What ports do we need open in a firewall for change auditor to work? (4281167)

Using Wireshark to trace the connection from the Coordinator to the SQL Server, we can see that a connection is attempted on UDP Port 1434.

 

With the enabled Firewall the connection is blocked, the Wireshark shows that connection is attempted several times.

 

Here is an example of a UDP Packet with its stream content:
192.168.2.21 192.168.2.202 UDP 60 Source port: 53147  Destination port: 1434 .mssqlserver2008r. When the Firewall is off we connection established on the first try, the UDP Packet with its stream content show: 192.168.2.21 192.168.2.202 UDP 60 Source port: 50926  Destination port: 1434.mssqlserver2008r..d.ServerName;SQLSRV-DB01;InstanceName;MSSQLSERVER2008R;IsClustered;No;Version;10.50.4000.0;tcp;1433;;

UDP port 1434 is used for SQL Server named instances. The SQL Server Browser service listens on this port for incoming connections to a named instance. The service then responds to the client with the TCP port number for the requested named instance, in this case as you see from the Stream Content of the UDP Packet it is Port 1433 TCP:.mssqlserver2008r..d.ServerName;SQLSRV-DB01;InstanceName;MSSQLSERVER2008R;IsClustered;No;Version;10.50.4000.0;tcp;1433;;

 

To resolve the problem, the incoming UDP Port 1434 from the Coordinator to the SQL Server needs to be open when a firewall is active.