WIXLIB

Connectivity and Firewall Port Requirementsfor Microsoft Dynamics CRM 2013Microsoft CorporationPublished: September 2013 Updated: October 2013AbstractThis document is designed to provide guidance on the connectivity requirements betweenMicrosoft Dynamics CRM 2013 and other systems to assist readers with proper firewallconfiguration in customer environments.

This document is provided "as-is". Information and views expressed in this document, includingURL and other Internet Web site references, may change without notice. You bear the risk ofusing it.Some examples depicted herein are provided for illustration only and are fictitious. No realassociation or connection is intended or should be inferred.This document does not provide you with any legal rights to any intellectual property in anyMicrosoft product. You may copy and use this document for your internal, reference purposes. 2013 Microsoft Corporation. All rights reserved.Microsoft, Active Directory, Excel, Hyper-V, Internet Explorer, Microsoft Dynamics, MicrosoftDynamics logo, MSDN, Outlook, Notepad, SharePoint, Silverlight, Visual C , Windows,Windows Azure, Windows Live, Windows PowerShell, Windows Server, and Windows Vista aretrademarks of the Microsoft group of companies.All other trademarks are property of their respective owners.

ContentsConnectivity and Firewall Port Requirements for Microsoft Dynamics CRM 2013 . 4Applies To . 4On-premises with Integrated Windows Authentication . 5On-premises with claims-based authentication . 6Default CRM connectivity requirements . 7Port recommendations . 9Network ports for the Microsoft Dynamics CRM web application . 9Network ports for the Asynchronous Service, Web Application Server, and SandboxProcessing Service server roles . 10Network ports for CRM Reporting Extensions . 10Connectivity requirements for Windows services . 13Connectivity requirements for Integrated Windows Authentication . 13Mail Server connectivity requirements . 14Appendix A: Additional resources . 16Appendix B: Accessibility for Microsoft Dynamics CRM . 16Feedback . 17

Connectivity and Firewall Port Requirementsfor Microsoft Dynamics CRM 2013Contributors: Venkat Sathyamurthy; Murali Vadakke Puthanveetil, Mahesh Hariharan, PeterSimonsPublished: September 2013 Updated: October 2013This document is designed to provide guidance on the connectivity requirements betweenMicrosoft Dynamics CRM 2013 and other systems to assist readers with proper firewallconfiguration in customer environments.Applies To Microsoft Dynamics CRM 2013In this white paper Introduction On-premises with Integrated Windows Authentication On-premises with claims-based authentication Default CRM connectivity requirements Port recommendations Connectivity requirements for Windows services Connectivity requirements for Integrated Windows Authentication Mail Server connectivity requirements Appendix A: Additional resources Appendix B: Accessibility for Microsoft Dynamics CRM FeedbackMany data centers include firewalls between the end users and the servers and other integratedsystems that support an implementation of Microsoft Dynamics CRM 2013. This document isdesigned to provide guidance on the connectivity requirements between Microsoft DynamicsCRM 2013 and other systems to assist readers with proper firewall configuration in customerenvironments.DownloadThis paper can be downloaded from the Microsoft Download Center: Connectivity and FirewallPort Requirements for Microsoft Dynamics CRM 20134

On-premises with Integrated WindowsAuthenticationAn overview of an on-premises implementation that uses Integrated Windows Authentication(IWA) is shown in the following diagram.In this scenario the user must have a certain level of connectivity to the CRM Server(s), theActive Directory Server(s) and the SQL Server for SQL Filtered View access (if Export to Excelfunctionality is required). The remainder of this document focuses primarily on this scenario anddetails the required level of connectivity between these various components as well as furtheroptions for integration, Citrix implication, and so on.5

On-premises with claims-based authenticationAn overview of an on-premises implementation that uses claims-based authentication usingActive Directory Federation Service (ADFS) as the Security Token Service (STS) is shown in thefollowing diagram.With claims-based authentication, the Microsoft Dynamics CRM site is accessed anonymouslyand is then redirected to ADFS. Users enter their credentials, which are validated by ADFS bycontacting Active Directory Directory Services (AD-DS) or alternative Identity Provider. Finally,AFDS issues a SAML token containing the necessary claims for accessing Microsoft DynamicsCRM.6

Default CRM connectivity requirementsAn overview of the default connectivity requirements for an on-premises deployment of MicrosoftDynamics CRM 2013 is shown in the following diagram.ImportantBecause this diagram is focused on Microsoft Dynamics CRM connectivity requirements,full details about the specific port requirements for Microsoft Exchange Server and theMicrosoft Windows Active Directory service are not shown. Additional information andlinks to related articles about these technologies and their specific requirements areprovided in the following sections of this document.7

