This article outlines the essential services and ports required to ensure proper communication between a client workstation and its Active Directory server

User is unable to communicate with Active Directory server through SRX firewall.

Consider the following topology:

[User PC]192.168.1.2 ---> ge-0/0/1-[SRX]-ge-0/0/2 ---> 10.0.0.1[Active Directory]

Connections from User to Active directory and services that must be allowed in the SRX configuration are:

• CLDAP UDP and LDAP TCP Port 389: It is an RFC used by various devices and servers to access active directory services over local or public networks

Note: Junos already contains application junos-ldap which is TCP port 389, but it does not contain an application for CLDAP UDP port 389, so a custom application must be created: 

set applications application LDAP_UDP protocol udp
set applications application LDAP_UDP destination-port 389

• Kerberos TCP/UDP Port 88: Kerberos is an authentication protocol that is used to verify the identity of a user or host.

Note: Junos default application package does not contain Kerberos protocol application, a custom application must be created:

set applications application KERBEROS_TCP protocol tcp
set applications application KERBEROS_TCP destination-port 88

set applications application KERBEROS_UDP protocol udp
set applications application KERBEROS_UDP destination-port 88

• Server message block (SMB) TCP Port 445: The Server Message Block (SMB) Protocol is a network file sharing protocol implemented by Microsoft.Junos contains applications junos-smb and junos-smb-session to permit SMB protocol. 

• MS-RPC TCP Port 135 Remote procedure call Endpoint Mapper: It enables other systems to identify what services are available on a machine and on which port they can be found. Junos contains several application for MS RPC, for the sake of simplicity application junos-ms-rpc-any is used.

• NetBIOS Datagram Service (NBDS) UDP Port 138: Provides a mechanism for registering and releasing NetBIOS names.NetBIOS names are endpoint addresses: each name represents an application or service running on a node. Junos contains application junos-nbds

• LDAPS UDP or TCP Port 636: Used for Directory, Replication, User and Computer Authentication, Group Policy, same as LDAP but secure. 

Note: Junos default application package does not contain LDAPS protocol application, a custom app should be created:

set applications application LDAPS_TCP protocol tcp
set applications application LDAPS_TCP destination-port 636

set applications application LDAPS_UDP protocol udp
set applications application LDAPS_UDP destination-port 636

This is how the security policy should look like: 

set security zones security-zone ZONE_LAN interfaces ge-0/0/1.0
set security zones security-zone ZONE_SERVER interfaces ge-0/0/2.0

set security policies from-zone ZONE_LAN to-zone ZONE_SERVER policy ALLOW_AD_SERVICES match source-address any
set security policies from-zone ZONE_LAN to-zone ZONE_SERVER policy ALLOW_AD_SERVICES match destination-address any
set security policies from-zone ZONE_LAN to-zone ZONE_SERVER policy ALLOW_AD_SERVICES match application LDAP_UDP
set security policies from-zone ZONE_LAN to-zone ZONE_SERVER policy ALLOW_AD_SERVICES match application junos-smb
set security policies from-zone ZONE_LAN to-zone ZONE_SERVER policy ALLOW_AD_SERVICES match application KERBEROS_TCP
set security policies from-zone ZONE_LAN to-zone ZONE_SERVER policy ALLOW_AD_SERVICES match application KERBEROS_UDP
set security policies from-zone ZONE_LAN to-zone ZONE_SERVER policy ALLOW_AD_SERVICES match application junos-ldap
set security policies from-zone ZONE_LAN to-zone ZONE_SERVER policy ALLOW_AD_SERVICES match application junos-nbds
set security policies from-zone ZONE_LAN to-zone ZONE_SERVER policy ALLOW_AD_SERVICES match application junos-ms-rpc-any
set security policies from-zone ZONE_LAN to-zone ZONE_SERVER policy ALLOW_AD_SERVICES match application LDAPS_TCP
set security policies from-zone ZONE_LAN to-zone ZONE_SERVER policy ALLOW_AD_SERVICES match application LDAPS_UDP

10/23/2024 - Added bulletpoints and additional information about services allowed. 

06/16/2026 - Removed integrated user firewall references

• Microsoft document - Active Directory and Active Directory Domain Services Port Requirements