Firewall settings for Microsoft Dynamics AX components [AX 2012]

Applies To: Microsoft Dynamics AX 2012 R2, Microsoft Dynamics AX 2012 Feature Pack, Microsoft Dynamics AX 2012

If you use Windows Firewall to help protect your computers, Microsoft Dynamics AX components require the settings in the following table. For more information about Windows Firewall, see the Windows documentation.

Component	Computer	Firewall setting	Notes
Setup	Any	Allow outbound HTTP connections.	To access the documentation that is available from the Setup wizard, you must be able to connect to the Internet from the computer where you are running Setup.
Databases	Database server	Exclude the port that is used by Microsoft SQL Server. By default, SQL Server uses port 1433.	For more information, see the SQL Server documentation.
Application Object Server (AOS)	AOS server	· Exclude the TCP/IP port that is used by the AOS instance. By default, AOS uses port 2712. Setup automatically creates the inbound rule "Dynamics AX 6.0 –MicrosoftDynamicsAX (RPC)" for the TCP/IP port. · Exclude the services WSDL port that is used by the AOS instance. By default, AOS uses port 8101. Setup automatically creates the inbound rule "Dynamics AX 6.0 –MicrosoftDynamicsAX (WSDL)" for the WSDL port. · Exclude the services endpoint port that is used by the AOS instance. By default, AOS uses port 8201. Setup automatically creates the inbound rule "Dynamics AX 6.0 –MicrosoftDynamicsAX (NetTCP)" for the services endpoint port.	Windows Firewall must be enabled on the computer. Each AOS instance must use a different port number. Note By default, every time that you install an additional AOS instance on a computer, the TCP/IP port number and the services endpoint port numbers are incremented by 1. For example, by default, the second AOS instance on a computer is assigned to TCP/IP port 2713.
Client	Client workstation	Exclude Ax32.exe.	The client uses a TCP port to connect to the AOS instance.
Microsoft SQL Server Reporting Services extensions	Report server	Exclude the port that is used by Reporting Services virtual directories, if Reporting Services uses a port other than port 80.	If you are installing Reporting Services extensions in a perimeter network, you may need to add a firewall policy that enables you to connect to the Microsoft Dynamics AX database. For example, if you are using Forefront Threat Management Gateway (TMG), you must add a Non-Web Server Protocol Rule. For more information, seeConfiguring SQL Server publishing in the Forefront TMG documentation.
Microsoft SQL Server Analysis Services integration	Analysis server	· Exclude the port that is used by Analysis Services. By default, Analysis Services uses port 2383. · If you are using SQL Server Browser, you must also exclude port 2382.	For more information about how to configure access to Analysis Services through Windows Firewall, see the SQL Server documentation on MSDN.
Debugger	Developer workstation	Exclude AxDebug.exe and its target programs, such as Ax32.exe and AxServ32.exe.	The debugger uses a dynamically allocated TCP port.
Enterprise Portal for Microsoft Dynamics AX	Web server	· Enable the Web Server (HTTP). · Exclude the port that is used by the Enterprise Portal website, if the site uses a port other than port 80.	If you do not enable the Web Server in Windows Firewall, you can view the site only from the local server.
Help Server	Web server	Exclude the port that is used by the Help Server web site, if the site uses a port other than port 80.
Enterprise Search	Web server	Exclude the port that is used by the Search web site, if the site uses a port other than port 80.
Web services	Web server	Exclude the port that is used by the services web site, if the site uses a port other than port 80.	External programs use this port to consume the Microsoft Dynamics AX web services that are based on Internet Information Services (IIS).
Management utilities	Remotely managed computer	Enable Remote Administration.	You must enable Remote Administration on computers that are administered remotely by using Windows PowerShell. For example, enable Remote Administration on a computer if you deploy reports to that computer from another computer where Windows PowerShell is installed.
Synch Service	Head-office communications server	· Exclude the port that is used by Microsoft SQL Server. By default, SQL Server uses port 1433. · Exclude the port that is used by Synch Service. By default, Synch Service uses port 16750. · Exclude the port that is used by Real-time Service. By default, Real-time Service uses port 1239.	For instructions, see the PCI Implementation Guide for Microsoft Dynamics AX 2012 Feature Pack.
Synch Service	Store communications server	· Enable Internet Protocol security (IPsec). · Exclude the port that is used by Microsoft SQL Server. By default, SQL Server uses port 1433. · Exclude the port that is used by Synch Service. By default, Synch Service uses port 16750.	For more information, see the PCI Implementation Guide for Microsoft Dynamics AX 2012 Feature Pack.
Real-time Service		Exclude the port that is used by Real-time Service, if the site uses a port other than port 80.	For more information, see the PCI Implementation Guide for Microsoft Dynamics AX 2012 Feature Pack.
Retail POS	Store communications server	Exclude the port that is used by Microsoft SQL Server. By default, SQL Server uses port 1433. Exclude the port that is used by Synch Service. By default, Synch Service uses port 16750.	For more information, see the PCI Implementation Guide for Microsoft Dynamics AX 2012 Feature Pack.
Retail POS	Store database server	Exclude the port that is used by Microsoft SQL Server. By default, SQL Server uses port 1433. On a register that has its own local database, you only need to open the firewall to SQL Server if Synch Service is on a computer other than the register.	For more information, see the PCI Implementation Guide for Microsoft Dynamics AX 2012 Feature Pack.
Microsoft Dynamics ERP RapidStart Connector	Microsoft Dynamics ERP RapidStart Services host machine	· Exclude the executable file for the Microsoft Dynamics ERP RapidStart Connector service. By default, the file is installed in this location: %SystemDrive%\Program Files\Microsoft Dynamics AX\60\RapidStartConnectorService\Microsoft.Dynamics.AX.AppConfig.ConnectorLoaderService.exe · Exclude the endpoint port that is used by the Microsoft Dynamics ERP RapidStart Connector service. By default, the service communicates with the Windows Azure Service Bus on ports 9350-9354, 80, and 443. · Exclude the Windows Azure Cloud Services Protocols.