Private network connectors

This page's changes and edits · All guidance changes

Microsoft's edit · 28 Sep 03:23 UTC

Revise TCP port range configuration guidance

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 78a31c7 · +61 ~~−13~~ lines · also on GitHub

⋯ 127 unchanged lines

128128

129129 For guidance on where to install connectors and how to optimize your network, see [Optimize traffic flow with Microsoft Entra application proxy](../identity/app-proxy/application-proxy-network-topology.md).

130130

131 −## Expanding ephemeral port range

131 +## Configure dynamic and AutoReuse TCP port ranges

132132

133 −Private network connectors initiate TCP and UDP connections to designated destination endpoints. These connections require available source ports on the connector host machine. Expanding the ephemeral port range can improve the availability of source ports, particularly when you're managing a high volume of concurrent connections.

133 +Private network connectors initiate outbound TCP and UDP connections to configured destinations. Each connection requires an available source port on the connector host.

134 +

135 +For high-volume TCP workloads, configure separate, non-overlapping dynamic and AutoReuse port ranges:

136 +- **Dynamic TCP range**: 49152–65535 (16,384 ports)

137 +- **AutoReuse TCP range**: 10000–49151 (39,152 ports)

138 +

139 +The AutoReuse range improves TCP connection scalability by allowing eligible outbound connections to reuse a local source port when the complete connection tuple—source IP, source port, destination IP, and destination port—remains unique.

140 +

141 +> [!IMPORTANT]

142 +> The dynamic and AutoReuse TCP ranges must not overlap.

143 +

144 +Before you begin:

145 +- Use Windows Server 2016 or later.

146 +- Run the commands from an elevated PowerShell session.

147 +- Confirm that ports 10000–49151 aren't required by applications installed on the connector server.

148 +- Review the excluded TCP port ranges:

134149

135 −To view the current dynamic port range on a system, use the following `netsh` commands:

150 +```

151 +netsh int ipv4 show excludedportrange tcp

152 +netsh int ipv6 show excludedportrange tcp

153 +```

154 +

155 +### Configure the port ranges

156 +

157 +**Configure the dynamic TCP range**

136158

137 −- `netsh int ipv4 show dynamicport tcp`

138 −- `netsh int ipv4 show dynamicport udp`

139 −- `netsh int ipv6 show dynamicport tcp`

140 −- `netsh int ipv6 show dynamicport udp`

159 +```

160 +netsh int ipv4 set dynamicport tcp start=49152 num=16384

161 +netsh int ipv6 set dynamicport tcp start=49152 num=16384

162 +```

163 +

164 +**Configure the AutoReuse TCP range**

141165

142 −Here are sample `netsh` commands to increase the ports:

166 +```

167 +Set-NetTCPSetting `

168 + -SettingName Internet,Datacenter,Compat `

169 + -AutoReusePortRangeStartPort 10000 `

170 + -AutoReusePortRangeNumberOfPorts 39152

171 +```

143172

144 −- `netsh int ipv4 set dynamicport tcp start=1025 num=64511`

145 −- `netsh int ipv4 set dynamicport udp start=1025 num=64511`

146 −- `netsh int ipv6 set dynamicport tcp start=1025 num=64511`

147 −- `netsh int ipv6 set dynamicport udp start=1025 num=64511`

173 +### Verify the configuration

148174

149 −These commands set the dynamic port range from 1025 to the maximum of 65535. The minimum start port is 1025.

175 +```

176 +netsh int ipv4 show dynamicport tcp

177 +netsh int ipv6 show dynamicport tcp

178 +

179 +Get-NetTCPSetting -SettingName Internet,Datacenter,Compat |

180 + Select-Object SettingName,

181 + DynamicPortRangeStartPort,

182 + DynamicPortRangeNumberOfPorts,

183 + AutoReusePortRangeStartPort,

184 + AutoReusePortRangeNumberOfPorts

185 +```

186 +

187 +Expected values:

188 +

190 +|---|---|---|---|

191 +|Dynamic TCP range|49152|16384|65535|

192 +|AutoReuse TCP range|10000|39152|49151|

193 +

194 +> [!NOTE]

195 +> AutoReuse allows the same source port to be used for simultaneous connections to different destinations. Connections from the same connector IP to the same resolved destination IP and port still require different source ports. Sustained high connection volume to a single destination can therefore still exhaust the available source ports.

196 +> A destination can be configured as an IP address or a fully qualified domain name (FQDN). For an FQDN, Windows establishes the connection to the IP address returned by DNS resolution.

197 +> AutoReuse applies only to TCP. UDP continues to use its configured dynamic port range.

150198

151199 ## Specifications and sizing requirements

152200

⋯ 79 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:51 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.