> For the complete documentation index, see [llms.txt](https://docs.amitysolutions.com/ekoai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.amitysolutions.com/ekoai/getting-started/eko/eko-ad-sync/prerequisites-and-installation-requirements/firewall-and-network-access-policy.md).

# Firewall and Network Access Policy

The installation of the Eko Active Directory Connector (EkoADC) requires the customer to define network access control policies. Since EkoADC is deployed within the Customer Data Center (on-premises), the customer's firewall must be configured to allow specific inbound and outbound traffic to enable user synchronization and authentication.

EkoADC supports synchronization directly from Active Directory or from a CSV file format from the customer’s file sharing system (in which case the customer must include the AD user in the file for authentication purposes).

The required firewall policies ensure connectivity between EkoADC and both the Eko (external communication) and the local AD (internal communication).

## 1. Required Network Access Control Policies

The following table details the necessary communication pathways that must be permitted on the customer's network:

<table><thead><tr><th width="98.6875">Direction</th><th width="131.5078125">Source</th><th width="137.2578125">Destination</th><th width="145.59375">Port/Protocol</th><th>Purpose</th></tr></thead><tbody><tr><td>Outbound</td><td>EkoADC</td><td>Internet (Any)</td><td>TCP/443 (HTTPS)</td><td>Communication with Eko/IDMAPI (Sending sync data)</td></tr><tr><td>Inbound</td><td>Internet (Any) / Customer Proxy</td><td>EkoADC</td><td>TCP/443 (HTTPS)</td><td>Webhook/API communication (For EkoIDMAPI to send requests to EkoADC, such as authentication requests)</td></tr><tr><td>Internal</td><td>EkoADC</td><td>Customer AD</td><td>TCP/389 (LDAP)</td><td>User synchronization and authentication using standard LDAP</td></tr><tr><td>Internal</td><td>EkoADC</td><td>Customer AD</td><td>TCP/636 (LDAPS)</td><td>Secure User synchronization and authentication (LDAPs is recommended)</td></tr><tr><td>Internal</td><td>EkoADC</td><td>Customer Time Server</td><td>TCP/123, UDP/123 (NTP)</td><td>Time synchronization</td></tr><tr><td>Internal</td><td>EkoADC</td><td>Customer DNS Server</td><td>UDP/53 (DNS)</td><td>DNS resolution (e.g., resolving the AD Server or Eko Cloud endpoints)</td></tr><tr><td>Outbound</td><td>EkoADC</td><td>FTP Server</td><td>TCP/FTP, TCP/FTPs</td><td>File sync for user profiles (Required if user data is sourced from an HR file system via FTP/SFTP)</td></tr><tr><td>Outbound</td><td>EkoADC</td><td>Proxy Server</td><td>TCP/8080 (Proxy Port)</td><td>If required, for external communication through a Customer Proxy Server</td></tr></tbody></table>

## 2. Proxy Configuration

If the customer utilizes a proxy server for external internet access, the EkoADC configuration supports defining this access. The configuration requires specifying the proxy protocol, host, port, username, and password.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.amitysolutions.com/ekoai/getting-started/eko/eko-ad-sync/prerequisites-and-installation-requirements/firewall-and-network-access-policy.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.