Firewall settings for Microsoft Dynamics AX components

Firewall settings for Microsoft Dynamics AX components

Applies To: Microsoft Dynamics AX 2012 R3, Microsoft Dynamics AX 2012 R2, Microsoft Dynamics AX 2012 Feature Pack, Microsoft Dynamics AX 2012

If you use Windows Firewall to help protect your computers, Microsoft Dynamics AX components require the settings in the following table. For more information about Windows Firewall, see the Windows documentation.

Firewall settings for Microsoft Dynamics AX components

Component	Computer	Firewall setting	Notes
Setup	Any	Allow outbound HTTP connections.	To access the documentation that is available from the Setup wizard, you must be able to connect to the Internet from the computer where you are running Setup.
Databases	Database server	Exclude the port that is used by Microsoft SQL Server. By default, SQL Server uses port 1433.	For more information, see the SQL Server documentation.
Application Object Server (AOS)	AOS server	Exclude the TCP/IP port that is used by the AOS instance. By default, AOS uses port 2712. Setup automatically creates the inbound rule "Dynamics AX 6.0 –MicrosoftDynamicsAX (RPC)" for the TCP/IP port. Exclude the services WSDL port that is used by the AOS instance. By default, AOS uses port 8101. Setup automatically creates the inbound rule "Dynamics AX 6.0 –MicrosoftDynamicsAX (WSDL)" for the WSDL port. Exclude the services endpoint port that is used by the AOS instance. By default, AOS uses port 8201. Setup automatically creates the inbound rule "Dynamics AX 6.0 –MicrosoftDynamicsAX (NetTCP)" for the services endpoint port.	Windows Firewall must be enabled on the computer. Each AOS instance must use a different port number. Note By default, every time that you install an additional AOS instance on a computer, the TCP/IP port number and the services endpoint port numbers are incremented by 1. For example, by default, the second AOS instance on a computer is assigned to TCP/IP port 2713.
Client	Client workstation	Exclude Ax32.exe.	The client uses a TCP port to connect to the AOS instance.
Microsoft SQL Server Reporting Services extensions	Report server	Exclude the port that is used by Reporting Services virtual directories, if Reporting Services uses a port other than port 80.	If you are installing Reporting Services extensions in a perimeter network, you may need to add a firewall policy that enables you to connect to the Microsoft Dynamics AX database. For example, if you are using Forefront Threat Management Gateway (TMG), you must add a Non-Web Server Protocol Rule. For more information, see Configuring SQL Server publishing in the Forefront TMG documentation.
Microsoft SQL Server Analysis Services integration	Analysis server	Exclude the port that is used by Analysis Services. By default, Analysis Services uses port 2383. If you are using SQL Server Browser, you must also exclude port 2382.	For more information about how to configure access to Analysis Services through Windows Firewall, see the SQL Server documentation on MSDN.
Management Reporter		Exclude the port that is used by the Management Reporter application server. By default, the application server uses port 4712.
Debugger	Developer workstation	Exclude AxDebug.exe and its target programs, such as Ax32.exe and AxServ32.exe.	The debugger uses a dynamically allocated TCP port.
Enterprise Portal for Microsoft Dynamics AX	Web server	Enable the Web Server (HTTP). Exclude the port that is used by the Enterprise Portal website, if the site uses a port other than port 80.	If you do not enable the Web Server in Windows Firewall, you can view the site only from the local server.
Help Server	Web server	Exclude the port that is used by the Help Server web site, if the site uses a port other than port 80.
Enterprise Search	Web server	Exclude the port that is used by the Search web site, if the site uses a port other than port 80.
Web services	Web server	Exclude the port that is used by the services web site, if the site uses a port other than port 80.	External programs use this port to consume the Microsoft Dynamics AX web services that are based on Internet Information Services (IIS).
Management utilities	Remotely managed computer	Enable Remote Administration.	You must enable Remote Administration on computers that are administered remotely by using Windows PowerShell. For example, enable Remote Administration on a computer if you deploy reports to that computer from another computer where Windows PowerShell is installed.
Synch Service	Head-office communications server	Exclude the port that is used by Microsoft SQL Server. By default, SQL Server uses port 1433. Exclude the port that is used by Synch Service. By default, Synch Service uses port 16750. Exclude the port that is used by Real-time Service. By default, Real-time Service uses port 1239.	For instructions, see the PCI Implementation Guide for Microsoft Dynamics AX 2012 Feature Pack.
Synch Service	Store communications server	Enable Internet Protocol security (IPsec). Exclude the port that is used by Microsoft SQL Server. By default, SQL Server uses port 1433. Exclude the port that is used by Synch Service. By default, Synch Service uses port 16750.	For more information, see the PCI Implementation Guide for Microsoft Dynamics AX 2012 Feature Pack.
Real-time Service		Exclude the port that is used by Real-time Service, if the site uses a port other than port 80.	For more information, see the PCI Implementation Guide for Microsoft Dynamics AX 2012 Feature Pack.
Async Server		Exclude the HTTPS port that is used by Async Server. Exclude the TCP port, if Async Server uses the TCP protocol.
Retail POS	Store communications server	Exclude the port that is used by Microsoft SQL Server. By default, SQL Server uses port 1433. Exclude the port that is used by Synch Service. By default, Synch Service uses port 16750.	For more information, see the PCI Implementation Guide for Microsoft Dynamics AX 2012 Feature Pack.
Retail POS	Store database server	Exclude the port that is used by Microsoft SQL Server. By default, SQL Server uses port 1433. On a register that has its own local database, you only need to open the firewall to SQL Server if Synch Service is on a computer other than the register.	For more information, see the PCI Implementation Guide for Microsoft Dynamics AX 2012 Feature Pack.
Retail Server	Retail Server	Exclude the port that is used by the Retail Server web site.
Retail Hardware Station	Retail Server	Exclude the port that is used by the Hardware Station web site.
Retail online store	Web server	Exclude the ports that are used by the Retail online store web site. For a production environment, the online store uses ports 80 and 443, by default. For a developer environment, the online store uses the following ports, by default. 40002: The online store (this is the port 80 site in production environments) 40004: The online store (this is the port 443 site in production environments with encrypted communications) 40003: The internal online store site (for changing site settings in SharePoint 40001: The internal product catalog site
Microsoft Dynamics ERP RapidStart Connector	Microsoft Dynamics ERP RapidStart Services host machine	Exclude the executable file for the Microsoft Dynamics ERP RapidStart Connector service. By default, the file is installed in this location: %SystemDrive%Program FilesMicrosoft Dynamics AX60RapidStartConnectorServiceMicrosoft.Dynamics.AX.AppConfig.ConnectorLoaderService.exe Exclude the endpoint port that is used by the Microsoft Dynamics ERP RapidStart Connector service. By default, the service communicates with the Windows Azure Service Bus on ports 9350-9354, 80, and 443. Exclude the Windows Azure Cloud Services Protocols.