Deployment

Firewall Ports

View as Markdown

Firewalls, security groups, and ACLs between the device network and Config Manager must permit the traffic below for the Config Manager DHCP and ZTP services to function correctly. DHCP and HTTPS are required for every deployment; the others are conditional on how ZTP and image distribution are configured.

Protocol / PortDirectionPurpose
UDP 67Bidirectional (DHCP relay ↔ Config Manager)Relayed DHCP requests and server responses (DISCOVER / REQUEST / OFFER / ACK)
TCP 443Device → Config ManagerHTTPS download of ZTP boot scripts, rendered configs, and images
TCP 80Device → Config ManagerHTTP fallback for ZTP boot scripts, where HTTPS is not used
TCP 22Device → Config ManagerSFTP image downloads, where SFTP is used instead of HTTPS
UDP/TCP 53Device → DNS resolverDNS resolution when ZTP/DHCP targets are referenced by hostname (e.g. ztp.<hostname>, dhcp.<hostname>)