Menu

KC Firewall exceptions

This topic describes the firewall exceptions enterprises must utilize to extend beyond their local and protected network domains to securely connect to the Knox Configure server resources.

Server resources can include the following Knox services:

  • Samsung license Servers — When activating Knox services, devices need to verify their license keys. Devices periodically check their licenses a few times a week.
  • Samsung SDS IAM & EMM — When utilizing an EMM, devices need to access Web based EMM consoles and storage sites.
  • Samsung ActiveSync Server — If using Exchange ActiveSync, you'll require an ActiveSync Server connection for the Email client to reach the ActiveSync Server.
NOTE — For highly regulated enterprises that don't permit connection to an external server, an alternate solution is the on-premise Knox Server. On-premise servers handle license verification within your firewall. Samsung charges an extra fee for this service. For more information, contact your Samsung reseller.

The following table lists the portal exemptions required for each listed Knox server resource:

Ports 443 and 80 must be open within your local network domain to reach Knox server resources.

NOTE - Knox Cloud Services can utilize both Amazon Web Services (AWS) and Google Firebase. Both services may also warrant whitelisting within your organization's firewall policy.

For information on the AWS that may require whitelist inclusion, go to: https://ip-ranges.amazonaws.com/ip-ranges.json.
For information on the Google Firebase services that may require whitelist inclusion, go to:https://firebase.google.com/docs/cloud-messaging/concept-options#ports_and_your_firewall.

The following table lists the portal exemptions required for each listed Knox server resource:

Firewall exceptions requirements

The following are the URLs and port numbers that require whitelisting as a trusted site for enterprises attempting to reach destination Knox Configure servers.

The following table lists the portal exemptions required for each listed Knox server resource:

URL Port Knox server resource

*.samsungknox.com *

*.secb2b.com

443/80

Knox Configure

Knox Identity Management

Single Sign On (SSO)

Knox Portal

*.samsung.com 443/80

SEAP

Samsung Account

 

NOTE — Knox Configure can use Firebase Cloud Messaging (FCM), which require its own unique firewall exceptions. For more information on these unique firewall exceptions, go to the Google Firebase documentation page on FCM ports and your firewall.

License servers for Knox products

Depending on your organization's IT policies, you may need to whitelist the following Knox license server resources.

If your IT policy restricts the use of a (*) to abbreviate a domain name, you may need to use the Fully Qualified Domain Name (FQDN) to reach a Knox license server.

Global

URL Port  
analytics.samsungknox.com -

 

prod-knoxlog.secb2b.com -

 

account.samsung.com 80|443

 

Americas

URL Port  
gslb.secb2b.com 443

 

us-elm.secb2b.com 443

 

us-prod-klm-b2c.secb2b.com 443

 

us-prod-klm.secb2b.com 443

 

usprod-knoxlog.secb2b.com -

 

EMEA

URL Port  
gslb.secb2b.com 443

 

eu-elm.secb2b.com 443

 

eu-prod-klm-b2c.secb2b.com 443

 

eu-prod-klm.secb2b.com 443

 

euprod-knoxlog.secb2b.com

-

 

China

URL Port  
china-gslb.secb2b.com.cn 443

 

china-elm.secb2b.com.cn 443

 

china-b2c-klm.secb2b.com.cn 443

 

china-prod-klm.secb2b.com.cn 443

 

Networking requirements for Knox cloud services

Global

URL Port  
knoxservices.secb2b.com 80|443

 

pinning.secb2b.com 80|443

 

pinning-02.secb2b.com 80|443

 

eula.secb2b.com 80|443

 

umc-cdn.secb2b.com 80|443

 

me.samsungknox.com 80|443

 

configure.samsungknox.com 80|443

 

custom.samsungknox.com  80|443

 

kcc-prod-repo.s3.amazonaws.com 80|443

 

klms-dev.s3.amazonaws.com 443

 

eu-api.samsungknox.com -

 

Americas

URL Port  
us-kc-portal.samsungknox.com 443

 

us-kc.samsungknox.com 443

 

us-kcc.samsungknox.com 443

 

us-segd-api.secb2b.com 443

 

us-segp-api.secb2b.com 443

 

us-segm-api.secb2b.com 443

 

us-kme.samsungknox.com -

 

us-kme-api.samsungknox.com -

 

us-kme-api-mssl.samsungknox.com -

 

us-kme-reseller.samsungknox.com -

 

EMEA

URL Port  
eu-kcc.samsungknox.com 443

 

eu-kc-portal.samsungknox.com 443

 

eu-kc.samsungknox.com 443

 

eu-prod-bulk.secb2b.com 80|443

 

eu-segd-api.secb2b.com 80|443

 

eu-segp-api.secb2b.com 80|443

 

eu-segm-api.secb2b.com 80|443

 

eu-kme.samsungknox.com -

 

eu-kme-api.samsungknox.com -

 

eu-kme-api-mssl.samsungknox.com -

 

eu-kme-reseller.samsungknox.com -

 

China

URL Port  
china-segd-api.secb2b.com.cn 443

 

myknoxapk.blob.core.chinacloudapi.cn 80|443