Windows Server Failover Clustering Hotfixes for SQL Server AlwaysOn

Windows Server Failover Clustering/SQL Server Firewall Access Rules

Last updated: 2026-08-21 17:01:33

This document defines the firewall rules necessary for a Multi-Subnet Windows Server Failover Cluster (WSFC) environment. It covers WSFC core communication, the WSFC dependency on Active Directory (AD), and SQL Server Availability Group (AG) communication. Use these rules when you request network access for a Multi-Subnet Cluster.

This version corrects several rows to agree with current Microsoft documentation. See Verification Notes at the end of this document for the list of changes and sources.

Table of Contents

• Windows Server Failover Clustering/SQL Server Firewall Access Rules
  • Table of Contents
  • Best Practice: IP Specificity
  • Critical Action: Review Ephemeral Port Ranges
  • Section 1: Core WSFC and Active Directory Ports
  • Section 2: SQL Server Database Engine and Availability Group Ports
  • Section 3: SQL Server BI Stack Ports (Conditional)
  • Section 4: Multi-Subnet / Cloud Deployment Ports (Conditional)
  • Section 5: Official References
  • Verification Notes
  • Windows Server 2025 / SQL Server 2025 Notes

Best Practice: IP Specificity

Specify exact IP addresses, or exact subnet masks, for all cluster endpoints. This includes every cluster node and every Availability Group Listener. Exact addressing makes sure that firewall rules apply correctly.

Critical Action: Review Ephemeral Port Ranges

Review the ephemeral port range. If company policy sets a different range for transient TCP/UDP traffic, change it. The default dynamic port range on current Windows Server versions is 49152 to 65535. Microsoft confirms this default in the RPC dynamic port documentation.

Section 1: Core WSFC and Active Directory Ports

These ports are necessary on all cluster nodes for basic cluster operation, network stability, and communication with Domain Controllers (DC).

Port(s)	Protocol	Direction	Service / Function	Notes
53	TCP/UDP	Bi-Directional	DNS	This port supports all name resolution.
88	TCP/UDP	Bi-Directional	Kerberos Authentication	UDP carries standard ticket requests. TCP carries tickets that are too large for UDP.
123	UDP	Outbound	NTP (Windows Time)	This port keeps node time synchronized with the Domain Controller.
135	TCP	Bi-Directional	RPC Endpoint Mapper	The Cluster Service uses this port. This port also finds the dynamic RPC port for WSFC and MS DTC traffic. This port has no UDP type.
137	UDP	Bi-Directional	NetBIOS Name Resolution (NBNS)	This port is legacy. DNS (53) replaces it. We recommend that you block this port.
138	UDP	Bi-Directional	NetBIOS Datagram Service (NBD)	This port is legacy. SMB (445) replaces it. We recommend that you block this port.
139	TCP	Bi-Directional	NetBIOS Session Service (NBSS)	This port is legacy. SMB (445) replaces it. We recommend that you block this port.
389	TCP/UDP	Bi-Directional	LDAP	This port carries unencrypted queries and writes to Active Directory.
445	TCP	Bi-Directional	SMB/CIFS	This port grants access to shared resources. Examples are the Cluster Shared Volume (CSV) and the File Share Witness (FSW). This port uses TCP only. SMB has no UDP mode on current Windows versions.
464	TCP/UDP	Bi-Directional	Kerberos Password Change	This port supports secure password changes and trust maintenance.
636	TCP	Bi-Directional	LDAPS (LDAP over TLS)	This port carries encrypted queries and updates to Active Directory. This port has no UDP type.
3268	TCP	Bi-Directional	Global Catalog (GC) LDAP	This port carries unencrypted, forest-wide user and group lookups.
3269	TCP	Bi-Directional	Global Catalog (GC) LDAPS	This port carries encrypted, forest-wide user and group lookups. We recommend port 3269 over port 3268.
3343	UDP	Bi-Directional	Cluster Network Driver (NetFT) heartbeat	This port is the primary heartbeat channel. It uses DTLS 1.0 or 1.2 for security.
3343	TCP	Bi-Directional	Cluster Network Driver (NetFT), node join only	This port is necessary only during a node join operation. It is not part of the regular heartbeat.
49152–65535	TCP/UDP	Bi-Directional	RPC Dynamic Ports	This port range carries the WSFC heartbeat and state data. It also carries MS DTC traffic. Port 135 sets up this traffic.
N/A	ICMPv4	Bi-Directional	Ping	This protocol supports basic reachability testing. Only administrators use it, for diagnostics. The Add Node Wizard uses it during a node join operation.

