Views:
The File Security Virtual Appliance runs on a Service Gateway instance. To allow scan clients to reach the appliance, and to allow the appliance to reach the file servers it scans, configure the following rules in the security group or firewall that protects the instance.
Note
Note
These rules control traffic between the appliance and your own network. For the external TrendAI Vision One™ destinations the appliance must reach, see File Security Virtual Appliance firewall exceptions.

Inbound rules on the Service Gateway instance

Type
Protocol
Port
Source
Reason
SSH
TCP
22
CIDR that can reach the instance
CLISH command access
HTTPS
TCP
443
CIDR that can reach the instance
SDK scan queries
Custom TCP
TCP
31344
ICAP client IP addresses
ICAP virus-scanning endpoint (NodePort). For more information, see Virtual Appliance support for ICAP scan.

Outbound rules from the Service Gateway instance

The Service Gateway instance requires outbound access to the SMB or NFS file servers that host the mount points you want to scan.

SMB mount point scanning

Protocol
Port
Destination
Reason
TCP/UDP
139
SMB server IP address
NetBIOS Session Service
TCP/UDP
445
SMB server IP address
SMB file share access

NFS mount point scanning

Protocol
Port
Destination
Reason
TCP/UDP
111
NFS server IP address
rpcbind
TCP/UDP
2049
NFS server IP address
NFS service
TCP/UDP
20048
NFS server IP address
mountd

Inbound rules on the file server

Configure matching inbound rules on the file servers so that the Virtual Appliance can mount the shares.
Server type
Protocol
Port
Source
Reason
SMB server
TCP/UDP
139, 445
Service Gateway instance IP address
Allows the Virtual Appliance to mount SMB shares
NFS server
TCP/UDP
111, 2049, 20048
Service Gateway instance IP address
Allows the Virtual Appliance to mount NFS shares (rpcbind, NFS, and mountd)
Note
Note
On the NFS server, you must also enable the nfs, mountd, and rpc-bind firewall services.