# Network Requirements

ARKSSPR is a self-service password reset and account unlock solution that integrates with Active Directory.\
For successful operation, certain network configurations and firewall permissions must be in place.

### **Default & Configurable Parameters**

* The ports and protocols listed in this document are **default values**.
* **E-Mail (SMTP), Syslog, and database connections** are configurable according to your environment.
* The ARKSSPR web application can be published via **any custom port** according to deployment requirements.
* Optional integrations (Syslog, remote DB, SMS) require corresponding outbound firewall permissions.

### **Network Communication Requirements**

| **Source**                   | **Direction** | **Destination**                     | **Protocol** | **Port(s)** | **Purpose**                         |
| ---------------------------- | ------------- | ----------------------------------- | ------------ | ----------- | ----------------------------------- |
| Internal ARKSSPR Server      | -->           | Internet (`license.arksoft.com.tr`) | TCP          | 443         | License validation                  |
| DMZ ARKSSPR Server           | -->           | Internal ARKSSPR Server             | TCP          | 80, 443     | Web traffic relay                   |
| Internal Clients             | -->           | Internal ARKSSPR Server             | TCP          | 80, 443     | User access to ARKSSPR portal       |
| Internet Clients             | -->           | DMZ ARKSSPR Server                  | TCP          | 80, 443     | External user access (if published) |
| Internal ARKSSPR Server (\*) | -->           | E-Mail Server                       | TCP          | 587         | <p>OTP emails<br>Report Mails</p>   |
| Internal ARKSSPR Server      | -->           | Database Server                     | TCP          | 1433        | Database connectivity               |
| Internal ARKSSPR Server      | -->           | Syslog Server                       | UDP          | 514         | Security and audit log forwarding   |
| Internal ARKSSPR Server      | <-->          | SMS Provider                        | HTTPS (TCP)  | 443         | Sending SMS-based OTP codes         |

`(*)` Outbound SMTP port may vary depending on configuration (25, 465, or 587).

### **Additional Communication (Domain Integration)**

| **Communication**                         | **Protocol** | **Port(s)**                   | **Purpose**                                |
| ----------------------------------------- | ------------ | ----------------------------- | ------------------------------------------ |
| ARKSSPR Web Server ↔ Active Directory DCs | LDAP / LDAPS | 389 / 636                     | User authentication, password change/reset |
| ARKSSPR Web Server ↔ Active Directory DCs | Kerberos     | 88                            | Authentication and ticket granting         |
| ARKSSPR Web Server ↔ Active Directory DCs | RPC / SMB    | 135, 445, dynamic 49152–65535 | AD management operations                   |
| ARKSSPR Web Server ↔ NTP Server           | NTP          | 123                           | Time synchronization                       |

### **Firewall & Security Considerations**

* Restrict inbound access to ARKSSPR portal to authorized networks or VPN users.
* Use **LDAPS (636)** instead of plain **LDAP (389)** where possible for secure directory communication.
* For RPC dynamic ports, limit firewall rules to the necessary range.
* Ensure **TLS 1.2 or higher** is enabled on the ARKSSPR server and client browsers.

### **High Availability / Load Balancer Notes**

* If deploying behind a load balancer, enable **session persistence (sticky sessions)**.
* All HA nodes must have identical firewall and port access configuration.

```
[User Browser] → HTTPS(443*) → [ARKSSPR Web Server] → LDAP/LDAPS/Kerberos/RPC → [AD DCs]
                                                 ↘ SMTP(587*) → [Mail Server]
                                                 ↘ HTTPS(443*) → [SMS Provider]
                                                 ↘ HTTPS(443) → [License Server]
                                                 ↘ Syslog(514*) → [Syslog Server]
                                                 ↘ TCP(1433*) → [Database Server]

```