Section 2: SQL Server Database Engine and Availability Group Ports

These ports are necessary for client connectivity, AG replication, and remote administration.

Port(s)	Protocol	Direction	Service / Function	Notes
161	UDP	Inbound	SNMP Agent	This port lets monitoring systems poll node health.
162	UDP	Outbound	SNMP Traps	This port sends critical event alerts to monitoring systems.
1433	TCP	Inbound	SQL Database Engine	This port is the default entry point for client applications and the AG Listener.
1434	UDP	Inbound	SQL Server Browser	This port tells clients the dynamic port number of a named instance.
3389	TCP	Inbound	RDP	This port gives administrative console access to the Windows Server node.
3389	UDP	Inbound	RDP (enhanced session transport)	The current RDP transport uses this port together with the TCP channel. Microsoft documents TCP and UDP for RDS.
5022	TCP	Bi-Directional	AG Replication Endpoint	The primary replica sends transaction log blocks to secondary replicas over this port. An administrator chooses this port. Microsoft does not fix a default port. Microsoft's own examples use port 5022 or port 7022. Run this query to confirm the actual port: SELECT name, protocol_desc, port, state_desc FROM sys.tcp_endpoints WHERE type_desc = 'DATABASE_MIRRORING'
5985	TCP	Inbound	WinRM (HTTP)	This port supports PowerShell Remoting over unencrypted HTTP. This port has no UDP type.
5986	TCP	Inbound	WinRM (HTTPS)	This port supports PowerShell Remoting over encrypted HTTPS. This port has no UDP type.

Load balancer health probe ports (cloud or multi-subnet deployments only) are in Section 4.

Section 3: SQL Server BI Stack Ports (Conditional)

If SSAS, SSRS, or SSIS runs on the cluster nodes, these ports become necessary.

Port(s)	Protocol	Direction	Service / Function	Notes
135	TCP	Inbound	SQL Server Integration Services (SSIS)	The Integration Services service uses DCOM on TCP port 135 to start, stop, and control the service remotely. You cannot change the port number. SSIS does not use UDP. If you connect to a remote Integration Services instance from Management Studio or a custom application, this port is necessary.
2382	TCP	Inbound	SSAS Redirector (SQL Server Browser)	The SQL Server Browser service listens on TCP port 2382. It redirects the client to the port that the named Analysis Services instance uses. Microsoft states this plainly: UDP is not used. TCP is the only protocol that SQL Server Analysis Services uses.
2383	TCP	Inbound	SSAS Default Instance	This port is the direct connection port for the default Analysis Services instance.
Varies	TCP	Inbound	SQL Server Reporting Services (SSRS)	The default is TCP 80/443 (HTTP/HTTPS). Many deployments use a custom, high port number. Check SSRS Configuration Manager for the actual value.

Section 4: Multi-Subnet / Cloud Deployment Ports (Conditional)

These ports are necessary in two cases. Case one: the Availability Group spans multiple subnets. Case two: the Availability Group runs in a public cloud (Azure/AWS) environment. An Internal Load Balancer (ILB) for the AG Listener (AGL) IP is necessary in each case.

The ILB routes client traffic to the active replica. It uses TCP health probes to do this. Allow these probe ports inbound from the ILB subnet to the cluster nodes.

Port(s)	Protocol	Direction	Service / Function	Notes
58888	TCP	Inbound	Cluster Core Probe (example port)	This port carries the load balancer health probe for the Cluster Name Object (CNO). An administrator chooses this port number.
59999	TCP	Inbound	AG Listener Probe (example port)	This port carries the load balancer health probe for the AG Listener (AGL). An administrator chooses this port number.

Section 5: Official References

Windows Server Failover Clustering (WSFC) ports Microsoft Learn: Service overview and network port requirements. This page covers core AD ports (53, 88, 135, 389, 445). It also covers NetBIOS (137, 138, 139), the Cluster Service (3343), and the RPC dynamic port range (49152–65535).

SMB/CIFS protocol confirmation Microsoft Learn: Direct hosting of SMB over TCP/IP. This page confirms SMB direct hosting uses TCP port 445 only. There is no UDP mode.

SQL Server Core and Availability Group (AG) ports Microsoft Learn: Configure the Windows Firewall to Allow SQL Server Access. This page covers the Database Engine (1433), SQL Server Browser (1434 UDP), the Database Mirroring/AG endpoint (5022 example), and Integration Services (135 TCP only, DCOM).

