SQL Server 2008 Books Online (October 2009)
How to: Configure Windows Firewall for Analysis Services Access

Windows Firewall system prevents unauthorized access to computer resources. To access an instance of Analysis Services through this firewall you must configure the firewall to enable access. There are many firewall systems available. If you are running a firewall other than Windows Firewall, consult your firewall documentation for information that is specific to your system. The information that follows is specific to Windows Firewall.

You must configure Windows Firewall to enable access to the relevant port for authorized users or computers, including configuring Analysis Services to use a specific TCP/IP port. The default instance of Analysis Services uses port 2383, but that can be changed. Named instances of Analysis Services use dynamic ports. For more information about how to configure for the use of a specific port, see How to: Configure a Server to Listen on a Specific TCP Port (SQL Server Configuration Manager). If you are running a default instance of Analysis Services only, using the SQL Server Browser service is optional. To use SQL Server Browser, you must open UDP port 1434.

ms174937.note(en-us,SQL.100).gifNote:
By default, Microsoft Windows XP Service Pack 2 enables the Windows Firewall, which closes port 2383 to prevent Internet computers from connecting to your computer. Connections to Analysis Services over the Internet using TCP/IP will not work unless you reopen port 2383. For more information, see your Windows documentation.

For more information about the default Windows firewall settings, and a description of the TCP ports that affect the Database Engine, Analysis Services, Reporting Services, and Integration Services, see Configuring the Windows Firewall to Allow SQL Server Access.

To configure the Windows XP Firewall or Windows Server 2003 Firewall

  1. In Control Panel, double-click Windows Firewall.

  2. In the Windows Firewall dialog box, click the Exceptions tab, and then click Add Port.

  3. The Add a Port dialog box opens. In the Name box, type Analysis Services.

  4. In the Port Number box, type the port number of the Analysis Services instance, for example, 2383, for the default instance.

  5. Make sure that TCP is selected, and then click OK.

ms174937.note(en-us,SQL.100).gifNote:
If you are running named instances of Analysis Services, you must make sure the port number for that named instance is listed as an exception and that SQL Server Browser service is also listed as an exception.

To open the port to make available the SQL Server Browser service

  1. In Control Panel, double-click Windows Firewall.

  2. In the Windows Firewall dialog box, click the Exceptions tab, and then click Add Port.

  3. The Add a Port dialog box opens. In the Name box, type SQL Server Browser.

  4. In the Port Number box, type 1434.

  5. Select UDP, and then click OK.

ms174937.note(en-us,SQL.100).gifNote:
Click Add Program in the Windows Firewall dialog box for additional options, such as granting access to specific programs, and restricting access to certain IP addresses or network subnets. For more information, see your Windows documentation.

See Also

Other Resources

How to: Configure a Windows Firewall for Database Engine Access
SQL Server Browser Service

Help and Information

Getting SQL Server 2008 Assistance
Tags :


Community Content

Thomas Lee
Interesting Firewall issue using SSMS

If you scope your firewall using IPv4 restrictions we found a troublesome side effect. When using SSMS on vista to connect to the database engine on port 1433, SSMS first tries IPv4 (which the firewall scope permits) and communication proceeds. When using SSMS on vista to connect to the analysis services engine on 2383 it first tries IPv6, then fails over to IPv4. Because our firewall exemption is scoped to IPv4 the initial IPv6 traffic is firewall blocked. Unfortunately, it seems to take about 15 secs before SSMS admits defeat on IPv6 and switches to IPv4, and the default connection timeout in SSMS is 15 secs, so you will receive an error when attempting to hit the analysis services engine. Increasing the connection timeout to 20-30 seconds (from 15) gives sufficient time for IPv6 communication to fail, rollover to IPv4, and successfuly communication to occur.

Very curious why SQL development team decided communication to one engine should do IPv4 - then IPv6, and swap methods to the other engine.

Anyways, IPv4 scoped firewall exemptions to analysis services will require increasing the default connection timeout of the client to provide sufficient time for protocol failure/rollover to occur.


Page view tracker