What needs to be reachable, on which port, from where. The classic firewall questions: "do I need 111 open?", "what port does SnapMirror use?", "is S3 on 443?"
Reading this table
"Inbound to ONTAP" = clients/servers connect to ONTAP's LIFs on these ports. "Outbound from ONTAP" = ONTAP initiates (AutoSupport, AD/LDAP, NTP, intercluster). Ports marked optional depend on features.
Management & automation
Port
Protocol
Used for
Direction
22/tcp
SSH
CLI access to cluster/node management LIFs
Inbound
443/tcp
HTTPS
System Manager, ONTAP REST API, BlueXP connectivity
Inbound
80/tcp
HTTP
Optional; redirects to HTTPS (management)
Inbound
111/tcp (optional)
portmapper/rpcbind
NFSv3 and some management RPCs — only if NFSv3 clients need it
Inbound
NAS protocols
Port
Protocol
Used for
Direction
2049/tcp
NFS (all versions)
NFS data traffic
Inbound
2049/udp
NFSv3
NFSv3 over UDP (rare nowadays)
Inbound (optional)
111/tcp+udp
portmapper
NFSv3 mount/rpc discovery; NFSv4 doesn't need it
Inbound (optional)
4045–4046/tcp
lockd / statd
NFSv3 locking (older clients)
Inbound (optional)
445/tcp
SMB/CIFS
SMB file sharing (also SMB over QUIC control)
Inbound
139/tcp
NetBIOS (legacy)
Legacy SMB/NetBIOS; usually not needed
Inbound (optional)
80, 443/tcp
S3 API
Object store server (HTTP/HTTPS endpoints)
Inbound
443/udp (optional)
SMB over QUIC
Secure SMB over UDP 443 (recent ONTAP, verify support)
Inbound (optional)
SAN protocols
Port
Protocol
Used for
Direction
3260/tcp
iSCSI
iSCSI data + MC/S
Inbound
4420/tcp
NVMe/TCP
NVMe over TCP (ONTAP 9.10+ platforms)
Inbound
—
FC / FCoE / NVMe/FC
Fibre Channel fabric — no IP ports; zoning via switch
—
Replication & clustering
Port
Protocol
Used for
Direction
10000/tcp
SnapMirror / cluster peer
Intercluster replication traffic (SnapMirror, SnapVault, SM-BC data path)
Both (between clusters)
10001/tcp (optional)
—
Some versions use 10001 for intercluster; confirm in your release
Both (optional)
—
Cluster interconnect
Node-to-node cluster traffic — dedicated ports/network, not routed
Internal
—
HA interconnect
NVRAM mirroring between HA partners — dedicated links
Internal
3260/tcp
MetroCluster (IP)
IP MetroCluster replication (uses iSCSI-based transport over dedicated network)
Between sites
Infrastructure services
Port
Protocol
Used for
Direction
53/tcp+udp
DNS
Name resolution (SVM config, AD, FQDN lookups)
Outbound
123/udp
NTP
Time sync (Kerberos and AD depend on it)
Outbound
88/tcp+udp
Kerberos
AD authentication (SMB/NFSv4 kerberos)
Outbound
389/tcp (636/tcp for LDAPS)
LDAP
AD/LDAP directory queries
Outbound
445/tcp
SMB (AD)
AD join / domain member traffic
Outbound
443/tcp
HTTPS
AutoSupport to NetApp, Active IQ, BlueXP, cloud services
Outbound
25/tcp (optional)
SMTP
Email alerts
Outbound (optional)
161/udp, 162/udp (optional)
SNMP
Monitoring (traps out, queries in)
Both (optional)
10000/tcp (optional)
NDMP
NDMP backup control (data transfer often separate ports)
Inbound (optional)
Connectivity check quick list
# From the cluster: is the LIF serving?
network ping-lif -vserver vs1 -lif data1
# From a client (Linux):
nc -vz 10.0.0.5 2049 # NFS
nc -vz 10.0.0.5 445 # SMB
nc -vz 10.0.0.5 3260 # iSCSI
nc -vz 10.0.0.5 443 # System Manager / REST / S3
showmount -e 10.0.0.5 # NFS exports visible?
Verify per release
Ports 10000/10001 for intercluster and the exact NVMe/TCP and SMB-over-QUIC support depend on your ONTAP version and platform. Check man pages and the official documentation for your release before locking down firewalls.
