How to set up the firewall for the local TACACS+ instance to connect to Portnox Cloud
In this topic, you will learn how to configure your firewall to make sure that the local TACACS+ instance can communicate with the cloud TACACS+ instances.
You need to open the following ports on your firewall:
| FQDN | Protocol | Ports | Direction |
|---|---|---|---|
| tm-tacacs-aahandler-prod.portnox.com | TCP | 443 | Outbound |
| tacacs-aahandler-aks-clear-prod-eus.portnox.com | TCP | 443 | Outbound |
| tacacs-aahandler-aks-clear-prod-weu.portnox.com | TCP | 443 | Outbound |
| tm-tacacs-prod.portnox.com | TCP | 443 | Outbound |
| tacacs-aks-clear-prod-eus.portnox.com | TCP | 443 | Outbound |
| tacacs-aks-clear-prod-weu.portnox.com | TCP | 443 | Outbound |
| tacacs-prod-eastus.servicebus.windows.net | TCP | 443 | Outbound |
| tacacs-prod-westeu.servicebus.windows.net | TCP | 443 | Outbound |
| tacacsprodus.blob.core.windows.net | TCP | 443 | Outbound |
| logs-consolidation-prod-eastus.servicebus.windows.net | TCP | 443 | Outbound |
| logs-consolidation-prod-westeu.servicebus.windows.net | TCP | 443 | Outbound |
Warning: Since Microsoft services can change their public IP addresses (as has happened in the past), we
recommend avoiding the use of static IP addresses. Instead, use fully qualified domain names (FQDNs) as listed above.
If your firewall software does not support FQDNs or encounters issues, such as failing to recognize some IP addresses resolved from the FQDNs, you can use this official Azure script to retrieve the IP addresses associated with an Azure FQDN. You can then add all these IP addresses to the firewall instead of the FQDNs. However, be sure to regularly monitor connectivity and check for any updates, as Microsoft may add or remove IP addresses over time.