What are common firewall rules needed for distributed scans?

To support a Distributed Scan in the Spirion Sensitive Data Platform, you must configure firewall rules to allow communication between the Discovery Agent, the Search Agents (Workers), and the Spirion Sensitive Data Platform console.

The architecture relies on a Postgres-backed queueing model where the Discovery Agent hosts the "work" and Search Agents connect to it to claim tasks.

1. Internal Network (Agent-to-Agent)

These rules must be open on the Discovery Agent's local firewall and any network firewalls between the Discovery Agent and the Search Agents.

Direction	Port	Protocol	Purpose
Inbound to Discovery	6433	TCP	pgBouncer (Critical): Search Agents connect here to check out work from the job queue.
Inbound to Discovery	5433	TCP	PostgreSQL: Used for direct database management and initialization (usually local, but sometimes needed for remote troubleshooting).
Inbound to Discovery	8080 / 443	TCP	Agent Communication: In some configurations, agents use these ports to coordinate status or heartbeat if not going through the console.

2. External Network (Agent-to-Spirion Sensitive Data Platform)

All agents (Discovery and Search) must be able to communicate with the Spirion Cloud Console. These are typically Outbound rules.

Direction	Port	Protocol	Destination	Purpose
Outbound	443	HTTPS	`*.spirion.com`	Policy & Reporting: Downloading scan instructions and uploading results/telemetry.
Outbound	443	HTTPS	`*.amazonaws.com`	Storage/Ingress: Results are often shipped to an S3-backed Ingress service.

3. Target Access (Discovery Agent only)

The Discovery Agent requires specific permissions to crawl the Target locations.

For example:

File Shares (SMB): Ports 139 and 445 (TCP/UDP) must be open from the Discovery Agent to the File Server.
SharePoint/O365: Port 443 (HTTPS) must be open to Microsoft's cloud URLs.
SQL Databases: Port 1433 (TCP) for MS SQL, or the specific port for Oracle/MySQL/etc.

Common Pitfalls and Troubleshooting

The "Ephemeral Port" Issue: Ensure that the Discovery Agent machine isn't blocking the high-range ports used by Windows for dynamic RPC communication if scanning remote Windows targets.
Postgres Binding: By default, the Spirion Postgres instance binds to the IP address of the Discovery Agent. If the agent has multiple NICs, ensure the firewall rule matches the IP registered in the SDP Console.
SSL Inspection: Deep Packet Inspection (DPI) or SSL Inspection on firewalls/proxies can break the connection to SDP Cloud. Ensure *.spirion.com is bypassed or the Spirion certificate is trusted.
Verification Command: From a Search Agent machine, run this PowerShell command to test connectivity to the Discovery Agent:
Test-NetConnection [Discovery_Agent_IP] -Port 6433
- If this returns TcpTestSucceeded : False, the Search Agent will log the "Unable to find job queue" error you saw earlier.

Summary for your specific error