The default connectivity requirements for components of an on-premises deployment of MicrosoftDynamics CRM 2013 are shown in the following table.ComponentDefault connectivity requirementsALL AD Connectivity RDP Connection from Administrator Users DNS name resolution (where applicable) on UDP/TCP: 53 NetBIOS name resolution (where applicable) on TCP: 139, UDP:137/138 NTP: Required on all Servers to Sync Network Time. UDP: 123 –this is a requirement for Kerberos Authentication DCOM and RPC: Required on all Servers. TCP 135, UDP 1025 AD Connectivity RDP Connection from Administrator Users DNS name resolution (where applicable) on UDP/TCP: 53 NetBIOS name resolution (where applicable) on TCP: 139, UDP:137/138 NTP: Required on all Servers to Sync Network Time. UDP: 123 –this is a requirement for Kerberos Authentication DCOM and RPC: Required on all Servers. TCP 135, UDP 1025 Connectivity to Exchange or other email services for server-sideemail integration Connectivity from CRM Front End Servers SQL Server access Remote PowerShell access from Administrator users’ clientcomputers Access to all CRM Servers / network load balancer SQL Server access Exchange Server Connectivity (EWS / SMTP / POP3) Other Mail Server Connectivity (POP3/SMTP) Optional Connectivity to a Microsoft Dynamics CRM Sink Mailbox HTTP / HTTPS access to CRM Servers / Network Load Balancer Connectivity to CRM Front End Server SDK listener to run FetchXML Connectivity from CRM Front End Server to execute, publish, anddelete reports. SQL Server accessCRM Front EndServersCRM Back EndServersCRM DeploymentServersExchange RouterSSRS Servers8

ComponentDefault connectivity requirementsClient Outlook Connectivity to Exchange HTTP / HTTPS access to CRM Servers / Network Load Balancer Optional access to SQL Server for direct access to SQL Views** It is recommended that the solution be designed to work using the FetchXML access (via theWeb services) rather than by granting users access to SQL Views directly. Using this approachsimplifies any future migration to CRM Online, with which SQL access is not available.ImportantIn each case, the port numbers can be configured to run under alternative (non-default)values, so environments will vary.Port recommendationsNetwork ports for the Microsoft Dynamics CRM web applicationThe following table lists the ports used for a server that is running a Full Server installation ofMicrosoft Dynamics CRM. Moreover, except for the Microsoft SQL Server role and the MicrosoftDynamics CRM Connector for SQL Server Reporting Services server role, all server roles areinstalled on the same TPDefault web application port; may be different as it canbe changed during Microsoft Dynamics CRM setup. Fornew websites, the default port number is 5555.TCP135MSRPCRPC endpoint resolutionTCP139NETBIOS-SSNNETBIOS session serviceTCP443HTTPSDefault secure HTTP port. The port number may differfrom the default port. This secure network transportmust be manually configured. Though this port is notrequired to run Microsoft Dynamics CRM, it is stronglyrecommend that it be used. For information about howto configure HTTPS for Microsoft Dynamics CRM, in theInstalling Guide, in topic Microsoft Dynamics CRM 2013Post-Installation and Configuration Guidelines, see thesection Make Microsoft Dynamics CRM client-toserver network communications more secure.TCP808crmsdklistenerCRM SDK ListenerTCP445Microsoft-DSActive Directory directory service required for ActiveDirectory access and authentication.9

ProtocolPortDescriptionExplanationUDP123NTPNetwork Time ProtocolUDP137NETBIOS-NSNETBIOS name serviceUDP138NETBIOS-dgmNETBIOS datagram serviceUDP445Microsoft-DSActive Directory directory service required for ActiveDirectory access and authenticationUDP1025BlackjackDCOM, used as an RPC listenerImportantDepending on the domain trust configuration, additional network ports may be requiredfor Microsoft Dynamics CRM to work correctly. For more detail, see Knowledge Basearticle ID 179442, How to configure a firewall for domains and trusts.Network ports for the Asynchronous Service, Web ApplicationServer, and Sandbox Processing Service server rolesThe following table lists the additional port that is used for a deployment in which the SandboxProcessing Service is running on a separate RM serverrolecommunicationThe Asynchronous Service and Web Application Serverservices communicate to the Sandbox Processing Servicethrough this channel. The default port is 808, but can bechanged in the Windows registry by adding the DWORDregistry value TcpPort in the keyHKEY LOCAL MACHINE\SOFTWARE\Microsoft\MSCRM\.Network ports for CRM Reporting ExtensionsThe following table lists the additional port that is required for CRM Reporting Extensionsconnectivity.Protocol PortDescriptionExplanationTCPUse for Fetchbased reportsThe CRM Reporting Extensions that are running Fetchbased reports communicate over this port whencommunicating with the computer that is running theFront End Server Role using the crmsdklistener to querythe CRM database over FetchXML.80810

The following diagram shows the connectivity for CRM Reporting Extensions.Report Execution ProcessThe following steps are involved in the report execution process.1. Client connects and authenticates (as the user using AD or ADFS/Cookie) with CRM FrontEnder Server over HTTP/HTTPS.2. Client hits a page in CRM that includes the report viewer control to view a report.3. The reporting control in CRM makes a requests to SSRS (Sandboxed), connecting using theCRM Service Account (i.e. not the user) but passing the user context over HTTP/HTTPS.4a. SSRS uses the Dynamic CRM SQL Reporting Extension to query the data via the CRMsecurity views (for SQL queries) on the standard SQL Port (default TCP:1433), obtains datasetfor report.4b. SSRS uses the Dynamics CRM Fetch Reporting Extensions to connect to thecrmsdklistener on the Front End CRM Server to run the FetchXML (TCP:808).5. SQL returns the data (for SQL reports) on open SQL connection (no new connection).6. The front end CRM server (web server role) executes FetchXML for report against SQLDatabase over SQL port (default 1433), and obtains dataset for report.7. The crmsdklistener returns FetchXML data on open TCP connection (no new connection).Report Publishing and Deletion3. Report publishing and deletion also uses the 2005 web service endpoint available on theSSRS report server.11