On all DeltaV nodes, the Windows Firewall is disabled on the DeltaV ACN NICs (Network Interface Cards). This must occur on the Independent Domain Controller as well.
For non-DeltaV networks, (such as the 3rd NIC on the IDDC), configure the Windows Firewall to allow only the domain authentication traffic through.
To protect the DeltaV ACN, an optional, physical Firewall-IPD is available with rules to allow only the domain authentication and time synchronization traffic through. The Emerson Firewall-IPD is used on the DeltaV ACNs (primary and secondary, where exists). It is connected between the Independent DeltaV Domain Controller (IDDC) and the rest of the DeltaV workstations.
The following table outlines the rules to configure on your firewall. These rules ALLOW communication through the firewall on the ports specified in the direction specified (where the Independent DeltaV Domain Controller is the point of reference). The Emerson Firewall-IPD comes with the rules configured. Other firewalls (including the Windows firewall) might also need the rules to be created.
| Function | Ports | Direction
(where the starting point is the DeltaV Independent Domain Controller) |
Configure on the following network: | Comment | |
|---|---|---|---|---|---|
| DeltaV ACNs | Non-ACN network | ||||
|
Domain controller to domain controller (RPC) Client to domain controller (RPC) |
UDP 135 TCP 135 |
Incoming Outgoing |
Yes |
Yes |
|
|
High Range (RCP) Ports (Ephemeral Ports) |
TCP 1024 to 65535 |
Incoming Outgoing |
Yes |
No |
|
|
Client queries to the domain controller (LDAP) |
UDP 389 TCP 389 |
Incoming Outgoing |
Yes |
Yes |
|
|
Kerberos Password Change |
TCP 464 UDP 464 |
Incoming Outgoing |
Yes |
Yes |
|
|
DNS client-to-Domain Controller |
TCP 53 UDP 53 |
Incoming Outgoing |
Yes |
Yes |
|
|
Kerberos |
TCP 88 UDP 88 |
Incoming Outgoing |
Yes |
Yes |
|
|
Kerberos V5 |
TCP 464 UDP 464 |
Incoming Outgoing |
Yes |
Yes |
|
|
User and Computer Authentication |
TCP 139 UDP 137 |
Incoming Outgoing |
Yes |
Yes |
|
|
File Replications Service Sysvol Share (SMB) |
TCP 445 UDP 445 |
Incoming Outgoing |
Yes |
No |
Necessary for group policy distribution
between the Independent DeltaV Domain Controller and the DeltaV workstations.
Important This should not be opened on the non-DeltaV NICs (connecting the Independent DeltaV Domain Controller and a non-ACN network). |
|
Global Catalog from Client to Domain Controller |
TCP 3268 UDP 3269 |
Incoming Outgoing |
Yes |
Yes |
This setting is dependent on the direction of any domain to domain trust. |
|
NTP |
UDP 123 |
Incoming Outgoing |
Yes |
No |
Important The Independent DeltaV Domain Controller listens for time broadcasts. Therefore, to remain in sync with the rest of the DeltaV nodes, the Independent DeltaV Domain Controller must only listen for time from the DeltaV Master Time node. |
|
Group Policy |
ICMP |
Incoming Outgoing |
Yes |
No |
Important This should not be opened on the non-DeltaV NICs (connecting the Independent DeltaV Domain Controller and a non-ACN network). |
|
File Replication Service between Domain Controllers - not Client |
TCP 25, 139 UDP 138 |
Incoming Outgoing |
Yes |
No |
Required for Domain Controller to Domain
Controller file replication within the DeltaV network.
Important This should not be opened on the non-DeltaV NICs (connecting the Independent DeltaV Domain Controller and a non-ACN network). |
|
Sysvol Replication between Domain Controllers |
TCP 5722 |
Yes |
No |
Required for Domain Controller to Domain
Controller Sysvol replication within the DeltaV network.
Important This should not be opened on the non-DeltaV NICs (connecting the Independent DeltaV Domain Controller and a non-ACN network). |
|
|
WINS in a Domain Trust Scenario offering NetBIOS resolution |
TCP 42 |
Incoming Outgoing |
No |
Yes |
|