ATT0025 1.6.1C_ESS Ports and Protocols List.xls

This is a Ports and Protocols List for the Enterprise Security Services (ESS) infrastructure supporting the Department of the Army Information Systems Engineering Command (USAISEC). The document specifies network configuration requirements for Unclassified systems operating at the MAC-II security level across two primary ESS components: Access Control Servers and Domain Controllers.

The Access Control Servers require 24 distinct TCP ports and 7 UDP ports to support critical functions including Microsoft Directory Services (port 445), RPC Location Services (port 135), Remote Desktop Protocol (port 3389), Microsoft SQL Server (ports 1433-1434), VMware management (port 29003), and various proprietary services on ports 4001-4005. Domain Controllers require significantly more extensive port access, including standard Active Directory services (LDAP on ports 389/636, Kerberos on port 88, DNS on port 53), Remote Desktop Protocol (port 3389), and a comprehensive range of UDP ports spanning from 123 (NTP) through port 54299, including thousands of ports allocated for dynamic communication between approximately 52970 and 54299. This extensive port allocation on Domain Controllers appears designed to accommodate high-volume distributed authentication, replication, and dynamic RPC endpoint mapping necessary for enterprise-scale directory services. All traffic operates over TCP/UDP protocols at the Unclassified classification level, with MAC-II mandatory access control requirements, indicating this infrastructure supports baseline DoD network security standards for information systems engineering operations.