Firewall requirements for day2 tasks in VCF 9.1

When VCF 9.1 Fleet is deployed in a fully firewalled, network isolated zone, customers often need a detailed communication matrix before running day-2 operations. They will need to know the exact source and destination IPs, ports, and protocols for specific workflows/tasks.
For example:
VCF SSO Setup: Which source component IPs will communicate with the external IdP server, and on which ports?
Offline Depot Configuration: Which source component IPs and ports must be allowed to communicate with the offline depot?

While the official VMware Ports and Protocols site covers traffic requirements between internal VCF 9.1 components, it doesn’t detail external integrations. We still need to document required ports and protocols for external dependencies like Identity Providers (Ping, Entra ID), Active Directory, Microsoft CA, offline depots, and SFTP backup targets.

On a recent project, we had to put together a firewall request matrix detailing the source IPs, ports, and protocols for these external connections. Providing this information allowed the customer’s network team to implement the required firewall rules so we could move forward with day-2 tasks.

Here is the list we used. Please note that this may not cover every single external connection or Day-2 scenario, but these settings worked successfully in our environment.

Please note that this may not cover every single external connection or Day-2 scenario, but these settings worked successfully in our environment.

*How do you find the fleet components FQDN, please refer the below screenshot.

**How do you find the VIDB FQDN?

I hope you find something helpful in this blog, Thank you for reading.