Configuring the Firewall

Updated: June 6, 2006

Applies To: Windows Compute Cluster Server 2003

Configuring Windows Firewall on a cluster

As part of Compute Cluster Pack head node setup, you have the option to enable or disable Windows Firewall on the head node.

Your choices are:

  • Enable Windows Firewall

    Selecting this option will enable Windows Firewall on the public interface of the head node and on any public network interfaces that exist on the compute nodes (as in network topology scenarios 2, 4, and 5). If your cluster has private or MPI networks, the firewall is disabled by default on those interfaces.

  • Disable Windows Firewall

    Selecting this option will disable Windows Firewall on all head node network interfaces.

ImportantImportant
If the head node is a domain controller, you must disable Windows Firewall.

To configure Windows Firewall on a compute cluster

  1. On the Networking tile of the To Do List, click Manage Windows Firewall Settings (wizard).

  2. On the Before You Begin page of the wizard, note the purpose of this wizard. Click Next to continue or Cancel to close the wizard.

  3. On the Configure Firewall page, select one of the following:

    1. Select Enable Windows Firewall to enable the firewall on all public network interfaces on the cluster head node and compute nodes.

    2. Select Disable Windows Firewall to disable the firewall on all interfaces.

  4. Click Next.

Windows Firewall settings on the head node are applied to compute nodes at the following times:

  • When the node is discovered and configured during setup.

  • Every 12 hours, the default refresh period for the SDM data store.

  • Whenever the cluster administrator runs the Manage Firewall Wizard and modifies, enables, or disables Windows Firewall.

For information about Windows Firewall, see Microsoft Networking Resources.

Port exemptions

Certain ports are placed on the firewall exempt listing, depending on the cluster network topology chosen.

Head Node Exemption List in Topology Scenarios 1, 2, 3, and 4

Traffic to Head Node Port

Job Scheduler

TCP 5969

SDM (data store)

TCP 9892

Management Service

TCP 6729

File and Print Services

Predefined service

Remote Administration

Enabled

Remote Desktop Service

Predefined service

Head Node Exemption List in Topology Scenario 5

Traffic to Head Node Port

Job Scheduler

TCP 5969

SDM

TCP 9892

Management Service

TCP 6729

File and Print Services

Predefined service

Remote Administration

Enabled

Remote Desktop Service

Predefined service

Scheduler port for Node Management Service

TCP 5970

Compute Node Exemption List in Topology Scenarios 1, 2, 3, and 4

Traffic to Compute Node Port

Management Service

TCP 6729

Remote Administration

Enabled

Remote Desktop Service

Predefined service

Compute Node Exemption List in Topology Scenario 5

Traffic to Compute Node Port

Management Service

TCP 6729

Remote Administration

Enabled

Remote Desktop Service

Predefined service

Scheduler port for Node Management Service

TCP 5970

Node Manager

1856

SMPD.EXE

Application Exemption

ImportantImportant
When you use Automated installation to install and configure a compute node, Windows Firewall is enabled on that compute node as part of the unattended RIS installation. When Compute Cluster Pack is installed (normally a very brief interval) the firewall is enabled and configured or disabled according to the Windows Firewall settings on the head node.

Community Additions

ADD
Show: