jplee3 wrote: > Hey guys, > > I found something interesting in attempting to deploy OSSEC in agent/ > server model. Not sure what the implications are here, but it seems > like 1514 isn't the only port OSSEC retains communication over (since > it's UDP I think?). > > The firewall rules that I'm working with are very restrictive. And UDP > is also restricted. I requested that 1514 UDP be opened on both the > server and agents but still couldn't get OSSEC to communicate between > the agents/servers.
I can confirm that only UDP/1514 is needed from the client to the server (at least for a Cisco firewall). The client will initiate a connection using an ephemeral port to 1514 on the server. At that point, the firewall should allow the response.
