Administration

• HTTPS: TCP/443

• SSH Server: TCP/22

• CoA

• External RESTful Services (ERS) REST API: TCP/9060

  he ERS and OpenAPI services are HTTPS-only REST APIs and operate over port 443. Currently, ERS APIs also operate over port 9060. This port might not be supported for ERS APIs in later Cisco ISE releases. We recommend that you only use port 443 for ERS APIs. The default conn-limit value for port 9060 is 30. If consecutive ERS API calls are returning a HTTP 502 error, we recommend that you increase the conn-limit value of port 9060 to 60 using the command conn-limit cl1 60 port 9060.

• External RESTful Services (ERS) REST API Certificate-based authentication for DNAC integration mode: TCP/9062

• To manage guest accounts from Admin GUI: TCP/9002

• ElasticSearch (Context Visibility; to replicate data from primary to secondary Admin node): TCP/9300

• Port 443 supports Admin web applications and is enabled by default.

  Access to Cisco ISE via HTTPS and SSH is restricted to Gigabit Ethernet 0.

• For SAML admin login, Port 8443 of PSN should be reachable from the device where the admin is trying to do the SAML login.

Not applicable

Monitoring

• SNMP Query: UDP/161

  This port is route table dependent.

• ICMP

Logging (Outbound)

• Syslog: UDP/20514, TCP/1468

• Secure Syslog: TCP/6514

  Default ports are configurable for external logging.

• SNMP Traps: UDP/162

External identity sources and resources (Outbound)

• Admin user interface and endpoint authentications:

  • LDAP: TCP/389, 3268, UDP/389

  • SMB: TCP/445

  • KDC: TCP/88

  • KPASS: TCP/464

• WMI : TCP/135

• ODBC:

  The ODBC ports are configurable on the third-party database server.

  • Microsoft SQL: TCP/1433

  • Sybase: TCP/2638

  • PostgreSQL: TCP/5432

  • Oracle: TCP/1521, TCPS/2484

• NTP: UDP/123 (localhost interfaces only)

• DNS: UDP/53, TCP/53

• For external identity sources and services reachable only through an interface other than Gigabit Ethernet 0, configure static routes accordingly.

• Cisco ISE sends an ICMP ping to the configured DNS server when diagnosing connectivity for an Active Directory connection.

Email

Guest account and user password expiration email notification: SMTP: TCP/25

Smart licensing

• Connection to Cisco cloud over TCP/443

• Connection to SSM on-premises server over TCP/443 and ICMP

Administration

• HTTPS uses TCP port 443

• SSH Server uses TCP port 22

Not applicable

Monitoring

• Simple Network Management Protocol (SNMP): SNMP uses UDP port 161. This port is route-table-dependent.

• ICMP

Logging

• Syslog uses UDP port 20514 and TCP port 1468

• Secure Syslog uses TCP port 6514

Default ports are configurable for external logging.

• SMTP uses TCP port 25 for email of alarms

• SNMP traps use UDP port 162

External identity sources and resources (Outbound)

• Admin user interface and endpoint authentications:

  • LDAP uses TCP ports 389 and 3268, and UDP port 389

  • SMB uses TCP port 445

  • KDC uses TCP port 88 and UDP port 88

  • KPASS uses TCP port 464

• WMI uses TCP port 135

• ODBC:

  The ODBC ports are configurable on the third-party database server.

  • Microsoft SQL uses TCP port 1433

  • Sybase uses TCP port 2638

  • PostgreSQL uses TCP port 5432

  • Oracle uses TCP ports 1521, 15723, and 16820

• NTP uses UDP port 123 (localhost interfaces only)

• DNS uses UDP port 53 and TCP port 53

For external identity sources and services reachable only through an interface other than Gigabit Ethernet 0, configure static routes accordingly.

Ports used for inbound communication

These ports are required in all types of deployments regardless of being on-premises or in the cloud.

• MnT node REST APIs: TCP 9443. This allows inbound API requests for monitoring and troubleshooting.

• Policy Administration Node (PAN) to MnT: TCP 1521. This enables communication from the PAN to MnT nodes.

• OpenAPIs: TCP 443, TCP 9070. These provide access to OpenAPI interfaces for integration.

• ERS APIs: TCP 443, TCP 9060. These ports facilitate inbound API requests through ERS interfaces.

Bulk download for pxGrid

TCP ports 9993, 2000

Log analytics (Kibana)

Open port 5701 on MnT nodes for communication with PAN nodes.

Administration

• HTTPS: TCP port 443

• SSH server: TCP port 22

• OCSP: TCP port 2560

You can manage the device only through Gigabit Ethernet 0.

Clustering (Node group)

Node groups or JGroups: TCP port 7800

Not applicable

SCEP

TCP port 9090

Not applicable

IPsec or ISAKMP

UDP port 500

Not applicable

Device Administration

TACACS+: TCP port 49

TrustSec

Use HTTP and Cisco ISE REST API to transfer TrustSec data to network devices over port 9063.

