Firewall Ports

For CommCell components to communicate across a firewall, the network TCP port numbers you select must be configured on your firewall device. In some cases, you must configure network routes for optimal throughput. For more information, see Network Topologies.

Tunnel Port: This is the inbound port number through which the CommServe server receives bidirectional tunnel connections. Port 8403 is the default for Commvault software, but it can be configured to another port number. The incoming connections port is in the Override default tunnel port box. For information about accessing the Override default tunnel port box, see Updating Incoming Ports on Client Computers.

TCP Port Types

The Commvault application can bind to TCP ports statically or dynamically.

Static Ports

Several services used by the software listen for inbound network traffic on predefined network ports. The CommServe server, MediaAgents, and agents within the CommCell group communicate with each other through these ports. Essential CommServe server services are automatically assigned registered, static port numbers during installation. MediaAgents, agents, and other software components can use the same default static port numbers or any static port numbers specified during installation.

Note:

• For the CommServe server, the CommServe cvfwd.exe process binds to port 8403, in addition to any other user-defined tunnel port. This is done so that laptop clients can create a tracking tunnel towards the Commserve server on this port when a firewall is not configured explicitly between the CommServe server and the client. The laptop clients use this tracking tunnel to inform the CommServe server about client online messages.
• For CommServe servers using the LiveSync operation for disaster recovery, the production and standby CommServe servers communicate with each other using port 8408 on the SQL client instance. A default topology, Firewall Topology created for failover clients, is created for communication between the production and standby CommServe servers using port 8408. This topology is created irrespective of the option selected for communication.
• Whenever there is a port restriction in place via network address translation (NAT) or firewall, and explicit network routes are not configured, Commvault automatically creates an on-demand tunnel to the destination client as long as the tunnel port (CVD port plus 3) is open bidirectionally between the source and destination clients. For more information, see the following:
  • Configuring Outgoing Tunnel Connections
  • Enforcing Automatic Tunneling for Network Traffic

For information on binding services to static ports, see Binding Services to Static Ports.

Dynamic Ports

Dynamic ports are opened and closed by the running Commvault software to permit certain types of transient traffic.

Free ports between 49152 and 65535 are used to communicate during data protection and data recovery jobs. After the job is finished, if no other job is pending, the dynamic ports are released.

If you have a large CommCell environment, you may need to increase the range of dynamic ports to avoid running out of dynamic ports on the CommServe server and the MediaAgent.

For Windows, use the following command to increase the range of dynamic ports:

netsh int ipversion set dynamicportrange transportprotocol start=startnumber num=totalnumber store=storevalue

Where: ipversion is the IP protocol (IPv4 or IPv6) transportprotocol is the transport protocol (TCP or UDP) startnumber is the starting port number (for example, 10000) totalnumber is the total number of ports (for example, 1000) storevalue is active (store until next boot) or persistent (store permanently)

Note:

• Dynamic port range can be used by a client for internal and external communication.
• Use of dynamic port range by Commvault services may be restricted internally by binding services to open ports. For more information, see Binding Services to Open Ports.
• You can configure network routes if the use of dynamic ports for external communication is restricted by firewall. For more information, see Network Routes.

SQL Server Ports

The default instance of a SQL server listens for inbound network traffic using static ports (1433 and 1434). But named instances, such as those used by this software, are configured by default to listen for inbound network traffic using dynamic ports. If a SQL Server instance is configured to listen for network traffic using dynamic ports, the instance will obtain an available port from the operating system and create an endpoint for that port. Inbound connections must then request that port number in order to connect to the software.

You have the option of configuring named instances to use static ports. For instructions, see Microsoft's TechNet article, Configure a Server to Listen on a Specific TCP Port (SQL Server Configuration Manager). If you do configure static ports for SQL Server, be sure to configure your firewall to allow TCP on port 1433 and UDP on port 1434.

Since a dynamic port number can change each time SQL Server launches, the SQL Server software provides the SQL Server Browser Service to monitor ports and direct inbound network traffic to the current port used by the default instance. This capability ensures that all port traffic between the SQL Server and the software can be traced at any given time, which is especially useful in network troubleshooting scenarios.

Note: Changing this behavior manually may require additional configuration changes to the data source name (DSN) settings installed by the software. Therefore, we recommended that this behavior not be changed unless absolutely necessary.

Multi-Instancing

Multi-instancing requires that each instance of the same agent (for example, the SQL Server Agent) or MediaAgent have a unique set of static TCP port numbers assigned. For more information, see Considerations for Installing Multi-Instances.

Clusters

For a given cluster server, the MediaAgent, agent, or other software component installed on every physical node in a cluster that is configured to host that cluster server must have the same port numbers configured. For example, if you have a cluster server named VS1, and three physical computers configured to host VS1, all three computers must have the same Network TCP port numbers configured for the network interface used by VS1.

Consider the following example:

Node A is configured to host cluster server VS1. Instance001 has the Informix Agent installed to protect Informix data on VS1. During install, Port 8502 was specified for the Communications Service (CVD).

Node B is also configured to host VS1. Instance003 has the Informix Agent installed to protect Informix data on VS1. During the Agent install, Port 8502 must be specified for the Communications Service (CVD) to match the Network TCP port number configuration of Node A.

Considerations

When specifying network TCP port numbers, it is essential to choose network TCP ports that are unassigned and unused. Commvault requires the ability to bind to the same ports across when the operating system or applications are restarted, and these ports must not be in use by other resources. All effort should be made to ensure that no other resource expects to use the specified ports, as a port conflict will cause an application failure.

When specifying a network TCP port number other than 8400 for a MediaAgent's Communications Service (GxCVD), which may be necessary when more than one instance of the MediaAgent is installed on a computer, note that clients with an earlier release may not be able to communicate through that port. Therefore, when specifying a non-default port number in such cases, you should ensure that all clients using the MediaAgent support the multi instancing feature and non-default network TCP port numbers.

If you need to change the network port numbers of a client or MediaAgent, see Changing Network Ports.