[slimbim]

1. Do we need to open port 3101 for Outbound traffic, Inbound, or both?
2. Can we just open the port only to srp.na.blackberry.net?

[x14]

You need to open port 3101 outbound only to srp.na.blackberry.net

[slimbim]

Ok Thanks.
Just curious, if only outbound is open, how does email sent from the device or MDS services etc get to the Blackberry server?

[x14]

Livelink - Redirection

[slimbim]

Thank you for the link to the security doc.

Under the "Receiving an email message on the BlackBerry device" (p.16), it says that the BES maintains "a constant, direct outbound TCP/IP connection" on port 3101. But in "Sending an email message from the BlackBerry device" on the following page, it says "The connection from the Blackberry Enterprise Server to the BlackBerry Infrastructure is a two-way TCP connection on port 3101."

So I guess 3101 needs to be open for both Outbound and Inbound if I also want to receive messages sent from the device?

[Logvin]

Originally Posted by x14

You need to open port 3101 outbound only to srp.na.blackberry.net

I'd recommend *highly* against srp.na.blackberry.net. I realize it used to be the de-facto standard, but its not anymore. If you are in the US, use srp.us.blackberry.net. RIM recently moved to a "high availability" infrastructure, and if there were an emergency, you would want your BES to be able to hit the right DNS entry and get your BES connected again... the NA doesnt cut it anymore.

FYI

[BBAdmin]

And if you're not in the US you can use srp.ap.blackberry.net for Asia Pasific and srp.eu.blackberry.net for the European relay (when I've seen at RIM's head office - very cool)!!

[dah605]

Originally Posted by slimbim

So I guess 3101 needs to be open for both Outbound and Inbound if I also want to receive messages sent from the device?

You only need outbound. A persistent TCP connection is opened to the SRP server from the BES. Once the connection is established, the systems can communicate back and forth. The existing connection is used when you send an email from the device.

[slimbim]

Thank you, makes sense.

As far as the srp address, when I lookup all of the individual country srp addresses, they all resolve to the regional ones. For instance, srp.us.blackberry.net and srp.ca.blackberry.net both resolve to same address as srp.na.blackberry.net. Same for the european country srp addresses resolving to srp.eu.blackberry.net. All of the country specific srp addresses are just aliases pointing to the regional ones. So I guess definitely safer to point to the country specific ones as it seems they can just swing it to point to something else if for some reason NA NOC is not available.