Which network ports and URLs are required for the KACE SMA appliance to function? (4211365)

The following table describes expected KACE Systems Management Appliance (SMA) traffic (inbound, outbound, bidirectional) at the NIC. This is meant to describe internal network behavior. Any outbound ports that require access out to the internet are labeled as 'NAT' in the Direction column. Some unique configurations, such as allowing SMTP inbound directly to the SMA will require slight deviation and custom configuration outside the confines of this list. When in doubt, contact KACE Support for clarification.

Quest’s patching and updating process for KACE® System Management Appliances (SMA) includes several security features.   For example, Quest’s transmissions of patch and update metadata for SMA are encrypted. Checksums are used to validate the integrity of SMA patch payloads.  And, the directory where SMA patch payloads reside is permission-controlled to prevent user tampering.

As with any web-server based application, security best practices include limiting access to the KACE Systems Management Appliance (SMA) from the Internet. Careful consideration and review of the environment are necessary to ensure security.

It is strongly recommended to consider firewalls, encryption, port access, roles, antivirus, SSL, access control list, disaster recovery, and review Best Practices for Securing your SMA prior to configuring the SMA on the Internet.  At a minimum, if the SMA is configured as internet/public facing, only port 443 (HTTPS) traffic should be allowed inbound through a firewall to the SMA for UI access and agent communication traffic.

URLs Required for Proper SMA Functionality

Below are the URLs used to update SMA software updates, OVAL, SCAP, Dell warranty, and Dell updates. Please whitelist these in your firewall for ports 80 and 443 (HTTP/HTTPS):

URLs Required for Patching Functionality

Below are the URLs used to update patch listings. Please whitelist these in your firewall for ports 80 and 443 (HTTP/HTTPS):

In some cases, load balancers, content filterers, or other network devices may block certain behaviors, make sure that extensions such as .exe, .msi are allowed, no download size restrictions, and other settings that may intervene and were covered on this article.