--- schema_version: "1" id: 0b5ca70e60e51ced640d29888fdfa529bbaa1946bc5d26259042e008db215963 title: Agentless Discovery Network, Port, and Access Requirements collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/it_srvcs_discovery_network_access_requirements.md canonical_url: https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_network_access_requirements.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: c16b70e955c8073e01b13d6e332e2a5937af6419863db247dd68ef50c3d56b17 description: Improve agentless scan reliability and keep discovered asset data current. Review the connectivity and access requirements for each supported probe before you create discovery targets. products: - Service Cloud - Agentforce IT Service release: "264" --- # Agentless Discovery Network, Port, and Access Requirements Improve agentless scan reliability and keep discovered asset data current. Review the connectivity and access requirements for each supported probe before you create discovery targets. ### Required Editions
Available in: Lightning Experience
Available in: Enterprise, Performance, and Unlimited Editions with Agentforce IT Service that have Discovery enabled.
## Plan Network Access Before you create a discovery target, work with your network, security, and infrastructure teams to allow the connections that apply to the selected probe and target systems. If your environment uses a third-party or centrally managed firewall, create equivalent rules in the firewall management console. The Discovery Application initiates agentless connections from its Windows host to reachable target systems. For more information about this communication flow, see [How the Discovery Application Connects Salesforce and Target Systems](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_app_communication.htm&release=264.0.0&type=5 "Keep asset data in CMDB accurate and current with reliable agentless scans. Understand how the Discovery Application receives scan instructions from Salesforce, collects asset details from target systems through supported protocols, and returns scan results to Salesforce for processing. Use this communication flow to plan network access."). ## Network Connections Allow each connection from the listed source to the destination. Limit firewall rules to the Discovery Application host and target systems that are included in your scan scope. | Connection | Source | Destination | Direction | Protocol and Port | Purpose | | --- | --- | --- | --- | --- | --- | | Salesforce communication | Discovery Application host | Salesforce | Outbound | HTTPS over TCP port 443 | Receive scan instructions and return scan results for processing. | | Azure cloud API discovery | Salesforce | Microsoft Azure APIs | Outbound | HTTPS over TCP port 443 | Collect Azure resource data by using the configured service principal. | | Host reachability check | Discovery Application host | Target systems | Outbound | ICMP echo request | Identify reachable hosts before the Discovery Application runs a network scan. | | WMI scan | Discovery Application host | Windows target | Outbound | TCP ports 135, 139, and 445, and TCP ports 49152 to 65535 | Use RPC endpoint mapping, dynamic RPC, and SMB to collect Windows inventory data. | | PowerShell Remoting scan | Discovery Application host | Windows target | Outbound | WinRM over TCP port 5985 for HTTP or TCP port 5986 for HTTPS | Collect Windows inventory data by using PowerShell Remoting. | | SSH scan | Discovery Application host | Linux, Unix, or macOS target | Outbound | SSH over TCP port 22 | Collect operating system, hardware, software, and configuration data. | | SNMP scan | Discovery Application host | Network device | Outbound | SNMP over UDP port 161 | Collect standard and manufacturer-specific device inventory and configuration data. | | VMware vCenter scan | Discovery Application host | VMware vCenter Server | Outbound | HTTPS over TCP port 443 | Collect virtual machine, host, datastore, and related virtualization data. | ## Authentication and Target Access Use credentials that provide the access required by the selected probe. Coordinate with each target system owner to apply your organization's access and credential policies. | Target and Probe | Authentication | Required Access | Target Configuration | | --- | --- | --- | --- | | Windows with WMI | Windows local or domain account | Local administrator access on the target | Allow remote WMI access from the Discovery Application host. | | Windows with PowerShell Remoting | Windows local or domain account | Membership in the Administrators and Remote Management Users groups on the target | Turn on Windows Remote Management on the Discovery Application host and the target. | | Linux or Unix with SSH | Username and password or SSH key | SSH access and sudo access for hardware-level details | Turn on SSH access on the target. | | macOS with SSH | Username and password or SSH key | Access to run `system_profiler` | Turn on Remote Login and grant access to the scanning account. | | Network device with SNMP | SNMP v2c community string or SNMP v3 username and authentication settings | Read-only access to the full MIB, including the system MIB and the manufacturer’s enterprise MIB | Turn on SNMP on the target device. | | VMware vCenter Server | VMware vSphere credentials | Read-only access to the vCenter inventory | Allow HTTPS connectivity from the Discovery Application host. | For more information about adding authentication details in Salesforce, see [Create Discovery Credentials for Secure Scanning](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_create_cred.htm&release=264.0.0&type=5 "Use discovery credentials to securely connect to systems and collect data during agentless scans. Credentials authenticate access to devices, applications, and cloud environments without manual sign-in. Create and manage credentials for supported types such as Windows, SSH, SNMP, or AWS to ensure accurate and authorized discovery results."). For more information about selecting a probe and configuring a target, see [Configuration Fields for Target Categories and Probe Types](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_target_fields.htm&release=264.0.0&type=5 "Understand the configuration fields that define each agentless discovery target type. Identify which fields appear dynamically for different target category and probe types in the Configure Scan Target Details page so that you can configure discovery targets accurately.").