Firewall settings for Microsoft Dynamics AX components

  • Article

Important

This content is archived and is not being updated. For the latest documentation, see Microsoft Dynamics 365 product documentation. For the latest release plans, see Dynamics 365 and Microsoft Power Platform release plans.

Applies To: Microsoft Dynamics AX 2012 R3, Microsoft Dynamics AX 2012 R2, Microsoft Dynamics AX 2012 Feature Pack, Microsoft Dynamics AX 2012

If you use Windows Firewall to help protect your computers, Microsoft Dynamics AX components require the settings in the following table. For more information about Windows Firewall, see the Windows documentation.

Component

Computer

Firewall setting

Notes

Setup

Any

Allow outbound HTTP connections.

To access the documentation that is available from the Setup wizard, you must be able to connect to the Internet from the computer where you are running Setup.

Databases

Database server

Exclude the port that is used by Microsoft SQL Server. By default, SQL Server uses port 1433.

For more information, see the SQL Server documentation.

Application Object Server (AOS)

AOS server

  • Exclude the TCP/IP port that is used by the AOS instance. By default, AOS uses port 2712.

    Setup automatically creates the inbound rule "Dynamics AX 6.0 –MicrosoftDynamicsAX (RPC)" for the TCP/IP port.

  • Exclude the services WSDL port that is used by the AOS instance. By default, AOS uses port 8101.

    Setup automatically creates the inbound rule "Dynamics AX 6.0 –MicrosoftDynamicsAX (WSDL)" for the WSDL port.

  • Exclude the services endpoint port that is used by the AOS instance. By default, AOS uses port 8201.

    Setup automatically creates the inbound rule "Dynamics AX 6.0 –MicrosoftDynamicsAX (NetTCP)" for the services endpoint port.

Windows Firewall must be enabled on the computer. Each AOS instance must use a different port number.

Note

By default, every time that you install an additional AOS instance on a computer, the TCP/IP port number and the services endpoint port numbers are incremented by 1. For example, by default, the second AOS instance on a computer is assigned to TCP/IP port 2713.

Client

Client workstation

Exclude Ax32.exe.

The client uses a TCP port to connect to the AOS instance.

Microsoft SQL Server Reporting Services extensions

Report server

Exclude the port that is used by Reporting Services virtual directories, if Reporting Services uses a port other than port 80.

If you are installing Reporting Services extensions in a perimeter network, you may need to add a firewall policy that enables you to connect to the Microsoft Dynamics AX database. For example, if you are using Forefront Threat Management Gateway (TMG), you must add a Non-Web Server Protocol Rule. For more information, see Configuring SQL Server publishing in the Forefront TMG documentation.

Microsoft SQL Server Analysis Services integration

Analysis server

  • Exclude the port that is used by Analysis Services. By default, Analysis Services uses port 2383.

  • If you are using SQL Server Browser, you must also exclude port 2382.

For more information about how to configure access to Analysis Services through Windows Firewall, see the SQL Server documentation on MSDN.

Management Reporter

Exclude the port that is used by the Management Reporter application server. By default, the application server uses port 4712.

Debugger

Developer workstation

Exclude AxDebug.exe and its target programs, such as Ax32.exe and AxServ32.exe.

The debugger uses a dynamically allocated TCP port.

Enterprise Portal for Microsoft Dynamics AX

Web server

  • Enable the Web Server (HTTP).

  • Exclude the port that is used by the Enterprise Portal website, if the site uses a port other than port 80.

If you do not enable the Web Server in Windows Firewall, you can view the site only from the local server.

Help Server

Web server

Exclude the port that is used by the Help Server web site, if the site uses a port other than port 80.

Enterprise Search

Web server

Exclude the port that is used by the Search web site, if the site uses a port other than port 80.

Web services

Web server

Exclude the port that is used by the services web site, if the site uses a port other than port 80.

External programs use this port to consume the Microsoft Dynamics AX web services that are based on Internet Information Services (IIS).

Management utilities

Remotely managed computer

Enable Remote Administration.

You must enable Remote Administration on computers that are administered remotely by using Windows PowerShell. For example, enable Remote Administration on a computer if you deploy reports to that computer from another computer where Windows PowerShell is installed.

Synch Service

Head-office communications server

  • Exclude the port that is used by Microsoft SQL Server. By default, SQL Server uses port 1433.

  • Exclude the port that is used by Synch Service. By default, Synch Service uses port 16750.

  • Exclude the port that is used by Real-time Service. By default, Real-time Service uses port 1239.

For instructions, see the PCI Implementation Guide for Microsoft Dynamics AX 2012 Feature Pack.

Synch Service

Store communications server

  • Enable Internet Protocol security (IPsec).

  • Exclude the port that is used by Microsoft SQL Server. By default, SQL Server uses port 1433.

  • Exclude the port that is used by Synch Service. By default, Synch Service uses port 16750.

For more information, see the PCI Implementation Guide for Microsoft Dynamics AX 2012 Feature Pack.

Real-time Service

Exclude the port that is used by Real-time Service, if the site uses a port other than port 80.

For more information, see the PCI Implementation Guide for Microsoft Dynamics AX 2012 Feature Pack.

Async Server

Exclude the HTTPS port that is used by Async Server.

Exclude the TCP port, if Async Server uses the TCP protocol.

Retail POS

Store communications server

Exclude the port that is used by Microsoft SQL Server. By default, SQL Server uses port 1433.

Exclude the port that is used by Synch Service. By default, Synch Service uses port 16750.

For more information, see the PCI Implementation Guide for Microsoft Dynamics AX 2012 Feature Pack.

Retail POS

Store database server

Exclude the port that is used by Microsoft SQL Server. By default, SQL Server uses port 1433.

On a register that has its own local database, you only need to open the firewall to SQL Server if Synch Service is on a computer other than the register.

For more information, see the PCI Implementation Guide for Microsoft Dynamics AX 2012 Feature Pack.

Retail Server

Retail Server

Exclude the port that is used by the Retail Server web site.

Retail Hardware Station

Retail Server

Exclude the port that is used by the Hardware Station web site.

Retail online store

Web server

Exclude the ports that are used by the Retail online store web site. For a production environment, the online store uses ports 80 and 443, by default. For a developer environment, the online store uses the following ports, by default.

  • 40002: The online store (this is the port 80 site in production environments)

  • 40004: The online store (this is the port 443 site in production environments with encrypted communications)

  • 40003: The internal online store site (for changing site settings in SharePoint

  • 40001: The internal product catalog site

Microsoft Dynamics ERP RapidStart Connector

Microsoft Dynamics ERP RapidStart Services host machine

  • Exclude the executable file for the Microsoft Dynamics ERP RapidStart Connector service. By default, the file is installed in this location:

    %SystemDrive%\Program Files\Microsoft Dynamics AX\60\RapidStartConnectorService\Microsoft.Dynamics.AX.AppConfig.ConnectorLoaderService.exe

  • Exclude the endpoint port that is used by the Microsoft Dynamics ERP RapidStart Connector service. By default, the service communicates with the Windows Azure Service Bus on ports 9350-9354, 80, and 443.

  • Exclude the Windows Azure Cloud Services Protocols.