Which NetBackup ports does your firewall team need to open? Cohesity's NetBackup Network Ports Reference Guide lists two default ports: 1556 (PBX, the Private Branch Exchange service) and 13724 (vnetd, the NetBackup network service). Add 443 from administrators' browsers to the primary server for the NetBackup web UI, then the ports for the features you actually use, such as deduplication, NDMP and VMware. NetBackup is a Cohesity product (formerly Veritas).

The core NetBackup ports

The guide lists each connection from source host to destination port:

Primary server to media servers and clients: 1556, plus 13724 where noted below.
Media servers to the primary server, other media servers and clients: 1556, plus 13724 where noted below. The guide lists further media server ports towards the primary and MSDP servers.
Clients to the primary server and to media servers: 1556, plus 13724 with Resilient Network.

Port 13724 is needed when the Resilient Network feature is used. For primary and media servers, it is also needed when a NetBackup 8.0 or earlier server cannot reach a legacy service through PBX. Since the guide lists connections that start from both servers and clients, expect to allow 1556 in both directions in most estates. Clients behind NAT are different: the guide says 1556 must be open from the client to the servers and need not be open from servers to clients, and the NetBackup Messaging Broker port (13781 by default) must be open from the client to the primary server.

For administration, the browser connects to the NetBackup web UI on 443 on the primary server. Port 13731 is used only when smart card authentication is configured.

Feature ports you may also need

Open these only if you use the feature:

Media Server Deduplication Pool (MSDP): 10082 (deduplication engine, spoold) and 10102 (deduplication manager, spad) between deduplication hosts. These are also needed between media servers and storage servers that perform optimised duplication.
Auto Image Replication (AIR) optimised duplication: TCP 1556, 10082 and 10102 between NetBackup domains (for an isolated recovery environment, only at the source domain).
Cloud storage from MSDP: the MSDP server connects to cloud storage on 443.
NDMP: TCP 10000 from the media server to the NDMP filer. For remote NDMP, the guide also requires the media server's SERVER_PORT_WINDOW range to be open from the filer to the media server.
VMware: 443 from the backup host to vCenter, and 902 from the backup host to the ESXi hosts for the NBD, NBDSSL and HotAdd transport modes.
Granular recovery (GRT): 111 (portmapper) and 7394 (nbfsd) from the client to the media server.

Connect Options and related settings can change how ports are selected, so check your configuration before finalising rules.

What this means for GCC customers

If your organisation segments its network into security zones, as is common in banking and other regulated sectors, many backup paths cross at least one firewall. The risk is rarely the core ports; it is the path nobody wrote down, such as a later deduplication pool, a DR site receiving replicated images, or a DMZ client behind NAT.

With change control that can take days, a missing rule may first show up as a failed restore during an incident. Many rule bases also carry older per-service ports from earlier NetBackup releases. Review those with your NetBackup team before removing them, because older clients or appliances in the estate may still depend on them.

A port matrix, agreed once between the backup and network teams and kept with your recovery runbook, avoids most of this.

Practical recommendations

Map every host by role and zone, including appliances, cloud targets and the DR site.
Start from the current guide for your release and add only the feature ports you use.
Write rules as source, destination and port, not any-to-any.
Plan NAT clients separately: 1556 from the client to the servers, and 13781 from the client to the primary server, as the guide's NAT section describes.
Test a backup and a restore after every firewall change.
Re-check after upgrades using the guide for the new release. Our post on NetBackup security advisories and the 11.2 upgrade covers why staying current matters.

Our NetBackup engineers can help you build a port matrix for your estate, and our backup and recovery team can design the network paths for a new Cohesity or NetBackup deployment.

Frequently asked questions

What is port 1556 in NetBackup?

It is the PBX (Private Branch Exchange) port, one of the two default ports in the Network Ports Reference Guide.

Which port does the NetBackup web UI use?

Administrators' browsers connect to the primary server on 443. Port 13731 is used only when smart card authentication is configured.

Do NetBackup firewall rules need to work in both directions?

For 1556, usually yes, because the guide lists connections that start from both servers and clients. Clients behind NAT are the exception: 1556 must be open from the client to the servers, not the reverse, plus 13781 from the client to the primary server.