I am submitting this idea for a documentation enhancement regarding port usage across AVEVA System Platform nodes, based on common challenges in real-world projects.
The current documentation, including the “AVEVA™ System Platform Deployment 2023 R2” guide and the “AVEVA™ System Platform Installation Guide Version 2023 R2 SP1”, can be improved. It does not specify which node types require which ports to be open. Additionally, at least one important port appears to be missing.
Cases related to closed ports are a recurring issue for customers, system integrators, IT departments, and AVEVA Support Engineers. All would benefit from a more detailed overview of ports and node relationships that makes port configuration more obvious.
Ports 30000 & 30001 are labeled as “Local redundancy messaging (WinPlatform)” in the documentation. Based on this, it is reasonable to assume they are only needed between platforms/nodes that host redundant engines. However, AVEVA Support has confirmed that these ports must be open between all platforms. This is not clear in the documentation.
Port 50051 appears not to be in use anymore. In newer versions such as AVEVA System Platform 2023 R2 SP1 P01, port 59203 seems to be used instead (as seen in C:\Program Files\Common Files\ArchestrA\Licensing Framework\License API2\appsettings.json). This change seems to be undocumented. Many documents, including “AVEVA™ System Platform Deployment 2023 R2”, “AVEVA™ System Platform Installation Guide Version 2023 R2 SP1”, "AVEVA™ Enterprise Licensing 4.1" and "AVEVA™ Enterprise Licensing Guide", still refer to port 50051.
IT departments may want to implement host-specific firewall rules to enhance security. This is currently difficult because the documentation does not specify which nodes (or component types) need to communicate on which ports.
The two different versions of the “Ports used by System Platform products” in the “AVEVA™ System Platform Deployment 2023 R2” guide and the “AVEVA™ System Platform Installation Guide Version 2023 R2 SP1” state different things.
The "Operations Control Logger 23.2" pdf lists port "57727: ocLogger service port". I can not find anything on port 57727 anywhere else. The pdf also refers to a "Port List". It is not clear what is meant by this, “Port List” is only mentioned once in the pdf, and no further elaborations on it are given. Also, port 135, which is the only Operations Control Logger port which is mentioned by the “AVEVA™ System Platform Deployment 2023 R2” guide and the “AVEVA™ System Platform Installation Guide Version 2023 R2 SP1” is not mentioned in the "Operations Control Logger 23.2" pdf at all. Also, for clarity, port 57727 is not mentioned in the “Ports used by System Platform products” in the “AVEVA™ System Platform Deployment 2023 R2” guide or in the “AVEVA™ System Platform Installation Guide Version 2023 R2 SP1”.
The "AVEVA™ System Monitor 1.7" pdf state that port 465 is used for secure SMTP. The “AVEVA™ System Platform Deployment 2023 R2” guide and the “AVEVA™ System Platform Installation Guide Version 2023 R2 SP1”, however, state that port 587 is used.
The ports listed for the "AVEVA Historian" in the “Ports used by System Platform products” section of the “AVEVA™ System Platform Deployment 2023 R2” guide and the “AVEVA™ System Platform Installation Guide Version 2023 R2 SP1” differs from the "Ports used by AVEVA Historian" in the "AVEVA™ Historian 2023 R2 SP1 P02" pdf. The latter provides a much more detailed overview of the ports which are required for the Historian, and not just those which are specific to the Historian. In contrast, the former gives the impression that fewer ports, than what are needed, is required for the Historian to function.
The following ports are listed by ”Ports used by System Platform products” table in the “AVEVA™ System Platform Deployment 2023 R2” guide and the “AVEVA™ System Platform Installation Guide Version 2023 R2 SP1”, but not in the ”AVEVA™ Communication Drivers 2023 R2 SP1 P02” pdf: port 102 (SIDIRECT), port 2221 (ABTCP), port 2222 (ABTCP), port 2223 (ABTCP), and port 44818 (ABCIP). This discrepancy can cause confusion surrounding Siemens and Allen-Bradley communication drivers.
The following default ports are listed in the ”AVEVA™ Communication Drivers 2023 R2 SP1 P02” pdf, but not in the ”Ports used by System Platform products” in the “AVEVA™ System Platform Deployment 2023 R2” guide and the “AVEVA™ System Platform Installation Guide Version 2023 R2 SP1”: port 47808 (BACLITE), port 1217 (CODESYS), port 1200 (CODESYS), port 161 (SNMP), port 162 (SNMP), port 1217 (SOMAC), and port 1505 (TI500). This discrepancy can cause confusion surrounding BACnet, CODESYS, SNMP, Schneider Electric, and Texas Instruments communication drivers.
I propose that future versions of the Installation Guide (and equivalent documentation) include:
I am confident that this would significantly improve clarity and reduce support cases related to port configuration.
Please consider voting for this idea if you agree. Thank you for considering this proposal.
I noticed that the "Ports used by System Platform products" article on the "Knowledge & Support Center" was updated yesterday. It currently lists port 50051 for System Platform 2023 R2 SP1, but this version comes with "AVEVA Enterprise License Manager 4.1.0", which, according to AVEVA Support & the license team, uses port 59203. Thus, this documentation also seems to be outdated.
Develop a tool to verify that all required ports are open and that the various permission settings are correctly configured and all requirement are meet.
Regards
Regarding 2., I just noticed that "AVEVA Enterprise Licensing 4.2" has been released. The "AVEVA™ Enterprise Licensing 4.2" and "AVEVA™ Enterprise Licensing Guide" documents, now both refer to port 59203!👍
The "Enterprise Licensing Guide", however, states that: "Port 59203 is used with version 4.2 or higher of the AVEVA Enterprise Licensing platform.", this seems to be incorrect, as I already had to use port 59203 with the 4.1.0 version.
I also quickly checked the other documents I referred to in 2.: the “AVEVA™ System Platform Deployment 2023 R2” and “AVEVA™ System Platform Installation Guide Version 2023 R2 SP1” documents. They both still refer to port 50051.
Regarding 5., I also checked the new "Operations Control Logger 23.4" pdf. The statements in 5. in the original post also still seem to be true.
The other documentation I referred to in the original post should be followed up on at another time, preferably by someone at AVEVA.
I strongly support this idea. I’ve personally spent a lot of time often together with AVEVA Support trying to figure out which ports need to be open. It’s a frustrating and time-consuming process that could easily be avoided with clearer documentation.
Very good. In todays day and age, ''everything open'' is not good enough when it comes to cyber security. IT wants to have everything closed, and just open the must-haves. this is too difficult, and takes too much trial and error with the current documentation
This seems like a very good idea. The current documentation is not very good, so we spend to much time implementing new Aveva systems