Required Ports for Cayosoft Guardian

Cayosoft Guardian service separated by a firewall from Active Directory

When the Cayosoft Guardian Service and Active Directory resources are separated by a firewall, the following ports must be opened:

NOTE: Each managed domain controller must be reachable on at least one of the LDAP port pairs — 389/3268 or 636/3269. If both pairs are blocked, Cayosoft Guardian cannot manage the DC. In default mode (useLdaps = false), Cayosoft Guardian tries 389 first and silently falls back to 636. In explicit LDAPS mode (useLdaps = true), only 636/3269 are used and no fallback occurs.

Cayosoft Guardian web portal

The following ports must be open to access the Cayosoft Guardian web portal:

Cayosoft Guardian AD connector

The following ports must be open to access the Cayosoft Guardian AD connector:

Cayosoft Guardian Forest Recovery Agent

The following ports must be open to access Forest Recovery Agent of Cayosoft Guardian:

Microsoft Office 365 Verification/Authentication

For detailed information about Microsoft Office 365 ports and addresses, see Office 365 URLs and IP address ranges article.

Azure SQL Database

For consistent connectivity to SQL Database or dedicated SQL pools in Azure Synapse, allow network traffic to and from ALL Gateway IP addresses and Gateway IP address subnets for the region. Periodically, Microsoft retires Gateways using old hardware and migrates the traffic to new Gateways following the process outlined in Azure SQL Database traffic migration to newer Gateways.

Find the list of Gateway IP addresses and Gateway IP address subnets in Gateway IP addresses.

Ports and endpoints required for Cayosoft cloud services

If Cayosoft Guardian uses online licensing or automatic product updates, allow outbound HTTPS traffic to the required Cayosoft cloud service endpoints.

Diagrams

Ports used by Cayosoft Guardian

1. Cayosoft Guardian connects to a single domain controller to collect changes from a managed AD domain.
2. Cayosoft Guardian connects to all domain controllers to collect additional data from a managed AD domain.
3. Cayosoft Guardian connects to select an agent on domain controller to create backup or connects to a machine in a recovery site to recover this machine as a domain controller.
4. Forest Recovery agent connects to all DCs in the environment using WinRM to collect information about every DC.
5. Microsoft 365 URLs and IP address ranges: Microsoft 365 URLs and IP address ranges.
6. Azure IP Ranges and Service Tags - Public Cloud: Azure IP Ranges and Service Tags – Public Cloud.

Ports used by AD connector

1. Cayosoft AD connector collects changes from preferred domain controller from a managed AD domain.
2. Cayosoft AD connector collects events from any domain controller from a managed AD domain.
3. Cayosoft AD connector tasks and collected data are delivered to Cayosoft Guardian Server.
4. Microsoft 365 URLs and IP address ranges: Microsoft 365 URLs and IP address ranges.
5. Azure IP ranges and service tags - Public Cloud: Azure IP Ranges and Service Tags – Public Cloud.
6. AWS IP address and port requirements - IP address and port requirements