This topic describes the firewall exceptions enterprises must utilize to extend beyond their own local and protected network domains and securely reach and connect to the Knox Mobile Enrollment server and its supporting Knox server resources. This topic contains the URLs and port numbers that require allowance of a trusted site for enterprises attempting to reach destination Knox servers.
These server resources can include the following Knox services:
- Samsung license Servers — When you activate Knox services, devices need to verify their license keys. Devices periodically check their licenses a few times a week.
- Samsung SDS IAM & EMM — If utilizing an EMM, devices will need to access Web based EMM consoles and storage sites.
- Samsung ActiveSync Server — If using Exchange ActiveSync, you will require an ActiveSync Server connection so the Email client can successfully reach the ActiveSync Server.
Ports 443 and 80 must be open within your local network domain to reach Knox server resources.
For information on the AWS that may require allowlist inclusion, go to: https://ip-ranges.amazonaws.com/ip-ranges.json.
For information on the Google Firebase services that may require allowlist inclusion, go to:https://firebase.google.com/docs/cloud-messaging/concept-options#ports_and_your_firewall.
The following table lists the portal exemptions required:
| URL | Port | Knox server resource |
|
*.samsungknox.com * *.secb2b.com |
443/80 |
Knox Mobile Enrollment Knox Identity Management Single Sign On (SSO) Knox Portal |
| *.samsung.com | 443/80 |
Knox Partner Portal Samsung Account |
License servers for Knox products
The following Knox license server resources may require an allowlist depending on your organization's IT policies. Additionally, if your organization's IT policy restricts the use of a (*) to abbreviate a domain name, the FQDN may be required to reach a Knox license server. Refer to the following license server destinations per region:
Global
| URL | Port | |
| analytics.samsungknox.com | - |
|
| prod-knoxlog.secb2b.com | - |
|
| account.samsung.com | 80|443 |
|
Americas
| URL | Port | |
| gslb.secb2b.com | 443 |
|
| gsl.samsunggsl.com | 443 | |
| us-elm.secb2b.com | 443 |
|
| us-prod-klm-b2c.secb2b.com | 443 |
|
| us-prod-klm.secb2b.com | 443 |
|
| usprod-knoxlog.secb2b.com | - |
|
EMEA
| URL | Port | |
| gslb.secb2b.com | 443 |
|
| gsl.samsunggsl.com | 443 | |
| eu-elm.secb2b.com | 443 |
|
| eu-prod-klm-b2c.secb2b.com | 443 |
|
| eu-prod-klm.secb2b.com | 443 |
|
| euprod-knoxlog.secb2b.com |
- |
|
China
| URL | Port | |
| china-gslb.secb2b.com.cn | 443 |
|
| china-elm.secb2b.com.cn | 443 |
|
| china-b2c-klm.secb2b.com.cn | 443 |
|
| china-klm.secb2b.com.cn | 443 |
|
Networking requirements for Knox cloud services
The following Knox network resources may require an allowlist depending on your organization's IT policies. Additionally, if your organization's IT policy restricts the use of a (*) to abbreviate a domain name, the FQDN may be required to reach a Knox deployment resource. Refer to the following per region:
Global
| URL | Port | |
| knoxservices.secb2b.com | 80|443 |
|
| pinning.secb2b.com | 80|443 |
|
| pinning-02.secb2b.com | 80|443 |
|
| eula.secb2b.com | 80|443 |
|
| umc-cdn.secb2b.com | 80|443 |
|
| me.samsungknox.com | 80|443 |
|
| configure.samsungknox.com | 80|443 |
|
| custom.samsungknox.com | 80|443 |
|
| kcc-prod-repo.s3.amazonaws.com | 80|443 |
|
| klms-dev.s3.amazonaws.com | 443 |
|
| eu-api.samsungknox.com | - |
|
Americas
| URL | Port | |
| us-kc-portal.samsungknox.com | 443 |
|
| us-kc.samsungknox.com | 443 |
|
| us-kcc.samsungknox.com | 443 |
|
| us-segd-api.secb2b.com | 443 |
|
| us-segp-api.secb2b.com | 443 |
|
| us-segm-api.secb2b.com | 443 |
|
| us-kme.samsungknox.com | - |
|
| us-kme-api.samsungknox.com | - |
|
| us-kme-api-mssl.samsungknox.com | - |
|
| us-kme-reseller.samsungknox.com | - |
|
EMEA
| URL | Port | |
| eu-kcc.samsungknox.com | 443 |
|
| eu-kc-portal.samsungknox.com | 443 |
|
| eu-kc.samsungknox.com | 443 |
|
| eu-prod-bulk.secb2b.com | 80|443 |
|
| eu-segd-api.secb2b.com | 80|443 |
|
| eu-segp-api.secb2b.com | 80|443 |
|
| eu-segm-api.secb2b.com | 80|443 |
|
| eu-kme.samsungknox.com | - |
|
| eu-kme-api.samsungknox.com | - |
|
| eu-kme-api-mssl.samsungknox.com | - |
|
| eu-kme-reseller.samsungknox.com | - |
|
China
| URL | Port | |
| china-segd-api.secb2b.com.cn | 443 |
|
| umcfs.samsungknox.cn | 443 |
|
