Menu

KC firewall exceptions

This topic describes the firewall exceptions, enterprises must utilize, to extend beyond their own local and protected network domains and securely reach and connect to the Knox Configure server and its supporting Knox server resources. This topic contains the URLs and port numbers that require adding to the allowlist as a trusted site for enterprises attempting to reach destination Knox Configure servers.

These server resources can include the following Knox services:

  • Samsung license Servers — When you activate Knox services, devices need to verify their license keys. Devices periodically check their licenses a few times a week.
  • Samsung SDS IAM & EMM — If utilizing an EMM, devices will need to access Web based EMM consoles and storage sites.
  • Samsung ActiveSync Server — If using Exchange ActiveSync, you will require an ActiveSync Server connection so the Email client can successfully reach the ActiveSync Server.
NOTE — If your enterprise is highly regulated, and does not permit a connection with an external server, you can request an on-premise Knox Server, which handles license verification within your firewall. Samsung charges an extra fee for this service. For more information, contact your Samsung representative or reseller.

The following table lists the portal exemptions required for each listed Knox server resource:

Ports 443 and 80 must be open within your local network domain to reach Knox server resources.

NOTE — Knox Cloud Services can utilize both Amazon Web Services (AWS) and Google Firebase. Both services may also warrant adding to the allowlist within your organization's firewall policy.

For information on the AWS that may require allowlist inclusion, go to: https://ip-ranges.amazonaws.com/ip-ranges.json.

For information on the Google Firebase services that may require allowlist inclusion, go to: https://firebase.google.com/docs/cloud-messaging/concept-options#ports_and_your_firewall.

The following table lists the portal exemptions required for each listed Knox server resource:

URL Port Knox server resource

*.samsungknox.com*

*.secb2b.com

 443/80

Knox Configure

Knox Identity Management

Single Sign On (SSO)

Knox Portal
*.samsung.com 443/80

Knox Partner Portal

Samsung Account

License servers for Knox products

The following Knox license server resources may be required to add to the allowlist depending on your organization's IT policies. Additionally, if your organization's IT policy restricts the use of a (*) to abbreviate a domain name, the FQDN may be required to reach a Knox license server. Refer to the following for license server destinations per region:

Global

URL Port
analytics.samsungknox.com -
prod-knoxlog.secb2b.com -
account.samsung.com 80|443

Americas

URL Port
gslb.secb2b.com 443
gsl.samsunggsl.com 443
us-elm.secb2b.com 443
us-prod-klm-b2c.secb2b.com 443
us-prod-klm.secb2b.com 443
usprod-knoxlog.secb2b.com -

EMEA

URL Port
gslb.secb2b.com 443
gsl.samsunggsl.com 443
eu-elm.secb2b.com 443
eu-prod-klm-b2c.secb2b.com 443
eu-prod-klm.secb2b.com 443
euprod-knoxlog.secb2b.com -

China

URL Port
china-gslb.secb2b.com.cn 443
china-elm.secb2b.com.cn 443
china-b2c-klm.secb2b.com.cn 443
china-prod-klm.secb2b.com.cn 443

Networking requirements for Knox cloud services

The following Knox network resources may need to be added to the allowlist depending on your organizations IT policies. Additionally, if your organization's IT policy restricts the use of a (*) to abbreviate a domain name, the FQDN may be required to reach a Knox network deployment resource. Refer to the following for per region:

Global

URL Port
knoxservices.secb2b.com 80|443
pinning.secb2b.com 80|443
pinning-02.secb2b.com 80|443
eula.secb2b.com 80|443
umc-cdn.secb2b.com 80|443
me.samsungknox.com 80|443
configure.samsungknox.com 80|443
custom.samsungknox.com 80|443
kcc-prod-repo.s3.amazonaws.com 80|443
klms-dev.s3.amazonaws.com 443
eu-api.samsungknox.com -

Americas

URL Port
us-kc-portal.samsungknox.com 443
us-kc.samsungknox.com 443
us-kcc.samsungknox.com 443
us-segd-api.secb2b.com 443
us-segp-api.secb2b.com 443
us-segm-api.secb2b.com 443
us-kme.samsungknox.com -
us-kme-api.samsungknox.com -
us-kme-api-mssl.samsungknox.com -
us-kme-reseller.samsungknox.com -

EMEA

URL Port
eu-kcc.samsungknox.com 443
eu-kc-portal.samsungknox.com 443
eu-kc.samsungknox.com 443
eu-prod-bulk.secb2b.com 80|443
eu-segd-api.secb2b.com 80|443
eu-segp-api.secb2b.com 80|443
eu-segm-api.secb2b.com 80|443
eu-kme.samsungknox.com -
eu-kme-api.samsungknox.com -
eu-kme-api-mssl.samsungknox.com -
eu-kme-reseller.samsungknox.com -

China

URL Port
china-segd-api.secb2b.com.cn 443
myknoxapk.blob.core.chinacloudapi.cn 80|443