Firewall administrators must allow incoming TCP connection requests on port 5000 for the IBM MQ agent.

Workgroup server to IBM MQ agent communication

The IBM MQ agent is started and creates TCP and UDP listeners on the specified port. The default port is 5000 and is configurable. 

The agent reads the local server configuration and sends UDP registration to the workgroup agent. The default port is 4010 and is configurable.

The server responds to registration and sends a request to establish TCP connection to port 5000.

1. Agent responds and starts new threads for the server, one per QMGR. TCP/IP service allocates a new port number for each thread, this is transparent to the user and handled automatically by the firewall.
2. If the connection is broken the server tries to re-establish connection. If not successful, it sends a TCP request every 10 minutes (default can be changed and is set for every node) to re-establish connection.
3. If the agent can successfully establish a connection on startup, the node can be manually added to the configuration and the server will send a TCP request. The agent will reply with registration response, and steps 3 and 4 are repeated.
4. The server also sends UDP broadcasts on a pre-configured port (5000) to request registrations from any new agents every 1440 minutes; both port and time are configurable.

Firewall administrators must allow incoming TCP connection requests on port 5000. UDP port on the agent need not be opened, it is used only for automatically discovering new agents on the network.