title: TFS 2017 server required firewall settings for Build agent
body: <p>I have TFS 2017 on Windows Server 2016 Standard.</p>
  
  <p>I am now setting up Build agent on Windows 10 pro using PAT token authentication. (having "Agent Pools (read, manage)", "Agent Pools (read)", "Build (read"), "Code (read)", "Build (read and execute)", though this part seeems to be fine.</p>
  
  <p>I am getting close to the very end of the configuration</p>
  
  <pre><code>Testing agent connection.
  An error occured while sending the request.
  </code></pre>
  
  <p>Log file says</p>
  
  <blockquote>
    <p>[2017-06-27 14:58:18Z ERR  Agent] System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.Http.WinHttpException: Der Servername oder die Serveradresse konnte nicht verarbeitet werden
       at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
       at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
       at System.Net.Http.WinHttpHandler.d__101.MoveNext()
       --- End of inner exception stack trace ---
       at Microsoft.VisualStudio.Services.Common.VssHttpRetryMessageHandler.d__3.MoveNext()
    --- End of stack trace from previous location where exception was thrown ---
       at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
       at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
       at System.Net.Http.HttpClient.d__58.MoveNext()</p>
  </blockquote>
  
  <p>More by chance (since this is nowhere mentioned as required) I disabled the firewall on the server and now the connection and configuration of the build agent goes to the very end.</p>
  
  <p>I definitely have 443 and 80 open, I am using TFS via https/443 and also entered that in the build agent config. In the TFS console, I see :80 and :443, nothing like :8080.</p>
  
  <p>What else do I need to consider?</p>
  
  <p>TFS server is in a domain, build agent is not, https certificate is self-signed and added to Root CAs on build agent.</p>