What kind of network firewall openings need to be in place between scan nodes and hosts to be scanned?
What ports need to open for the Scan Node?<\/p>\n
Any limitation to the visibility of the scanned host will result in less findings from network-based vulnerability scans. We recommended deploying scan nodes in the same private networks where scan-targets are present and allowing all incoming\/outcoming traffic from scan nodes. Only in this scenario can you detect e.g. unwanted services running on non-standard TCP\/UDP ports.<\/p>\n
However, there is additional network access requirement applicable when using authenticated scanning where scan node needs to communicate with scan targets and fetch data. Each of those methods has a default port that needs to be open and these are documented in the online documentation available here:<\/p>\n
The paragraph starting with "Network access to" from this page for Windows:\u00a0Installing scan nodes (Windows) | Elements Vulnerability Management | 4.0 | WithSecure User Guides<\/a>\u00a0and for Linux:\u00a0Installing WithSecure Elements VM scan nodes (Linux) | Elements Vulnerability Management | 4.0 | WithSecure User Guides<\/a><\/p>\n The TCP-port used is 443 and in the default configuration, the traffic is OUTBOUND (from SNA point of view).<\/p>\n To summarize: the network access requirement depends on the authenticated scan method select and is summarized below using default TCP-ports (note that the TCP-ports used can be differently configured in your environment).<\/p>\n 1. WinRM based authenticated scanning, either WinRM port 5985\/TCP (http) or 5986 (https) need to be open (INBOUND) on the scan targets. Important!<\/p>\n Related to firewall access, scan nodes need to have unlimited access to the IP addresses associated with *.fsapi.com<\/strong>. A good example is active test for the Log4J vulnerability, which requires the scan node to access a call-back server hosted by WithSecure.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":" What kind of network firewall openings need to be in place between scan nodes and hosts to be scanned?<\/p>\n","protected":false},"template":"","support_article_product":[108],"class_list":["post-4041","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000011937","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 15:02:23","import_hash":"6addebe41c608ca2852e4a98c103742ef9b187b0","vanilla_article_id":32683,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/32683-what-kind-of-network-firewall-openings-need-to-be-in-place-between-scan-nodes-and-hosts-to-be-scanned","vanilla_kb_id":30,"vanilla_category_id":156,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article\/4041","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=4041"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article_product?post=4041"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
2. RPC based authenticated scanning, TCP\/135 need to be open (INBOUND) on scan targets.
3. SSH based authenticated scanning, TCP\/22 need to be open (INBOUND) on scan targets.<\/p>\n