Ports and Firewall Matrix
Every network flow CBOM Secure needs, in the form a firewall change request asks for. Rows marked conditional are needed only when the corresponding feature or sensor is in use — open them as you enable the feature, not in advance.
Principles
One externally exposed port. Only the reverse proxy is reachable from outside the platform segment. Every other service listens on the internal network only.
Explicit allow-lists. No any-to-any rule should reach the platform segment.
Open what you use. The outbound table is long because CBOM Secure can discover many kinds of target. A deployment that scans only cloud KMS needs one outbound row, not forty.
No inbound route from target networks is required. A network that cannot reach the platform is served by off-grid discovery instead.
Inbound to the platform
| Source | Destination | Port | Protocol | Purpose |
|---|---|---|---|---|
| Operator workstations | Reverse proxy | 443 | HTTPS | Console, API and telemetry dashboards |
| Operator workstations | Reverse proxy | 80 | HTTP | Redirect to 443 only. Carries no application traffic. |
| Target hosts running agents | Reverse proxy | 443 | HTTPS | Result submission over HTTPS |
| Target hosts running agents | Broker | 5672 | AMQP | Result submission over the message broker |
| Browsers | Reverse proxy | 443 | HTTPS | Sign-in and single sign-on redirect |
The broker port is the one genuinely new inbound exposure. Agents publish results to it directly, so it is published by default. On a deployment that deploys no agents — cloud-only discovery, or off-grid only — bind it to loopback instead and close the rule.
Platform-internal
These flows stay inside the platform segment. On a single-node deployment they never leave the host.
| Source | Destination | Port | Protocol |
|---|---|---|---|
| Reverse proxy | Backend API | 5000 | HTTPS |
| Reverse proxy | Collector | 5001 | HTTPS |
| Reverse proxy | Console | 3000 | HTTP |
| Reverse proxy | AI service | 8501 | HTTPS |
| Reverse proxy | Telemetry dashboards | 3000 | HTTP |
| Reverse proxy | Identity provider | 8443 | HTTPS |
| Reverse proxy | Broker management portal | 15672 | HTTP |
| Backend, collector, AI service | Database | 27017 | MongoDB wire protocol |
| Backend, AI service | Identity provider | 8443 | HTTPS |
| Collector worker | Broker | 5672 | AMQP |
| Discovery server | Collector, backend | 5001 / 5000 | HTTPS |
| All services | Telemetry collector | 4317 / 4318 | gRPC / HTTP |
| Telemetry collector | Log store | 3100 | HTTP |
| Telemetry dashboards | Log store | 3100 | HTTP |
Outbound — discovery targets
Open only the rows for the sensors you deploy.
Agent delivery
| Destination | Port | Protocol | Needed for |
|---|---|---|---|
| Linux and Unix targets | 22 | SSH / SFTP | Agent delivery and execution |
| Windows targets | 5985 | WinRM over HTTP | Agent delivery and execution |
| Windows targets | 5986 | WinRM over HTTPS | Agent delivery and execution |
| Windows targets | 445 | SMB | File transfer, where used |
Deploying through an endpoint agent platform instead removes all four: delivery then travels over that platform's own channel on 443.
Cloud and hosted services
| Destination | Port | Protocol | Needed for |
|---|---|---|---|
| AWS control plane | 443 | HTTPS | AWS KMS, ACM, IAM, CloudHSM |
| Azure control plane | 443 | HTTPS | Key Vault, Managed HSM, resource certificates |
| Google Cloud control plane | 443 | HTTPS | Cloud KMS, Cloud HSM |
| Oracle Cloud control plane | 443 | HTTPS | OCI Vault |
| IBM Cloud control plane | 443 | HTTPS | Hyper Protect Crypto Services |
| CrowdStrike Falcon cloud | 443 | HTTPS | Host synchronisation and agent delivery |
| Microsoft Entra ID | 443 | HTTPS | Federated sign-in |
| Git hosting | 443 / 22 | HTTPS / SSH | Source-code discovery |
| Model provider API | 443 | HTTPS | AI service, hosted-provider mode only |
Hardware security modules
| Destination | Port | Protocol | Needed for |
|---|---|---|---|
| Thales Luna Network HSM | 1792 | NTLS | PKCS#11 discovery |
| Entrust nShield | 9004 | nShield protocol | PKCS#11 discovery |
| Utimaco SecurityServer | 288 | Utimaco protocol | PKCS#11 discovery |
| Key managers speaking KMIP | 5696 | KMIP over TLS | KMIP discovery |
Locally attached HSMs and tokens — SoftHSM, smart cards, USB tokens — need no network rule; the sensor reaches them through the vendor library on the scanning host.
