Configure Firewall Exceptions

[This is pre-release documentation and subject to change in future releases. This topic's current status is: Milestone-Ready]

Topic Last Modified: 2010-07-19

For a Standard Edition Deployment, firewall exceptions are created automatically during Microsoft Communications Server 2010 Setup. However, for Enterprise Edition deployments, you must configure the firewall exceptions manually on the Microsoft SQL Server back-end server. This topic covers:

Creating a firewall exception for the Central Management database
Creating a firewall exception for remaining Communications Server 2010 databases
Creating a firewall exception for the SQL Server Browser service
Configuring a static listening port

To configure the firewall exception for the Central Management database

Create a firewall exception rule with the following settings:

Wizard Page	Value
Rule Type	Custom
Program	All Programs
Protocol and Ports	Protocol Type: TCP Local port: Specific Ports, value set to 1433 Remote port: All Ports
Scope	Any IP address for both
Action	Allow the Connection
Profile	Domain
Name	Descriptive firewall exception name

Open the Advanced Firewall console on the SQL Server, right-click the Inbound Rules node, and then click New Rules.
Select Custom, and then click Next.
Select All Programs, and then click Next.
On the Protocols and Ports page, set:
- Protocol type to TCP
- Set Local port to Specific Ports
- Under Specific Ports set the value to 1433
- Set Remote port to All Ports
Click Next to continue.
On the Scope page, select Any IP address for both local and remote IP addresses.
On the Action page, select Allow the connection and continue.
On the Profile page, select Domain, and then clear the check boxes for Private and Public.
On the Name page, enter a name and short description for this firewall exception.

A good practice is to include the SQL Server instance name and the port number. For example: SQL-INSTANCE1-1433.
Click Finish to complete the wizard.
Continue to the next procedure to create a firewall exception for all other databases.

To configure the firewall exception for all other databases

Create a firewall exception rule with the following settings:

Wizard Page	Value
Rule Type	Custom
Program	All Programs
Protocol and Ports	Protocol Type: TCP Local port: Specific Ports, value set to 1433 Remote port: All Ports
Scope	Any IP address for local IP addresses These IP addresses for remote IP addresses.
Action	Allow the Connection
Profile	Domain
Name	Descriptive firewall exception name

Open the Advanced Firewall console on the SQL Server, right-click the Inbound Rules node, and then click New Rules.
Select Custom, and then click Next.
Select All Programs, and then click Next.
On the Protocols and Ports page, set:
- Protocol type to TCP
- Set Local port to Specific Ports
- Under Specific Ports set the value to 1433
- Set Remote port to All Ports
Click Next to continue.
On the Scope page, select Any IP address for local IP addresses.
On the Scope page, select These IP addresses for remote IP addresses, and then click Add.
On the IP Address page, you can make the following selections:
- Select This IP address or subnet. This is useful when adding individual machines.
- Select This IP address range. Choose this when specifying an IP address range, instead of individual IP addresses.
- Select Predefined set of computers. From the drop down list box, select Local subnet. Choose this option when SQL Server and Communications Server are on the same IP subnet.
On the Action page, select Allow the connection and continue.
On the Profile page, select Domain, and then clear the check boxes for Private and Public.
On the Name page, enter a name and short description for this firewall exception.

A good practice is to include the SQL Server instance name and the port number. For example: SQL-INSTANCE2-1433.
Click Finish to complete the wizard.

To configure the firewall exception for the SQL Server Browser service

Open the Advanced Firewall console on the SQL Server, right-click the Inbound Rules node, and then click New Rules.
Select Custom, and then click Next.
Select All Programs, and then click Next.
On the Protocols and Ports page, set:
- Protocol type to UDP
- Set Local port to Specific Ports
- Under Specific Ports set the value to 1434
- Set Remote port to All Ports
Click Next to continue.
On the Scope page, select Any IP address for both local and remote IP addresses.
On the Action page, select Allow the connection and continue.
On the Profile page, select Domain, and then clear the check boxes for Private and Public.
On the Name page, enter a name and short description for this firewall exception.

A good practice is to include the SQL Server instance name and the port number. For example: SQL-BROWSER-1434.
Click Finish to complete the wizard.

To set a static listening port for the SQL Server instance

From the server running SQL Server, open SQL Server Configuration Manager. (With a Classic Start menu), click Start, point to Programs, point to Configuration Tools, and then click SQL Server Configuration Menu.
Expand the SQL Server Network Configuration node.
Select the Protocols for <instance_name> node for the specific SQL Server instance you want to modify.
In the right pane, right-click TCPIP, and then select Properties.
Click the IP Addresses tab, and scroll down to IPAll.
Under IPAll, set TCP Dynamic Ports to a blank (empty) value, and then set TCP Port equal to 1433.
Click Apply, and then click OK.
Restart the SQL Server service.