The System Center Operations Manager Support Team Blog

This is the OpsMgr 2007 blog for the Microsoft support team. If you were looking for the SCOM 2007 or MOM 2005 blog then you are in the right place.

OpsMgr 2007: Port requirements for SCOM agents in a DMZ

OpsMgr 2007: Port requirements for SCOM agents in a DMZ

  • Comments 6
  • Likes

image Here's another interesting issue I came across the other day that I thought I would share with you just in case you happen to find yourself in a similar situation.  Hopefully if you do then this will help you get all this working the way it should. 

Scenario:    An RMS in a parent domain and client agents that are domain controllers in a child domain in a DMZ. 

The manual agent install goes fine on the clients but the agents never appear in the operators console despite Review New Manual agent installations in pending management View and Auto–approve New manually installed agents settings in SETTINGS—SECURITY –GENERAL.

The following event shows up on the agents:

Event Type:          Error
Event Source:       OpsMgr Connector
Event Category:    None
Event ID:              20070
Computer:            DC
Description:          The OpsMgr Connector connected to <domain>, but the connection was closed immediately after authentication occurred.  The most likely cause of this error is that the agent is not authorized to communicate with the server, or the server has not received configuration.  Check the event log on the server for the presence of 20000 events, indicating that agents which are not approved are attempting to connect.

This event shows up on the server:

Event Type:          Error
Event Source:       OpsMgr Connector
Event Category:    None
Event ID:              20002
Description:          A device at IP <addr> attempted to connect but could not be authenticated, and was rejected.

None of the agents show up in any of the following tables under Opsmgrdb:

Dbo.Mt_Computer
Dbo.Mt_healthservice
Dbo.Mt_healthservicewatcher
dbo.AgentPendingActions

The following powershell command returns nothing:

get-agentpendingaction

The product documentation does not talk much about this scenario other than having port 5723 open from the agent to the server:

http://technet.microsoft.com/da-dk/library/cc540431(en-us).aspx

Regardless, what I’ve found is that we also need to have port 88 and port 389 opened between the agent and the RMS if they’re separated by a firewall.  This has worked for me just about every time I’ve found myself in this situation.

Hope this helps,

Rohit Kaul

Comments
  • Feed: The Operations Manager Support Team Blog Posted on: Tuesday, February 17, 2009 10:38 AM Author

  • Feed: The Operations Manager Support Team Blog Here&#39;s another interesting issue I came across the

  • Feed: The Operations Manager Support Team Blog Here&#39;s another interesting issue I came across the

  • Hi,What does tcp port 88 used for?

    I have another problem about the firewall.

    the RMS and the clients are in the same domain but they were separated by the isa 2006.I have opened the protocols such as to join a computer to the domain and tcp port 5723.and now I am use an action account as a member of a domain admins,but i can't install the agents to the client because of the rpc unreachable.I try to open tcp port 135 and 1024 plus ports,but no results ,What another ports should I opened?

  • Check this one out here

    ========================

    Agent push requirements (including firewall ports):

    The account being used to push the agent must have local admin rights on the targeted agent machine.

    The following ports must be open:

    RPC endpoint mapper                              Port number: 135             Protocol: TCP/UDP

    *RPC/DCOM High ports (2000/2003 OS)    Ports 1024-5000              Protocol: TCP/UDP

    *RPC/DCOM High ports (2008 OS)            Ports 49152-65535           Protocol: TCP/UDP

    NetBIOS name service                             Port number: 137             Protocol: TCP/UDP

    NetBIOS session service                           Port number: 139             Protocol: TCP/UDP

    SMB over IP                                            Port number: 445             Protocol: TCP

    MOM Channel                                          Port number: 5723           Protocol: TCP/UDP

    The following services must be set:

    Display Name:  Netlogon                           Started                 Auto      Running

    **Display Name:  Remote Registry            Started                 Auto      Running

    Display Name:  Windows Installer              Started                 Manual   Running

    Display Name:  Automatic Updates             Started                 Auto      Running

    Extracted from :     http://blogs.technet.com/kevinholman/archive/2007/12/12/agent-discovery-and-push-troubleshooting-in-opsmgr-2007.aspx

  • In my own experience, on dmz environments, no need for those 2 ports (88 and 389); but ensure that the RMS server is able to resolve from IP to FQDN. a problem with the DNS configuration will yield event IDs 20002, and all the agents on grey state.

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment