Port on the SP Veeam backup server used to listen to cloud commands from the tenant side. Tenant cloud commands are passed to the Veeam Cloud Connect Service via the cloud gateway.
Port on the SP Veeam backup server used by SP-side network redirector(s) to connect to the Remote Access Console and establish a Remote Desktop Connection to tenant.
Port range used during transfer of the Veeam Availability Console agent from the SP Veeam backup server to the tenant backup server.
Default range of ports used as transmission channels for replication jobs. For every TCP connection that a job uses, one port from this range is assigned.
Port used to establish secure VPN connection for network extension during partial site failover.
If a tenant has several IP networks, additional odd ports should be opened starting from 1195 — one port per tenant's IP network.
For example, a tenant Tenant1 replicates VMs that are connected to 3 IP networks. In the Veeam Cloud Connect infrastructure, the SP deployed a network extension appliance for Tenant1. In this case, the SP needs to open between the network extension appliance and the cloud gateway the following ports: 1195, 1197, 1199.
Controlling port for RPC calls.
Default port used for data transfer between WAN accelerators.
Port on the Veeam Availability Console server used to communicate with the tenant backup server.
Communication between tenant backup servers and Veeam Availability Console server goes through cloud gateways.
Port on the cloud gateway used to listen for cloud commands from the Veeam Cloud Connect Service. The service cloud commands from the Veeam Cloud Connect Service are sent to set up, delete and check the status of data transport channels between tenants and the cloud repository.
Port used for communication with the network extension appliance.
SP backup server needs access to the SP network extension appliance via ICMP.
Port on the cloud gateway used to transport VM data from the tenant side to the SP side (UDP is used only during partial failover of a cloud replica).
Tenant backup server needs access to CRLs (Certificate Revocation Lists) of the CA (Certification Authority) who issued a certificate to the SP.
Generally, information about CRL locations can be found on the CA website.
Default port used to download information about available updates from the Veeam Update Notification Server over the Internet.
Default port used for license auto-update.
Port used for communication with the Veeam Backup Service (locally on the backup server).
Port used to carry tenant VM traffic from the tenant network extension appliance to the SP network extension appliance through the cloud gateway.
Port used for VM data transport to the cloud repository by backup jobs.
Port used for VM data transport to the cloud repository by backup copy jobs.
Port used for communication with the Veeam Cloud Connect Service and SP-side network redirector(s).
Port used for communication with the Veeam Backup Service.
Default port used for communication with the SP Veeam Cloud Connect Service and SP-side network redirector(s).
Remote Access Console needs access to CRLs (Certificate Revocation Lists) of the CA (Certification Authority) who issued a certificate to the SP.
Port used for accessing Veeam Cloud Connect Portal by tenants.
Veeam Cloud Connect Portal is installed on the SP Veeam Backup Enterprise Manager server as an optional component. It should be published on the internet by the SP administrator.
To learn what ports are required for other components in the Veeam Cloud Connect infrastructure, see the Ports section in Veeam Backup & Replication User Guide at: https://www.veeam.com/documentation-guides-datasheets.html.