUM (VMware Update Manager) webserver listening for updates. Configurable at install. |
| 9087 | TCP | Update Manager | vCenter Server | Port used for uploading host update files. Configurable at install. |
| 9000 to 9100 | TCP | ESXi | Update Manager | This is the recommend port range from which to choose ports for Update Manager if ports 80 and 443 are already in use. Update Manager automatically opens these ports for ESX Host scanning and remediation. |
| 111 | TCP/UDP | vCloud Director Cell | NFS Server | NFS portmapper used by transfer service |
| 920 | TCP/UDP | vCloud Director Cell | NFS Server | NFS rpc.statd used by transfer service |
| 61611 | TCP | vCloud Director Cell (Message Bus) | vCloud Director Cell | ActiveMQ |
| 61616 | TCP | vCloud Director Cell (Message Bus) | vCloud Director Cell | ActiveMQ |
| 25 | TCP/UDP | vCloud Director Cell | SMTP Server | SMTP |
| 53 | TCP/UDP | vCloud Director Cell | DNS Server | DNS |
| 123 | TCP/UDP | vCloud Director Cell | NTP Time Server | NTP |
| 389 | TCP/UDP | vCloud Director Cell | LDAP Server | LDAP |
| 443 | TCP | vCloud Director Cell | ESXi / vCenter | vCenter Server and ESXi connections |
| 514 | UDP | vCloud Director Cell | Syslog Server | Optional, enables syslog use |
| 902 | TCP | vCloud Director Cell | ESXi / vCenter | vCenter Server and ESXi connections |
| 903 | TCP | vCloud Director Cell | ESXi / vCenter | vCenter Server and ESXi connections |
| 1433 | TCP | vCloud Director Cell | SQL Server Database | Default Microsoft SQL Server database port |
| 1521 | TCP | vCloud Director Cell | Oracle Database Server | Default Oracle database port |
| 5672 | TCP/UDP | vCloud Director Cell | AMQP RabbitMQ | Optional, AMQP messages for task extensions. |
| 10109 | TCP | vCenter Server | vCenter Server | vCenter Inventory Service Management |
| 10111 | TCP | vCenter Server | vCenter Server | vCenter Inventory Service Linked Mode Communication |
| 10111 | TCP | vCenter Inventory Service | vCenter Server | vCenter Inventory Service Linked Mode Communication |
| 10080 | TCP | vSphere Client | vCenter Server | vCenter Inventory Service HTTP |
| 10443 | TCP | vSphere Client | vCenter Server | vCenter Inventory Service HTTPS |
| 9443 | TCP | Client PC | Web Client Server | Web Client Server HTTPS connection |
| 9090 | TCP | Client PC | Web Client Server | Web Client Server HTTP connection |
| 443 | TCP | Web Client Server | vCenter Server | Web Client Server to vCenter Server connection |
| 7444 | TCP | Web Client Server | vCenter Single Sign On | SSO Lookup service connection |
| 5988,8889 | TCP | CIM Server | ESXi | CIM transactions over HTTP (only used in case of loopback – for the applications running locally) |
| 12443 | TCP | Web Client Server | Log Browser Service | For accessing the logs |
| 12221 | TCP | Log Browser Proxy | Log Browser Service | Internal port for Log Browser adminitstration page. It opens a socket (only bound to localhost) to accept admin commands. |
| 9 | UDP | vCenter Server | Virtual Volume | Used by the Virtual Volumes feature |
| 546 | TCP/UDP | DHCP Server | ESXi | DHCP client for IPv6 |
| 547 | TCP/UDP | ESXi | DHCP Server | DHCP client for IPv6 |
| 2233 | TCP | ESXi | Virtual SAN Transport | Used for RDT traffic (Unicast peer to peer communication) between Virtual SAN nodes. |
| 12345,23451 | UDP | ESXi | Virtual SAN Clustering Service | Cluster Monitoring, Membership, and Directory Service used by Virtual SAN. |
| 2012 | TCP | vCenter Server | SSO | Control interface RPC for vCenter Single Sign-On(SSO). |
| 2014 | TCP | vCenter Server | SSO | RPC port for all VMCA (VMware Certificate Authority) APIs. |
| 2020 | TCP/UDP | vCenter Server | vCenter Server | Authentication framework management |
| 6500 | TCP/UDP | vCenter Server | ESXi | ESXi Dump Collector port |
| 443 | TCP | vSphere Web Client | ESXi | Client connections |