Home / Reference / Network & Ports
Network & Port Reference
What needs to be reachable, on which port, from where. The classic firewall questions: "do I need 111 open?", "what port does SnapMirror use?", "is S3 on 443?"
Reading this table
"Inbound to ONTAP" = clients/servers connect to ONTAP's LIFs on these ports. "Outbound from ONTAP" = ONTAP initiates (AutoSupport, AD/LDAP, NTP, intercluster). Ports marked optional depend on features.
Management & automation
| Port | Protocol | Used for | Direction |
|---|---|---|---|
| 22/tcp | SSH | CLI access to cluster/node management LIFs | Inbound |
| 443/tcp | HTTPS | System Manager, ONTAP REST API, BlueXP connectivity | Inbound |
| 80/tcp | HTTP | Optional; redirects to HTTPS (management) | Inbound |
| 111/tcp (optional) | portmapper/rpcbind | NFSv3 and some management RPCs — only if NFSv3 clients need it | Inbound |
NAS protocols
| Port | Protocol | Used for | Direction |
|---|---|---|---|
| 2049/tcp | NFS (all versions) | NFS data traffic | Inbound |
| 2049/udp | NFSv3 | NFSv3 over UDP (rare nowadays) | Inbound (optional) |
| 111/tcp+udp | portmapper | NFSv3 mount/rpc discovery; NFSv4 doesn't need it | Inbound (optional) |
| 4045–4046/tcp | lockd / statd | NFSv3 locking (older clients) | Inbound (optional) |
| 445/tcp | SMB/CIFS | SMB file sharing (also SMB over QUIC control) | Inbound |
| 139/tcp | NetBIOS (legacy) | Legacy SMB/NetBIOS; usually not needed | Inbound (optional) |
| 80, 443/tcp | S3 API | Object store server (HTTP/HTTPS endpoints) | Inbound |
| 443/udp (optional) | SMB over QUIC | Secure SMB over UDP 443 (recent ONTAP, verify support) | Inbound (optional) |
SAN protocols
| Port | Protocol | Used for | Direction |
|---|---|---|---|
| 3260/tcp | iSCSI | iSCSI data + MC/S | Inbound |
| 4420/tcp | NVMe/TCP | NVMe over TCP (ONTAP 9.10+ platforms) | Inbound |
| — | FC / FCoE / NVMe/FC | Fibre Channel fabric — no IP ports; zoning via switch | — |
Replication & clustering
| Port | Protocol | Used for | Direction |
|---|---|---|---|
| 10000/tcp | SnapMirror / cluster peer | Intercluster replication traffic (SnapMirror, SnapVault, SM-BC data path) | Both (between clusters) |
| 10001/tcp (optional) | — | Some versions use 10001 for intercluster; confirm in your release | Both (optional) |
| — | Cluster interconnect | Node-to-node cluster traffic — dedicated ports/network, not routed | Internal |
| — | HA interconnect | NVRAM mirroring between HA partners — dedicated links | Internal |
| 3260/tcp | MetroCluster (IP) | IP MetroCluster replication (uses iSCSI-based transport over dedicated network) | Between sites |
Infrastructure services
| Port | Protocol | Used for | Direction |
|---|---|---|---|
| 53/tcp+udp | DNS | Name resolution (SVM config, AD, FQDN lookups) | Outbound |
| 123/udp | NTP | Time sync (Kerberos and AD depend on it) | Outbound |
| 88/tcp+udp | Kerberos | AD authentication (SMB/NFSv4 kerberos) | Outbound |
| 389/tcp (636/tcp for LDAPS) | LDAP | AD/LDAP directory queries | Outbound |
| 445/tcp | SMB (AD) | AD join / domain member traffic | Outbound |
| 443/tcp | HTTPS | AutoSupport to NetApp, Active IQ, BlueXP, cloud services | Outbound |
| 25/tcp (optional) | SMTP | Email alerts | Outbound (optional) |
| 161/udp, 162/udp (optional) | SNMP | Monitoring (traps out, queries in) | Both (optional) |
| 10000/tcp (optional) | NDMP | NDMP backup control (data transfer often separate ports) | Inbound (optional) |
Connectivity check quick list
# From the cluster: is the LIF serving?
network ping-lif -vserver vs1 -lif data1
# From a client (Linux):
nc -vz 10.0.0.5 2049 # NFS
nc -vz 10.0.0.5 445 # SMB
nc -vz 10.0.0.5 3260 # iSCSI
nc -vz 10.0.0.5 443 # System Manager / REST / S3
showmount -e 10.0.0.5 # NFS exports visible?
Verify per release
Ports 10000/10001 for intercluster and the exact NVMe/TCP and SMB-over-QUIC support depend on your ONTAP version and platform. Check
man pages and the official documentation for your release before locking down firewalls.