Azure HPC Cache
An Azure service that provides file caching for high-performance computing.
28 questions
How do I configure HPC-PACK-NODE-COMMUNICATION from using TFTP port 69?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(172.8, 64%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES6%3C/text%3E%3C/svg%3E)
sam-6271
5
Reputation points
My security team informs me that HPC-PACK-NODE-COMMUNICATION appears to be using TFTP on port 69 for UDP communications on my Head node: Windows Server 2019 (1809).
Appendix 1: HPC Cluster Networking does not mention such communication in the list of "Firewall ports that are required for cluster services".
Kindly elaborate on what HPC-PACK-NODE-COMMUNICATION is (I presume it deals with certificate communications between nodes), which firewall ports need to be open on which network(s) for each Network Topology, and how to avoid using TFTP or its ports.
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(304, 6%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKD%3C/text%3E%3C/svg%3E)
Keshavulu Dasari 2,835 Reputation points Microsoft Vendor2025-01-07T01:00:04.38+00:00 Hi sam-6271 ,
Greetings & Welcome to Microsoft Q&A forum! Thanks for posting your query!
HPC-PACK-NODE-COMMUNICATION is part of the Microsoft HPC Pack, which is used for managing and running high-performance computing (HPC) clusters. It typically handles communication between the head node and compute nodes,
For HPC Pack communication, the following ports are generally required:
- TCP 443: Used for secure communication between nodes.
- TCP 8040-8041: Used for job scheduler and management.
- TCP 9090: Used for HPC Cluster Manager.
- TCP/UDP 3389: Used for Remote Desktop Protocol (RDP) access.
- TCP 445: Used for SMB (Server Message Block) communication.
To avoid using TFTP on port 69, you can configure your HPC Pack to use different communication methods, Ensure that the TFTP service is disabled on your head node and compute nodes, Block port 69 on your firewall to prevent any TFTP configure your HPC Pack to use secure communication channels like HTTPS (port 443) instead of TFTP.
For More information:
If you are still facing issues, please provide some screenshots and details in the "comments" and I would be happy to help you.
-
Keshavulu Dasari 2,835 Reputation points Microsoft Vendor
2025-01-07T19:02:06.54+00:00 Hi sam-6271 ,
Just checking in to see if the response helped. If you have any questions, let me know in the "comments" and I would be happy to help you. -
sam-6271 5 Reputation points
2025-01-08T01:44:47.1533333+00:00 Hi Keshavulu,
Sorry for the delay, I just received the notice (24 hours after your first reply).
I'm a bit confused. Your list of HPC ports does not mention TFTP nor port 69.
I also do not find TFTP listed in Services on my Head Node.
You say, "Configure your HPC Pack to use secure communication channels like HTTPS (port 443) instead of TFTP." Does this mean HPC uses TFTP by default unless I configure it to use port 443? In which case, what commands or specific steps do I take to change the configuration?
I believe HPC uses HTTPS (port 443) as we use the RESTful API for initiating jobs from our application.
Thank you. -
Keshavulu Dasari 2,835 Reputation points Microsoft Vendor
2025-01-08T13:37:31.8566667+00:00 Hi sam-6271 ,
HPC Pack does not typically use TFTP on port 69 for its default communication. Instead, it primarily uses HTTPS (port 443) for secure communications, especially when using the RESTful API.
HPC Pack generally uses HTTPS (port 443) for secure communication between nodes, especially for RESTful API interactions.
There is no indication that TFTP on port 69 is used by default for HPC Pack communications. If your security team has flagged this, it might be due to a specific configuration or a misunderstanding .
Refer to the official Microsoft HPC Pack documentation for detailed information on required ports and network configurations.
Please refer below for more:
https://answers.microsoft.com/en-us/windowserver/forum/all/how-do-i-configure-hpc-pack-node-communication/e36d7f05-d22c-4c4c-8c2b-422f84041f6d
If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.
-
sam-6271 5 Reputation points
2025-01-08T23:59:47.1466667+00:00 How to tell what's going on with port 69
netstat -aof | findstr :69 UDP <enterprise-ip>:69 : 4392 UDP <private-ip:69 : 4392 UDP [::1]:69 : 4392 OR Get-Process -Id (Get-NetUDPEndpoint -LocalPort 69).OwningProcess Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName
654 469 11228 16796 10.47 4392 0 svchosttasklist /svc | findstr 4392 svchost.exe 4392 WDSServer
HPC Head Node installation installs the "transport" portion (but not the "Service" portion) of Windows Deployment Server. So while the issue is not directly an HPC issue, the HPC installer causes the issue by installing the WDS TransportServer.
Disabling the WDS TransportServer does not stop the listening service
WDSUtil /Get-TransportServer /show:Config WDS Transport Server Policy: IPv4 source: Range Start address: 239.192.0.2 End address: 239.192.0.254 IPv6 source: Range Start address: FF15::1:1 End address: FF15::1:FF UDP Port Policy: Dynamic Start port: <Not Applicable> End port: <Not Applicable> Network profile: <Not Applicable> TFTP Properties: Maximum block size: 0 Variable window extension enabled: Yes Multicast session policy: Slow client handling policy: Auto Disconnect AutoDisconnect threshold: 1024 KBps Multistream stream count: 2 Slow client fallback: No Multicast Content Providers:
WDSUtil /disable-transportserver
Continues to listen for UDP on port 69The question becomes:
- How do we configure WDS-TS to use secure communications (not TFTP)?
- How do we exclude WDS-TS from HPC installation, or remove WDS-TS after installation, without impacting HPC (non-deployment) operations?
-
Keshavulu Dasari 2,835 Reputation points Microsoft Vendor
2025-01-09T01:12:28.2666667+00:00 Hi sam-6271 ,
The WDS Transport Server, which is installed as part of the HPC Pack installation.
Configuring WDS-TS to Use Secure Communications
WDS-TS inherently uses TFTP for its operations, and there is no direct way to configure it to use secure communications like HTTPS, you can mitigate the security risks associated with TFTP by ensuring it is only accessible within a secure, isolated network.
If you have any other questions, let me know I would be happy to help you.
Sign in to comment
Sign in to answer