SXP

• PSN (SXP node) to NADs: TCP port 64999

• PSN to SXP (internal communication on the same Cisco ISE): TCP port 9644

TC-NAC

TCP port 443

Monitoring

Simple Network Management Protocol (SNMP): UDP port 161. This port is route table dependent.

Logging (Outbound)

• Syslog: UDP port 20514, TCP port 1468

• Secure Syslog: TCP port 6514

• SNMP traps: UDP port 162

Session

• RADIUS authentication: UDP ports 1645, 1812

• RADIUS accounting: UDP ports 1646, 1813

• RADIUS DTLS authentication and accounting: UDP ports 2083.

• RADIUS Change of Authorization (CoA) send: UDP port 1700

• RADIUS Change of Authorization (CoA) listen or relay: UDP ports 1700, 3799

You cannot configure UDP port 3799.

External identity sources and resources (Outbound)

• Admin user interface and endpoint authentications:

  • LDAP: TCP ports 389, 3268

  • SMB: TCP port 445

  • KDC: TCP port 88

  • KPASS: TCP port 464

• WMI : TCP port 135

• ODBC: The ODBC ports are configurable on the third-party database server.

  • Microsoft SQL: TCP port 1433

  • Sybase: TCP port 2638

  • PostgreSQL: TCP port 5432

  • Oracle: TCP port 1521

• NTP: UDP port 123 (localhost interfaces only)

• DNS: UDP port 53, TCP port 53

Passive ID (Inbound)

• TS agent: TCP port 9094

• AD agent: TCP port 9095

• Syslog: UDP port 40514, TCP port 11468

Web portal services:

• Guest and web authentication

• Guest sponsor portal

• My devices portal

• Client provisioning

• Certificate provisioning

• Blocked list portal

HTTPS (Interface must be enabled for service in Cisco ISE):

• Blocked list portal: TCP port 8000-8999 (default port is TCP port 8444)

• Guest portal and client provisioning: TCP port 8000-8999 (default port is TCP port 8443)

• Certificate provisioning portal: TCP port 8000-8999 (default port is TCP port 8443)

• My devices portal: TCP port 8000-8999 (default port is TCP port 8443)

• Sponsor portal: TCP portal 8000-8999 (default port is TCP portal 8445)

• SMTP guest notifications from guest and sponsor portals: TCP portal 25

Posture

• Discovery

• Provisioning

• Assessment or heartbeat

• Discovery (Client side): TCP port 8905 (HTTPS)

  Cisco ISE presents the admin certificate for Posture and client provisioning on TCP port 8905.

  Cisco ISE presents the portal certificate on TCP port 8443 (or the port that you have configured for portal use).

  From Cisco ISE release 3.1, port 8905 is disabled by default on non-PSNs. To enable this port, check the Enable Port 8905 on non-Policy Service Nodes for Posture Services check box in the General Settings window (Administration > System > Settings > Posture > General Settings).

• Discovery (Policy Service Node side): TCP port 8443, 8905 (HTTPS) . This is configurable in the latest Cisco ISE release with Cisco Secure Client release 4.4 and later.

• Assessment - Posture negotiation and agent reports: TCP port 8905 (HTTPS)

• Bidirectional posture flow - TCP port 8000-8999 (default port is TCP port 8449)

Bring Your Own Device (BYOD) or Network Service Protocol (NSP)

• Redirection

• Provisioning

• SCEP

• Provisioning - URL redirection: See web portal services: Guest portal and client provisioning

• For android devices with EST authentication: TCP port 8084. Port 8084 must be added to the redirect ACL for android devices.

• Provisioning - Active-X and Java applet install (includes the launch of wizard install): See web portal services: Guest portal and client provisioning

• Provisioning - Wizard install from Cisco ISE (Windows and Mac OS): TCP port 8443

• Provisioning - Wizard install from Google Play (Android): TCP port 443

• Provisioning - Supplicant provisioning process: TCP port 8905

• SCEP proxy to CA: TCP port 443 (Based on SCEP RA URL configuration)

Mobile Device Management (MDM) API integration

• Provisioning - URL redirection: See web portal services: Guest portal and client provisioning

• API: Vendor specific

• Agent install and device registration: Vendor specific

Profiling

• NetFlow: UDP port 9996 can be configured

• DHCP: UDP port 67 can be configured

• DHCP SPAN Probe: UDP/68

• HTTP: 8080

• DNS: UDP port 53 (lookup). This port is route table dependent.

• SNMP query: UDP port 161. This port is route table dependent.

• SNMP trap: UDP port 162 can be configured.

pxGrid subscribers

TCP port 8910

Inter-node communication

TCP port 8910