Databases
| Destination | Port | Protocol | Needed for |
|---|---|---|---|
| Oracle Database | 1521 | TNS | TDE key discovery |
| Microsoft SQL Server | 1433 | TDS | TDE key discovery |
| MySQL and MariaDB | 3306 | MySQL protocol | TDE key discovery |
Directories, CAs and secret managers
| Destination | Port | Protocol | Needed for |
|---|---|---|---|
| LDAP directories | 389 | LDAP | Directory discovery |
| LDAP directories | 636 | LDAPS | Directory discovery over TLS |
| Active Directory | 389 / 636 / 3268 / 3269 | LDAP / LDAPS / Global Catalog | Active Directory discovery |
| Active Directory Certificate Services | 135 plus the dynamic RPC range | RPC | Certificate authority discovery |
| HashiCorp Vault | 8200 | HTTPS | Secret-manager discovery |
| Certificate authorities and lifecycle platforms | 443 | HTTPS | Venafi, Keyfactor, EJBCA, CertSecure and similar |
Network endpoint scanning
| Destination | Port | Protocol | Needed for |
|---|---|---|---|
| TLS endpoints in scope | 443 and any operator-specified port | TLS | Endpoint protocol and cipher-suite discovery |
| SSH endpoints in scope | 22 and any operator-specified port | SSH | SSH algorithm discovery |
Endpoint scanning is the one discovery mode whose destination list is defined entirely by the operator's target list, so size the rule from that list rather than from this table.
Network characteristics
| Property | Requirement |
|---|---|
| Inter-node latency | 1 ms or less within a deployment tier. Database traffic must not cross a WAN link. |
| Ingestion bandwidth | At least 10 Mbps per 1,000 concurrently scanning hosts. |
| DNS | Forward and reverse resolution must agree for every platform node name and for the public service name. |
| Proxy read timeout | At least 600 seconds on API routes, so that long-running operations are not cut off. |
| Request body limit | Raised on the ingestion path; result batches are large. |
Behind an additional load balancer or WAF
Where the platform sits behind another proxy, that proxy must pass the X-Forwarded-* headers through, and the identity provider must be configured to trust them. Without this the sign-in redirect and the token issuer are generated from the internal address, so sign-in fails with an error that names neither cause.
Egress proxy
Every outbound HTTPS destination in this page can be routed through an egress proxy by configuration. Cloud provider SDKs, the model provider client and the source-code fetchers all honour the standard proxy environment variables.
Flows that cannot traverse an HTTP proxy — SSH, WinRM, SMB, database wire protocols, KMIP, and the HSM protocols — need a direct route or a network-layer relay.
Verifying the rules
Before the first discovery run, confirm each opened flow from the host that will use it rather than from a workstation:
# Platform host to a Linux target
nc -zv target.example.com 22
# Platform host to a Windows target
nc -zv target.example.com 5985
# Platform host to a KMIP key manager
openssl s_client -connect kms.example.com:5696 -brief
# Platform host to a cloud control plane
curl -sS -o /dev/null -w '%{http_code}\n' https://kms.us-east-1.amazonaws.com/
# From a target host back to the platform — the direction most often missed
nc -zv cbom.example.com 443
nc -zv cbom.example.com 5672Test the return path from a target host, not only the outbound path from the platform. A deployment can reach a target, deliver the agent and run a scan successfully while the results never arrive, because nothing opened the route back. The deployment reports success; the inventory stays empty.