SQL Server Analysis Services (SSAS) ports Microsoft Learn: Configure the Windows Firewall to Allow Analysis Services Access. This page confirms that port 2382 (SQL Server Browser) and port 2383 (default instance) use TCP only.

Multi-Subnet / cloud deployment (load balancer probes) Microsoft Learn: Configure Availability Group Listeners and Load Balancer (PowerShell). This page explains load balancer health probes for the AGL IP address. An administrator chooses the probe port numbers. Microsoft does not fix these numbers.

Verification Notes

This table lists the rows that changed, after a comparison with current Microsoft documentation.

Port(s)	Original claim	Corrected to	Reason
137, 138, 139	Grouped as one row: "137-139, UDP/TCP"	Split into three rows: 137/UDP, 138/UDP, 139/TCP	Microsoft documents distinct, single protocols per port. There is no 137/TCP, 138/TCP, or 139/UDP.
445	TCP/UDP	TCP only	Microsoft's SMB direct-hosting documentation and every reference in the general Windows Server port list show SMB as TCP 445 only. No UDP mode exists.
3343	Single row, "TCP/UDP... must allow both for compatibility"	Split into two rows: UDP (primary heartbeat, DTLS-secured) and TCP (node join only)	Microsoft documents regular Cluster Service heartbeat traffic as UDP with DTLS. Microsoft calls out TCP port 3343 separately. This port is necessary only during a node join operation.
2382	UDP	TCP	Microsoft states directly: "SQL Server Browser service listens on TCP port 2382. UDP is not used." The original document likely confused this with the unrelated SQL Server Browser UDP 1434 rule for the Database Engine.
SSIS row	TCP/UDP, Bi-Directional	TCP, Inbound, port 135 only	Microsoft's SQL Server firewall documentation states Integration Services uses DCOM on TCP port 135, with no UDP component.
3389	TCP only	TCP and UDP	Microsoft's general Windows Server port list documents RDS (Remote Desktop Services) on TCP 3389 and UDP 3389.
5022	Presented as a fixed default	Presented as an administrator-chosen port (with a query to confirm the actual value)	Microsoft states there is no default port for database mirroring/AG endpoints. Its own examples use port 5022 or port 7022.
N/A (Workgroup Cluster row)	Labeled as a Windows Server 2025 feature	Labeled as a feature from Windows Server 2016	Windows Server 2016 introduced workgroup clusters. Microsoft's documentation for domain-independent Availability Groups exists for versions before Windows Server 2025.

Windows Server 2025 / SQL Server 2025 Notes

This document targets Windows Server 2022 and SQL Server 2022. This section notes what changes for firewall planning if a project moves to Windows Server 2025 and SQL Server 2025. No port numbers change. Two items affect the necessary ports and encryption.

Item	What changes in the 2025 versions	Effect on this document
TDS 8.0 with enforced TLS 1.3	SQL Server 2025 can enforce strict TLS 1.3 encryption on connections to the Database Engine (1433) and the AG endpoint (5022).	This adds no new port. Traffic on these ports can be TLS 1.3-only. Before you turn this on, confirm client and driver support.
Domain-independent Availability Groups (workgroup clusters)	An AG can run in a workgroup cluster, with no Active Directory domain. Windows Server 2016 and later versions support workgroup clusters. This is not a new feature in Windows Server 2025.	See the note below this table.

If you use domain-independent Availability Groups, drop these Active Directory-dependent ports from Section 1:

• Port 53 (DNS)
• Port 88 (Kerberos)
• Port 389 (LDAP)
• Port 636 (LDAPS)
• Ports 3268-3269 (Global Catalog)
• Port 464 (Kerberos Password Change)

The core WSFC ports still apply: 123, 135, 137-139, 445, 3343, 49152-65535, and ICMP. The AG-specific ports in Section 2 also still apply. A domain is still necessary for a SQL Server Failover Cluster Instance (FCI). This exception applies only to AG-only, workgroup-cluster deployments.

Synchronized clocks are necessary for cluster certificate trust, so port 123 (NTP) still applies. Point it at a reliable external time source instead of a Domain Controller.

A workgroup cluster does not support a File Share Witness (FSW). Port 445 still applies only for the Cluster Shared Volume (CSV) use case. Use a disk witness or a cloud witness for quorum instead of an FSW.