InfoQi

What are the recommended Anti-Virus and Firewall settings with Epicor Kinetic/ERP?

Do we need to allow or exclude any folder from real-time antivirus scanning, backup, or purge routines?

Below are lists of ports, processes, files, and folders that should be allowed.

PORTS

Client and Epicor IIS server(s) – TCP ports

• 808 (net.tcp) [For Kinetic/ERP deployments before Kinetic 2022.1]
• 443 (ssl/https) [For all Kinetic/ERP deployments and releases]

Epicor IIS server(s) – TCP ports

• 80 (default IIS/Reporting Services instance/legacy classic ERP help)
• 135 (Microsoft Remote Procedure Call / RPC Endpoint Mapper service). If using a firewall, allow inbound DTC connections port 135 on both the app server and the DB server. Allow all of the following rules.
  • Distributed Transaction Coordinator (RPC)
  • Distributed Transaction Coordinator (RPC-EPMAP)
  • Distributed Transaction Coordinator (TCP-In)
  •   
• 9010 (task agent service)
• 8172 (we check this port during the creation of appservers; webdeploy port)
• 8098/9098 (Enterprise Search)
• For Dynamic RPC Ports review https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-rpc-dynamic-port-allocation-with-firewalls

SQL / Reporting Services server(s) – TCP ports

• 80 (Default Reporting Services instance-HTTP)
• 135 (Microsoft Remote Procedure Call / RPC Endpoint Mapper service). See details above.
• 443 (Default Reporting Services instance – HTTPS)
• 1433 (default SQL server instance port)

EXTERNAL URLs

Client machines (or Terminal Server used by client connecting via Remote Desktop)

Confirm that the following URLs are not blocked by web-filtering software (e.g., Websense, Untangle, ZScaler, etc.), firewall, router, network appliance, etc.

• http & https://education.epicor.com (online legacy classic ERP embedded education site)
• http & https://erpvideo.epicor.com (online ERP Knowledge on Demand site)
• http & https://kinetichelp.epicor.com (online Kinetic application help)
• http & https://erphelp*.zendesk.com (online Kinetic application help)
• http & https://help.epicor.com (online legacy classic ERP application help between 10.2.300 and 10.2.700)
• http & https://qbuild.ca/ & https://www.qbuildsoftware.com/ (if using CADLink)
• https://api.nuget.org (required for the Epicor Administration Console when executing the Data Model Regeneration as of Kinetic 2022.1)

PROCESSES AND FOLDERS

Confirm that security software allows and excludes the following from any real-time scans.

MACHINE(S) WITH INSTALLED EPICOR CLIENTS

• Programs
  • EpiEOBrowser.exe
  • Autoupdate.exe
  • Epicor.exe
  • Epicor64.exe
  • Kinetic.exe
  • Kinetic64.exe
  • SessionManager.exe
• Folders
  • The Kinetic/ERP client folder(s)
    • by default: c:\epicor\ERPxxxClient
  • Client cache
    • by default: C:\ProgramData\Epicor and C:\programdata\Epicor Software Corporation
    • an alternate cache folder can be defined in the client’s .sysconfig file, e.g.
      • <AlternateCacheFolder value=”C:\clientcache\%username%” />
  • Azure AD
    • • C:\Users\<User>\AppData\Roaming\Epicor\AzureAD\<Version>\<AzureADWebAppID>\<AzureADNativeClientAppID>

EAC (Epicor Administration Console) machines

• Since ERP 10.1: C:\ProgramData\Epicor\AdministrationConsole
• For ERP 10.0: C:\Program Files (x86)\Common Files\Epicor Software Corporation\Epicor ERP Administration Console\Database Server Manager Snap-In

EPICOR APPLICATION SERVERS (IIS)

• The root IIS folder (by default: C:\inetpub)
• The root ERP folder (by default: C:\epicor\erp1X)
• The inetsrv process: (C:\Windows\sysem32\inetsrv\w3wp.exe)
• Database Manager Extensions
  Some customers have reported antivirus blocking specific functions such as Data Model Regen or DB Migration, so you may want to add the following directories and subdirectories, possibly because they contain some log files:
  • C:\Program Files (x86)\Common Files\Epicor Software\Database Manager Extensions\*\DataModelGenerator
  • C:\Program Files (x86)\Common Files\Epicor Software\Database Manager Extensions\*\DB Migration

EPICOR DATABASE SERVERS (MICROSOFT SQL)

• All folders that contain the SQL database files (ldfs/mdfs).
• The following processes (default paths are listed below):
  • %ProgramFiles%\Microsoft SQL Server\MSSQLxx.<Instance Name>\MSSQL\Binn\SQLServr.exe
  • %ProgramFiles%\Microsoft SQL Server\MSRSxx.<Instance Name>\Reporting Services\ReportServer\Bin\ReportingServicesService.exe
  • %ProgramFiles%\Microsoft SQL Server\MSASxx.<Instance Name>\OLAP\Bin\MSMDSrv.exe
• Note: Some customers reported Zero Trust products (e.g. CrowdStrike) suddenly blocking SSRS processes

Notes

---

• If using third-party or extension products with Kinetic/ERP, additional processes or ports may be allowed, for example:
  • For Mobile Warehouse review https://docs.biscit.com/epicor-kinetic-warehouse/epicor-kinetic-warehouse-installation-guide/ekw-installation-guide#id-9.-firewall-restrictions
• There may be additional requirements if Kinetic is used in an environment managed by Windows Active Directory, see https://learn.microsoft.com/en-US/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements
• The Asynchronous BPM process uses port 135. 
• RPC Dynamic Ports are used by the EAC when using Windows (SSO) authentication.
• Epicor cannot recommend using specific security solutions (Antivirus, Firewall, Zero Trust).
• Some of the directories mentioned in this article can be hidden/system folders, e.g. C:\ProgramData or C:\Users\<User>
• Following Sophos updates, some Sophos Intercept customers reported performance degradation with the Kinetic/ERP client; see KB0129749 Sophos Intercept X 2023.1.1.6 Degrades Performance after Windows Updates